Paul Nothaft
38fd41aad3
fix(security): harden .picpeak restore operator-preservation (GHSA-qxfx follow-up)
...
The req.admin.id fix activated reinjectCurrentAdmin(); hardening its preservation
logic (found across Codex review rounds of #811 ):
- MFA hijack: reinject wrote back only password_hash/is_active/
must_change_password, leaving a crafted backup's two_factor_* on the
operator's row — it could strip or replace their second factor. The email-
matched row is now updated with the operator's full AUTH set (login identity,
password, and all two_factor_* columns). Relationship/audit FKs (role_id,
created_by) are deliberately NOT forced from the snapshot: on a cross-instance
restore those pre-restore ids may be absent from the backup and would dangle
the FK (SQLite rolls back at commit); the restored row keeps its own valid
values.
- Cross-instance restore rollback / FK safety: reinject matched only by email,
so a backup shipping a different admin with the default `admin` username hit
UNIQUE(username) and rolled the whole restore back; email and username could
even collide on two different rows. Reconciliation is now non-destructive:
the email-matching row is updated in place (id preserved → restored FKs like
events.created_by stay valid); any different row holding the operator's
username is RENAMED, not deleted (deletion would fire ON DELETE actions /
dangle references); only when no row has the operator's email is a fresh row
inserted, with created_by nulled and an explicit max(id)+1 id (batchInsert
left the Postgres identity sequence unadvanced, so a sequence-based insert
could collide).
- Stale session after restore: admin_users ids shift on restore, but the
operator's live JWT is bound only to decoded.id (IP logged not enforced; the
backup controls password_changed_at). The route now revokes the token (result
checked and logged) and clears the admin cookie; the client redirects to a
fresh login via a sessionInvalidated flag. Cookie clear is the unconditional
guarantee.
Adds SQLite-backed reinject regression tests (in-place login/MFA restore with id
and FK columns preserved, username-only rename, email+username on different rows,
clean insert with created_by nulled) and the frontend redirect on
sessionInvalidated.
Deferred (design decisions / pre-existing, need a Postgres test env — see PR
discussion): global "invalidate all pre-restore sessions" cutoff; preserving the
operator's ROLE semantics across an RBAC-table replace; and resyncing Postgres
identity sequences after any restore (batchInsert leaves them behind max(id) —
pre-existing, affects every restored table).
2026-07-16 12:27:59 +02:00
Paul Nothaft
31bc01cb4b
fix(security): sanitize chunked-upload filename (GHSA-pc72-jf53-w28j)
...
The chunked video upload stored req.body.filename unmodified and later built
the merged path as path.join(tempDir, uploadMeta.filename). path.join does not
neutralise '../', so a filename like '../../uploads/logos/evil.svg' escaped the
temp dir on merge and overwrote arbitrary files. Requires admin with
photos.upload.
Fix: path.basename() the client filename in initializeUpload() and reject
names that collapse to nothing. Adds a regression test.
2026-07-16 10:55:10 +02:00
Paul Nothaft
9cd6b08441
fix(security): reject ZIP-slip entries in archive/backup restore (GHSA-jfhw-fj23-fx6x)
...
node-stream-zip's extract(null, root) writes each entry to path.join(root,
entry.name) without neutralising '../', so a crafted archive entry named
'../../uploads/logos/evil.svg' escaped the target dir and overwrote arbitrary
files (logos, .env, route files → RCE on source deploys). Requires admin with
archives.restore.
Adds assertZipEntriesWithin() to utils/safePath.js — a lexical containment
check run on the entry list BEFORE extract() — and guards both extract sinks:
adminArchives.js (the reported route) and picpeakImportService.js (the sibling
.picpeak import, same sink). Adds unit tests for traversal, absolute-path, and
sibling-prefix entries.
2026-07-16 10:55:10 +02:00
Paul Nothaft
7dace044dc
fix(security): share-login must not bypass gallery password (GHSA-9hmx-68vc-qpqw)
...
POST /auth/gallery/share-login validated only the 128-bit share token and then
minted a full type:'gallery' access token regardless of require_password —
computing requiresPassword at the end only to echo it, never enforce it. Anyone
holding a gallery's share link could read and download every photo in a
password-protected gallery via a direct API call, no password needed.
