From 85a60a2dc7526aa6b673e2a04e9fdfba7de7117f Mon Sep 17 00:00:00 2001 From: Paul Nothaft Date: Mon, 16 Mar 2026 22:34:32 +0100 Subject: [PATCH 01/13] fix(security): invalidate tokens on password change, enforce session timeout, fix role update - Set password_changed_at when changing password via adminAuth route so existing JWT tokens are rejected by the auth middleware check - Enforce session timeout on first request with unseen tokens by checking token iat against configured timeout (prevents bypass after server restart) - Convert camelCase roleId/isActive to snake_case role_id/is_active in frontend updateUser service (fixes silent role update failures) Resolves GHSA-rqg3-47p5-vgwg --- backend/src/middleware/sessionTimeout.js | 22 ++++++++++++++----- backend/src/routes/adminAuth.js | 6 +++-- .../src/services/userManagement.service.ts | 6 ++++- 3 files changed, 25 insertions(+), 9 deletions(-) diff --git a/backend/src/middleware/sessionTimeout.js b/backend/src/middleware/sessionTimeout.js index f8fce550..1d4fc267 100644 --- a/backend/src/middleware/sessionTimeout.js +++ b/backend/src/middleware/sessionTimeout.js @@ -85,18 +85,28 @@ async function sessionTimeoutMiddleware(req, res, next) { const now = Date.now(); const lastActivity = sessions.get(token); const timeout = await getSessionTimeout(); - - // If session exists, check if it's expired + if (lastActivity) { + // Existing session โ€” check if idle too long if (now - lastActivity > timeout) { sessions.delete(token); - return res.status(401).json({ - error: 'Session expired', - code: 'SESSION_TIMEOUT' + return res.status(401).json({ + error: 'Session expired', + code: 'SESSION_TIMEOUT' + }); + } + } else { + // First request with this token โ€” check if token was issued longer ago than the timeout + // This prevents old/stolen tokens from bypassing session timeout after server restart + const tokenIssuedAt = (decoded.iat || 0) * 1000; // iat is in seconds + if (now - tokenIssuedAt > timeout) { + return res.status(401).json({ + error: 'Session expired', + code: 'SESSION_TIMEOUT' }); } } - + // Update last activity sessions.set(token, now); diff --git a/backend/src/routes/adminAuth.js b/backend/src/routes/adminAuth.js index dfc5c183..18fe5852 100644 --- a/backend/src/routes/adminAuth.js +++ b/backend/src/routes/adminAuth.js @@ -122,13 +122,15 @@ router.post('/change-password', [ // Hash new password with more rounds const newPasswordHash = await bcrypt.hash(newPassword, 12); - // Update password and clear must_change_password flag + // Update password, set password_changed_at to invalidate existing tokens, and clear must_change_password flag + const now = new Date(); await db('admin_users') .where('id', userId) .update({ password_hash: newPasswordHash, + password_changed_at: now, must_change_password: false, - updated_at: new Date() + updated_at: now }); // Log activity diff --git a/frontend/src/services/userManagement.service.ts b/frontend/src/services/userManagement.service.ts index ae1fe9f1..3f62afd9 100644 --- a/frontend/src/services/userManagement.service.ts +++ b/frontend/src/services/userManagement.service.ts @@ -149,7 +149,11 @@ export const userManagementService = { * Update an admin user */ async updateUser(id: number, data: UpdateUserData): Promise { - const response = await api.put(`/admin/users/${id}`, data); + // Convert camelCase to snake_case for backend API + const payload: Record = {}; + if (data.roleId !== undefined) payload.role_id = data.roleId; + if (data.isActive !== undefined) payload.is_active = data.isActive; + const response = await api.put(`/admin/users/${id}`, payload); return transformUser(response.data.user); }, From 7febba2d9c88793181ef4d47dbd715aa34b67a08 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 16 Mar 2026 21:37:35 +0000 Subject: [PATCH 02/13] chore(main): release 2.6.2 --- .release-please-manifest.json | 2 +- CHANGELOG.md | 8 ++++++++ backend/package.json | 2 +- frontend/package.json | 2 +- 4 files changed, 11 insertions(+), 3 deletions(-) diff --git a/.release-please-manifest.json b/.release-please-manifest.json index 8ff2f5ec..86e26a2d 100644 --- a/.release-please-manifest.json +++ b/.release-please-manifest.json @@ -1,3 +1,3 @@ { - ".": "2.6.1" + ".": "2.6.2" } diff --git a/CHANGELOG.md b/CHANGELOG.md index c722b79e..e3cac425 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,14 @@ All notable changes to PicPeak will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [2.6.2](https://github.com/the-luap/picpeak/compare/v2.6.1...v2.6.2) (2026-03-16) + + +### Bug Fixes + +* **security:** invalidate tokens on password change, enforce session timeout, fix role update ([85a60a2](https://github.com/the-luap/picpeak/commit/85a60a2dc7526aa6b673e2a04e9fdfba7de7117f)) +* **security:** token invalidation on password change, session timeout enforcement ([0a3a537](https://github.com/the-luap/picpeak/commit/0a3a53763c9f3caef9fdceccf9fdbfdefe9bd8bf)) + ## [2.6.1](https://github.com/the-luap/picpeak/compare/v2.6.0...v2.6.1) (2026-03-11) diff --git a/backend/package.json b/backend/package.json index bc45ed1f..3cedc698 100644 --- a/backend/package.json +++ b/backend/package.json @@ -1,6 +1,6 @@ { "name": "picpeak-backend", - "version": "2.6.1", + "version": "2.6.2", "description": "Backend for PicPeak event photo sharing platform", "main": "server.js", "scripts": { diff --git a/frontend/package.json b/frontend/package.json index d38a76de..24ca0dd0 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -1,7 +1,7 @@ { "name": "picpeak-frontend", "private": true, - "version": "2.6.1", + "version": "2.6.2", "type": "module", "scripts": { "dev": "vite", From 681b4403814a9c5306e6f69e6fcb6d8d0dece2d4 Mon Sep 17 00:00:00 2001 From: Paul Nothaft Date: Sun, 5 Apr 2026 18:41:45 +0200 Subject: [PATCH 03/13] security: pin axios to 1.14.0 to prevent supply chain attack Axios versions 1.14.1 and 0.30.4 were compromised on March 31, 2026 with a RAT dropper attributed to North Korean threat actor. Pin to exact 1.14.0 (latest safe release) to prevent resolution to compromised versions. See https://github.com/axios/axios/issues/10604 --- backend/package-lock.json | 38 +++++++++++++++++++++++++++----------- backend/package.json | 2 +- frontend/package-lock.json | 25 ++++++++++++++----------- frontend/package.json | 2 +- 4 files changed, 43 insertions(+), 24 deletions(-) diff --git a/backend/package-lock.json b/backend/package-lock.json index 6eb24e1e..ccefee41 100644 --- a/backend/package-lock.json +++ b/backend/package-lock.json @@ -1,12 +1,12 @@ { "name": "picpeak-backend", - "version": "2.5.0", + "version": "2.6.2", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "picpeak-backend", - "version": "2.5.0", + "version": "2.6.2", "dependencies": { "@aws-sdk/client-s3": "^3.850.0", "@aws-sdk/lib-storage": "^3.850.0", @@ -14,7 +14,7 @@ "@ffmpeg-installer/ffmpeg": "^1.1.0", "adm-zip": "^0.5.16", "archiver": "^5.3.1", - "axios": "^1.12.2", + "axios": "1.14.0", "bcrypt": "6.0.0", "chokidar": "4.0.3", "cookie-parser": "^1.4.7", @@ -4071,14 +4071,14 @@ "license": "MIT" }, "node_modules/axios": { - "version": "1.13.6", - "resolved": "https://registry.npmjs.org/axios/-/axios-1.13.6.tgz", - "integrity": "sha512-ChTCHMouEe2kn713WHbQGcuYrr6fXTBiu460OTwWrWob16g1bXn4vtz07Ope7ewMozJAnEquLk5lWQWtBig9DQ==", + "version": "1.14.0", + "resolved": "https://registry.npmjs.org/axios/-/axios-1.14.0.tgz", + "integrity": "sha512-3Y8yrqLSwjuzpXuZ0oIYZ/XGgLwUIBU3uLvbcpb0pidD9ctpShJd43KSlEEkVQg6DS0G9NKyzOvBfUtDKEyHvQ==", "license": "MIT", "dependencies": { "follow-redirects": "^1.15.11", "form-data": "^4.0.5", - "proxy-from-env": "^1.1.0" + "proxy-from-env": "^2.1.0" } }, "node_modules/babel-jest": { @@ -6664,6 +6664,19 @@ "cross-fetch": "4.0.0" } }, + "node_modules/iconv-lite": { + "version": "0.6.3", + "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz", + "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==", + "license": "MIT", + "optional": true, + "dependencies": { + "safer-buffer": ">= 2.1.2 < 3.0.0" + }, + "engines": { + "node": ">=0.10.0" + } + }, "node_modules/ieee754": { "version": "1.2.1", "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz", @@ -9579,10 +9592,13 @@ } }, "node_modules/proxy-from-env": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz", - "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==", - "license": "MIT" + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-2.1.0.tgz", + "integrity": "sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==", + "license": "MIT", + "engines": { + "node": ">=10" + } }, "node_modules/pstree.remy": { "version": "1.1.8", diff --git a/backend/package.json b/backend/package.json index 3cedc698..43a23f9a 100644 --- a/backend/package.json +++ b/backend/package.json @@ -19,7 +19,7 @@ "@ffmpeg-installer/ffmpeg": "^1.1.0", "adm-zip": "^0.5.16", "archiver": "^5.3.1", - "axios": "^1.12.2", + "axios": "1.14.0", "bcrypt": "6.0.0", "chokidar": "4.0.3", "cookie-parser": "^1.4.7", diff --git a/frontend/package-lock.json b/frontend/package-lock.json index 63fdbb68..d4a77371 100644 --- a/frontend/package-lock.json +++ b/frontend/package-lock.json @@ -1,12 +1,12 @@ { "name": "picpeak-frontend", - "version": "2.5.0", + "version": "2.6.2", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "picpeak-frontend", - "version": "2.5.0", + "version": "2.6.2", "dependencies": { "@tanstack/react-query": "^5.0.0", "@tiptap/extension-character-count": "^2.26.1", @@ -20,7 +20,7 @@ "@types/dompurify": "^3.0.5", "@types/lodash": "^4.17.20", "@types/react-google-recaptcha": "^2.1.9", - "axios": "^1.12.2", + "axios": "1.14.0", "clsx": "^2.0.0", "date-fns": "4.1.0", "dompurify": "^3.2.6", @@ -3020,14 +3020,14 @@ } }, "node_modules/axios": { - "version": "1.13.6", - "resolved": "https://registry.npmjs.org/axios/-/axios-1.13.6.tgz", - "integrity": "sha512-ChTCHMouEe2kn713WHbQGcuYrr6fXTBiu460OTwWrWob16g1bXn4vtz07Ope7ewMozJAnEquLk5lWQWtBig9DQ==", + "version": "1.14.0", + "resolved": "https://registry.npmjs.org/axios/-/axios-1.14.0.tgz", + "integrity": "sha512-3Y8yrqLSwjuzpXuZ0oIYZ/XGgLwUIBU3uLvbcpb0pidD9ctpShJd43KSlEEkVQg6DS0G9NKyzOvBfUtDKEyHvQ==", "license": "MIT", "dependencies": { "follow-redirects": "^1.15.11", "form-data": "^4.0.5", - "proxy-from-env": "^1.1.0" + "proxy-from-env": "^2.1.0" } }, "node_modules/balanced-match": { @@ -5751,10 +5751,13 @@ } }, "node_modules/proxy-from-env": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz", - "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==", - "license": "MIT" + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-2.1.0.tgz", + "integrity": "sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==", + "license": "MIT", + "engines": { + "node": ">=10" + } }, "node_modules/punycode": { "version": "2.3.1", diff --git a/frontend/package.json b/frontend/package.json index 24ca0dd0..181922fb 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -24,7 +24,7 @@ "@types/dompurify": "^3.0.5", "@types/lodash": "^4.17.20", "@types/react-google-recaptcha": "^2.1.9", - "axios": "^1.12.2", + "axios": "1.14.0", "clsx": "^2.0.0", "date-fns": "4.1.0", "dompurify": "^3.2.6", From f6ca713a6edc8ba371db790daba05ecb85ea4872 Mon Sep 17 00:00:00 2001 From: Paul Nothaft Date: Tue, 7 Apr 2026 19:52:02 +0200 Subject: [PATCH 04/13] docs: add External Media Library section to deployment guide (#270) Add the missing "External Media Library" chapter to DEPLOYMENT_GUIDE.md that was referenced in the TOC but never written. Covers configuration, Docker volume mounting, folder structure, usage workflow, limitations, and troubleshooting. Closes #270 --- DEPLOYMENT_GUIDE.md | 91 ++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 90 insertions(+), 1 deletion(-) diff --git a/DEPLOYMENT_GUIDE.md b/DEPLOYMENT_GUIDE.md index a68d0e1e..d1dc0d21 100644 --- a/DEPLOYMENT_GUIDE.md +++ b/DEPLOYMENT_GUIDE.md @@ -11,7 +11,7 @@ This guide covers multiple deployment options for PicPeak, from simple local set - [First Login](#-first-login) - [Release Channels](#-release-channels) - [Reverse Proxy Setup](#-reverse-proxy-setup) -- [External Media Library](#external-media-library) +- [External Media Library](#-external-media-library) - [Maintenance](#-maintenance) - [Troubleshooting](#-troubleshooting) @@ -552,6 +552,95 @@ sudo certbot certonly --webroot -w /var/www/certbot -d your-domain.com # Or use your reverse proxy's built-in ACME support ``` +## ๐Ÿ“‚ External Media Library + +The External Media Library allows events to reference photos stored directly on your host filesystem instead of uploading them through the admin UI. This is useful for photographers who already have organized photo libraries and want to share them without re-uploading. + +### How It Works + +- **Managed mode** (default): Photos are uploaded through the admin UI and stored inside PicPeak's storage directory. +- **Reference mode**: Photos remain on your host filesystem. PicPeak reads them directly and generates thumbnails on demand. + +Each event can use either mode. Reference mode events point to a folder under the configured external media root. + +### Configuration + +Add the following to your `.env` file: + +```bash +# Path where your photo library is stored on the host +EXTERNAL_MEDIA_ROOT=/path/to/your/photos +``` + +Then mount this path into the backend container in your `docker-compose.yml` or `docker-compose.production.yml`: + +```yaml +services: + backend: + environment: + - EXTERNAL_MEDIA_ROOT=/external-media + volumes: + - /path/to/your/photos:/external-media:ro # read-only is recommended +``` + +> **Permissions**: Ensure the container user (`PUID`/`PGID`) has read access to the mounted directory. If thumbnails fail to generate, this is usually a permissions issue. + +### Folder Structure + +Organize your photos with subdirectories for each event. Within each event folder, use `individual/` and `collages/` subdirectories to classify photos: + +``` +/path/to/your/photos/ +โ”œโ”€โ”€ wedding-smith-2026/ +โ”‚ โ”œโ”€โ”€ individual/ +โ”‚ โ”‚ โ”œโ”€โ”€ IMG_0001.jpg +โ”‚ โ”‚ โ”œโ”€โ”€ IMG_0002.jpg +โ”‚ โ”‚ โ””โ”€โ”€ ... +โ”‚ โ””โ”€โ”€ collages/ +โ”‚ โ”œโ”€โ”€ group-photo.jpg +โ”‚ โ””โ”€โ”€ ... +โ”œโ”€โ”€ corporate-event/ +โ”‚ โ”œโ”€โ”€ individual/ +โ”‚ โ”‚ โ””โ”€โ”€ ... +โ”‚ โ””โ”€โ”€ collages/ +โ”‚ โ””โ”€โ”€ ... +``` + +Supported file formats: `.jpg`, `.jpeg`, `.png`, `.webp` + +### Usage + +1. **Create an event** in the admin panel as usual (name, date, email, etc.). + +2. **Switch source mode** to "Reference external folder" in the event details under Source Mode. + +3. **Browse and select** the external folder using the folder picker that appears. Navigate to the event's directory. + +4. **Import photos** by clicking "Import from External Folder" in the Photos tab. PicPeak will: + - Recursively scan the selected folder + - Classify photos by subfolder name (`individual/` or `collages/`) + - Deduplicate by filename (keeps the largest file if duplicates exist) + - Extract image dimensions for gallery layout + - Register the photos in the database + +5. **Thumbnails** are generated on demand when a guest first views the gallery. There is no upfront processing delay. + +### Limitations + +- **Images only** โ€” video files are not supported for external media. +- **Read-only** โ€” PicPeak does not modify or delete files in the external