377 Commits

Author	SHA1	Message	Date
Paul Nothaft	77cb65f5a2	chore(main): release 3.103.1-beta.0 (#1053)	2026-08-16 13:17:54 +00:00
Paul Nothaft	2728479d2a	chore(main): release 3.103.0-beta.0 (#1052)	2026-08-16 13:02:55 +00:00
Paul Nothaft	9b976386f9	chore(main): release 3.102.2-beta.0 (#1046)	2026-08-13 16:57:48 +00:00
Paul Nothaft	e2832725ea	chore(main): release 3.102.1-beta.0 (#1026)	2026-08-11 08:41:17 +00:00
Paul Nothaft	054c342c33	chore(main): release 3.102.0-beta.0 (#1025)	2026-08-11 07:49:42 +00:00
Paul Nothaft	02deac9f10	chore(main): release 3.101.5-beta.0 (#1021)	2026-08-10 11:36:23 +00:00
Paul Nothaft	08e0098597	chore(main): release 3.101.4-beta.0 (#1016)	2026-08-10 09:03:45 +00:00
Paul Nothaft	5503e6ca5e	chore(main): release 3.101.3-beta.0 (#1011)	2026-08-10 07:18:08 +00:00
Paul Nothaft	fbe1d07228	chore(main): release 3.101.2-beta.0 (#1009)	2026-08-10 06:30:01 +00:00
Paul Nothaft	4ec93107a9	chore(main): release 3.101.1-beta.0 (#1007)	2026-08-10 06:19:11 +00:00
Paul Nothaft	80599a5e47	chore(main): release 3.101.0-beta.0 (#1004)	2026-08-09 11:43:36 +00:00
Paul Nothaft	e2d8ec86bd	chore(main): release 3.100.2-beta.0 (#1002)	2026-08-09 09:19:07 +00:00
Paul Nothaft	1f224f4ead	chore(main): release 3.100.1-beta.0 (#996)	2026-08-04 15:33:44 +00:00
Paul Nothaft	9dc2b2166e	chore(main): release 3.100.0-beta.0 (#994)	2026-08-04 14:52:13 +00:00
Paul Nothaft	083b3d86b0	chore(main): release 3.99.2-beta.0 (#989)	2026-08-04 12:40:03 +00:00
Paul Nothaft	6c03feaef5	fix(deps): bump ip-address, brace-expansion and postcss for open CVEs (#987) ... Closes Trivy code-scanning alerts #414-#418 on the backend image. brace-expansion 5.0.8 -> 5.0.9 CVE-2026-69152 (high) DoS via unbounded intermediate arrays ip-address 10.2.0 -> 10.4.0 CVE-2026-69192 (high), CVE-2026-54272 and CVE-2026-69198 (medium) — SSRF and trust-boundary bypasses. Needs 10.3.1+ to clear all three. postcss 8.5.18 -> 8.5.23 CVE-2026-69153 (medium) information disclosure via crafted sourceMappingURL ip-address and brace-expansion were already in overrides but pinned below the new fixed versions; the floors just needed raising. postcss reaches the image through sanitize-html — the direct pin is not an import, it forces the transitive copy to dedupe to a known version, so it moves with the bump. Only the backend image is affected: the frontend production stage is nginx:1.30-alpine and ships no node_modules. Each lockfile now holds exactly one entry per package, all at or above the fixed version, and the image installs via npm ci --omit=dev so the lockfile is authoritative.	2026-08-04 14:35:57 +02:00
Paul Nothaft	0ef836df19	chore(main): release 3.99.1-beta.0 (#986)	2026-08-04 12:21:08 +00:00
Paul Nothaft	83d514315e	chore(main): release 3.99.0-beta.0 (#980)	2026-08-03 20:06:19 +00:00
Paul Nothaft	d66425c8ee	chore(main): release 3.98.6-beta.0 (#978)	2026-08-03 12:52:55 +00:00
Paul Nothaft	569ae39acb	chore(main): release 3.98.5-beta.0 (#973)	2026-08-02 19:27:37 +00:00
Paul Nothaft	3fc6463873	chore(main): release 3.98.4-beta.0 (#971)	2026-08-02 19:22:22 +00:00
Paul Nothaft	acd6b453d1	chore(main): release 3.98.3-beta.0 (#954)	2026-08-02 20:25:32 +02:00
Paul Nothaft	8cbb37310b	chore(main): release 3.98.2-beta.0 (#945)	2026-08-01 17:37:57 +02:00
Paul Nothaft	fe615c82e4	fix(security): bump sanitize-html to 2.17.5 (CVE-2026-53606) (#937) ... Co-authored-by: Paul Nothaft <paul@MacStudio-von-Paul.local>	2026-08-01 17:36:09 +02:00
