75499992eb
chore(main): release 2.6.5
2026-04-08 11:15:26 +00:00
62643f241b
Merge pull request #281 from the-luap/docs/readme-rewrite-main
...
docs: rewrite README — shorter, cleaner
2026-04-08 13:15:07 +02:00
64f606152f
docs: rewrite README — shorter, cleaner, less AI-sounding
...
Rewrote from 350 lines to ~130 lines. Removed emoji-heavy headings,
marketing fluff, redundant sections, and the AI disclosure. Collapsed
screenshots into details tags. Kept all essential info: demo, features,
quick start, comparison, tech stack, docs links.
2026-04-08 13:14:57 +02:00
e2a698e892
Merge pull request #277 from the-luap/release-please--branches--main
...
Build and Push Docker Images / build-backend (push) Failing after 3m25s
Build and Push Docker Images / build-frontend (push) Failing after 3m24s
Build and Push Docker Images / summary (push) Successful in 2s
chore(main): release 2.6.4
2026-04-08 09:39:15 +02:00
d1d71dba25
chore(main): release 2.6.4
2026-04-08 07:14:32 +00:00
bb81fa5f4b
Merge pull request #276 from the-luap/fix/main-lockfile-sync
...
fix: sync backend package-lock.json for security deps
2026-04-08 09:14:16 +02:00
03e19893b3
fix: sync backend package-lock.json with security dep updates
...
The lock file was not committed with PR #275 , causing npm ci to fail
in Docker builds. Regenerate to match the updated package.json overrides.
2026-04-08 09:14:06 +02:00
279314e4b7
Merge pull request #275 from the-luap/security/fix-dep-vulnerabilities-main
...
security: fix 20 dependency vulnerabilities (backport)
2026-04-08 09:05:56 +02:00
730912a3f4
security: fix 20 dependency vulnerabilities (backport to main)
...
Same fixes as beta PR #274 . Updates handlebars, nodemailer, tar,
fast-xml-parser, brace-expansion, path-to-regexp, and lodash to
address 20 GitHub code scanning alerts.
2026-04-08 09:05:48 +02:00
ff9fb64e75
Merge pull request #273 from the-luap/release-please--branches--main
...
Build and Push Docker Images / build-backend (push) Failing after 3m26s
Build and Push Docker Images / build-frontend (push) Failing after 3m28s
Build and Push Docker Images / summary (push) Successful in 2s
chore(main): release 2.6.3
2026-04-07 20:40:47 +02:00
9cbbe74051
chore(main): release 2.6.3
2026-04-07 18:40:34 +00:00
2e1c71c1ab
Merge pull request #272 from the-luap/docs/external-media-library-270
...
docs: add External Media Library section to deployment guide (#270 )
2026-04-07 20:40:11 +02:00
f6ca713a6e
docs: add External Media Library section to deployment guide ( #270 )
...
Add the missing "External Media Library" chapter to DEPLOYMENT_GUIDE.md
that was referenced in the TOC but never written. Covers configuration,
Docker volume mounting, folder structure, usage workflow, limitations,
and troubleshooting.
Closes #270
2026-04-07 19:52:02 +02:00
197cd8e1e0
Merge pull request #268 from the-luap/security/pin-axios-main
...
security: pin axios to 1.14.0 — supply chain attack prevention
2026-04-05 18:41:54 +02:00
681b440381
security: pin axios to 1.14.0 to prevent supply chain attack
...
Axios versions 1.14.1 and 0.30.4 were compromised on March 31, 2026
with a RAT dropper attributed to North Korean threat actor. Pin to
exact 1.14.0 (latest safe release) to prevent resolution to compromised
versions. See https://github.com/axios/axios/issues/10604
2026-04-05 18:41:45 +02:00
3daeac9e53
Merge pull request #246 from the-luap/release-please--branches--main
...
Build and Push Docker Images / build-backend (push) Failing after 3m32s
Build and Push Docker Images / build-frontend (push) Failing after 3m34s
Build and Push Docker Images / summary (push) Successful in 3s
chore(main): release 2.6.2
2026-03-16 22:37:56 +01:00
7febba2d9c
chore(main): release 2.6.2
2026-03-16 21:37:35 +00:00
0a3a53763c
Merge pull request #245 from the-luap/fix/security-session-invalidation-main
...
fix(security): token invalidation on password change, session timeout enforcement
2026-03-16 22:37:16 +01:00
85a60a2dc7
fix(security): invalidate tokens on password change, enforce session timeout, fix role update
...