Fix: compute requiresPassword before minting; for a password-protected gallery
return { requires_password: true } with NO token and NO cookie. The client then
goes through /gallery/verify, which does bcrypt.compare the password. The public
(no-password) auto-login path is unchanged. The frontend already falls through
to the password prompt when share-login returns no token/event.
Adds route regression test covering the bypass, the public path, and bad tokens.
2026-07-16 10:55:10 +02:00
Paul Nothaft
348894efef
fix(security): preserve current admin on .picpeak restore (GHSA-qxfx-4493-4v8f)
...
adminAuth populates req.admin, not req.user, so currentAdminId was always
undefined in the /api/admin/picpeak/import handler. reinjectCurrentAdmin()
then had no account to preserve and the admin_users table was fully replaced
by the uploaded backup — a crafted .picpeak let any admin with backup.restore
take over every admin account (critical). One-line fix: pass req.admin.id.
Closes GHSA-qxfx-4493-4v8f and its duplicate GHSA-pjp6-jcrj-3cr5.
2026-07-16 10:55:10 +02:00
Paul Nothaft
f0cdcddb92
chore(main): release 3.88.0-beta.0 ( #805 )
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
2026-07-15 21:07:21 +00:00
Paul Nothaft
0751a08aa6
Merge pull request #804 from PicPeak/fix/gallery-feedback-filter-chips
...
fix(gallery): show feedback filter chips on desktop for galleries without categories
2026-07-15 23:02:48 +02:00
Paul Nothaft
d64eef8abf
Merge pull request #803 from PicPeak/fix/event-type-hardcoded-deps
...
fix(event-types): un-hardcode event type dependencies in v1 API and CRM
2026-07-15 23:02:35 +02:00
Paul Nothaft
109aba8598
Merge pull request #801 from PicPeak/feat/setup-wizard-event-types
...
feat(setup): event-types step in first-run wizard + un-hardcode event type dependencies
2026-07-15 23:01:36 +02:00
Paul Nothaft
aab9e1a937
chore(main): release 3.87.0-beta.0 ( #797 )
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
2026-07-11 20:24:23 +00:00
Paul Nothaft
ffd4a7eee6
Merge pull request #796 from Luca-Timo/feat/invoice-vat-note
...
feat(invoices): configurable VAT note under MwSt. line + fix multi-page page-number overlap (#794 )
2026-07-11 22:21:41 +02:00
Paul Nothaft
e3d597b89a
Merge pull request #787 from PicPeak/ci/push-images-to-dockerhub
...
ci(docker): also publish images to Docker Hub (picpeak/backend, picpeak/frontend)
2026-07-10 20:35:58 +02:00
Paul Nothaft
ea9caa9c5d
chore(main): release 3.86.0-beta.0 ( #795 )
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
2026-07-10 18:30:28 +00:00
Paul Nothaft
d51112e761
Merge pull request #790 from Luca-Timo/feat/category-reorder
...
feat(categories): per-event category ordering — global default + override (#782 )
2026-07-10 20:26:11 +02:00
Paul Nothaft
ed0fa3241b
chore(main): release 3.85.0-beta.0 ( #793 )
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
2026-07-10 13:38:57 +00:00
Paul Nothaft
54676424f2
Merge pull request #788 from PicPeak/feat/slideshow-order-category
...
feat(slideshow): per-event play order + category filter (#202 )
2026-07-10 15:35:45 +02:00
Paul Nothaft
b41cb1586d
chore(main): release 3.84.1-beta.0 ( #792 )
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
2026-07-10 12:21:09 +00:00
Paul Nothaft
1f3bc3c343
Merge pull request #791 from PicPeak/fix/docker-v-tag-via-ref
...
fix(ci): publish v-prefixed image tags via type=ref,event=tag (#668 )
2026-07-10 14:17:11 +02:00
Paul Nothaft
aeade94a35
Merge pull request #786 from PicPeak/release-please--branches--main
...