Paul Nothaft	cf37ad5389	chore(main): release 3.98.1-beta.0 (#935)	2026-08-01 10:32:31 +00:00
Paul Nothaft	2581f4af70	chore(main): release 3.98.0-beta.0 (#930)	2026-07-31 09:56:00 +02:00
Paul Nothaft	39d397c086	chore(main): release 3.97.6-beta.0 (#926)	2026-07-30 12:28:18 +00:00
Paul Nothaft	342dde3589	chore(main): release 3.97.5-beta.0 (#922)	2026-07-30 10:19:02 +00:00
Paul Nothaft	55b344b531	chore(main): release 3.97.4-beta.0 (#918)	2026-07-29 20:26:14 +00:00
Paul Nothaft	888150ba2d	chore(main): release 3.97.3-beta.0 (#913)	2026-07-29 19:48:17 +00:00
Paul Nothaft	1ee7fe7336	chore(main): release 3.97.2-beta.0 (#906)	2026-07-29 16:02:10 +00:00
Paul Nothaft	5171105938	chore(main): release 3.97.1-beta.0 (#901)	2026-07-29 10:40:56 +00:00
Paul Nothaft	564e816bec	chore(main): release 3.97.0-beta.0 (#899)	2026-07-29 09:46:14 +00:00
Paul Nothaft	435c558704	chore(main): release 3.96.1-beta.0 (#898)	2026-07-29 09:30:02 +00:00
Paul Nothaft	9f7c644e0a	chore(main): release 3.96.0-beta.0 (#897)	2026-07-29 09:25:35 +00:00
Paul Nothaft	0f8b68c05c	chore(main): release 3.95.5-beta.0 (#896)	2026-07-29 08:55:34 +00:00
Paul Nothaft	d41cd9746d	chore(main): release 3.95.4-beta.0 (#887)	2026-07-27 22:12:46 +00:00
Paul Nothaft	06a9991a22	chore(main): release 3.95.3-beta.0 (#880)	2026-07-27 07:57:33 +00:00
Paul Nothaft	08be2b84f1	fix(security): close 5 Trivy alerts — postcss/tar bumps + drop npm from the runtime image (#878) ... * fix(security): close the 5 open Trivy alerts — dep bumps + drop npm from the runtime image Backend deps: - postcss 8.5.10 -> 8.5.18 (CVE-2026-45623, GHSA-r28c-9q8g-f849; the pin exists to force sanitize-html's transitive copy onto a fixed version) - tar pin/override >=7.5.16 -> >=7.5.21, resolves 7.5.22 (GHSA-r292-9mhp-454m) Runtime image: - Remove the npm CLI from the final stage instead of upgrading it: npm's bundled node_modules ship tar 7.5.19 and brace-expansion 5.0.7 (no npm release bundles the fixed versions — checked 11.18.0 and 12.0.1), and npm never runs in production. wait-for-db.sh now invokes the migration runners via node directly. This ends the recurring npm-bundled-CVE alert class; the previous 'npm install -g npm@11' line was itself a patch for the last batch. * fix(restore): run post-restore migrations via node — the image ships no npm restoreService still shelled out to 'npm run migrate:safe' after a restore; with npm removed from the runtime image that would ENOENT into the non-fatal catch, silently leaving a restored older backup on a schema behind the running code until the next container restart. Invoke migrations/run-migrations-safe.js through node directly, matching wait-for-db.sh. The PR #596 source-contract test now pins the new invocation.	2026-07-27 09:54:33 +02:00
Paul Nothaft	ea8bd9b3e9	chore(main): release 3.95.2-beta.0 (#876)	2026-07-27 07:10:19 +00:00
Paul Nothaft	a2e723413e	fix(backup): make backup settings actually apply (#871) (#874) ... * fix(backup): make backup settings actually apply (#871) - Wire the What-to-Backup toggles into the walker: honor backup_include_thumbnails / backup_include_photos (opt-out, default ON) and accept the UI's backup_include_archives spelling for the archived gate (the engine expected _archived, so the Archives checkbox silently never worked). - Fix the 167.6 TB dashboard size: file_size_bytes is a bigint that node-postgres returns as a string, and the S3 path concatenated it onto the byte counter; coerce to Number at the source. - Compute the real next