- Set password_changed_at when changing password via adminAuth route so
existing JWT tokens are rejected by the auth middleware check
- Enforce session timeout on first request with unseen tokens by checking
token iat against configured timeout (prevents bypass after server restart)
- Convert camelCase roleId/isActive to snake_case role_id/is_active in
frontend updateUser service (fixes silent role update failures)
Resolves GHSA-rqg3-47p5-vgwg
2026-03-16 22:36:52 +01:00
e74e73a3a0
Merge pull request #231 from the-luap/i18n/ru-missing-keys
...
i18n: add missing Russian translations for thumbnails and photo dimensions
2026-03-15 20:01:15 +01:00
52ab609597
i18n: add missing Russian translations for thumbnails and photo dimensions
...
Adds 38 missing keys for settings.thumbnails and settings.photoDimensions
that were added after the initial Russian localization PR (#216 ).
2026-03-15 19:48:41 +01:00
fafcfbf4e6
Merge pull request #216 from Ih0rd/russian-localization
...
basic Russian localization
2026-03-15 19:47:25 +01:00
56f497c5f1
Merge pull request #227 from the-luap/release-please--branches--main
...
Build and Push Docker Images / build-backend (push) Failing after 3m29s
Build and Push Docker Images / build-frontend (push) Failing after 3m40s
Build and Push Docker Images / summary (push) Successful in 3s
chore(main): release 2.6.1
2026-03-11 21:54:39 +01:00
b52cf1f741
chore(main): release 2.6.1
2026-03-11 19:48:05 +00:00
7f7736282f
Merge pull request #225 from the-luap/fix/security-reporting-policy
...
fix: update security policy with private reporting channels
2026-03-11 20:47:41 +01:00
67b0f32456
fix: update security policy with proper contact email and private reporting
...
- Replace placeholder security@example.com with info@picpeak.app
- Add GitHub Private Vulnerability Reporting links
- Update supported versions table to 2.x.x
Closes #223
2026-03-11 20:21:32 +01:00
25b40c03b0
Merge pull request #224 from the-luap/release/beta-to-main
...
Merge beta into main
2026-03-11 20:19:10 +01:00
28793bba68
Merge main into beta for release/beta-to-main
2026-03-11 20:12:52 +01:00
4ae91142f8
Merge pull request #222 from the-luap/release-please--branches--main
...
Build and Push Docker Images / build-backend (push) Failing after 3m23s
Build and Push Docker Images / build-frontend (push) Failing after 3m18s
Build and Push Docker Images / summary (push) Successful in 2s
chore(main): release 2.6.0
2026-03-11 12:01:51 +01:00
c92879fbd3
chore(main): release 2.6.0
2026-03-11 10:57:06 +00:00
a0bb080586
Merge pull request #221 from the-luap/fix/video-upload-select-all-dimensions
...
fix: video upload, select all, and dimension repair (#203 , #220 , #180 )
2026-03-11 11:56:38 +01:00
fc75bcdfc3
fix: video upload media type, select all, and dimension repair ( #203 , #220 , #180 )
...
- Fix admin video upload missing media_type/mime_type and video processing (#203 )
- Fix Gallery-Premium Select All using atomic callbacks instead of stale closure loop (#220 )
- Add photo dimension repair endpoint and admin UI (#180 )
- Add E2E tests for all three fixes
2026-03-11 11:50:43 +01:00
9877f63aed
Merge pull request #219 from the-luap/release-please--branches--beta
...
Build and Push Docker Images / build-frontend (push) Failing after 3m20s
Build and Push Docker Images / build-backend (push) Failing after 3m20s
Build and Push Docker Images / summary (push) Successful in 2s
chore(beta): release 3.17.1-beta.0
2026-03-08 15:47:06 +01:00
0c98c6b453
chore(beta): release 3.17.1-beta.0
2026-03-08 14:42:28 +00:00
831ea6a3bc
Merge pull request #218 from the-luap/fix/optional-email-event-creation
...
fix: respect optional email settings in event creation
2026-03-08 15:42:14 +01:00
9c44a0ebfa
fix: respect optional email settings in event creation ( #217 )
...