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
chore(main): release 3.84.0-beta.0
2026-07-10 13:04:13 +02:00
Paul Nothaft
03ded870bf
chore(main): release 3.84.0-beta.0
2026-07-10 10:20:17 +02:00
Paul Nothaft
df5aeaba41
Merge pull request #785 from PicPeak/docs/releasing-stable-version-alignment
...
docs(releasing): align stable version to main on promote (Option A)
2026-07-10 10:20:04 +02:00
Paul Nothaft
279e0472c7
Merge pull request #784 from PicPeak/feat/admin-github-repo-button
...
feat(admin): GitHub repo button in the sidebar footer (#778 )
2026-07-10 10:19:49 +02:00
Paul Nothaft
2ee4146d9a
Merge pull request #783 from PicPeak/fix/docker-versioned-tags-v-prefix
...
fix(ci): publish v-prefixed image tags so :vX.Y.Z resolves (#668 )
2026-07-10 10:19:22 +02:00
Paul Nothaft
dbe4b588eb
chore(main): release 3.83.1-beta.0 ( #776 )
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
2026-07-09 11:17:23 +00:00
Paul Nothaft
274ef0cd73
Merge pull request #774 from PicPeak/fix/release-please-stable-target
...
fix(release): target stable in release-please + undo bogus 2.7.0 bump
2026-07-09 13:13:23 +02:00
Paul Nothaft
be710eb1de
Merge pull request #773 from PicPeak/release-please--branches--main
...
chore(main): release 2.7.0
2026-07-08 21:14:07 +02:00
Paul Nothaft
58a86af868
chore(main): release 2.7.0
2026-07-08 20:46:56 +02:00
Paul Nothaft
1250306d11
Merge pull request #772 from PicPeak/ci/run-tests-on-stable
...
ci: run the Tests workflow on stable-targeted PRs
2026-07-08 20:42:01 +02:00
Paul Nothaft
c29ad747f2
chore(main): release 3.83.0-beta.0 ( #770 )
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
2026-07-08 10:42:24 +00:00
Paul Nothaft
a71b9b5ed7
Merge pull request #769 from Luca-Timo/feat/messages-email-client
...
feat(messages): unified Messages email client (flag-gated, default off)
2026-07-08 12:38:58 +02:00
Paul Nothaft
72cbb95b44
chore(main): release 3.82.6-beta.0 ( #768 )
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
2026-07-07 10:35:31 +00:00
Paul Nothaft
c0ac5c36a4
chore(main): release 3.82.5-beta.0 ( #767 )
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
2026-07-07 07:08:02 +00:00
Paul Nothaft
760a201b60
Merge pull request #766 from PicPeak/fix/date-input-invalid-crash
...
fix(admin): stop the event-date field crashing the page on backspace
2026-07-07 09:04:04 +02:00
Paul Nothaft
2522d7e1ce
chore(main): release 3.82.4-beta.0 ( #765 )
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
2026-07-07 05:13:53 +00:00
Paul Nothaft
0c2d319fc1
Merge pull request #763 from Luca-Timo/fix/email-language-and-payment-confirm
...
fix(email,ui): billing emails follow customer language + readable payment-check confirmation
2026-07-07 07:10:09 +02:00
Paul Nothaft
a52317d8a5
chore(main): release 3.82.3-beta.0 ( #758 )
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
2026-07-06 09:53:29 +00:00
Paul Nothaft
a88da99c8d
Merge pull request #757 from PicPeak/fix/hero-logo-global-inherit-756
...
fix(branding): make 'Show logo in hero' a true global toggle with per-event override (#756 )
2026-07-06 11:50:06 +02:00
Paul Nothaft
43213b50ce
chore(main): release 3.82.2-beta.0 ( #755 )
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
2026-07-05 21:43:21 +00:00
Paul Nothaft
a87ad77d8d
Merge pull request #754 from PicPeak/fix/og-shorturl-slideshow-viber-699
...
fix(og): route branded short URLs + slideshow to OG handler, add Viber (#699 )
2026-07-05 23:39:59 +02:00
Paul Nothaft
f15e104702
chore(main): release 3.82.1-beta.0 ( #753 )
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
2026-07-05 17:27:41 +00:00
Paul Nothaft
c3ed7f1693
chore(main): release 3.82.0-beta.0 ( #742 )
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
2026-07-03 11:10:31 +00:00
Paul Nothaft
a5f49e3235
Merge pull request #741 from PicPeak/feat/setup-final-step-and-button-fix
...
feat(setup): final community step (#732 ) + fix create-admin button overflow (#730 )
2026-07-03 13:07:21 +02:00
Paul Nothaft
c76877c0c4
chore(main): release 3.81.0-beta.0 ( #740 )
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
2026-07-03 10:08:29 +00:00
Paul Nothaft
e985c6bacd
Merge pull request #733 from PicPeak/refactor/codebase-cleanup
...
