From 8cbb37310bd1d8ca7bdcbf282f51ea2d99e0fa23 Mon Sep 17 00:00:00 2001
From: Paul Nothaft <53005142+the-luap@users.noreply.github.com>
Date: Sat, 1 Aug 2026 17:37:57 +0200
Subject: [PATCH] chore(main): release 3.98.2-beta.0 (#945)

---
 .release-please-manifest-beta.json |  2 +-
 CHANGELOG.md                       | 10 ++++++++++
 backend/package.json               |  2 +-
 frontend/package.json              |  2 +-
 4 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/.release-please-manifest-beta.json b/.release-please-manifest-beta.json
index 17c400ab..e013e7f1 100644
--- a/.release-please-manifest-beta.json
+++ b/.release-please-manifest-beta.json
@@ -1,3 +1,3 @@
 {
-  ".": "3.98.1-beta.0"
+  ".": "3.98.2-beta.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 35bce9c4..fb5d9634 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,16 @@ All notable changes to PicPeak will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.98.2-beta.0](https://github.com/PicPeak/picpeak/compare/v3.98.1-beta.0...v3.98.2-beta.0) (2026-08-01)
+
+
+### Bug Fixes
+
+* **security:** block guest access to hidden/client-only photos across bulk + secure routes ([#939](https://github.com/PicPeak/picpeak/issues/939)) ([8a87c92](https://github.com/PicPeak/picpeak/commit/8a87c9274b2950a500ed1d17bc30fa573fcbf0c0))
+* **security:** bump sanitize-html to 2.17.5 (CVE-2026-53606) ([#937](https://github.com/PicPeak/picpeak/issues/937)) ([fe615c8](https://github.com/PicPeak/picpeak/commit/fe615c82e48de42399d8be47f796878835b90c5d))
+* **security:** close authorization/ownership gaps (token scope, mass-assignment, category hero, project docs) ([#943](https://github.com/PicPeak/picpeak/issues/943)) ([82d6871](https://github.com/PicPeak/picpeak/commit/82d68711cf7b74b9c81a0eed3fd0905d668d5df7))
+* **security:** resolve DNS before vetting external hostnames (SSRF cluster) ([#941](https://github.com/PicPeak/picpeak/issues/941)) ([b700569](https://github.com/PicPeak/picpeak/commit/b7005692b33595cf9df52892ce2f94342ca21fe5))
+
 ## [3.98.1-beta.0](https://github.com/PicPeak/picpeak/compare/v3.98.0-beta.0...v3.98.1-beta.0) (2026-08-01)
 
 
diff --git a/backend/package.json b/backend/package.json
index 5c277e8a..5d1c5be2 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "picpeak-backend",
-  "version": "3.98.1-beta.0",
+  "version": "3.98.2-beta.0",
   "description": "Backend for PicPeak event photo sharing platform",
   "main": "server.js",
   "engines": {
diff --git a/frontend/package.json b/frontend/package.json
index 4f9771aa..b8b4d132 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,7 +1,7 @@
 {
   "name": "picpeak-frontend",
   "private": true,
-  "version": "3.98.1-beta.0",
+  "version": "3.98.2-beta.0",
   "type": "module",
   "scripts": {
     "dev": "vite",