media directory. +- **No automatic sync** โ€” If you add new photos to the external folder, you need to re-import from the admin UI. +- **Backup caveat** โ€” External media originals are excluded from PicPeak's built-in backup system. Only thumbnails and database records are backed up. You are responsible for backing up the source files separately. + +### Troubleshooting + +| Problem | Solution | +|---------|----------| +| Folder picker shows empty directory | Check that the volume is mounted correctly and `EXTERNAL_MEDIA_ROOT` matches the container path | +| "Permission denied" errors | Ensure `PUID`/`PGID` in `.env` match the owner of the external media files on the host | +| Thumbnails not generating | Verify the backend container can read the files: `docker exec picpeak-backend ls /external-media/your-folder/` | +| Import finds 0 photos | Only `.jpg`, `.jpeg`, `.png`, `.webp` files are supported. Check file extensions. | + ## ๐Ÿ”ง Maintenance ### Viewing Logs From 9cbbe74051ddce80e66408e91efbe2460964ae95 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 7 Apr 2026 18:40:34 +0000 Subject: [PATCH 05/13] chore(main): release 2.6.3 --- .release-please-manifest.json | 2 +- CHANGELOG.md | 8 ++++++++ backend/package.json | 2 +- frontend/package.json | 2 +- 4 files changed, 11 insertions(+), 3 deletions(-) diff --git a/.release-please-manifest.json b/.release-please-manifest.json index 86e26a2d..a00a1904 100644 --- a/.release-please-manifest.json +++ b/.release-please-manifest.json @@ -1,3 +1,3 @@ { - ".": "2.6.2" + ".": "2.6.3" } diff --git a/CHANGELOG.md b/CHANGELOG.md index e3cac425..f14c886c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,14 @@ All notable changes to PicPeak will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [2.6.3](https://github.com/the-luap/picpeak/compare/v2.6.2...v2.6.3) (2026-04-07) + + +### Documentation + +* add External Media Library section to deployment guide ([#270](https://github.com/the-luap/picpeak/issues/270)) ([2e1c71c](https://github.com/the-luap/picpeak/commit/2e1c71c1ab073e488ac93e35337a2d3955dfef3d)) +* add External Media Library section to deployment guide ([#270](https://github.com/the-luap/picpeak/issues/270)) ([f6ca713](https://github.com/the-luap/picpeak/commit/f6ca713a6edc8ba371db790daba05ecb85ea4872)) + ## [2.6.2](https://github.com/the-luap/picpeak/compare/v2.6.1...v2.6.2) (2026-03-16) diff --git a/backend/package.json b/backend/package.json index 43a23f9a..f088c7c0 100644 --- a/backend/package.json +++ b/backend/package.json @@ -1,6 +1,6 @@ { "name": "picpeak-backend", - "version": "2.6.2", + "version": "2.6.3", "description": "Backend for PicPeak event photo sharing platform", "main": "server.js", "scripts": { diff --git a/frontend/package.json b/frontend/package.json index 181922fb..2af38faf 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -1,7 +1,7 @@ { "name": "picpeak-frontend", "private": true, - "version": "2.6.2", + "version": "2.6.3", "type": "module", "scripts": { "dev": "vite", From 730912a3f43dffc4156046732f95c0cac37620aa Mon Sep 17 00:00:00 2001 From: Paul Nothaft Date: Wed, 8 Apr 2026 09:05:48 +0200 Subject: [PATCH 06/13] security: fix 20 dependency vulnerabilities (backport to main) Same fixes as beta PR #274. Updates handlebars, nodemailer, tar, fast-xml-parser, brace-expansion, path-to-regexp, and lodash to address 20 GitHub code scanning alerts. --- backend/package.json | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/backend/package.json b/backend/package.json index f088c7c0..8a24ac00 100644 --- a/backend/package.json +++ b/backend/package.json @@ -31,7 +31,7 @@ "express-validator": "^7.0.1", "fluent-ffmpeg": "^2.1.3", "form-data": "^4.0.4", - "handlebars": "^4.7.8", + "handlebars": "^4.7.9", "helmet": "^7.0.0", "i18next": "25.3.2", "i18next-browser-languagedetector": "^8.2.0", @@ -44,7 +44,7 @@ "mime-types": "^3.0.1", "multer": "^2.0.2", "node-cron": "^3.0.2", - "nodemailer": "^7.0.10", + "nodemailer": "^7.0.13", "pg": "^8.16.3", "react-i18next": "^15.6.0", "sanitize-html": "^2.17.0", @@ -67,10 +67,12 @@ }, "glob": "^11.1.0", "js-yaml": "^4.1.1", - "fast-xml-parser": ">=5.3.8", + "fast-xml-parser": ">=5.5.10", "qs": ">=6.14.2", - "tar": ">=7.5.8", - "brace-expansion": ">=5.0.0", - "minimatch": ">=9.0.7" + "tar": ">=7.5.13", + "brace-expansion": ">=5.0.5", + "minimatch": ">=9.0.7", + "path-to-regexp": "0.1.13", + "lodash": ">=4.18.1" } } From 03e19893b3532a27aa59e7b834d53c6a2b52b7cd Mon Sep 17 00:00:00 2001 From: Paul Nothaft Date: Wed, 8 Apr 2026 09:14:06 +0200 Subject: [PATCH 07/13] fix: sync backend package-lock.json with security dep updates The lock file was not committed with PR #275, causing npm ci to fail in Docker builds. Regenerate to match the updated package.json overrides. --- backend/package-lock.json | 103 ++++++++++++++++++++++---------------- 1 file changed, 61 insertions(+), 42 deletions(-) diff --git a/backend/package-lock.json b/backend/package-lock.json index ccefee41..9c0616f2 100644 --- a/backend/package-lock.json +++ b/backend/package-lock.json @@ -1,12 +1,12 @@ { "name": "picpeak-backend", - "version": "2.6.2", + "version": "2.6.3", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "picpeak-backend", - "version": "2.6.2", + "version": "2.6.3", "dependencies": { "@aws-sdk/client-s3": "^3.850.0", "@aws-sdk/lib-storage": "^3.850.0", @@ -26,7 +26,7 @@ "express-validator": "^7.0.1", "fluent-ffmpeg": "^2.1.3", "form-data": "^4.0.4", - "handlebars": "^4.7.8", + "handlebars": "^4.7.9", "helmet": "^7.0.0", "i18next": "25.3.2", "i18next-browser-languagedetector": "^8.2.0", @@ -39,7 +39,7 @@ "mime-types": "^3.0.1", "multer": "^2.0.2", "node-cron": "^3.0.2", - "nodemailer": "^7.0.10", + "nodemailer": "^7.0.13", "pg": "^8.16.3", "react-i18next": "^15.6.0", "sanitize-html": "^2.17.0", @@ -4290,9 +4290,9 @@ "license": "MIT" }, "node_modules/brace-expansion": { - "version": "5.0.4", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.4.tgz", - "integrity": "sha512-h+DEnpVvxmfVefa4jFbCf5HdH5YMDXRsmKflpf1pILZWRFlTbJpxeU55nJl4Smt5HQaGzg1o6RHFPJaOqnmBDg==", + "version": "5.0.5", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz", + "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==", "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" @@ -5832,21 +5832,9 @@ "license": "MIT" }, "node_modules/fast-xml-builder": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.0.0.tgz", - "integrity": "sha512-fpZuDogrAgnyt9oDDz+5DBz0zgPdPZz6D4IR7iESxRXElrlGTRkHJ9eEt+SACRJwT0FNFrt71DFQIUFBJfX/uQ==", - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/NaturalIntelligence" - } - ], - "license": "MIT" - }, - "node_modules/fast-xml-parser": { - "version": "5.4.1", - "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.4.1.tgz", - "integrity": "sha512-BQ30U1mKkvXQXXkAGcuyUA/GA26oEB7NzOtsxCDtyu62sjGw5QraKFhx2Em3WQNjPw9PG6MQ9yuIIgkSDfGu5A==", + "version": "1.1.4", + "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.1.4.tgz", + "integrity": "sha512-f2jhpN4Eccy0/Uz9csxh3Nu6q4ErKxf0XIsasomfOihuSUa3/xw6w8dnOtCDgEItQFJG8KyXPzQXzcODDrrbOg==", "funding": [ { "type": "github", @@ -5855,8 +5843,24 @@ ], "license": "MIT", "dependencies": { - "fast-xml-builder": "^1.0.0", - "strnum": "^2.1.2" + "path-expression-matcher": "^1.1.3" + } + }, + "node_modules/fast-xml-parser": { + "version": "5.5.10", + "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.5.10.tgz", + "integrity": "sha512-go2J2xODMc32hT+4Xr/bBGXMaIoiCwrwp2mMtAvKyvEFW6S/v5Gn2pBmE4nvbwNjGhpcAiOwEv7R6/GZ6XRa9w==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/NaturalIntelligence" + } + ], + "license": "MIT", + "dependencies": { + "fast-xml-builder": "^1.1.4", + "path-expression-matcher": "^1.2.1", + "strnum": "^2.2.2" }, "bin": { "fxparser": "src/cli/cli.js" @@ -6418,9 +6422,9 @@ "license": "MIT" }, "node_modules/handlebars": { - "version": "4.7.8", - "resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.7.8.tgz", - "integrity": "sha512-vafaFqs8MZkRrSX7sFVUdo3ap/eNiLnb4IakshzvP56X5Nr1iGKAIqdX6tMlm6HcNRIkr6AxO5jFEoJzzpT8aQ==", + "version": "4.7.9", + "resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.7.9.tgz", + "integrity": "sha512-4E71E0rpOaQuJR2A3xDZ+GM1HyWYv1clR58tC8emQNeQe3RH7MAzSbat+V0wG78LQBo6m6bzSG/L4pBuCsgnUQ==", "license": "MIT", "dependencies": { "minimist": "^1.2.5", @@ -7990,9 +7994,9 @@ } }, "node_modules/lodash": { - "version": "4.17.23", - "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz", - "integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==", + "version": "4.18.1", + "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz", + "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==", "license": "MIT" }, "node_modules/lodash.defaults": { @@ -8773,9 +8777,9 @@ "license": "MIT" }, "node_modules/nodemailer": { - "version": "7.0.12", - "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-7.0.12.tgz", - "integrity": "sha512-H+rnK5bX2Pi/6ms3sN4/jRQvYSMltV6vqup/0SFOrxYYY/qoNvhXPlYq3e+Pm9RFJRwrMGbMIwi81M4dxpomhA==", + "version": "7.0.13", + "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-7.0.13.tgz", + "integrity": "sha512-PNDFSJdP+KFgdsG3ZzMXCgquO7I6McjY2vlqILjtJd0hy8wEvtugS9xKRF2NWlPNGxvLCXlTNIae4serI7dinw==", "license": "MIT-0", "engines": { "node": ">=6.0.0" @@ -9158,6 +9162,21 @@ "node": ">=8" } }, + "node_modules/path-expression-matcher": { + "version": "1.4.0", + "resolved": "https://registry.npmjs.org/path-expression-matcher/-/path-expression-matcher-1.4.0.tgz", + "integrity": "sha512-s4DQMxIdhj3jLFWd9LxHOplj4p9yQ4ffMGowFf3cpEgrrJjEhN0V5nxw4Ye1EViAGDoL4/1AeO6qHpqYPOzE4Q==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/NaturalIntelligence" + } + ], + "license": "MIT", + "engines": { + "node": ">=14.0.0" + } + }, "node_modules/path-key": { "version": "3.1.1", "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz", @@ -9199,9 +9218,9 @@ } }, "node_modules/path-to-regexp": { - "version": "0.1.12", - "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.12.tgz", - "integrity": "sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ==", + "version": "0.1.13", + "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.13.tgz", + "integrity": "sha512-A/AGNMFN3c8bOlvV9RreMdrv7jsmF9XIfDeCd87+I8RNg6s78BhJxMu69NEMHBSJFxKidViTEdruRwEk/WIKqA==", "license": "MIT" }, "node_modules/pg": { @@ -10675,9 +10694,9 @@ } }, "node_modules/strnum": { - "version": "2.2.0", - "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.2.0.tgz", - "integrity": "sha512-Y7Bj8XyJxnPAORMZj/xltsfo55uOiyHcU2tnAVzHUnSJR/KsEX+9RoDeXEnsXtl/CX4fAcrt64gZ13aGaWPeBg==", + "version": "2.2.3", + "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.2.3.tgz", + "integrity": "sha512-oKx6RUCuHfT3oyVjtnrmn19H1SiCqgJSg+54XqURKp5aCMbrXrhLjRN9TjuwMjiYstZ0MzDrHqkGZ5dFTKd+zg==", "funding": [ { "type": "github", @@ -10776,9 +10795,9 @@ } }, "node_modules/tar": { - "version": "7.5.9", - "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.9.tgz", - "integrity": "sha512-BTLcK0xsDh2+PUe9F6c2TlRp4zOOBMTkoQHQIWSIzI0R7KG46uEwq4OPk2W7bZcprBMsuaeFsqwYr7pjh6CuHg==", + "version": "7.5.13", + "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.13.tgz", + "integrity": "sha512-tOG/7GyXpFevhXVh8jOPJrmtRpOTsYqUIkVdVooZYJS/z8WhfQUX8RJILmeuJNinGAMSu1veBr4asSHFt5/hng==", "license": "BlueOak-1.0.0", "dependencies": { "@isaacs/fs-minipass": "^4.0.0", From d1d71dba25f6bbec8c07f2e649827c632c05407c Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 8 Apr 2026 07:14:32 +0000 Subject: [PATCH 08/13] chore(main): release 2.6.4 --- .release-please-manifest.json | 2 +- CHANGELOG.md | 8 ++++++++ backend/package.json | 2 +- frontend/package.json | 2 +- 4 files changed, 11 insertions(+), 3 deletions(-) diff --git a/.release-please-manifest.json b/.release-please-manifest.json index a00a1904..9caa5c14 100644 --- a/.release-please-manifest.json +++ b/.release-please-manifest.json @@ -1,3 +1,3 @@ { - ".": "2.6.3" + ".": "2.6.4" } diff --git a/CHANGELOG.md b/CHANGELOG.md index f14c886c..eafd7a17 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,14 @@ All notable changes to PicPeak will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [2.6.4](https://github.com/the-luap/picpeak/compare/v2.6.3...v2.6.4) (2026-04-08) + + +### Bug Fixes + +* sync backend package-lock.json for security deps ([bb81fa5](https://github.com/the-luap/picpeak/commit/bb81fa5f4b5f1bd927a02470ce80a13c4f53443f)) +* sync backend package-lock.json with security dep updates ([03e1989](https://github.com/the-luap/picpeak/commit/03e19893b3532a27aa59e7b834d53c6a2b52b7cd)) + ## [2.6.3](https://github.com/the-luap/picpeak/compare/v2.6.2...v2.6.3) (2026-04-07) diff --git a/backend/package.json b/backend/package.json index 8a24ac00..ddedbfdf 100644 --- a/backend/package.json +++ b/backend/package.json @@ -1,6 +1,6 @@ { "name": "picpeak-backend", - "version": "2.6.3", + "version": "2.6.4", "description": "Backend for PicPeak event photo sharing platform", "main": "server.js", "scripts": { diff --git a/frontend/package.json b/frontend/package.json index 2af38faf..3b2b3742 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -1,7 +1,7 @@ { "name": "picpeak-frontend", "private": true, - "version": "2.6.3", + "version": "2.6.4", "type": "module", "scripts": { "dev": "vite", From 64f606152fde2db9034fa9ffa08cc58623edf646 Mon Sep 17 00:00:00 2001 From: Paul Nothaft Date: Wed, 8 Apr 2026 13:14:57 +0200 Subject: [PATCH 09/13] =?UTF-8?q?docs:=20rewrite=20README=20=E2=80=94=20sh?= =?UTF-8?q?orter,=20cleaner,=20less=20AI-sounding?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Rewrote from 350 lines to ~130 lines. Removed emoji-heavy headings, marketing fluff, redundant sections, and the AI disclosure. Collapsed screenshots into details tags. Kept all essential info: demo, features, quick start, comparison, tech stack, docs links. --- README.md | 378 ++++++++++++------------------------------------------ 1 file changed, 85 insertions(+), 293 deletions(-) diff --git a/README.md b/README.md index 0c8357f6..241c97d2 100644 --- a/README.md +++ b/README.md @@ -1,350 +1,142 @@ -# ๐Ÿ“ธ PicPeak - Open Source Photo Sharing for Events +# PicPeak
PicPeak Logo - + + **Self-hosted photo sharing for event photographers.** + [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT) [![Docker](https://img.shields.io/badge/docker-%230db7ed.svg?style=flat&logo=docker&logoColor=white)](https://www.docker.com/) [![Node.js](https://img.shields.io/badge/node.js-6DA55F?style=flat&logo=node.js&logoColor=white)](https://nodejs.org/) [![React](https://img.shields.io/badge/react-%2320232a.svg?style=flat&logo=react&logoColor=%2361DAFB)](https://reactjs.org/) - [Homepage](https://www.picpeak.app) ยท [Live Demo](https://demo.picpeak.app) ยท [Documentation](DEPLOYMENT_GUIDE.md) + [Live Demo](https://demo.picpeak.app) ยท [Deployment Guide](DEPLOYMENT_GUIDE.md) ยท [Homepage](https://www.picpeak.app)