refactor: codebase-wide cleanup — dead code, dedup, standardization, god-file decomposition
2026-07-03 12:05:33 +02:00
Paul Nothaft
cf073615ef
Merge pull request #739 from PicPeak/feat/admin-mfa
...
feat: admin two-factor authentication (TOTP) with recovery codes + CLI reset
2026-07-03 11:49:07 +02:00
Paul Nothaft
b732974779
Merge pull request #737 from PicPeak/fix/auth-access-control
...
fix(security): cross-event thumbnail leak, bulk-op ownership bypass + auth hardening
2026-07-03 11:47:25 +02:00
Paul Nothaft
b187f588b4
Merge pull request #734 from PicPeak/fix/event-create-nan-and-bool-render
...
fix: event creation 500s on PostgreSQL (NaN slideshow seed) + stray "0" boolean renders
2026-07-03 11:46:58 +02:00
Paul Nothaft
5b26dbd935
chore(main): release 3.80.0-beta.0 ( #736 )
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
2026-07-03 08:05:34 +00:00
Paul Nothaft
e513e8345b
Merge pull request #731 from Luca-Timo/feat/setup-wizard-and-backup-roundtrip
...
feat: first-run setup wizard (feature selection + config) and portable .picpeak backup roundtrip
2026-07-03 10:03:22 +02:00
Paul Nothaft
b04ef216f5
chore(main): release 3.79.1-beta.0 ( #729 )
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
2026-07-02 19:03:05 +00:00
Paul Nothaft
4aa6583bae
Merge pull request #728 from Luca-Timo/fix/settings-duplicate-mail-import
...
fix(settings): remove duplicate Mail import that crashes the dev server
2026-07-02 20:59:40 +02:00
Paul Nothaft
c8610276c2
Merge pull request #727 from PicPeak/chore/security-nginx-npm-bumps
...
chore(security): bump frontend nginx to r4 (close 4 HTTP/2 & module CVEs)
2026-07-02 20:53:45 +02:00
Paul Nothaft
24c287d051
chore(main): release 3.79.0-beta.0 ( #726 )
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
2026-07-02 15:12:45 +00:00
Paul Nothaft
681619f0a1
Merge pull request #718 from PicPeak/feat/setup-wizard-unattended
...
feat: setup wizard + argument-driven unattended install
2026-07-02 17:08:21 +02:00
Paul Nothaft
6850bd3bef
chore(main): release 3.78.0-beta.0 ( #725 )
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
2026-07-02 14:35:07 +00:00
Paul Nothaft
97b9853709
Merge pull request #724 from PicPeak/fix/release-automerge-pat
...
fix: enable release-PR auto-merge with the PAT so releases actually publish
2026-07-02 16:32:04 +02:00
Paul Nothaft
bafc96f468
Merge pull request #714 from Luca-Timo/feat/first-run-setup-wizard
...
feat: zero-config first run — in-browser admin bootstrap + auto-generated secrets
2026-07-02 16:19:33 +02:00
Paul Nothaft
2b2dc6e35c
chore(main): release 3.77.3-beta.0 ( #723 )
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
2026-07-02 13:29:08 +00:00
Paul Nothaft
d00d52a221
Merge pull request #722 from PicPeak/fix/release-please-gh-repo
...
fix: set GH_REPO in release-please auto-merge step
2026-07-02 15:23:49 +02:00
Paul Nothaft
e54100ac46
Merge pull request #721 from PicPeak/release-please--branches--main
...
Build and Push Docker Images / summary (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
chore(main): release 3.77.2-beta.0
2026-07-02 15:23:08 +02:00
Paul Nothaft
95dac43fdf
chore(main): release 3.77.2-beta.0
2026-07-02 15:17:15 +02:00
Paul Nothaft
fb64ec0910
Merge pull request #720 from PicPeak/fix/release-please-automation
...
fix: auto-publish release-please PRs without manual approval
2026-07-02 15:16:54 +02:00
Paul Nothaft
934cc92bb8
Merge pull request #717 from PicPeak/release-please--branches--main
...