When admin/customer emails were configured as optional in Settings >
Event Creation, the backend still rejected empty values because:
1. express-validator .optional() only skips undefined, not empty strings
— changed to .optional({ values: 'falsy' }) so "" is treated as
absent
2. DB columns host_email and admin_email had NOT NULL constraints
— added migration to make them nullable
3. Email queue insert crashed on null recipient_email
— skip queuing when no customer email is provided
2026-03-08 15:36:38 +01:00
a840ad4594
basic Russian localization
2026-03-06 06:17:30 +03:00
08ac238d0a
Merge pull request #215 from the-luap/release-please--branches--beta
...
Build and Push Docker Images / build-backend (push) Failing after 3m31s
Build and Push Docker Images / build-frontend (push) Failing after 3m31s
Build and Push Docker Images / summary (push) Successful in 3s
chore(beta): release 3.17.0-beta.0
2026-03-05 22:22:58 +01:00
7d967a47ae
chore(beta): release 3.17.0-beta.0
2026-03-05 21:21:48 +00:00
9b7495e005
Merge pull request #214 from the-luap/feat/configurable-upload-batch-size
...
feat: configurable upload batch size for reverse proxy compatibility
2026-03-05 22:21:29 +01:00
e1ad4219a5
Merge pull request #212 from the-luap/revert-210-feat/configurable-upload-batch-size
...
Revert "feat: configurable upload batch size for reverse proxy compatibility"
2026-03-05 22:16:43 +01:00
cc4503ad28
Revert "feat: configurable upload batch size for reverse proxy compatibility"
2026-03-05 22:16:28 +01:00
424336340b
Merge pull request #210 from the-luap/feat/configurable-upload-batch-size
...
feat: configurable upload batch size for reverse proxy compatibility
2026-03-05 22:14:41 +01:00
a8308a5c02
Merge pull request #209 from the-luap/release-please--branches--beta
...
Build and Push Docker Images / build-frontend (push) Failing after 3m37s
Build and Push Docker Images / build-backend (push) Failing after 3m38s
Build and Push Docker Images / summary (push) Successful in 3s
chore(beta): release 3.16.0-beta.0
2026-03-05 22:14:28 +01:00
02a46e083d
feat: add configurable upload batch size for reverse proxy compatibility ( #208 )
...
Users behind Cloudflare Tunnel and other reverse proxies cannot upload
batches >100MB. The upload chunking previously used a hardcoded 500MB
limit. This adds a configurable `max_upload_batch_size_mb` setting
(default 95MB) to the admin General settings, leaving headroom below
Cloudflare's 100MB limit.
2026-03-05 22:12:37 +01:00
98fd6dd8e1
chore(beta): release 3.16.0-beta.0
2026-03-05 20:38:56 +00:00
3a30fea862
Merge pull request #207 from the-luap/fix/github-issues-194-197-main
...
feat: add thumbnail settings UI to admin panel
2026-03-05 21:38:41 +01:00
7d6d2f5688
feat: add thumbnail settings UI to admin settings page ( #206 )
...
Add a new "Thumbnails" tab in the admin settings page allowing users to
configure thumbnail dimensions, quality, format, and fit mode from the UI.
Also fix backend route column name mismatch (key/value → setting_key/setting_value)
that caused a 500 error, and add a button to regenerate all thumbnails.
2026-03-04 22:55:14 +01:00
b5074e4e46
Merge pull request #205 from the-luap/release-please--branches--beta
...
Build and Push Docker Images / build-frontend (push) Failing after 3m24s
Build and Push Docker Images / build-backend (push) Failing after 3m25s
Build and Push Docker Images / summary (push) Successful in 4s
chore(beta): release 3.15.3-beta.0
2026-03-02 23:18:27 +01:00
a1d941f049
chore(beta): release 3.15.3-beta.0
2026-03-02 22:18:06 +00:00
github-actions[bot]