-**PicPeak** is a powerful, self-hosted open-source alternative to commercial photo-sharing platforms like PicDrop.com and Scrapbook.de. Designed specifically for photographers and event organizers, PicPeak makes it simple to share beautiful, time-limited photo galleries with clients while maintaining full control over your data and branding. +--- + +PicPeak lets you create password-protected, time-limited photo galleries for your clients โ€” hosted on your own server. No subscriptions, no storage limits, no third-party access to your photos. ![PicPeak Gallery Preview](docs/screenshot-gallery.png) -## ๐ŸŽฎ Live Demo +## Demo -Try PicPeak without installing anything: +Try it out at [demo.picpeak.app](https://demo.picpeak.app). -| | | -|---|---| -| **Demo URL** | [demo.picpeak.app](https://demo.picpeak.app) | -| **Admin Panel** | [demo.picpeak.app/admin](https://demo.picpeak.app/admin) | -| **Email** | `demo@picpeak.app` | -| **Password** | `Demo2026!` | +Admin panel: [demo.picpeak.app/admin](https://demo.picpeak.app/admin) โ€” login with `demo@picpeak.app` / `Demo2026!` -> The demo resets periodically. Uploaded content may be removed without notice. +> The demo resets periodically. -## ๐ŸŒŸ Why Choose PicPeak? +## Features -Unlike expensive SaaS solutions, PicPeak gives you: +**Gallery Management** โ€” Create galleries, upload photos via drag & drop, set passwords and expiration dates. Galleries auto-archive when they expire. Events start as drafts so you can upload and prepare before notifying the client. -- **๐Ÿ’ฐ No Monthly Fees** - One-time setup, unlimited galleries -- **๐Ÿ”’ Complete Data Control** - Your photos stay on your server -- **๐ŸŽจ White-Label Ready** - Full branding customization -- **๐Ÿ“ฑ Mobile-First Design** - Beautiful on all devices -- **๐Ÿš€ Lightning Fast** - Optimized performance and caching -- **๐ŸŒ Multi-Language** - Built-in i18n support (EN, DE) +**Client Experience** โ€” Responsive galleries that look great on any device. Guests can browse, download individual photos or everything at once. Optional guest uploads and feedback (likes, comments, ratings). -## โœจ Key Features +**Themes & Branding** โ€” 11 built-in theme presets, custom CSS templates, configurable colors/fonts/layouts. White-label your admin panel and login page with your own logo and company name. -### For Photographers -- ๐Ÿ“ **Drag & Drop Upload** - Simply drop photos into folders -- ๐Ÿ”— **External Media (Reference Mode)** - Browse and import from a readโ€‘only external folder library without copying originals -- โฐ **Auto-Expiring Galleries** - Set expiration dates (default: 30 days) -- ๐Ÿ” **Password Protection** - Secure client galleries -- ๐Ÿ“ง **Automated Emails** - Creation confirmations and expiration warnings -- ๐Ÿ“Š **Analytics Dashboard** - Track views, downloads, and engagement -- ๐ŸŽจ **Custom Themes** - Match your brand perfectly -- ๐ŸŒ **Public Landing Page** - Publish a curated marketing page when guests visit your root URL +**Email Notifications** โ€” Automated gallery creation, expiration warning, and archive emails. Multilingual templates (EN, DE, NL, PT, RU) editable from the admin UI. -### For Clients -- ๐Ÿ–ผ๏ธ **Beautiful Galleries** - Clean, modern interface -- ๐Ÿ“ฑ **Mobile Optimized** - Swipe through photos on any device -- โฌ‡๏ธ **Bulk Downloads** - Download all photos with one click -- ๐Ÿ” **Smart Search** - Find photos quickly -- ๐Ÿ“ค **Guest Uploads** - Optional client photo uploads -- ๐Ÿ›ก๏ธ **Download Protection** - Advanced image protection with watermarking and right-click prevention +**Photo Protection** โ€” Watermarking, right-click prevention, canvas rendering, DevTools detection. Configurable per gallery. -### Technical Excellence -- ๐Ÿณ **Docker Ready** - Deploy in minutes -- ๐Ÿ”„ **Auto-Processing** - Automatic thumbnail generation -- ๐Ÿ—‚๏ธ **Reference Library Support** - Point PicPeak at `EXTERNAL_MEDIA_ROOT` to reference existing originals, index quickly, and generate thumbnails on demand -- ๐Ÿ’พ **Smart Storage** - Automatic archiving of expired galleries -- ๐Ÿ›ก๏ธ **Security First** - JWT auth, rate limiting, CORS protection -- ๐Ÿ“ˆ **Scalable** - From small studios to large agencies +**External Media** โ€” Reference photos from a mounted folder instead of uploading. PicPeak reads originals in place and generates thumbnails on demand. -## ๐Ÿš€ Quick Start +**Multi-Language** โ€” Full UI translations for English, German, Dutch, Portuguese, and Russian. Email templates support all languages independently. -Get PicPeak running in under 5 minutes: +**Analytics** โ€” Built-in view/download tracking plus optional Umami integration for privacy-focused analytics. + +**Video Support** โ€” Upload and stream MP4, WebM, MOV alongside photos. FFmpeg bundled via npm. + +**Multiple Admins** โ€” Role-based access control with super admin, admin, and editor roles. + +## Quick Start ```bash -# Clone the repository git clone https://github.com/the-luap/picpeak.git cd picpeak - -# Copy environment template cp .env.example .env - -# Edit configuration (required: JWT_SECRET) -nano .env - -# Start with Docker Compose +# Edit .env โ€” set at least JWT_SECRET and passwords docker compose up -d - -# Access at http://localhost:3000 ``` -Note on Docker file permissions (PUID/PGID) -- When using bind mounts (e.g., `./storage`, `./data`, `./logs`, `./events`), ensure the container user can write to these host folders. The backend runs as a nonโ€‘root user by default. -- Set `PUID` and `PGID` in your `.env` to match your host userโ€™s UID/GID (run `id -u` and `id -g` on the host). Compose maps the container user to these values. -- Example in `.env`: - - `PUID=1000` - - `PGID=1000` -- Without this, creating events, uploads, thumbnails, or logs can fail with "Permission denied". +Open `http://localhost:3000` and log in with the credentials from your `.env`. -## ๐Ÿ”„ Release Channels +> **Permissions:** Set `PUID` and `PGID` in `.env` to match your host user (`id -u` / `id -g`) so Docker volumes are writable. -PicPeak offers two release channels for different needs: +See the [Deployment Guide](DEPLOYMENT_GUIDE.md) for reverse proxy setup, SSL, external media, and production configuration. -### Stable Channel (Recommended) -- Production-ready releases -- Thoroughly tested before release -- Docker tags: `stable`, `latest`, or specific version like `v2.3.0` +## Screenshots -### Beta Channel -- Early access to new features -- May contain bugs or incomplete functionality -- Docker tags: `beta` or specific version like `v2.3.0-beta.1` +
+Admin Dashboard -### Switching Channels +Admin Dashboard +
-Set the `PICPEAK_CHANNEL` environment variable in your `.env` file: +
+Event Management + +Event Management +
+ +
+Analytics + +Analytics +
+ +## Comparison + +| | PicPeak | PicDrop | Scrapbook.de | +|---|---|---|---| +| Self-hosted | Yes | No | No | +| Monthly cost | $0 | $29-199 | 19-99 EUR | +| Storage | Unlimited | 50-500 GB | 100-1000 GB | +| Custom branding | Full | Limited | Limited | +| Open source | Yes | No | No | +| API | Yes | Paid | No | + +## Tech Stack + +- **Backend:** Node.js, Express, PostgreSQL (or SQLite) +- **Frontend:** React, TypeScript, Tailwind CSS +- **Infrastructure:** Docker, Nginx, Redis +- **Processing:** Sharp (images), FFmpeg (video) + +## Release Channels + +**Stable** (`stable` / `latest`) โ€” Production-ready. Use this for real deployments. + +**Beta** (`beta`) โ€” Early access to new features. May have rough edges. ```bash -# For stable releases (default) -PICPEAK_CHANNEL=stable +# Set in .env +PICPEAK_CHANNEL=stable # or beta -# For beta releases -PICPEAK_CHANNEL=beta - -# For a specific version -PICPEAK_CHANNEL=v2.3.0 -``` - -Then update your containers: - -```bash +# Update docker compose -f docker-compose.production.yml pull docker compose -f docker-compose.production.yml up -d ``` -### Update Notifications +The admin dashboard notifies you when updates are available. -The admin dashboard automatically notifies you when updates are available for your channel. To disable update checks, set: +## Contributing -```bash -UPDATE_CHECK_ENABLED=false -``` +We welcome contributions โ€” bug fixes, features, translations, documentation. See [CONTRIBUTING.md](CONTRIBUTING.md) for setup instructions. -## ๐Ÿ“– Documentation +## Documentation -- ๐Ÿ“˜ [**Deployment Guide**](DEPLOYMENT_GUIDE.md) - Detailed installation instructions - - Includes the new [External Media Library](DEPLOYMENT_GUIDE.md#external-media-library) reference mode -- ๐Ÿ“š [**Admin API (OpenAPI)**](docs/picpeak-admin-api.openapi.yaml) - Machine-readable documentation for event automation endpoints -- ๐Ÿ› ๏ธ [**Admin API Quickstart**](docs/admin-api-quickstart.md) - Step-by-step authentication and testing guide for the documented endpoints -- ๐Ÿค [**Contributing**](CONTRIBUTING.md) - How to contribute -- ๐Ÿ“œ [**License**](LICENSE) - MIT License -- ๐Ÿ”’ [**Security**](SECURITY.md) - Security policies -- ๐Ÿ“‹ [**Code of Conduct**](CODE_OF_CONDUCT.md) - Community guidelines +- [Deployment Guide](DEPLOYMENT_GUIDE.md) โ€” Installation, configuration, reverse proxy, external media +- [Admin API (OpenAPI)](docs/picpeak-admin-api.openapi.yaml) โ€” Machine-readable API spec +- [Admin API Quickstart](docs/admin-api-quickstart.md) โ€” Authentication and testing guide +- [Security Policy](SECURITY.md) -## ๐ŸŒ Public Landing Page +## License -Spotlight your studio with a customizable marketing page at `/`: - -- Head to **Admin โ†’ CMS Pages** to enable the public landing page toggle. -- Edit the provided HTML template (rich sections, hero, testimonials) and optional CSS overrides. -- The preview renders in a sandboxed iframe so you can iterate safely before publishing. -- PicPeak sanitizes stored HTML and CSS server-sideโ€”scripts, iframes, and unsafe attributes are stripped automatically. -- Use **Reset to default** anytime to restore the bundled template. -- The backend caches the rendered landing page for 60 seconds by default; override with `PUBLIC_SITE_CACHE_TTL_MS` if you need a different TTL. -- When the landing page is disabled PicPeak continues to serve the admin SPA/login exactly as before. - -## ๐ŸŽฏ Use Cases - -Perfect for: -- ๐Ÿ’’ **Wedding Photographers** - Share ceremony photos securely -- ๐ŸŽ‚ **Event Photography** - Birthday parties, corporate events -- ๐Ÿ“ธ **Portrait Studios** - Client galleries with download limits -- ๐Ÿข **Corporate Events** - Internal photo sharing with branding -- ๐ŸŽ“ **School Photography** - Secure parent access with expiration - -## ๐Ÿ—๏ธ Tech Stack - -- **Backend**: Node.js, Express, SQLite/PostgreSQL -- **Frontend**: React, Tailwind CSS, Framer Motion -- **Storage**: File-based with automatic archiving -- **Email**: SMTP with customizable templates -- **Analytics**: Privacy-focused with Umami integration - -## ๐Ÿ’ป System Requirements - -### Minimum Requirements -- **CPU**: 2 CPU cores -- **RAM**: 2GB minimum -- **Storage**: 20GB minimum (plus photo storage needs) -- **OS**: Linux (Ubuntu 20.04+), macOS, or Windows with WSL2 -- **Node.js**: v18.0.0 or higher -- **Database**: SQLite (included) or PostgreSQL 12+ - -### Docker Requirements (Recommended) -- **Docker**: v20.10.0+ -- **Docker Compose**: v2.0.0+ - -### Video Support Requirements -When enabling video uploads, consider these additional resources: - -| Resource | Recommendation | Notes | -|----------|----------------|-------| -| **RAM** | 4GB+ recommended | FFmpeg processing requires more memory | -| **Storage** | Plan for 10-100x more | Videos are significantly larger than images | -| **CPU** | Additional cores help | Video thumbnail extraction is CPU-intensive | -| **Bandwidth** | Higher throughput | Video streaming requires more bandwidth | - -**Technical Notes:** -- FFmpeg is bundled via npm (`@ffmpeg-installer/ffmpeg`) - no system installation required -- Maximum upload size: **10GB per video file** -- Chunked upload support for files >100MB (resumable uploads) -- Supported formats: MP4, WebM, MOV, AVI -- Video thumbnails are automatically generated from the first few seconds - -**For Nginx/Reverse Proxy:** -If using Nginx, increase the client max body size: -```nginx -client_max_body_size 10G; -proxy_read_timeout 3600; -proxy_send_timeout 3600; -``` - -## ๐Ÿค Contributing - -We love contributions! PicPeak is built by photographers, for photographers. Whether you're fixing bugs, adding features, or improving documentation, your help is welcome. - -See our [Contributing Guide](CONTRIBUTING.md) for details. - -## ๐Ÿ“Š Comparison with Alternatives - -| Feature | PicPeak | PicDrop | Scrapbook.de | -|---------|---------|---------|--------------| -| Self-Hosted | โœ… | โŒ | โŒ | -| Custom Branding | โœ… Full | Limited | Limited | -| Monthly Cost | $0 | $29-199 | โ‚ฌ19-99 | -| Storage Limit | Unlimited* | 50-500GB | 100-1000GB | -| Client Uploads | โœ… | โœ… | โœ… | -| API Access | โœ… | Paid | โŒ | -| Open Source | โœ… | โŒ | โŒ | - -*Limited only by your server storage - -## ๐Ÿ›ก๏ธ Security - -PicPeak takes security seriously: -- ๐Ÿ” Password hashing with bcrypt -- ๐ŸŽซ JWT-based authentication -- ๐Ÿšฆ Rate limiting on all endpoints -- ๐Ÿ›ก๏ธ CORS protection -- ๐Ÿ“ Activity logging -- ๐Ÿ”’ Secure file access - -Found a security issue? Please open a [security issue](https://github.com/the-luap/picpeak/issues/new?labels=security) on GitHub - -## ๐Ÿ“ธ Screenshots - -### ๐ŸŽ›๏ธ **Admin Dashboard** -Get a complete overview of your photo galleries, analytics, and system status. - -PicPeak Admin Dashboard - -### ๐Ÿ“Š **Analytics & Insights** -Track gallery performance, view statistics, and monitor user engagement. - -PicPeak Analytics Dashboard - -### ๐Ÿ“ **Event Management** -Organize and manage your photo galleries with intuitive event management tools. - -PicPeak Events Management - -### โœจ **Key Interface Highlights** - -
-๐Ÿ‘† Click to see more interface details - -#### What makes PicPeak's interface special: - -- **๐ŸŽจ Clean Design**: Modern, photographer-friendly interface -- **๐Ÿ“ฑ Responsive**: Perfect on desktop, tablet, and mobile -- **โšก Fast Loading**: Optimized for quick photo browsing -- **๐Ÿ”’ Secure Access**: Password-protected galleries with expiration -- **๐Ÿ“ค Easy Uploads**: Drag & drop functionality for effortless photo management -- **๐ŸŽฏ Client-Focused**: Intuitive gallery experience for your clients - -