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
chore(main): release 3.77.1-beta.0
2026-07-02 14:51:09 +02:00
Paul Nothaft
f5b4aa7a5b
Merge pull request #716 from PicPeak/docs/require-ui-screenshots
...
docs: require screenshots for UI changes in PRs
2026-07-02 13:01:04 +02:00
Paul Nothaft
b8b33ae6d6
Merge pull request #713 from PicPeak/release-please--branches--main
...
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
chore(main): release 3.77.0-beta.0
2026-07-01 10:00:29 +02:00
Paul Nothaft
e873f7c98c
Merge pull request #712 from PicPeak/chore/conventional-pr-title-guard
...
feat: admin photos list/grid toggle + upload failure report (#707 , #708 )
2026-07-01 09:55:37 +02:00
Paul Nothaft
b8665e1d86
Merge pull request #708 from andredlng/feat/upload-failure-details
...
Surface which files failed during photo upload
2026-07-01 09:29:19 +02:00
Paul Nothaft
f4a1db8b6a
Merge pull request #707 from andredlng/feat/photos-list-view
...
Add grid/list layout toggle to admin Photos tab
2026-07-01 09:00:31 +02:00
Paul Nothaft
22b20e8314
Merge pull request #711 from PicPeak/release-please--branches--main
...
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
chore(main): release 3.76.2-beta.0
2026-06-30 22:57:16 +02:00
Paul Nothaft
3feed0fae6
Merge pull request #710 from PicPeak/fix/whatsnew-workflow-no-checkout
...
fix(ci): whatsnew highlights — set GH_REPO so gh runs without a checkout
2026-06-30 22:52:08 +02:00
Paul Nothaft
152952877f
Merge pull request #709 from PicPeak/release-please--branches--main
...
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
chore(main): release 3.76.1-beta.0
2026-06-30 22:42:09 +02:00
Paul Nothaft
0b74b51f40
Merge pull request #703 from Luca-Timo/ci/whatsnew-highlights-workflow
...
ci(whatsnew): generate release highlights via GitHub Models
2026-06-30 22:33:00 +02:00
Paul Nothaft
627c655a4d
Merge pull request #704 from PicPeak/release-please--branches--main
...
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
chore(main): release 3.76.0-beta.0
2026-06-30 17:12:31 +02:00
Paul Nothaft
a0f7033ffc
Merge pull request #702 from PicPeak/feat/branded-short-urls-699
...
feat(gallery): branded URL shortener — /s/<slug> with OG injection (#699 )
2026-06-30 17:01:16 +02:00
Paul Nothaft
3ac88370d6
Merge pull request #701 from PicPeak/release-please--branches--main
...
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
chore(main): release 3.75.1-beta.0
2026-06-30 17:00:10 +02:00
Paul Nothaft
25bf7bb523
Merge pull request #700 from PicPeak/fix/og-injection-share-token-and-slideshow-699
...
fix(og): rich social previews for share-token + slideshow URLs (#699 )
2026-06-30 16:09:31 +02:00
Paul Nothaft
52dfe2723d
Merge pull request #697 from PicPeak/release-please--branches--main
...
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
chore(main): release 3.74.1-beta.0
2026-06-30 11:44:10 +02:00
Paul Nothaft
a1a73bf75f
Merge pull request #694 from Luca-Timo/feat/whatsnew-notifications
...
feat(updates): "What's New" highlights after update + pre-update teaser
2026-06-30 11:43:39 +02:00
Paul Nothaft
0191b283d7
Merge pull request #692 from PicPeak/chore/security-bumps-aug-2026-batch
...
chore(security): close all 27 code-scanning alerts via dep + base-image bumps
2026-06-30 10:58:09 +02:00
Paul Nothaft
e48b81fb8d
Merge pull request #693 from PicPeak/chore/workflow-required-checks-always-fire
...
ci: required-check workflows fire on every PR (drop paths filter + post-rename branch list)
2026-06-30 10:53:25 +02:00
Paul Nothaft
a24821de55
Merge pull request #691 from PicPeak/chore/bypass-size-gate
...
ci: bypass size gate — cap self-merge PR size for bypass users
2026-06-29 23:15:45 +02:00
Paul Nothaft
beae46e408
Merge pull request #689 from PicPeak/release-please--branches--main
...