scheduled run (cron-parser) and return it as nextBackup; the UI read a field the API never sent and rendered a hardcoded 'Not scheduled'. A named schedule label now beats the stray default cron the UI always sent, which silently turned weekly schedules into daily 03:00 runs. - Never back up filesystem noise (.nfs* silly-renames, .DS_Store, Thumbs.db) and honor backup_exclude_patterns in the walker (previously rsync-only). - Remove the compression/encryption toggles from the configuration UI: no backend implementation exists, and collecting an encryption passphrase while uploading plaintext is a false promise. Closes #871 * fix(backup): close the review gaps in the settings wiring - The UI's backup_include_archives now beats the migration-seeded backup_include_archived: every install has the singular key seeded true, so the alias-only-when-absent lookup made unchecking Archives a no-op. - rsync destinations now receive the de-selected What-to-Backup paths and the noise filters as anchored --exclude args; previously rsync synced the whole storage root and the walker's selection only shaped the manifest, which then misreported what was actually transferred. - Escape regex metacharacters in the walker's glob matcher: '.nfs*' compiled to /^.nfs.*$/ whose leading dot matched any character, so files like anfs-photo.jpg were silently dropped from backups. - The Backup Coverage report now uses the same gate as the walker (new 'skipped-by-setting' status) instead of re-implementing it without the opt-out toggles and the archives alias. * fix(backup): make the coverage diagnostics agree with the walker - The coverage table shows the alias-aware flag value the gate actually used, instead of the seeded backup_include_archived shadowed by the UI's plural key (true next to a 'Gated off' badge). - skipped-by-setting paths are now counted in the coverage summary (backend, TS contract, summary card, EN/DE locales) so the totals reconcile again when Photos or Thumbnails is unchecked. - The form's thumbnail default now matches the backend's never-saved fallback (include): the checkbox no longer shows 'off' while thumbnails are being backed up, and saving an unrelated setting no longer flips the backup scope. * fix(backup): keep custom crons, exclude disabled rows from rsync, normalize flag display - Saving a named schedule no longer wipes the stored custom cron: the backend already prefers the label, so the cron field stays inert for named schedules and is preserved for switching back to Custom. A custom schedule now validates the 5-field expression before saving (the backend silently fell back to daily 02:00 on a blank value). - resolveExcludedBackupPaths now also returns rows disabled via include_in_default, so rsync excludes them; the enabled-only loader hid them and rsync transferred their contents anyway. - The coverage table normalizes flag values like the walker does — Boolean('false') displayed true beside a gated-off badge.	2026-07-27 09:06:38 +02:00
Paul Nothaft	0c65edd99a	chore(main): release 3.95.1-beta.0 (#872)	2026-07-26 18:41:13 +00:00