- -## ๐Ÿ—บ๏ธ Roadmap - -We're constantly improving PicPeak and welcome contributions from our community! If you have ideas for new features or want to help implement existing ones, please open an issue or submit a pull request. Your contributions help make PicPeak better for everyone. - -### ๐Ÿšง Beta Features (Use at your own risk) - -These features are currently in beta testing and may have limited functionality or stability: - -| Feature | Description | Status | -|---------|-------------|--------| -| **Simple Deployment Script** | One-click deployment script for quick server setup with automated configuration and dependency installation | ๐Ÿงช Beta | - -### ๐Ÿ“‹ Future Enhancements - -| Feature | Description | Priority | Status | -|---------|-------------|----------|---------| -| **Backup & Restore** | Comprehensive backup system with S3/MinIO support, automated scheduling, and safe restore functionality | High | โœ… Implemented | -| **External Media Library (Reference Mode)** | Use an external folder library as a readโ€‘only source with import and onโ€‘demand thumbnail generation | High | โœ… Implemented | -| **Download Protection** | Advanced image protection system with canvas rendering, invisible watermarking, right-click prevention, and DevTools detection to protect photos from unauthorized downloads | High | โœ… Implemented | -| **Gallery Templates** | Multiple gallery layouts (grid, masonry, carousel, timeline, hero, mosaic) with custom CSS styling support. Includes starter templates like Apple Liquid Glass for complete visual customization | Medium | โœ… Implemented | -| **Face Recognition** | AI-powered face detection to help guests find their photos and create automatic person-based albums | Low | ๐Ÿ”„ Open | -| **Gallery Feedback** | Allow guests to like, rate, and comment on photos with admin notifications and moderation | Medium | โœ… Implemented | -| **Video Support** | Upload and display videos alongside photos in galleries with streaming support | Low | โœ… Implemented | -| **Multiple Administrators** | Support for multiple admin accounts with role-based permissions and activity tracking | Low | โœ… Implemented | -| **Filtering & Export Options** | Filter photos by likes, ratings, comments, or favorites. Search by filename. Sort by date, name, size, or rating. Export filtered selections as ZIP or generate Capture One/Lightroom-compatible file lists for professional workflows | Medium | โœ… Implemented | - -**Status Legend:** โœ… Implemented | ๐Ÿšง In Progress | ๐Ÿ”„ Open | ๐Ÿ“‹ Planned - -## ๐Ÿ™ Acknowledgments - -PicPeak is inspired by the best features of commercial platforms while remaining completely open source. Special thanks to all contributors who make this project possible. - -### ๐Ÿค– AI-Assisted Development - -This project was generated with the assistance of AI technology, but has been: -- โœ… **Fully tested end-to-end** by human developers -- ๐Ÿ”’ **Security audited** with comprehensive security checks -- ๐Ÿ‘จโ€๐Ÿ’ป **Human-reviewed** for code quality and best practices -- ๐Ÿงช **Production-tested** in real-world scenarios - -We believe in transparent development practices and the responsible use of AI as a tool to accelerate development while maintaining high standards of quality and security. - -## ๐Ÿ“„ License - -PicPeak is released under the [MIT License](LICENSE). Use it freely for personal or commercial projects. - -## ๐Ÿš€ Ready to Get Started? - -1. โญ **Star this repository** to show your support -2. ๐Ÿ“– Read the [Deployment Guide](DEPLOYMENT_GUIDE.md) -3. ๐Ÿ› Report issues or request features -4. ๐Ÿค Join our community and contribute! +MIT โ€” use it for personal or commercial projects. ---

- Made with โค๏ธ by photographers, for photographers -
- Homepage โ€ข - Live Demo โ€ข - GitHub โ€ข - Documentation โ€ข - Support + Homepage ยท Live Demo ยท Docs ยท Issues

From 75499992ebae107192f331a9eb052fda7cac1be2 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 8 Apr 2026 11:15:26 +0000 Subject: [PATCH 10/13] chore(main): release 2.6.5 --- .release-please-manifest.json | 2 +- CHANGELOG.md | 8 ++++++++ backend/package.json | 2 +- frontend/package.json | 2 +- 4 files changed, 11 insertions(+), 3 deletions(-) diff --git a/.release-please-manifest.json b/.release-please-manifest.json index 9caa5c14..b5439b8b 100644 --- a/.release-please-manifest.json +++ b/.release-please-manifest.json @@ -1,3 +1,3 @@ { - ".": "2.6.4" + ".": "2.6.5" } diff --git a/CHANGELOG.md b/CHANGELOG.md index eafd7a17..6507ff14 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,14 @@ All notable changes to PicPeak will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [2.6.5](https://github.com/the-luap/picpeak/compare/v2.6.4...v2.6.5) (2026-04-08) + + +### Documentation + +* rewrite README โ€” shorter, cleaner ([62643f2](https://github.com/the-luap/picpeak/commit/62643f241b51dc1620e30a8c8767f52428c0314c)) +* rewrite README โ€” shorter, cleaner, less AI-sounding ([64f6061](https://github.com/the-luap/picpeak/commit/64f606152fde2db9034fa9ffa08cc58623edf646)) + ## [2.6.4](https://github.com/the-luap/picpeak/compare/v2.6.3...v2.6.4) (2026-04-08) diff --git a/backend/package.json b/backend/package.json index ddedbfdf..d6a4a31b 100644 --- a/backend/package.json +++ b/backend/package.json @@ -1,6 +1,6 @@ { "name": "picpeak-backend", - "version": "2.6.4", + "version": "2.6.5", "description": "Backend for PicPeak event photo sharing platform", "main": "server.js", "scripts": { diff --git a/frontend/package.json b/frontend/package.json index 3b2b3742..f145dbf4 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -1,7 +1,7 @@ { "name": "picpeak-frontend", "private": true, - "version": "2.6.4", + "version": "2.6.5", "type": "module", "scripts": { "dev": "vite", From ab6db37326a4a0789f1f1619751ed37eee3d3439 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 7 May 2026 10:59:36 +0000 Subject: [PATCH 11/13] chore(main): release 3.43.0 --- .release-please-manifest.json | 2 +- CHANGELOG.md | 286 ++++++++++++++++++++++++++++++++++ backend/package.json | 2 +- frontend/package.json | 2 +- 4 files changed, 289 insertions(+), 3 deletions(-) diff --git a/.release-please-manifest.json b/.release-please-manifest.json index 094e9dae..71ab31f3 100644 --- a/.release-please-manifest.json +++ b/.release-please-manifest.json @@ -1 +1 @@ -{ ".": "3.42.1" } +{".":"3.43.0"} diff --git a/CHANGELOG.md b/CHANGELOG.md index e4aafcf7..2780c5a5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,292 @@ All notable changes to PicPeak will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [3.43.0](https://github.com/the-luap/picpeak/compare/v3.42.1...v3.43.0) (2026-05-07) + + +### Features + +* add admin dark mode and SEO/robots.txt settings ([9c2a0d2](https://github.com/the-luap/picpeak/commit/9c2a0d272a21dfcace2ec795034e2f1adcba47e0)) +* add bulk category editing for photos ([#157](https://github.com/the-luap/picpeak/issues/157)) ([eca36c7](https://github.com/the-luap/picpeak/commit/eca36c70a23f18f937a9f5bddeff855e18f364c3)) +* add category hero/cover photo selection ([#163](https://github.com/the-luap/picpeak/issues/163)) ([6c30e2c](https://github.com/the-luap/picpeak/commit/6c30e2c2edd19a24d4f30a9558690bb7e2331b32)) +* add configurable upload batch size for reverse proxy compatibility ([#208](https://github.com/the-luap/picpeak/issues/208)) ([02a46e0](https://github.com/the-luap/picpeak/commit/02a46e083d68cfdb355b5a4fe4a8da7d667050b9)) +* add COOKIE_SECURE=auto for mixed HTTPS/HTTP deployments ([#298](https://github.com/the-luap/picpeak/issues/298)) ([b1dfbe4](https://github.com/the-luap/picpeak/commit/b1dfbe4c2fe271d8087974d02cf724f04058bdc9)) +* add COOKIE_SECURE=auto for mixed HTTPS/HTTP deployments ([#298](https://github.com/the-luap/picpeak/issues/298)) ([15a8ab4](https://github.com/the-luap/picpeak/commit/15a8ab41fd1c94e3397d300b161cd1fdd459ea05)) +* add customizable event types with admin management ([f8881d5](https://github.com/the-luap/picpeak/commit/f8881d5bd62d449fb40917ec8c20f0eb16c1fdad)) +* add Dutch (nl) locale and fix missing translation keys across all locales ([b54a80d](https://github.com/the-luap/picpeak/commit/b54a80d251bcbb9a126e32eeaef522688bc810c6)) +* add Dutch locale and fix missing translation keys ([e32da68](https://github.com/the-luap/picpeak/commit/e32da68cbdfa430d62cbb1057ea418dc6b2f14fb)) +* add Gallery Premium and Gallery Story layouts (Beta) ([e179def](https://github.com/the-luap/picpeak/commit/e179def3cceefe5fd6acd5574f2986e4f9e223ef)) +* add hero image focal point picker with anchor positioning ([#162](https://github.com/the-luap/picpeak/issues/162)) ([734868a](https://github.com/the-luap/picpeak/commit/734868abc23731b0ac9ad73e799194df1e6aa6ab)) +* add justified layout modes and aspect-ratio-aware mosaic ([#146](https://github.com/the-luap/picpeak/issues/146)) ([608bbd5](https://github.com/the-luap/picpeak/commit/608bbd50e7b31d49c7516a00e96f284fa16e2777)) +* Add justified layout modes and aspect-ratio-aware mosaic ([#146](https://github.com/the-luap/picpeak/issues/146)) ([ef2ae00](https://github.com/the-luap/picpeak/commit/ef2ae00ff20b754c2f2ed797e18c146d12d7f31a)) +* add justified/rows layout mode to masonry gallery ([#146](https://github.com/the-luap/picpeak/issues/146)) ([e081b56](https://github.com/the-luap/picpeak/commit/e081b56a44bf9fdaa3dd225d5dd4dde35bfe83d3)) +* add justified/rows layout mode to masonry gallery ([#146](https://github.com/the-luap/picpeak/issues/146)) + security fixes ([cd1d504](https://github.com/the-luap/picpeak/commit/cd1d50474f673b759c2f9401fdbe209a84773e39)) +* add optional event date and expiration settings ([3079eaa](https://github.com/the-luap/picpeak/commit/3079eaa2e5d1728c2c0f315626cc253e4b08edc2)) +* add optional event date and expiration settings ([2151147](https://github.com/the-luap/picpeak/commit/2151147f2d3134448ff32130da44678e2942d73c)), closes [#118](https://github.com/the-luap/picpeak/issues/118) +* add original filename preservation and Lightroom export support ([a59f414](https://github.com/the-luap/picpeak/commit/a59f41463f960a3a74ce3933dc7db84ee3a2018d)) +* add original filename preservation and Lightroom export support ([9872ad3](https://github.com/the-luap/picpeak/commit/9872ad3aef6488b359c5499a6dc3d8bfbfa48fde)) +* add per-event custom logo upload with bug fixes ([85170b8](https://github.com/the-luap/picpeak/commit/85170b883f504d83f1d862abb3f4e46741074826)) +* add per-event hero logo customization options ([0790a1d](https://github.com/the-luap/picpeak/commit/0790a1ddad774af89827a0a392e9fae0a945bff2)) +* add per-gallery thumbnail scale setting ([#172](https://github.com/the-luap/picpeak/issues/172)) ([#251](https://github.com/the-luap/picpeak/issues/251)) ([ee46088](https://github.com/the-luap/picpeak/commit/ee46088985ebbbb81d16e5bac23be2060c94397f)) +* add photo cap per event and Portuguese (pt-BR) locale ([1fa222e](https://github.com/the-luap/picpeak/commit/1fa222e9c4c26e525c7899e368988c6b0b08da85)) +* add photo cap per event and Portuguese locale ([088de43](https://github.com/the-luap/picpeak/commit/088de43f09f974d444f50452ef1117315c289ebc)) +* add quilted layout, fix mosaic, and backfill photo dimensions ([#146](https://github.com/the-luap/picpeak/issues/146)) ([46ed1bc](https://github.com/the-luap/picpeak/commit/46ed1bc276867a25b27bf22cd9b9d7e879a6947b)) +* add thumbnail settings UI to admin panel ([3a30fea](https://github.com/the-luap/picpeak/commit/3a30fea862034d64fbc7188fc25292594a9319e2)) +* add thumbnail settings UI to admin settings page ([#206](https://github.com/the-luap/picpeak/issues/206)) ([7d6d2f5](https://github.com/the-luap/picpeak/commit/7d6d2f56883a4402f0d97c95b0432a8a783c8024)) +* add update instructions dialog, email notifications, and capture date sorting ([50c0990](https://github.com/the-luap/picpeak/commit/50c09904a9434f988ab32a07da5d24db0e02065e)), closes [#181](https://github.com/the-luap/picpeak/issues/181) +* add visual WYSIWYG email template editor ([#229](https://github.com/the-luap/picpeak/issues/229)) ([04a7ea8](https://github.com/the-luap/picpeak/commit/04a7ea80f95d6aeb474b145292e75f45fb85c66d)) +* **branding:** 8-token CI palette + force color mode + dark-mode consistency ([8050927](https://github.com/the-luap/picpeak/commit/80509276074b8125b6d676839afabb0b6f89206f)) +* **branding:** force color mode (dark or light) site-wide ([5a162fc](https://github.com/the-luap/picpeak/commit/5a162fc8bec47a49cb1bcaa92ff72e197e8d2e42)) +* **branding:** inline force color mode with auto-save + clearer palette help text ([67d7d8d](https://github.com/the-luap/picpeak/commit/67d7d8d3fa25ceab0eda02b291f2e220b222f84a)) +* **branding:** per-family generic fallback via meta.json ([dcff451](https://github.com/the-luap/picpeak/commit/dcff4515721482e06c2ef1c1eb34f9e12754c07c)) +* **branding:** preview each font in its own face in the picker dropdown ([b4f9b65](https://github.com/the-luap/picpeak/commit/b4f9b65f1df4c400f22b28f20e1304ec57279d33)) +* **branding:** self-hosted webfonts with filesystem scanner ([d04bf28](https://github.com/the-luap/picpeak/commit/d04bf288084144bf53ef0ba988fa32ed703d7351)) +* **branding:** self-hosted webfonts with filesystem scanner ([bac51fe](https://github.com/the-luap/picpeak/commit/bac51fe69a39f85381f445e8da6cd63cf5826fc4)) +* **cms:** add external URL toggle for imprint and privacy pages ([b2c8161](https://github.com/the-luap/picpeak/commit/b2c8161a43c2d0b09d6783e791b3f26862254824)) +* **cms:** add per-page external URL override โ€” backend ([66423bb](https://github.com/the-luap/picpeak/commit/66423bb65e83b6204509c9a98d783ba8255c3364)) +* **cms:** admin UI for external imprint/privacy URL ([a4e3d10](https://github.com/the-luap/picpeak/commit/a4e3d10fb0c97ea07c4b08d16c0947945d8a7576)) +* **cms:** redirect legal links to external URL when configured ([c5bba50](https://github.com/the-luap/picpeak/commit/c5bba505ac92b5257f6bb1c069b8bc23ea6a5a1b)) +* configurable upload batch size for reverse proxy compatibility ([9b7495e](https://github.com/the-luap/picpeak/commit/9b7495e0054975e66c9b5006c24a9fae63969de4)) +* configurable upload batch size for reverse proxy compatibility ([4243363](https://github.com/the-luap/picpeak/commit/424336340bef8e1629490ade154f0ceebb2a71e1)) +* customisable 404 + gallery-not-found pages via CMS ([#324](https://github.com/the-luap/picpeak/issues/324)) ([4f77905](https://github.com/the-luap/picpeak/commit/4f77905b87bea474b3d2496350996deaad041230)) +* decouple hero header from gallery layouts ([#158](https://github.com/the-luap/picpeak/issues/158)) ([7b8d8bd](https://github.com/the-luap/picpeak/commit/7b8d8bd92ba7a96717bb4d821b38dddc395f701a)) +* draft mode, admin branding, and workflow improvements ([dc98206](https://github.com/the-luap/picpeak/commit/dc98206737d1ebe43637319ce8c5b6da2e44c05d)) +* draft mode, admin branding, and workflow improvements ([40332a7](https://github.com/the-luap/picpeak/commit/40332a71db6534097940d3f9362b0fe651dba6c7)) +* dynamic website title from branding settings ([d29aab7](https://github.com/the-luap/picpeak/commit/d29aab7c70c5777451666fb7d5c7a9729dab684a)) +* **email:** expand email palette to 8 tokens + Sync from Branding button ([47b6b39](https://github.com/the-luap/picpeak/commit/47b6b39f3a942aee93b970031d95a952cb769d09)) +* **events:** add Photos column to admin events list ([#384](https://github.com/the-luap/picpeak/issues/384)) ([d561db8](https://github.com/the-luap/picpeak/commit/d561db802b04db8fbb38819a22e840532e775ef0)) +* **events:** add Photos column to admin events list ([#384](https://github.com/the-luap/picpeak/issues/384)) ([ffb4318](https://github.com/the-luap/picpeak/commit/ffb4318a1f667e273cd59805673b125d2f17699b)) +* **events:** bulk delete with password confirmation ([#384](https://github.com/the-luap/picpeak/issues/384)) ([647aea2](https://github.com/the-luap/picpeak/commit/647aea21ae42fe0d089bf45568702617a25b98e4)) +* **events:** bulk delete with password confirmation ([#384](https://github.com/the-luap/picpeak/issues/384)) ([48d538f](https://github.com/the-luap/picpeak/commit/48d538f94fd39d9b85ec57c57301a8490b7d4f6d)) +* **events:** prefill admin email + admin picker on event creation ([3fe8e61](https://github.com/the-luap/picpeak/commit/3fe8e61bd1175e35dcb61604447e5d9c2e902ec5)) +* **events:** prefill admin email + admin picker on event creation ([ee56b67](https://github.com/the-luap/picpeak/commit/ee56b6762f5b2eb9ea42f4abe4dde4356e2e54e6)) +* **events:** Sync from Branding button in gallery theme customizer + clarified default inheritance ([bdbe7b8](https://github.com/the-luap/picpeak/commit/bdbe7b80a13b8b215ac544ba9105100e792eeda2)) +* **events:** tree view for external media folder picker ([cdd40ac](https://github.com/the-luap/picpeak/commit/cdd40acb4591d4eb8f80a79c69201556eab1bfd0)) +* **events:** tree view for external media folder picker ([f927b09](https://github.com/the-luap/picpeak/commit/f927b09c70f3b6a5c81c3726609a29680b96b6fc)) +* **frontend:** dedupe /public/settings via shared usePublicSettings hook ([#325](https://github.com/the-luap/picpeak/issues/325)) ([3d4ae4d](https://github.com/the-luap/picpeak/commit/3d4ae4d7e9f9995d93563e8092e05215362afb3b)) +* gallery layouts, bulk category editing, and hero header improvements ([7037106](https://github.com/the-luap/picpeak/commit/7037106bff62593bba600d898a781f79f07b459d)) +* gallery layouts, hero customization, bulk categories & event types ([d9e00dc](https://github.com/the-luap/picpeak/commit/d9e00dc0dbd7cef0ddb4665e5306c98aac3573e3)) +* gallery layouts, hero customization, event types, and UX improvements ([#146](https://github.com/the-luap/picpeak/issues/146), [#155](https://github.com/the-luap/picpeak/issues/155)-163, [#170](https://github.com/the-luap/picpeak/issues/170), [#171](https://github.com/the-luap/picpeak/issues/171)) ([4280444](https://github.com/the-luap/picpeak/commit/4280444d70e73db09e67e18ce25bac75cf499b75)) +* **gallery:** decouple header style from layout, add banner option ([1f1a856](https://github.com/the-luap/picpeak/commit/1f1a856083b1966ed4b32a23a14442f1727cecef)) +* **gallery:** decouple header style from layout, add banner option ([24d7277](https://github.com/the-luap/picpeak/commit/24d727752c442263a6469e0aefa666454a4c652f)) +* **gallery:** decouple header style from layout, add banner option ([aff29c9](https://github.com/the-luap/picpeak/commit/aff29c91bbb250debe74e2a512047ee40e157a34)) +* **gallery:** icon-only menu, accent Download CTA ([#386](https://github.com/the-luap/picpeak/issues/386)) ([876b35b](https://github.com/the-luap/picpeak/commit/876b35b4a512f70cfc19561e35ce9d915a599547)) +* **gallery:** icon-only menu, accent Download CTA, logo aligned ([#386](https://github.com/the-luap/picpeak/issues/386)) ([de8ad5f](https://github.com/the-luap/picpeak/commit/de8ad5fdd5ce1b9552ca8ca6e405d15c7372a4c8)) +* guest selections with per-person identity ([#292](https://github.com/the-luap/picpeak/issues/292)) ([3856ba2](https://github.com/the-luap/picpeak/commit/3856ba25bbce971b07bba4dad19e7bdceca98cab)) +* guest selections with per-person identity ([#292](https://github.com/the-luap/picpeak/issues/292)) ([ad4e5a7](https://github.com/the-luap/picpeak/commit/ad4e5a7506bc9217d1223101da0bc112047532a8)) +* **i18n:** add Brazilian Portuguese (pt-BR) locale ([375f512](https://github.com/the-luap/picpeak/commit/375f51285b5db9c0dfcc04761d24927282e57796)) +* **i18n:** improve pt locale with pt-BR phrasings, remove duplicate pt-BR file ([f25559c](https://github.com/the-luap/picpeak/commit/f25559c0e76776f7cfe8d187e1fea05e751bbafe)) +* improve gallery layouts with aspect-ratio-aware masonry and mosaic modes ([#146](https://github.com/the-luap/picpeak/issues/146)) ([aacfcd5](https://github.com/the-luap/picpeak/commit/aacfcd517ea5739e834cf84627b55b3449740a5c)) +* improve hero image UX and live preview ([#163](https://github.com/the-luap/picpeak/issues/163), [#158](https://github.com/the-luap/picpeak/issues/158)) ([d63f67a](https://github.com/the-luap/picpeak/commit/d63f67a2afba1b92610382aa1012428ccacb86bd)) +* multilingual email templates with translations table ([8c5996e](https://github.com/the-luap/picpeak/commit/8c5996e4ec43b2817d84cc040cfe52878ffb61d5)) +* multilingual email templates with translations table ([f50d7c0](https://github.com/the-luap/picpeak/commit/f50d7c0c51aa84a2182e450cd4b6a00777a8f9c0)) +* native multi-arch Docker images (Apple Silicon, ARM64 Linux) ([df30618](https://github.com/the-luap/picpeak/commit/df3061893d154152b75b8ab0d07e0b1e0078431d)) +* native S3 storage backend ([#328](https://github.com/the-luap/picpeak/issues/328)) + presigned download follow-up ([1b717ce](https://github.com/the-luap/picpeak/commit/1b717ce5ededa343d2fbb7e1c3493b4434743565)) +* new features and bug fixes for beta release ([151e1bf](https://github.com/the-luap/picpeak/commit/151e1bf50f206ae0571fa044c75b8bc9f0f40120)) +* optional customer phone field gated by global toggle ([#322](https://github.com/the-luap/picpeak/issues/322)) ([be6cb28](https://github.com/the-luap/picpeak/commit/be6cb28c8097d2277c1af2a32cf8bc88ebbc7136)) +* original filename in admin UI, update dialog, and security hardening ([3ea9d5b](https://github.com/the-luap/picpeak/commit/3ea9d5b1219980032cbee7a2564c0004948923f5)) +* original filename in admin UI, update dialog, security hardening, and bug fixes ([bcf2745](https://github.com/the-luap/picpeak/commit/bcf2745ab64acb968ae4bd0710b28e78c14f340c)) +* outbound webhooks for event/photo lifecycle ([#327](https://github.com/the-luap/picpeak/issues/327)) ([c488f48](https://github.com/the-luap/picpeak/commit/c488f481caacf0d63dafc47f509e8de2708bc30f)) +* per-event custom logos, customizable event types, and multiple bug fixes ([4c08160](https://github.com/the-luap/picpeak/commit/4c081601e02888d7ad289acb7847aee9d6f5703f)) +* photo visibility control with client access ([#172](https://github.com/the-luap/picpeak/issues/172)) ([4a93e4e](https://github.com/the-luap/picpeak/commit/4a93e4e8cbe1b7a23a8be706291a270ccdf5bb55)) +* photo visibility control with client access ([#172](https://github.com/the-luap/picpeak/issues/172)) ([e1b6e43](https://github.com/the-luap/picpeak/commit/e1b6e43e524211c913d3d29ade5fc029df12920f)) +* pre-generate watermarks for instant lightbox loading ([1be974a](https://github.com/the-luap/picpeak/commit/1be974afbb0b7a1bdbdd140327771907a5d3c2ae)), closes [#112](https://github.com/the-luap/picpeak/issues/112) +* pre-generated watermarks and mobile upload button improvements ([c6fdd38](https://github.com/the-luap/picpeak/commit/c6fdd38e842e1a8c0aa9cbab9fc791e6669e402d)) +* pre-zip download all and photo replacement by name ([#312](https://github.com/the-luap/picpeak/issues/312), [#313](https://github.com/the-luap/picpeak/issues/313)) ([d3f1206](https://github.com/the-luap/picpeak/commit/d3f12068164a6bfe6c4a3817ad2fc2e8ed7abf4f)) +* pre-zip download all and photo replacement by name ([#312](https://github.com/the-luap/picpeak/issues/312), [#313](https://github.com/the-luap/picpeak/issues/313)) ([e18afd3](https://github.com/the-luap/picpeak/commit/e18afd3e6b0b5a4cdb4873fb227d1b1d2bf35f21)) +* presigned download UI + S3 prefix walker auto-importer (follow-ups) ([446d80a](https://github.com/the-luap/picpeak/commit/446d80a4cc5eb0389994e29585b2a98dad373db2)) +* public v1 API + token management + OpenAPI docs ([#322](https://github.com/the-luap/picpeak/issues/322)) ([808b15b](https://github.com/the-luap/picpeak/commit/808b15bafbcdab6ea55aff7f0e507153f513a70a)) +* register Russian locale and add to language selector ([6f95b8c](https://github.com/the-luap/picpeak/commit/6f95b8c26cd794525e15e45d478f9ead0ec22555)) +* S3 storage + webhooks + settings dedupe + backup fixes ([06d54be](https://github.com/the-luap/picpeak/commit/06d54bec4d0afc4a1b9ba6f2449ed7d79f1d3e8f)) +* show original filename in admin UI ([#184](https://github.com/the-luap/picpeak/issues/184)) ([0891be1](https://github.com/the-luap/picpeak/commit/0891be197fdb7d92ade5a293b8db0bed26fa6e3a)) +* sort photos by capture date with configurable default sort ([#283](https://github.com/the-luap/picpeak/issues/283)) ([8805fa5](https://github.com/the-luap/picpeak/commit/8805fa53e61c6b3672a8f6dad14d2fd17998a451)) +* sort photos by capture date with configurable default sort ([#283](https://github.com/the-luap/picpeak/issues/283)) ([633d4a0](https://github.com/the-luap/picpeak/commit/633d4a0f301e355ee9f057347f2f8dee8c5b4163)) +* support Apple Silicon natively via multi-arch images ([c282a72](https://github.com/the-luap/picpeak/commit/c282a72bd35db062cec25770a42cf9c803388e44)) +* **theme:** expand color settings to 8-token CI palette + alt button ([114aab5](https://github.com/the-luap/picpeak/commit/114aab57771a4bba03a9e5c616c75a37c9b25969)) +* **upload:** async photo processing โ€” backend (PR-B part 1) ([851744c](https://github.com/the-luap/picpeak/commit/851744c3c4df7deba8d946b6592fdb5042c52a26)) +* **upload:** async photo processing โ€” frontend (PR-B part 2) ([3b827b8](https://github.com/the-luap/picpeak/commit/3b827b80d51269e1a7b9c693396f3cb7a9a48ffc)) +* **upload:** async photo processing + fix(auth): /auth/session symmetry (loop fix) ([907bcf1](https://github.com/the-luap/picpeak/commit/907bcf1eb2d44ded149a1caf39ee1cfe63fec994)) +* **upload:** two-state UI + temp dir cleanup (PR-A of async processing) ([86dfcc4](https://github.com/the-luap/picpeak/commit/86dfcc4f116a394e7e092ab3e01f3f1d030bb367)) +* visual WYSIWYG email template editor ([703c03f](https://github.com/the-luap/picpeak/commit/703c03fbee754a5291b57b885c5e82fbdd3e69e9)) +* warn about low thumbnail resolution when selecting beta themes ([ee3f6ae](https://github.com/the-luap/picpeak/commit/ee3f6ae13bf9c9fb3295286e84150e04bf9fbce4)) +* warn about low thumbnail resolution with beta themes ([aef9b4e](https://github.com/the-luap/picpeak/commit/aef9b4ed7fc443cbec8890c580759077e05e77b4)) +* **webhooks:** enrich event.* payloads with customer contact + share_token ([#341](https://github.com/the-luap/picpeak/issues/341)) ([7ea4801](https://github.com/the-luap/picpeak/commit/7ea4801544fd5cd8bca1907a71b5c4e96ee77649)) +* **webhooks:** enrich event.* payloads with customer contact + share_token ([#341](https://github.com/the-luap/picpeak/issues/341)) ([1e69d5f](https://github.com/the-luap/picpeak/commit/1e69d5ff71ac2d1d133b0e40637b437d7cc8bc4f)) + + +### Bug Fixes + +* add allow_user_uploads to gallery API responses ([691e3ab](https://github.com/the-luap/picpeak/commit/691e3aba09f2148afe902a0bb0139d062634e669)) +* add lightbox loading spinner and watermark cache invalidation ([050ed37](https://github.com/the-luap/picpeak/commit/050ed378199eb3b15c7c7f243792f68f858803f5)) +* add STORAGE_PATH to production docker-compose ([cdda709](https://github.com/the-luap/picpeak/commit/cdda70988664a177b351abc6a259ec39664d17ff)) +* address beta feedback - gallery layout fixes, Russian locale, email logo ([#249](https://github.com/the-luap/picpeak/issues/249)) ([486239a](https://github.com/the-luap/picpeak/commit/486239aeb9b5f56551d5aa90f0bad3008eedc3bb)) +* address bugs and feature requests from discussion [#317](https://github.com/the-luap/picpeak/issues/317) ([6cfff6f](https://github.com/the-luap/picpeak/commit/6cfff6f6a6dbdc5bc1e9fe4fbce5795cdb1855c6)) +* address Shannon security assessment findings (37 vulnerabilities) ([#254](https://github.com/the-luap/picpeak/issues/254)) ([23cd9cb](https://github.com/the-luap/picpeak/commit/23cd9cb680eb77b94a97266c3353dfc835f0cc69)) +* admin photo feedback filters have no effect ([#293](https://github.com/the-luap/picpeak/issues/293)) ([9ed8a2b](https://github.com/the-luap/picpeak/commit/9ed8a2b1994d139efd100c8fb97e6368655e5530)) +* **admin:** tab underlines use accent (not accent-dark) for proper highlight color ([565ae45](https://github.com/the-luap/picpeak/commit/565ae45ca71e46166c8bbfc0eb0b6da92d74f120)) +* apply password change fix to regular modal + longer toast delay ([#263](https://github.com/the-luap/picpeak/issues/263)) ([c63bc47](https://github.com/the-luap/picpeak/commit/c63bc47089b4b32c570bdeeb1f82bf722569875f)) +* apply password change redirect fix to regular modal too ([#263](https://github.com/the-luap/picpeak/issues/263)) ([147dc28](https://github.com/the-luap/picpeak/commit/147dc28440ca69ed970677fa221dfac00c8e2560)) +* apply sort direction in gallery and respect show_feedback_to_guests ([#302](https://github.com/the-luap/picpeak/issues/302), [#303](https://github.com/the-luap/picpeak/issues/303)) ([3716ff5](https://github.com/the-luap/picpeak/commit/3716ff50854766bde588fbd6b9027f8647e59150)) +* apply sort direction in gallery view and respect show_feedback_to_guests ([#302](https://github.com/the-luap/picpeak/issues/302), [#303](https://github.com/the-luap/picpeak/issues/303)) ([dffe057](https://github.com/the-luap/picpeak/commit/dffe057772c922ab6a213e25f171157e0c2badf8)) +* **auth:** /auth/session must enforce session timeout symmetrically ([#350](https://github.com/the-luap/picpeak/issues/350) recurrence) ([c8e09c2](https://github.com/the-luap/picpeak/commit/c8e09c2a2a7d0920901560317eecd773b83251c0)) +* **auth:** /auth/session must enforce session timeout symmetrically ([#350](https://github.com/the-luap/picpeak/issues/350) recurrence) ([b106da1](https://github.com/the-luap/picpeak/commit/b106da1ededa27fc8727f2c0e74a9182e6e9c895)) +* **auth:** /auth/session must reject tokens that adminAuth/galleryAuth would reject ([f905f7e](https://github.com/the-luap/picpeak/commit/f905f7e7336c756e73a8c650c9239b171697164a)) +* **auth:** /auth/session must verify issuer claim like adminAuth ([#350](https://github.com/the-luap/picpeak/issues/350)) ([83dedbc](https://github.com/the-luap/picpeak/commit/83dedbcd45e34a924594dd83f6e3561f776576fb)) +* **auth:** make /auth/session verify the issuer claim like adminAuth ([#350](https://github.com/the-luap/picpeak/issues/350)) ([88a6c6a](https://github.com/the-luap/picpeak/commit/88a6c6a7fba7e1419a021f4870518f0b76ac6494)) +* **backup:** cron schedule mapping + manifest format detection + bigint coerce ([ab4095f](https://github.com/the-luap/picpeak/commit/ab4095f5928b1476009cddfd3444d6f5b58b034d)) +* **backup:** incremental backups against S3 + jsonb stats parsing ([e232f9f](https://github.com/the-luap/picpeak/commit/e232f9f2cf54aeba1e16d769397428206a0f1801)) +* **branding:** admin sidebar uses accent-dark, primary buttons follow CI token ([fc2bce3](https://github.com/the-luap/picpeak/commit/fc2bce3a01f02b2d131ca4ce1c8e81fc9dc62755)) +* **branding:** comprehensive sweep โ€” replace remaining primary-* legacy colors with accent tokens ([578a174](https://github.com/the-luap/picpeak/commit/578a1745b8d010eeeb261d3452fd192b1ec7bcf8)) +* **branding:** selected-state accent colors, force-mode actually flips galleries, compact color picker layout ([5b410ed](https://github.com/the-luap/picpeak/commit/5b410ed9f87daad8e96345a86897f2a9e9419802)) +* **branding:** working tooltips, high-contrast selected states, gallery chrome follows accent ([b19bb0c](https://github.com/the-luap/picpeak/commit/b19bb0c6208744f329cb3e99f4e26a83f191710a)) +* checkbox and toggle settings not persisting after page refresh ([808ed1d](https://github.com/the-luap/picpeak/commit/808ed1d2f1164d9fd1114586c68a1f925bf73ddf)), closes [#117](https://github.com/the-luap/picpeak/issues/117) +* **cms:** apply dark mode to CMS editor, public CMS, and admin modals ([d2a10f6](https://github.com/the-luap/picpeak/commit/d2a10f6523655488267d6f68835d7adb46dcf962)) +* **cms:** nl/pt/ru i18n + gate external_url in public response ([08d0462](https://github.com/the-luap/picpeak/commit/08d046276bf259e8511b01415141f51b8484f967)) +* **cms:** nl/pt/ru i18n + gate external_url in public response ([bce5c1f](https://github.com/the-luap/picpeak/commit/bce5c1f725043965c2499515f18e93e9578bd204)) +* correct invitation activation validation and add missing translations ([991aa98](https://github.com/the-luap/picpeak/commit/991aa98f98cffd1d7785c272726615325e2c0208)), closes [#129](https://github.com/the-luap/picpeak/issues/129) +* correct