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
chore(main): release 3.74.0-beta.0
2026-06-29 22:44:39 +02:00
Paul Nothaft
14bd3e1a6c
Merge pull request #688 from PicPeak/chore/readme-migration-banner
...
docs: prominent migration banner at the top of README
2026-06-29 22:29:09 +02:00
Paul Nothaft
02133478bd
Merge pull request #687 from PicPeak/chore/in-app-migration-banner
...
feat(admin): in-app migration banner for the org rename
2026-06-29 22:22:52 +02:00
Paul Nothaft
297c2d3df0
Merge pull request #686 from PicPeak/chore/post-rename-workflow-triggers
...
chore: workflows + RELEASING.md for the post-rename branch model
2026-06-29 22:21:56 +02:00
Paul Nothaft
166ef47611
Merge pull request #685 from PicPeak/chore/post-org-move-docs-and-contributing
...
docs: branch model + migration-to-org guide + PR template
2026-06-29 22:21:24 +02:00
Paul Nothaft
448da95020
Merge pull request #684 from PicPeak/chore/migrate-image-registry-to-picpeak-org
...
chore: migrate Docker registry + GitHub URLs to PicPeak org
2026-06-29 20:25:15 +02:00
Paul Nothaft
5ebe126970
Merge pull request #683 from the-luap/release-please--branches--beta
...
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
chore(beta): release 3.73.0-beta.0
2026-06-29 20:00:07 +02:00
Paul Nothaft
86475582e8
Merge pull request #682 from Luca-Timo/fix/invoice-draft-and-nits
...
CRM: held invoices read as "Draft", + mark-paid / dashboard / reminder fixes
2026-06-29 19:57:27 +02:00
Paul Nothaft
06f4c109bc
Merge pull request #680 from Luca-Timo/fix/invoice-pdf-multipage
...
Fix/invoice pdf multipage
2026-06-28 22:17:07 +02:00
Paul Nothaft
23d1f5d609
Merge pull request #681 from the-luap/release-please--branches--beta
...
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
chore(beta): release 3.72.0-beta.0
2026-06-28 21:57:58 +02:00
Paul Nothaft
ec33ec7670
Merge pull request #679 from Luca-Timo/feat/booking-cutover
...
feat(workflows): booking cutover — wire booking actions + hold documents behind approval gates
2026-06-28 21:53:09 +02:00
Paul Nothaft
e6f29b6345
Merge pull request #678 from the-luap/release-please--branches--beta
...
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
chore(beta): release 3.71.3-beta.0
2026-06-27 21:56:11 +02:00
Paul Nothaft
f01754247c
Merge pull request #676 from the-luap/fix/whatsapp-public-events-route-647
...
fix(events): wire customer notifications into both public API entry points (#647 )
2026-06-27 21:50:00 +02:00
Paul Nothaft
54c52d3cf7
Merge pull request #677 from the-luap/release-please--branches--beta
...
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
chore(beta): release 3.71.2-beta.0
2026-06-27 21:49:30 +02:00
Paul Nothaft
c8714ca42f
Merge pull request #674 from Luca-Timo/feat/workflow-engine
...
fix: event-reminder, email-language & gallery-publish bugs surfaced during workflow testing
2026-06-27 21:45:07 +02:00
Paul Nothaft
4212062c12
Merge pull request #673 from the-luap/release-please--branches--beta
...
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
chore(beta): release 3.71.1-beta.0
2026-06-26 17:03:18 +02:00
Paul Nothaft
748af98f3d
Merge pull request #671 from the-luap/fix/publish-dialog-cta-overflow-670
...
fix(admin): stack publish-gallery dialog CTAs so the German label fits (#670 )
2026-06-26 13:04:45 +02:00
Paul Nothaft
dddf932f13
Merge pull request #672 from the-luap/release-please--branches--beta
...
Build and Push Docker Images / build-backend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-backend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-backend (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/amd64, ubuntu-latest) (push) Has been cancelled
Build and Push Docker Images / build-frontend (linux/arm64, ubuntu-24.04-arm) (push) Has been cancelled
Build and Push Docker Images / merge-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
chore(beta): release 3.71.0-beta.0
2026-06-25 19:26:31 +02:00
Paul Nothaft
15be3b8d32
Merge pull request #667 from Luca-Timo/feat/workflow-engine
...
feat: admin-configurable workflow engine + dunning/Mahngebühr rework (RFC — feedback welcome)
2026-06-25 19:17:03 +02:00
Paul Nothaft