Paul Nothaft	38b8d476d1	fix(security): bump backend deps to close all 14 open Trivy code-scanning alerts (#869) ... * fix(security): bump backend deps to close all open Trivy code-scanning alerts - axios 1.16.0 -> 1.18.1 (GHSA-gcfj-64vw-6mp9 high + 10 medium advisories) - sharp 0.34.3 -> 0.35.3 (GHSA-f88m-g3jw-g9cj, inherited libvips CVEs) - mailparser 3.9.9 -> 3.9.14 (pulls linkify-it 5.0.2, CVE-2026-59887) - brace-expansion override >=5.0.6 -> >=5.0.7 (CVE-2026-13149) - body-parser 1.20.4 -> 1.20.6 via lockfile refresh (CVE-2026-12590) * fix(images): migrate removed sharp failOnError option and enforce Node >=20.9 sharp 0.35 drops the deprecated failOnError constructor option, so recoverably corrupt images would start failing upload validation and thumbnail generation; use the failOn: 'none' equivalent instead. sharp 0.35 also requires Node >=20.9: declare it in engines and make picpeak-setup.sh compare the full version instead of only the major, so native installs on Node 20.3-20.8 upgrade instead of breaking. * fix(setup): align the Node floor with the whole dependency tree and gate native updates html-to-text@10 needs Node >=20.19 and the glob/minimatch family excludes Node 21, so declare engines as ^20.19.0 || >=22 and enforce the same range in picpeak-setup.sh. Also run install_nodejs at the start of update_native_installation so existing native installs on an old Node get upgraded before the service is stopped, instead of restarting broken. * fix(setup): make the update-path Node gate actually work --update dispatches before detect_os, so install_nodejs saw an empty PACKAGE_MANAGER, matched no install branch, and reported success on the old runtime. Detect the OS on demand and re-verify the installed version afterwards, failing loudly (before the service is stopped) when the runtime still misses the engines range, e.g. a Node 21 that package managers refuse to downgrade.	2026-07-26 20:38:05 +02:00
Paul Nothaft	6e2e0a1a63	chore(main): release 3.95.0-beta.0 (#867)	2026-07-25 13:10:23 +02:00
Paul Nothaft	c5dc790e28	chore(main): release 3.94.2-beta.0 (#864)	2026-07-23 19:59:53 +00:00
Paul Nothaft	9ac23e5fe1	chore(main): release 3.94.1-beta.0 (#861)	2026-07-22 19:30:46 +00:00
Paul Nothaft	f89d374236	chore(main): release 3.94.0-beta.0 (#859)	2026-07-22 19:10:00 +00:00
Paul Nothaft	ad326da35c	chore(main): release 3.93.0-beta.0 (#853)	2026-07-19 20:40:52 +00:00
Paul Nothaft	613133c29c	chore(main): release 3.92.2-beta.0 (#852)	2026-07-19 20:05:52 +00:00
Paul Nothaft	8337a716b1	fix(file-watcher): bound concurrent photo processing (#846) ... * fix(file-watcher): bound concurrent photo processing chokidar fires 'add' once per file — with no ignoreInitial option the boot scan fires it for every existing file, and a bulk drop into the watch folder fires it for every new one at once. Each handler runs DB lookups plus (for new files) a full sharp pipeline; sharp.concurrency(2) only caps libvips threads WITHIN one operation, not the number of parallel pipelines, so unbounded handlers can OOM small hosts. Gate both 'add' and 'unlink' through a shared p-limit (FILE_WATCHER_CONCURRENCY, default 2, floor 1) — mass deletes otherwise burst DB work and ZIP-cache invalidation the same way. p-limit is pinned to ^3.1.0, the last CommonJS release. Adapted from the filpgame fork (426ca491) — thanks @filpgame; extended to cover 'unlink', documented in .env.example, plus a lock-in test for the existing Sharp cache/concurrency caps this bound relies on. * chore(compose): pass FILE_WATCHER_CONCURRENCY into the backend container (codex review of #846) The backend service uses an explicit environment list (no env_file), so the documented override never reached the container in the default compose deployments. Added to both compose files + root .env.example.	2026-07-19 22:00:46 +02:00