invitation email link URL path ([86fa104](https://github.com/the-luap/picpeak/commit/86fa1046d5439cb451feb164175c919c49ca219a)), closes [#129](https://github.com/the-luap/picpeak/issues/129) +* correct storage path resolution in multiple files ([#96](https://github.com/the-luap/picpeak/issues/96)) ([0e3674b](https://github.com/the-luap/picpeak/commit/0e3674b2b0325bbcee5aa2c9ff7781da92f612d1)) +* correct storage path resolution in multiple files ([#96](https://github.com/the-luap/picpeak/issues/96)) ([3ccb815](https://github.com/the-luap/picpeak/commit/3ccb8154eb40a432aa467fb06b3f216fd0d2c6b4)) +* database migration restart bug, lightbox loading spinner, and watermark cache invalidation ([7c58749](https://github.com/the-luap/picpeak/commit/7c5874980640ae8c3d1050ce24daeb0a2aeab7a3)) +* dedupe parallel admin 401 redirects to /admin/login ([038e84c](https://github.com/the-luap/picpeak/commit/038e84cae7f56a0a1af8c71b85881ca5d320c6e3)) +* discussion [#317](https://github.com/the-luap/picpeak/issues/317) issues and [#318](https://github.com/the-luap/picpeak/issues/318) archive crash ([2f2f405](https://github.com/the-luap/picpeak/commit/2f2f405d9bc2831b3bbe2ca7fbf726d61382dc38)) +* display welcome message in gallery and fix guest thumbnail URLs ([#306](https://github.com/the-luap/picpeak/issues/306), [#307](https://github.com/the-luap/picpeak/issues/307)) ([b05c36a](https://github.com/the-luap/picpeak/commit/b05c36ac810a557a2ac088ab7bec39bb76f9a2ae)) +* display welcome message in gallery and fix guest thumbnail URLs ([#306](https://github.com/the-luap/picpeak/issues/306), [#307](https://github.com/the-luap/picpeak/issues/307)) ([9323bef](https://github.com/the-luap/picpeak/commit/9323befdd99d64b85cca89af24ac1b7034d72eee)) +* docker compose v2 syntax and add missing ADMIN_PASSWORD to .env.example ([#189](https://github.com/the-luap/picpeak/issues/189)) ([0817443](https://github.com/the-luap/picpeak/commit/0817443e793e37c770c6a1968ecae4b9464107b0)) +* **docker:** install system ffmpeg on Alpine, drop broken bundled binary ([3ab8a64](https://github.com/the-luap/picpeak/commit/3ab8a64a24f1600e674f77d39139e33857b4dfc8)) +* **docker:** install system ffmpeg on Alpine, drop broken bundled binary ([96818c7](https://github.com/the-luap/picpeak/commit/96818c7ae8de0d8fd478cd901ea25a3272eee85d)) +* dynamic website title from branding settings ([4701edc](https://github.com/the-luap/picpeak/commit/4701edc12ecfab27cb2d1cfb0b4ed4fd53f56cc6)) +* **email:** render conditionals, localise password placeholders, fix caller/template variable drift ([0767203](https://github.com/the-luap/picpeak/commit/07672038d4ac31fc601adfb2338104223856ba71)) +* **email:** render conditionals, localise password placeholders, fix caller/template variable drift ([e8052ad](https://github.com/the-luap/picpeak/commit/e8052adf1d2f1717652ac5d6b8cd8bcc01787189)) +* event-specific custom CSS settings not being saved ([dadef81](https://github.com/the-luap/picpeak/commit/dadef81158972d28aa32812203500f77ed08a999)), closes [#136](https://github.com/the-luap/picpeak/issues/136) +* events search/counters ([#346](https://github.com/the-luap/picpeak/issues/346)), lazy gallery skeleton ([#321](https://github.com/the-luap/picpeak/issues/321)), smooth lightbox swipe ([#348](https://github.com/the-luap/picpeak/issues/348)) ([6229b38](https://github.com/the-luap/picpeak/commit/6229b38bac90cc0c538a72688efae3be77a3bb08)) +* events without expiration date incorrectly shown as expired ([c4f16eb](https://github.com/the-luap/picpeak/commit/c4f16eb76c909158abdb63aa4cc22f817f274dc5)) +* **events:** admin-set password on reset, full-URL gallery_link in all emails ([0d1f82d](https://github.com/the-luap/picpeak/commit/0d1f82d31a2f9e30bf193496ac203eaf8dfd856b)) +* **events:** admin-set password on reset, full-URL gallery_link in all emails ([ff50c74](https://github.com/the-luap/picpeak/commit/ff50c74e1912ccba60f7ccdbead92b76de91388b)) +* **events:** coerce expires_in_days to Number before addDays ([e5712d8](https://github.com/the-luap/picpeak/commit/e5712d8ffe2f0ed980e1df5e1263876af7202b76)) +* **events:** coerce expires_in_days to Number before addDays ([db29d0e](https://github.com/the-luap/picpeak/commit/db29d0e2788f63cc9eb0a43ec58313387acb0c0d)) +* **events:** match scrollbar to theme in external folder tree picker ([bd42ee1](https://github.com/the-luap/picpeak/commit/bd42ee1ce03b8f6e7b011b53f2c71453be931cc6)) +* **events:** server-side search/pagination to remove first-100 cap ([#346](https://github.com/the-luap/picpeak/issues/346)) ([a5b20ca](https://github.com/the-luap/picpeak/commit/a5b20ca3fe77df665d4a9744413d7ee4054858f0)) +* **events:** show customer phone in event details view ([#331](https://github.com/the-luap/picpeak/issues/331)) ([4c73d22](https://github.com/the-luap/picpeak/commit/4c73d228ed98b8ec05bec2824aee7ce066a184e1)) +* **events:** stop mapping branding_logo_position onto hero_logo_position ([af2b062](https://github.com/the-luap/picpeak/commit/af2b0628cb4f79a147366665d35c098012071216)) +* **events:** stop mapping branding_logo_position onto hero_logo_position ([ef1c875](https://github.com/the-luap/picpeak/commit/ef1c875f6ec1e02657006cb09cd0b1d868ec2fc0)) +* external media dimensions, theme race condition, email color customization ([dfae2c2](https://github.com/the-luap/picpeak/commit/dfae2c2bc6d86378c553cd847b439f7cb53a4f2a)) +* floor password_changed_at when comparing against JWT iat ([793e410](https://github.com/the-luap/picpeak/commit/793e410554b461522fbe24014dfd3baa915da2bb)) +* **fonts:** drop immutable Cache-Control to allow font replacement rollout ([5703fcb](https://github.com/the-luap/picpeak/commit/5703fcb80680155e3b637dd5fc15c430de963c40)) +* **gallery:** default controls to inline for every layout ([045e9ea](https://github.com/the-luap/picpeak/commit/045e9ea4861f33e3e82e31f978ac297c7f7824f6)) +* **gallery:** lazy-render skeleton grid for fast loads ([#321](https://github.com/the-luap/picpeak/issues/321) follow-up) ([d9d8137](https://github.com/the-luap/picpeak/commit/d9d81372b80f7d44dca54b7993f52c36574048c9)) +* **gallery:** preserve sidebar controlsStyle on banner migration ([05dadff](https://github.com/the-luap/picpeak/commit/05dadff4934ad9b055de8875846c2a7175e16f86)) +* **gallery:** single-finger swipe nav in mobile lightbox ([#332](https://github.com/the-luap/picpeak/issues/332)) ([4c8eba0](https://github.com/the-luap/picpeak/commit/4c8eba0cb43635d92a53d90c58b19007136c1c12)) +* **gallery:** use ref for swipe-start to avoid stale-closure miss ([#332](https://github.com/the-luap/picpeak/issues/332)) ([fcddfe0](https://github.com/the-luap/picpeak/commit/fcddfe094b2a01963f7b420afa886e7d5dae4390)) +* **gallery:** WCAG-safe Download button text + extract HeaderDownloadButton ([#401](https://github.com/the-luap/picpeak/issues/401) follow-ups) ([04e928d](https://github.com/the-luap/picpeak/commit/04e928d7621743d9d99797f0996f8c7aa50e7b2d)) +* **gallery:** WCAG-safe Download button text + extract HeaderDownloadButton ([#401](https://github.com/the-luap/picpeak/issues/401) follow-ups) ([0c80abd](https://github.com/the-luap/picpeak/commit/0c80abd57b806b9df01429a093c30c12c80c0601)) +* guest feedback flow bugs in Masonry grid and PhotoLightbox ([#292](https://github.com/the-luap/picpeak/issues/292)) ([54badef](https://github.com/the-luap/picpeak/commit/54badefc51b834d55530722f87c81a6ade33e35b)) +* guest feedback flow bugs in Masonry grid and PhotoLightbox ([#292](https://github.com/the-luap/picpeak/issues/292)) ([77f07e9](https://github.com/the-luap/picpeak/commit/77f07e9329e47f6ac5040f2e85d2710ebbea3ced)) +* handle null dates in dashboard and gallery pages ([c5a8ffc](https://github.com/the-luap/picpeak/commit/c5a8ffc08cd4c53c37fe4fb9cde8519a68f1f343)) +* hero header state and preview in admin theme editor ([#158](https://github.com/the-luap/picpeak/issues/158)) ([f554f46](https://github.com/the-luap/picpeak/commit/f554f463b3492346dba067c0980b52ef42dd5e70)) +* improve ghost button visibility in admin dark mode ([4912e2b](https://github.com/the-luap/picpeak/commit/4912e2bccf282134d5598a8ac80942ed46d0523c)) +* improve password validation errors and event list UX ([#170](https://github.com/the-luap/picpeak/issues/170), [#171](https://github.com/the-luap/picpeak/issues/171)) ([171abb3](https://github.com/the-luap/picpeak/commit/171abb31615484d77cf95a99cb5634afa0160adc)) +* improve photo serving, category filters, and upload chunking ([#155](https://github.com/the-luap/picpeak/issues/155), [#156](https://github.com/the-luap/picpeak/issues/156), [#161](https://github.com/the-luap/picpeak/issues/161)) ([fa4c838](https://github.com/the-luap/picpeak/commit/fa4c83812d87cfa63394e51186e320a072929d37)) +* increase upload limit to 1GB and fix category filters ([#155](https://github.com/the-luap/picpeak/issues/155), [#156](https://github.com/the-luap/picpeak/issues/156)) ([397d33a](https://github.com/the-luap/picpeak/commit/397d33a95a09e0b0986c3f6cf5965c544992a764)) +* issue [#203](https://github.com/the-luap/picpeak/issues/203) file type validation + security CVE fixes ([8017171](https://github.com/the-luap/picpeak/commit/80171713e0ffedda56f7cffb403b25a8d55634d1)) +* **lightbox:** mobile toolbar clipping + iOS safe-area + viewport-fit ([#336](https://github.com/the-luap/picpeak/issues/336)) ([42a7ae4](https://github.com/the-luap/picpeak/commit/42a7ae4be8fe7b12104ae036465c9c4117606378)) +* **lightbox:** smooth carousel swipe + drop instructional hint ([#348](https://github.com/the-luap/picpeak/issues/348)) ([743086d](https://github.com/the-luap/picpeak/commit/743086d3cb9100fb163bc9d04d968e5b611a1f99)) +* mobile lightbox + share previews + customer phone bug triage ([1e40677](https://github.com/the-luap/picpeak/commit/1e4067713ce9a808a7b49319bc262e5c9a6599c6)) +* mobile upload button not visible in gallery ([#113](https://github.com/the-luap/picpeak/issues/113)) ([cacaffa](https://github.com/the-luap/picpeak/commit/cacaffa5c39f67105c4cfb092ea62157121fb72e)) +* mobile upload button visibility in gallery ([2a2c23d](https://github.com/the-luap/picpeak/commit/2a2c23d11610e6c81684163eb4ea934a6d6104fb)), closes [#113](https://github.com/the-luap/picpeak/issues/113) +* mobile upload button visibility in gallery ([df7dbff](https://github.com/the-luap/picpeak/commit/df7dbffbffb180e62af0d2b58326f9de0f515439)), closes [#113](https://github.com/the-luap/picpeak/issues/113) +* mobile upload button visibility in gallery ([#113](https://github.com/the-luap/picpeak/issues/113)) ([05a5307](https://github.com/the-luap/picpeak/commit/05a5307e22dc45be4b75b2996ff9fac65dec399d)) +* mobile upload button visibility in gallery ([#113](https://github.com/the-luap/picpeak/issues/113)) ([6cb4342](https://github.com/the-luap/picpeak/commit/6cb43428d1e703267edeacda9ede050a8c4f8e0c)) +* **nginx:** proxy /fonts requests to backend ([e6c03e4](https://github.com/the-luap/picpeak/commit/e6c03e4b6e4ee2ccc3e3cd8b7a54c18f9685c2ba)) +* pin npm to v10 in backend Dockerfile ([ddefd3a](https://github.com/the-luap/picpeak/commit/ddefd3a95e5047d4a22aa4b6fef57dfb1c880967)) +* pin npm upgrade to v10 in backend Dockerfile ([978e447](https://github.com/the-luap/picpeak/commit/978e4473b5227ee61ad7d17487063eb3284bea36)) +* prevent backend crash on archive when admin_email is null ([#318](https://github.com/the-luap/picpeak/issues/318)) ([e4b0f96](https://github.com/the-luap/picpeak/commit/e4b0f961b75952b6907cc2291fa256215c09c80c)) +* prevent database migration restart failures ([83a4344](https://github.com/the-luap/picpeak/commit/83a4344a01de4f65c5024fdf2d177a04457ccd2f)), closes [#107](https://github.com/the-luap/picpeak/issues/107) +* remove non-functional watermark toggle from Feature Toggles ([d4a15db](https://github.com/the-luap/picpeak/commit/d4a15dbe74d0d70bbe6ff03362dc7337fb8f4c5c)) +* render minimal/none header styles, cap hero height, switch category hero images ([#158](https://github.com/the-luap/picpeak/issues/158), [#162](https://github.com/the-luap/picpeak/issues/162), [#163](https://github.com/the-luap/picpeak/issues/163)) ([bc6c48b](https://github.com/the-luap/picpeak/commit/bc6c48bb2429505c2de3641693a8ff4f623a4951)) +* resend gallery email fails for events without password ([6b3ead7](https://github.com/the-luap/picpeak/commit/6b3ead747b1395d8ea2b3d135a5ac24db05e2eb8)), closes [#137](https://github.com/the-luap/picpeak/issues/137) +* resolve admin invitation flow issues and improve STORAGE_PATH documentation ([41bf6ff](https://github.com/the-luap/picpeak/commit/41bf6ff884d5ef3181f95f3aa4a528434c23947a)) +* resolve code quality issues and add missing i18n keys ([#162](https://github.com/the-luap/picpeak/issues/162), [#163](https://github.com/the-luap/picpeak/issues/163)) ([329d224](https://github.com/the-luap/picpeak/commit/329d224846d3f4eefa31e42337f34047c267d578)) +* resolve code scanning security alerts (multer, tar, Node 22) ([85a07fc](https://github.com/the-luap/picpeak/commit/85a07fcca7ad935f4c0c300f5ffe2f3af8da1e5f)) +* resolve external media dimensions, gallery theme race condition, and add email color customization ([bbeedd1](https://github.com/the-luap/picpeak/commit/bbeedd1888561b6c57586b5f42bbfee3ffc69fd7)) +* resolve issues [#194](https://github.com/the-luap/picpeak/issues/194), [#195](https://github.com/the-luap/picpeak/issues/195), [#196](https://github.com/the-luap/picpeak/issues/196), [#197](https://github.com/the-luap/picpeak/issues/197) ([33af088](https://github.com/the-luap/picpeak/commit/33af0885607799e0071e2e74a582c7eb396c9b83)) +* resolve issues [#194](https://github.com/the-luap/picpeak/issues/194), [#195](https://github.com/the-luap/picpeak/issues/195), [#196](https://github.com/the-luap/picpeak/issues/196), [#197](https://github.com/the-luap/picpeak/issues/197) ([5ea4ef3](https://github.com/the-luap/picpeak/commit/5ea4ef3cf36b06f9e6c9108f80bfe2e9a6470898)) +* resolve issues [#194](https://github.com/the-luap/picpeak/issues/194), [#195](https://github.com/the-luap/picpeak/issues/195), [#196](https://github.com/the-luap/picpeak/issues/196), [#197](https://github.com/the-luap/picpeak/issues/197) ([33483cf](https://github.com/the-luap/picpeak/commit/33483cf32dfae57f8da51c0765353792239135f9)) +* resolve issues [#194](https://github.com/the-luap/picpeak/issues/194), [#195](https://github.com/the-luap/picpeak/issues/195), [#196](https://github.com/the-luap/picpeak/issues/196), [#197](https://github.com/the-luap/picpeak/issues/197) ([cd00bc1](https://github.com/the-luap/picpeak/commit/cd00bc13d4e02a86a0f1742ed1f11f064614b8da)) +* resolve JWT iat timing issue in password change ([#263](https://github.com/the-luap/picpeak/issues/263)) ([c031b1e](https://github.com/the-luap/picpeak/commit/c031b1e86333d90e8e0e0aa723572efa110f7fd1)) +* resolve mixed light/dark mode styling in admin UI ([#175](https://github.com/the-luap/picpeak/issues/175)) ([f8c8abd](https://github.com/the-luap/picpeak/commit/f8c8abd70bbae35d6cd519894624ade33b5115a8)) +* resolve password change redirect loop ([#263](https://github.com/the-luap/picpeak/issues/263)) and file watcher crash ([#269](https://github.com/the-luap/picpeak/issues/269)) ([b23c51b](https://github.com/the-luap/picpeak/commit/b23c51b386270dee4d911902b728dfacb1ff1bf9)) +* resolve password change redirect loop and file watcher crash ([835bdf5](https://github.com/the-luap/picpeak/commit/835bdf5abb40c7b143c5cdafb507c317a7c349bf)), closes [#269](https://github.com/the-luap/picpeak/issues/269) +* resolve redirect loop after mandatory password change ([#263](https://github.com/the-luap/picpeak/issues/263)) ([07fc5e6](https://github.com/the-luap/picpeak/commit/07fc5e6519cd84f2214479d5f31bc35a495bfe4b)) +* resolve redirect loop after mandatory password change ([#263](https://github.com/the-luap/picpeak/issues/263)) ([3c8d344](https://github.com/the-luap/picpeak/commit/3c8d344ddd23974c9cf0f5f63edd6cd07817fee9)) +* respect allowed_file_types setting for upload validation ([#203](https://github.com/the-luap/picpeak/issues/203)) ([fe07a14](https://github.com/the-luap/picpeak/commit/fe07a148f1d998c0be00377c1f8b4eca3908305c)) +* respect optional email settings in event creation ([831ea6a](https://github.com/the-luap/picpeak/commit/831ea6a3bccfae4ec00ce1f619967b91b85150ce)) +* respect optional email settings in event creation ([#217](https://github.com/the-luap/picpeak/issues/217)) ([9c44a0e](https://github.com/the-luap/picpeak/commit/9c44a0ebfa527fa133512eb7f2f03335a2377aaa)) +* restore aspect-ratio layouts and improve hero image quality ([#180](https://github.com/the-luap/picpeak/issues/180)) ([3974ba5](https://github.com/the-luap/picpeak/commit/3974ba5de5a6605ad906608d3e4d61620a215059)) +* restore aspect-ratio layouts and improve hero image quality ([#180](https://github.com/the-luap/picpeak/issues/180)) ([5cef7fd](https://github.com/the-luap/picpeak/commit/5cef7fdd188389512bc4b55ae61536c8b1219eb8)) +* revert /api prefix in adminPhotos.js to avoid double-prefix ([094276d](https://github.com/the-luap/picpeak/commit/094276d3cc7117eee30e4bcbce487e54f0eacb29)) +* revert /api prefix in adminPhotos.js to avoid double-prefix ([#307](https://github.com/the-luap/picpeak/issues/307)) ([ceb2a09](https://github.com/the-luap/picpeak/commit/ceb2a09f483b4754fda232c5c1f7acb8971aac10)) +* **security:** invalidate tokens on password change, enforce session timeout, fix role update ([85a60a2](https://github.com/the-luap/picpeak/commit/85a60a2dc7526aa6b673e2a04e9fdfba7de7117f)) +* **security:** invalidate tokens on password change, enforce session timeout, fix role update ([f362239](https://github.com/the-luap/picpeak/commit/f3622396e77ce5d0b0741e439fc554a1dccaca50)) +* **security:** resolve all npm audit vulnerabilities ([4272618](https://github.com/the-luap/picpeak/commit/4272618b3f7fcb06aaca14fb724a6a7733251f24)) +* **security:** resolve Docker image CVEs for code scanning alerts ([cbecb93](https://github.com/the-luap/picpeak/commit/cbecb9323cf4b80c800326de14f6df73f60147c1)) +* **security:** token invalidation on password change, session timeout enforcement ([0a3a537](https://github.com/the-luap/picpeak/commit/0a3a53763c9f3caef9fdceccf9fdbfdefe9bd8bf)) +* **security:** token invalidation on password change, session timeout enforcement ([7ca9631](https://github.com/the-luap/picpeak/commit/7ca96315e254eef58d8ecc505f95a5186d2fa2da)) +* set JWT iat after password_changed_at to prevent token rejection ([#263](https://github.com/the-luap/picpeak/issues/263)) ([b1d1667](https://github.com/the-luap/picpeak/commit/b1d16670d56e19f7b35e7f2f12f3611fdb3fab58)) +* **share:** OG/Twitter-card metadata for gallery share URLs ([#333](https://github.com/the-luap/picpeak/issues/333)) ([5275621](https://github.com/the-luap/picpeak/commit/5275621fcd38f1ec09b54595163ecd5e63614b1a)) +* shorten Save button label on email template editor ([7250c42](https://github.com/the-luap/picpeak/commit/7250c427b905ffa3e8696dff607450f5a0b801b8)) +* show upload button in mobile topbar instead of sidebar ([ae181cf](https://github.com/the-luap/picpeak/commit/ae181cf92fc9c1e85cad7a7b843a4d83cec636ac)), closes [#113](https://github.com/the-luap/picpeak/issues/113) +* sync backend package-lock.json for security deps ([bb81fa5](https://github.com/the-luap/picpeak/commit/bb81fa5f4b5f1bd927a02470ce80a13c4f53443f)) +* sync backend package-lock.json with security dep updates ([03e1989](https://github.com/the-luap/picpeak/commit/03e19893b3532a27aa59e7b834d53c6a2b52b7cd)) +* sync header_style DB column with theme editor selections ([#158](https://github.com/the-luap/picpeak/issues/158)) ([2288309](https://github.com/the-luap/picpeak/commit/228830939553fd32c250704bb89a8ce233324d25)) +* sync header_style DB column with theme editor selections ([#158](https://github.com/the-luap/picpeak/issues/158)) ([a19e7c4](https://github.com/the-luap/picpeak/commit/a19e7c40a200ff822c947a83349ed07ccf4e1b01)) +* theme picker buttons no longer submit the parent form ([#326](https://github.com/the-luap/picpeak/issues/326)) ([2eead52](https://github.com/the-luap/picpeak/commit/2eead523193ccb7f23eb767097ad9698e8312833)) +* theme save without Live Preview, Branding default on new events, gallery loading flicker ([#323](https://github.com/the-luap/picpeak/issues/323), [#321](https://github.com/the-luap/picpeak/issues/321)) ([822be9a](https://github.com/the-luap/picpeak/commit/822be9a9b2716f1832a4cb6fccd53602e3cbab51)) +* theme-preset match loop ignores extra fields like logoUrl ([#323](https://github.com/the-luap/picpeak/issues/323)) ([b63a877](https://github.com/the-luap/picpeak/commit/b63a8774c4b44733b903736b2ca5a472a884055e)) +* **theme:** centralise force-mode enforcement inside ThemeContext so every gallery flips ([21188f4](https://github.com/the-luap/picpeak/commit/21188f48d76dd29bc1251bcc6faf9d6d96c805b5)) +* **theme:** kill initial white frame + theme-aware skeleton tiles ([#358](https://github.com/the-luap/picpeak/issues/358) follow-up) ([f529c9e](https://github.com/the-luap/picpeak/commit/f529c9e3d72f0e3496951dfa5d160afda9a1ac51)) +* **theme:** kill initial white frame + theme-aware skeleton tiles ([#358](https://github.com/the-luap/picpeak/issues/358) follow-up) ([1a530ae](https://github.com/the-luap/picpeak/commit/1a530aeaa2d61b34d9721a555b71631c7101c58e)) +* **theme:** pre-React bootstrap to kill white-flash on dark galleries ([#358](https://github.com/the-luap/picpeak/issues/358)) ([07b41e6](https://github.com/the-luap/picpeak/commit/07b41e691d2e8a71f775c667d805a2f9adc10590)) +* **theme:** pre-React bootstrap to kill white-flash on dark galleries ([#358](https://github.com/the-luap/picpeak/issues/358)) ([f81a872](https://github.com/the-luap/picpeak/commit/f81a8728e67b313ac43f55c94fb635abf9beca05)) +* update dependencies to resolve code scanning security alerts ([1f524f2](https://github.com/the-luap/picpeak/commit/1f524f23580d2e2a21dbba28cb46aed76e85c475)) +* update docker-compose to docker compose and add ADMIN_PASSWORD to .env.example ([#189](https://github.com/the-luap/picpeak/issues/189)) ([a4c6248](https://github.com/the-luap/picpeak/commit/a4c624802b2926a16adcf0472a3041562f9b2f48)) +* update packages to fix security vulnerabilities ([8097a0c](https://github.com/the-luap/picpeak/commit/8097a0cb530bd8003597cde81606231efadb0bf5)) +* update security policy with private reporting channels ([308e086](https://github.com/the-luap/picpeak/commit/308e08626383bab213ce3eb5563608dff6168ef4)) +* update security policy with private reporting channels ([7f77362](https://github.com/the-luap/picpeak/commit/7f7736282f534adf4b9d5331d841a1f0bff7341c)) +* update security policy with proper contact email and private reporting ([67b0f32](https://github.com/the-luap/picpeak/commit/67b0f32456d0216e4c685a104c680fa5a5fd578f)), closes [#223](https://github.com/the-luap/picpeak/issues/223) +* use actual photo aspect ratios in masonry columns mode ([#146](https://github.com/the-luap/picpeak/issues/146)) ([8711f96](https://github.com/the-luap/picpeak/commit/8711f967a15f5d57f6ad01bfdbd8d33f9ee96abc)) +* use CSS Columns for gap-free mosaic layout ([#146](https://github.com/the-luap/picpeak/issues/146)) ([821d329](https://github.com/the-luap/picpeak/commit/821d3296ea4b6bde499e5497d258f15ab8dd1dbc)) +* use photo dimensions for mosaic aspect ratios ([#146](https://github.com/the-luap/picpeak/issues/146)) ([27ff51e](https://github.com/the-luap/picpeak/commit/27ff51e7a1217848859b47940bc88caa6f1fb20f)) +* video upload media type, select all, and dimension repair ([#203](https://github.com/the-luap/picpeak/issues/203), [#220](https://github.com/the-luap/picpeak/issues/220), [#180](https://github.com/the-luap/picpeak/issues/180)) ([fc75bcd](https://github.com/the-luap/picpeak/commit/fc75bcdfc38673d6e4dd1cd943cfb4638d3a306c)) +* video upload, select all, and dimension repair ([#203](https://github.com/the-luap/picpeak/issues/203), [#220](https://github.com/the-luap/picpeak/issues/220), [#180](https://github.com/the-luap/picpeak/issues/180)) ([a0bb080](https://github.com/the-luap/picpeak/commit/a0bb0805868e742f323b64312c3c5ef8ec408f68)) +* wire admin photo feedback filters into grid query ([#293](https://github.com/the-luap/picpeak/issues/293)) ([d4b4dc6](https://github.com/the-luap/picpeak/commit/d4b4dc628f28a303ff1c80ba6d8e5e768217ba51)) +* wrap email preview with full styled header/footer template ([9a6d2e8](https://github.com/the-luap/picpeak/commit/9a6d2e8e3a3fab8d7969a8a42e94934c38d88392)) +* wrap email preview with full styled header/footer template ([fc0911a](https://github.com/the-luap/picpeak/commit/fc0911acf8b7c8a18d71bb4267f1086acd1e0ca1)), closes [#229](https://github.com/the-luap/picpeak/issues/229) +* wrap test email with standard email template ([#252](https://github.com/the-luap/picpeak/issues/252)) ([954a011](https://github.com/the-luap/picpeak/commit/954a0118bae5770c74f1e811e03b8fc702c70db2)) + + +### Reverts + +* **branding:** per-option font preview (defer to follow-up) ([f410207](https://github.com/the-luap/picpeak/commit/f410207b2d7ddf1c9525603c7dcbb7cdfee1729b)) + + +### Documentation + +* add API_URL environment variable to .env.example files ([3e69579](https://github.com/the-luap/picpeak/commit/3e69579f5a171b31a253b2a42bb033bf1b97387d)) +* add Buy Me a Coffee badge + Support section ([46bc894](https://github.com/the-luap/picpeak/commit/46bc894d917bd55dbd9bafaa64fd38db21488b81)) +* add External Media Library section to deployment guide ([#270](https://github.com/the-luap/picpeak/issues/270)) ([2e1c71c](https://github.com/the-luap/picpeak/commit/2e1c71c1ab073e488ac93e35337a2d3955dfef3d)) +* add External Media Library section to deployment guide ([#270](https://github.com/the-luap/picpeak/issues/270)) ([f6ca713](https://github.com/the-luap/picpeak/commit/f6ca713a6edc8ba371db790daba05ecb85ea4872)) +* clarify file system photo import requires existing event ([#269](https://github.com/the-luap/picpeak/issues/269)) ([5295516](https://github.com/the-luap/picpeak/commit/5295516b67a1d9f035564c5f9a724f25f8d21c78)) +* clarify file system photo import requires existing event ([#269](https://github.com/the-luap/picpeak/issues/269)) ([ee0baaf](https://github.com/the-luap/picpeak/commit/ee0baafc59f3588a26172aa8835c12dcaec35d10)) +* emphasize importance of STORAGE_PATH in env example ([3397807](https://github.com/the-luap/picpeak/commit/3397807670784e02cbe34a7a60db43c95d64f19c)) +* **fonts:** cache rollout, stale-list note, meta.json ([bd0e052](https://github.com/the-luap/picpeak/commit/bd0e052b1a1847718151a16117dacc6c42a2178e)) +* move documentation to docs.picpeak.app, drop in-repo copies ([02ed5d4](https://github.com/the-luap/picpeak/commit/02ed5d400736f966283a138dedde2455448067ff)) +* move documentation to docs.picpeak.app, drop in-repo copies ([0faf9b3](https://github.com/the-luap/picpeak/commit/0faf9b32816f5f94aa584d2336cdb1e0b7082239)) +* **readme:** add Contributors section with @Luca-Timo and @Rekoo-PS ([c60ab74](https://github.com/the-luap/picpeak/commit/c60ab74ae2daabc4b11fea1f1b2df728294b03c8)) +* **readme:** add Contributors section with @Luca-Timo and @Rekoo-PS ([dbe0a30](https://github.com/the-luap/picpeak/commit/dbe0a3055bd2c71981cb7d9cf43c2b22b9e3276c)) +* rewrite README โ€” shorter, cleaner ([62643f2](https://github.com/the-luap/picpeak/commit/62643f241b51dc1620e30a8c8767f52428c0314c)) +* rewrite README โ€” shorter, cleaner, less AI-sounding ([64f6061](https://github.com/the-luap/picpeak/commit/64f606152fde2db9034fa9ffa08cc58623edf646)) + ## [3.42.1](https://github.com/the-luap/picpeak/compare/v2.6.5...v3.42.1) (2026-05-07) Stable release promoting the entire `beta` channel to `main`. Brings ~300 commits of features, fixes, and infrastructure improvements that have been baked on the beta channel since v2.6.5. Highlights below; full per-version notes follow in the beta history. diff --git a/backend/package.json b/backend/package.json index f64bcf2c..be52caf2 100644 --- a/backend/package.json +++ b/backend/package.json @@ -1,6 +1,6 @@ { "name": "picpeak-backend", - "version": "3.42.1", + "version": "3.43.0", "description": "Backend for PicPeak event photo sharing platform", "main": "server.js", "scripts": { diff --git a/frontend/package.json b/frontend/package.json index 96ccad3b..9db351a6 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -1,7 +1,7 @@ { "name": "picpeak-frontend", "private": true, - "version": "3.42.1", + "version": "3.43.0", "type": "module", "scripts": { "dev": "vite", From 37bf894412b4da0f0507dd8f1384e6f101ce14b2 Mon Sep 17 00:00:00 2001 From: Paul Nothaft Date: Thu, 7 May 2026 13:51:55 +0200 Subject: [PATCH 12/13] fix(security): patch 18 dependency CVEs (axios + transitives + nodemailer + i18next-http-backend) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes the open Trivy code-scanning alerts for app-side dependencies. The npm-bundled CVEs in /usr/local/lib/node_modules/npm (picomatch, brace-expansion, ip-address inside the Node image itself) are deferred to a separate Node-base-image PR โ€” they're build-environment-side and need their own compatibility testing. | Package | From | To | CVEs cleared | |---|---|---|---| | axios (backend + frontend) | 1.14.0 | 1.15.2 | CVE-2026-42264 (HIGH), CVE-2026-42043 (HIGH), CVE-2026-42035 (HIGH), CVE-2026-42033 (HIGH), CVE-2026-42044, CVE-2026-42042, CVE-2026-42041, CVE-2026-42040, CVE-2026-42039, CVE-2026-42038, CVE-2026-42037, CVE-2026-42036, CVE-2026-42034, CVE-2026-40175, CVE-2025-62718 | | nodemailer (backend) | ^7.0.13 | ^8.0.5 | GHSA-vvjj-xcjg-gr5g, GHSA-c7w3-x93f-qmm8 | | i18next-http-backend (frontend) | ^3.0.2 | ^3.0.5 | CVE-2026-41691 | | uuid (backend) | ^11.1.0 | ^11.1.1 | CVE-2026-41907 | | postcss (frontend, devDep) | ^8.4.21 | ^8.5.10 | CVE-2026-41305 | For transitives whose direct parents haven't released a version that picks up the patched range, pinned via npm overrides: | Package | Min | CVE | |---|---|---| | follow-redirects (backend + frontend) | >=1.16.0 | GHSA-r4q5-vmmm-2653 | | fast-xml-parser (backend) | >=5.7.0 | CVE-2026-41650 | | @tootallnate/once (backend) | >=3.0.1 | CVE-2026-3449 | | ip-address (backend) | >=10.1.1 | CVE-2026-42338 | PR #268 originally pinned axios to 1.14.0 to avoid a supply-chain attack on a specific compromised version range. The 1.15.x series are post-incident upstream releases โ€” clean. Confirmed with the maintainer before bumping. * `npx tsc --noEmit` (frontend) โ€” clean * `npx vite build` (frontend) โ€” clean (~4s, existing bundle-size warning, not new) * Backend module-load smoke test โ€” all critical modules load (`auth`, `adminAuth` middleware, `emailProcessor`, `recaptcha`, `storage`) with the new axios + nodemailer * Lockfile re-verification โ€” every targeted CVE now resolves to the patched version range * npm-bundled CVEs inside `/usr/local/lib/node_modules/npm/` โ€” picomatch CVE-2026-33671 (HIGH), CVE-2026-33672, brace-expansion CVE-2026-33750, ip-address (npm-internal) CVE-2026-42338. These live in the Node base image and require a Node base image bump with its own compatibility testing โ€” separate PR. Targeting `beta` so the bumps go through the normal release-please flow before promotion to `main`. --- backend/package-lock.json | 85 ++++++++++++++++++++++---------------- backend/package.json | 13 +++--- frontend/package-lock.json | 44 ++++++++++---------- frontend/package.json | 9 ++-- 4 files changed, 84 insertions(+), 67 deletions(-) diff --git a/backend/package-lock.json b/backend/package-lock.json index 8b15dc83..852786e6 100644 --- a/backend/package-lock.json +++ b/backend/package-lock.json @@ -1,19 +1,19 @@ { "name": "picpeak-backend", - "version": "3.42.1", + "version": "3.43.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "picpeak-backend", - "version": "3.42.1", + "version": "3.43.0", "dependencies": { "@aws-sdk/client-s3": "^3.850.0", "@aws-sdk/lib-storage": "^3.850.0", "@aws-sdk/s3-request-presigner": "^3.850.0", "adm-zip": "^0.5.16", "archiver": "^5.3.1", - "axios": "1.14.0", + "axios": "1.15.2", "bcrypt": "6.0.0", "chokidar": "4.0.3", "cookie-parser": "^1.4.7", @@ -38,7 +38,7 @@ "mime-types": "^3.0.1", "multer": "^2.0.2", "node-cron": "^3.0.2", - "nodemailer": "^7.0.13", + "nodemailer": "^8.0.5", "pg": "^8.16.3", "react-i18next": "^15.6.0", "sanitize-html": "^2.17.0", @@ -46,7 +46,7 @@ "sqlite3": "^5.1.6", "swagger-jsdoc": "^6.2.8", "swagger-ui-express": "^5.0.1", - "uuid": "^11.1.0", + "uuid": "^11.1.1", "winston": "^3.8.2", "zxcvbn": "^4.4.2" }, @@ -2594,6 +2594,18 @@ "url": "https://paulmillr.com/funding/" } }, + "node_modules/@nodable/entities": { + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/@nodable/entities/-/entities-2.1.0.tgz", + "integrity": "sha512-nyT7T3nbMyBI/lvr6L5TyWbFJAI9FTgVRakNoBqCD+PmID8DzFrrNdLLtHMwMszOtqZa8PAOV24ZqDnQrhQINA==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/nodable" + } + ], + "license": "MIT" + }, "node_modules/@nodelib/fs.scandir": { "version": "2.1.5", "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz", @@ -3538,13 +3550,13 @@ } }, "node_modules/@tootallnate/once": { - "version": "1.1.2", - "resolved": "https://registry.npmjs.org/@tootallnate/once/-/once-1.1.2.tgz", - "integrity": "sha512-RbzJvlNzmRq5c3O09UipeuXno4tA1FE6ikOjxZK0tuxVv3412l64l5t1W5pj4+rJq9vpkm/kwiR07aZXnsKPxw==", + "version": "3.0.1", + "resolved": "https://registry.npmjs.org/@tootallnate/once/-/once-3.0.1.tgz", + "integrity": "sha512-VyMVKRrpHTT8PnotUeV8L/mDaMwD5DaAKCFLP73zAqAtvF0FCqky+Ki7BYbFCYQmqFyTe9316Ed5zS70QUR9eg==", "license": "MIT", "optional": true, "engines": { - "node": ">= 6" + "node": ">= 10" } }, "node_modules/@types/babel__core": { @@ -4009,9 +4021,9 @@ "license": "MIT" }, "node_modules/axios": { - "version": "1.14.0", - "resolved": "https://registry.npmjs.org/axios/-/axios-1.14.0.tgz", - "integrity": "sha512-3Y8yrqLSwjuzpXuZ0oIYZ/XGgLwUIBU3uLvbcpb0pidD9ctpShJd43KSlEEkVQg6DS0G9NKyzOvBfUtDKEyHvQ==", + "version": "1.15.2", + "resolved": "https://registry.npmjs.org/axios/-/axios-1.15.2.tgz", + "integrity": "sha512-wLrXxPtcrPTsNlJmKjkPnNPK2Ihe0hn0wGSaTEiHRPxwjvJwT3hKmXF4dpqxmPO9SoNb2FsYXj/xEo0gHN+D5A==", "license": "MIT", "dependencies": { "follow-redirects": "^1.15.11", @@ -5781,9 +5793,9 @@ "license": "MIT" }, "node_modules/fast-xml-builder": { - "version": "1.1.4", - "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.1.4.tgz", - "integrity": "sha512-f2jhpN4Eccy0/Uz9csxh3Nu6q4ErKxf0XIsasomfOihuSUa3/xw6w8dnOtCDgEItQFJG8KyXPzQXzcODDrrbOg==", + "version": "1.1.9", + "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.1.9.tgz", + "integrity": "sha512-jcyKVSEX13iseJqg7n/KWw+xnu/7fdrZ333Fac54KjHDIELVCfDDJXYIm6DTJ0Su4gSzrhqiK0DzY/wZbF40mw==", "funding": [ { "type": "github", @@ -5796,9 +5808,9 @@ } }, "node_modules/fast-xml-parser": { - "version": "5.5.10", - "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.5.10.tgz", - "integrity": "sha512-go2J2xODMc32hT+4Xr/bBGXMaIoiCwrwp2mMtAvKyvEFW6S/v5Gn2pBmE4nvbwNjGhpcAiOwEv7R6/GZ6XRa9w==", + "version": "5.7.3", + "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.7.3.tgz", + "integrity": "sha512-C0AaNuC+mscy6vrAQKAc/rMq+zAPHodfHGZu4sGVehvAQt/JLG1O5zEcYcXSY5zSqr4YVgxsB+pHXTq0i7eDlg==", "funding": [ { "type": "github", @@ -5807,9 +5819,10 @@ ], "license": "MIT", "dependencies": { - "fast-xml-builder": "^1.1.4", - "path-expression-matcher": "^1.2.1", - "strnum": "^2.2.2" + "@nodable/entities": "^2.1.0", + "fast-xml-builder": "^1.1.7", + "path-expression-matcher": "^1.5.0", + "strnum": "^2.2.3" }, "bin": { "fxparser": "src/cli/cli.js" @@ -5983,9 +5996,9 @@ "license": "MIT" }, "node_modules/follow-redirects": { - "version": "1.15.11", - "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.11.tgz", - "integrity": "sha512-deG2P0JfjrTxl50XGCDyfI97ZGVCxIpfKYmfyrQ54n5FO/0gfIES8C/Psl6kWVDolizcaaxZJnTS0QSMxvnsBQ==", + "version": "1.16.0", + "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.0.tgz", + "integrity": "sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==", "funding": [ { "type": "individual", @@ -6753,9 +6766,9 @@ } }, "node_modules/ip-address": { - "version": "10.1.0", - "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.1.0.tgz", - "integrity": "sha512-XXADHxXmvT9+CRxhXg56LJovE+bmWnEWB78LB83VZTprKTmaC5QfruXocxzTZ2Kl0DNwKuBdlIhjL8LeY8Sf8Q==", + "version": "10.2.0", + "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz", + "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==", "license": "MIT", "optional": true, "engines": { @@ -8746,9 +8759,9 @@ "license": "MIT" }, "node_modules/nodemailer": { - "version": "7.0.13", - "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-7.0.13.tgz", - "integrity": "sha512-PNDFSJdP+KFgdsG3ZzMXCgquO7I6McjY2vlqILjtJd0hy8wEvtugS9xKRF2NWlPNGxvLCXlTNIae4serI7dinw==", + "version": "8.0.7", + "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-8.0.7.tgz", + "integrity": "sha512-pkjE4mkBzQjdJT4/UmlKl3pX0rC9fZmjh7c6C9o7lv66Ac6w9WCnzPzhbPNxwZAzlF4mdq4CSWB5+FbK6FWCow==", "license": "MIT-0", "engines": { "node": ">=6.0.0" @@ -9139,9 +9152,9 @@ } }, "node_modules/path-expression-matcher": { - "version": "1.4.0", - "resolved": "https://registry.npmjs.org/path-expression-matcher/-/path-expression-matcher-1.4.0.tgz", - "integrity": "sha512-s4DQMxIdhj3jLFWd9LxHOplj4p9yQ4ffMGowFf3cpEgrrJjEhN0V5nxw4Ye1EViAGDoL4/1AeO6qHpqYPOzE4Q==", + "version": "1.5.0", + "resolved": "https://registry.npmjs.org/path-expression-matcher/-/path-expression-matcher-1.5.0.tgz", + "integrity": "sha512-cbrerZV+6rvdQrrD+iGMcZFEiiSrbv9Tfdkvnusy6y0x0GKBXREFg/Y65GhIfm0tnLntThhzCnfKwp1WRjeCyQ==", "funding": [ { "type": "github", @@ -11216,9 +11229,9 @@ } }, "node_modules/uuid": { - "version": "11.1.0", - "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.0.tgz", - "integrity": "sha512-0/A9rDy9P7cJ+8w1c9WD9V//9Wj15Ce2MPz8Ri6032usz+NfePxx5AcN3bN+r6ZL6jEo066/yNYB3tn4pQEx+A==", + "version": "11.1.1", + "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.1.tgz", + "integrity": "sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ==", "funding": [ "https://github.com/sponsors/broofa", "https://github.com/sponsors/ctavan" diff --git a/backend/package.json b/backend/package.json index be52caf2..c6d13ce5 100644 --- a/backend/package.json +++ b/backend/package.json @@ -19,7 +19,7 @@ "@aws-sdk/s3-request-presigner": "^3.850.0", "adm-zip": "^0.5.16", "archiver": "^5.3.1", - "axios": "1.14.0", + "axios": "1.15.2", "bcrypt": "6.0.0", "chokidar": "4.0.3", "cookie-parser": "^1.4.7", @@ -44,7 +44,7 @@ "mime-types": "^3.0.1", "multer": "^2.0.2", "node-cron": "^3.0.2", - "nodemailer": "^7.0.13", + "nodemailer": "^8.0.5", "pg": "^8.16.3", "react-i18next": "^15.6.0", "sanitize-html": "^2.17.0", @@ -52,7 +52,7 @@ "sqlite3": "^5.1.6", "swagger-jsdoc": "^6.2.8", "swagger-ui-express": "^5.0.1", - "uuid": "^11.1.0", + "uuid": "^11.1.1", "winston": "^3.8.2", "zxcvbn": "^4.4.2" }, @@ -69,12 +69,15 @@ }, "glob": "^11.1.0", "js-yaml": "^4.1.1", - "fast-xml-parser": ">=5.5.10", + "fast-xml-parser": ">=5.7.0", "qs": ">=6.14.2", "tar": ">=7.5.13", "brace-expansion": ">=5.0.5", "minimatch": ">=9.0.7", "path-to-regexp": "0.1.13", - "lodash": ">=4.18.1" + "lodash": ">=4.18.1", + "follow-redirects": ">=1.16.0", + "@tootallnate/once": ">=3.0.1", + "ip-address": ">=10.1.1" } } diff --git a/frontend/package-lock.json b/frontend/package-lock.json index 89f503d3..a770f42b 100644 --- a/frontend/package-lock.json +++ b/frontend/package-lock.json @@ -1,12 +1,12 @@ { "name": "picpeak-frontend", - "version": "3.42.1", + "version": "3.43.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "picpeak-frontend", - "version": "3.42.1", + "version": "3.43.0", "dependencies": { "@tanstack/react-query": "^5.0.0", "@tiptap/extension-character-count": "^2.26.1", @@ -20,14 +20,14 @@ "@types/dompurify": "^3.0.5", "@types/lodash": "^4.17.20", "@types/react-google-recaptcha": "^2.1.9", - "axios": "1.14.0", + "axios": "1.15.2", "clsx": "^2.0.0", "date-fns": "4.1.0", "dompurify": "^3.2.6", "framer-motion": "^12.33.0", "i18next": "^25.3.1", "i18next-browser-languagedetector": "^8.2.0", - "i18next-http-backend": "^3.0.2", + "i18next-http-backend": "^3.0.5", "justified-layout": "^4.1.0", "linkifyjs": "^4.3.2", "lodash": "^4.17.21", @@ -63,7 +63,7 @@ "eslint-plugin-react-refresh": "^0.4.20", "globals": "^16.2.0", "jsdom": "^25.0.1", - "postcss": "^8.4.21", + "postcss": "^8.5.10", "tailwindcss": "^3.3.0", "typescript": "~5.8.3", "typescript-eslint": "^8.34.1", @@ -3020,9 +3020,9 @@ } }, "node_modules/axios": { - "version": "1.14.0", - "resolved": "https://registry.npmjs.org/axios/-/axios-1.14.0.tgz", - "integrity": "sha512-3Y8yrqLSwjuzpXuZ0oIYZ/XGgLwUIBU3uLvbcpb0pidD9ctpShJd43KSlEEkVQg6DS0G9NKyzOvBfUtDKEyHvQ==", + "version": "1.15.2", + "resolved": "https://registry.npmjs.org/axios/-/axios-1.15.2.tgz", + "integrity": "sha512-wLrXxPtcrPTsNlJmKjkPnNPK2Ihe0hn0wGSaTEiHRPxwjvJwT3hKmXF4dpqxmPO9SoNb2FsYXj/xEo0gHN+D5A==", "license": "MIT", "dependencies": { "follow-redirects": "^1.15.11", @@ -3355,12 +3355,12 @@ } }, "node_modules/cross-fetch": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/cross-fetch/-/cross-fetch-4.0.0.tgz", - "integrity": "sha512-e4a5N8lVvuLgAWgnCrLr2PP0YyDOTHa9H/Rj54dirp61qXnNq46m82bRhNqIA5VccJtWBvPTFRV3TtvHUKPB1g==", + "version": "4.1.0", + "resolved": "https://registry.npmjs.org/cross-fetch/-/cross-fetch-4.1.0.tgz", + "integrity": "sha512-uKm5PU+MHTootlWEY+mZ4vvXoCn4fLQxT9dSc1sXVMSFkINTJVN8cAQROpwcKm8bJ/c7rgZVIBWzH5T78sNZZw==", "license": "MIT", "dependencies": { - "node-fetch": "^2.6.12" + "node-fetch": "^2.7.0" } }, "node_modules/cross-spawn": { @@ -4080,9 +4080,9 @@ "license": "ISC" }, "node_modules/follow-redirects": { - "version": "1.15.11", - "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.11.tgz", - "integrity": "sha512-deG2P0JfjrTxl50XGCDyfI97ZGVCxIpfKYmfyrQ54n5FO/0gfIES8C/Psl6kWVDolizcaaxZJnTS0QSMxvnsBQ==", + "version": "1.16.0", + "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.0.tgz", + "integrity": "sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==", "funding": [ { "type": "individual", @@ -4440,12 +4440,12 @@ } }, "node_modules/i18next-http-backend": { - "version": "3.0.2", - "resolved": "https://registry.npmjs.org/i18next-http-backend/-/i18next-http-backend-3.0.2.tgz", - "integrity": "sha512-PdlvPnvIp4E1sYi46Ik4tBYh/v/NbYfFFgTjkwFl0is8A18s7/bx9aXqsrOax9WUbeNS6mD2oix7Z0yGGf6m5g==", + "version": "3.0.6", + "resolved": "https://registry.npmjs.org/i18next-http-backend/-/i18next-http-backend-3.0.6.tgz", + "integrity": "sha512-mBOqy8993jtqAoj6XaI1XeC/8/9v6EPS+681ziegrPvTB0DoaCY7PpTS0SpY56qLMoS4OI1TZEM2Zf59zNh05w==", "license": "MIT", "dependencies": { - "cross-fetch": "4.0.0" + "cross-fetch": "4.1.0" } }, "node_modules/iconv-lite": { @@ -5333,9 +5333,9 @@ } }, "node_modules/postcss": { - "version": "8.5.6", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz", - "integrity": "sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==", + "version": "8.5.14", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.14.tgz", + "integrity": "sha512-SoSL4+OSEtR99LHFZQiJLkT59C5B1amGO1NzTwj7TT1qCUgUO6hxOvzkOYxD+vMrXBM3XJIKzokoERdqQq/Zmg==", "dev": true, "funding": [ { diff --git a/frontend/package.json b/frontend/package.json index 9db351a6..edc397e2 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -24,14 +24,14 @@ "@types/dompurify": "^3.0.5", "@types/lodash": "^4.17.20", "@types/react-google-recaptcha": "^2.1.9", - "axios": "1.14.0", + "axios": "1.15.2", "clsx": "^2.0.0", "date-fns": "4.1.0", "dompurify": "^3.2.6", "framer-motion": "^12.33.0", "i18next": "^25.3.1", "i18next-browser-languagedetector": "^8.2.0", - "i18next-http-backend": "^3.0.2", + "i18next-http-backend": "^3.0.5", "justified-layout": "^4.1.0", "linkifyjs": "^4.3.2", "lodash": "^4.17.21", @@ -67,7 +67,7 @@ "eslint-plugin-react-refresh": "^0.4.20", "globals": "^16.2.0", "jsdom": "^25.0.1", - "postcss": "^8.4.21", + "postcss": "^8.5.10", "tailwindcss": "^3.3.0", "typescript": "~5.8.3", "typescript-eslint": "^8.34.1", @@ -79,6 +79,7 @@ }, "overrides": { "glob": "^11.1.0", - "js-yaml": "^4.1.1" + "js-yaml": "^4.1.1", + "follow-redirects": ">=1.16.0" } } From 3678193ae204b91bddcd398758d3ca848aea0752 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 7 May 2026 12:36:13 +0000 Subject: [PATCH 13/13] chore(main): release 3.43.1 --- .release-please-manifest.json | 2 +- CHANGELOG.md | 8 ++++++++ backend/package.json | 2 +- frontend/package.json | 2 +- 4 files changed, 11 insertions(+), 3 deletions(-) diff --git a/.release-please-manifest.json b/.release-please-manifest.json index 71ab31f3..3954780d 100644 --- a/.release-please-manifest.json +++ b/.release-please-manifest.json @@ -1 +1 @@ -{".":"3.43.0"} +{".":"3.43.1"} diff --git a/CHANGELOG.md b/CHANGELOG.md index 2780c5a5..5b8039ed 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,14 @@ All notable changes to PicPeak will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [3.43.1](https://github.com/the-luap/picpeak/compare/v3.43.0...v3.43.1) (2026-05-07) + + +### Bug Fixes + +* **security:** backport 18 dependency CVE patches from beta (3.42.2 stable) ([74eacbc](https://github.com/the-luap/picpeak/commit/74eacbc78f7efd5c499ae1647b716d3234096c39)) +* **security:** patch 18 dependency CVEs (axios + transitives + nodemailer + i18next-http-backend) ([37bf894](https://github.com/the-luap/picpeak/commit/37bf894412b4da0f0507dd8f1384e6f101ce14b2)) + ## [3.43.0](https://github.com/the-luap/picpeak/compare/v3.42.1...v3.43.0) (2026-05-07) diff --git a/backend/package.json b/backend/package.json index c6d13ce5..05d66632 100644 --- a/backend/package.json +++ b/backend/package.json @@ -1,6 +1,6 @@ { "name": "picpeak-backend", - "version": "3.43.0", + "version": "3.43.1", "description": "Backend for PicPeak event photo sharing platform", "main": "server.js", "scripts": { diff --git a/frontend/package.json b/frontend/package.json index edc397e2..a41ef533 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -1,7 +1,7 @@ { "name": "picpeak-frontend", "private": true, - "version": "3.43.0", + "version": "3.43.1", "type": "module", "scripts": { "dev": "vite",