d1d71dba25
chore(main): release 2.6.4
2026-04-08 07:14:32 +00:00
730912a3f4
security: fix 20 dependency vulnerabilities (backport to main)
...
Same fixes as beta PR #274 . Updates handlebars, nodemailer, tar,
fast-xml-parser, brace-expansion, path-to-regexp, and lodash to
address 20 GitHub code scanning alerts.
2026-04-08 09:05:48 +02:00
9cbbe74051
chore(main): release 2.6.3
2026-04-07 18:40:34 +00:00
681b440381
security: pin axios to 1.14.0 to prevent supply chain attack
...
Axios versions 1.14.1 and 0.30.4 were compromised on March 31, 2026
with a RAT dropper attributed to North Korean threat actor. Pin to
exact 1.14.0 (latest safe release) to prevent resolution to compromised
versions. See https://github.com/axios/axios/issues/10604
2026-04-05 18:41:45 +02:00
7febba2d9c
chore(main): release 2.6.2
2026-03-16 21:37:35 +00:00
b52cf1f741
chore(main): release 2.6.1
2026-03-11 19:48:05 +00:00
0c98c6b453
chore(beta): release 3.17.1-beta.0
2026-03-08 14:42:28 +00:00
7d967a47ae
chore(beta): release 3.17.0-beta.0
2026-03-05 21:21:48 +00:00
98fd6dd8e1
chore(beta): release 3.16.0-beta.0
2026-03-05 20:38:56 +00:00
a1d941f049
chore(beta): release 3.15.3-beta.0
2026-03-02 22:18:06 +00:00
c0301dcbf4
Merge branch 'beta' into fix/github-issues-194-197-main
2026-03-02 23:15:37 +01:00
cbecb9323c
fix(security): resolve Docker image CVEs for code scanning alerts
...
- Upgrade nginx base from 1.27-alpine to 1.28-alpine (Alpine 3.23, OpenSSL 3.5.5)
- Upgrade npm to latest in backend production stage to fix tar, minimatch, brace-expansion CVEs
- Add brace-expansion and minimatch overrides for app-level transitive deps
- Remove incompatible body-parser v2 override (breaks Express 4 JSON parsing)
- Remove npm upgrade from builder stages (npm 11 breaks npm ci with existing lockfile)
2026-03-02 23:06:15 +01:00
4272618b3f
fix(security): resolve all npm audit vulnerabilities
...
Frontend (6 → 0 vulnerabilities):
- axios: update to fix DoS via __proto__ key in mergeConfig (CVE-2026-25639)
- swiper: update to fix prototype pollution (critical)
- rollup: update to fix arbitrary file write via path traversal
- minimatch: update to fix multiple ReDoS vulnerabilities
- ajv: update to fix ReDoS with $data option
- markdown-it: update to fix ReDoS
Backend (32 → 0 vulnerabilities):
- multer: update to fix DoS via incomplete cleanup and resource exhaustion
- minimatch: update to fix multiple ReDoS vulnerabilities
- Add npm overrides for transitive dependencies:
- fast-xml-parser >=5.3.8 (fixes XSS, DoS, stack overflow via AWS SDK)
- qs >=6.14.2 (fixes arrayLimit bypass DoS via Express)
- tar >=7.5.8 (fixes path traversal and hardlink attacks via sqlite3)
Docker:
- Pin nginx base image to 1.27-alpine in Dockerfile.prod
- Update security comments in backend Dockerfile
- Existing apk upgrade --no-cache ensures OpenSSL/libexpat CVEs are
patched at build time (OpenSSL 3.5.5, Alpine 3.23.3)
2026-03-02 10:36:47 +01:00
3e0c4fd73e
chore(beta): release 3.15.2-beta.0
2026-02-22 21:37:26 +00:00
f672c1daa6
chore(main): release 2.5.0
2026-02-21 19:48:43 +00:00
888c4ab209
Merge main into beta for release/beta-to-main
...
Resolved conflicts in CHANGELOG.md, backend/package.json, and
frontend/package.json. Version set to 3.15.1.
2026-02-21 20:43:46 +01:00
9045402c9a
chore(beta): release 3.15.1-beta.0
2026-02-21 19:31:37 +00:00
fe9486e5fa
chore(beta): release 3.15.0-beta.0
2026-02-17 19:47:41 +00:00
6613f1b088
chore(beta): release 3.14.0-beta.0
2026-02-17 14:38:14 +00:00
3ea9d5b121
Merge pull request #185 from the-luap/feat/new-features
...
feat: original filename in admin UI, update dialog, and security hardening
2026-02-17 15:37:56 +01:00
50c09904a9
feat: add update instructions dialog, email notifications, and capture date sorting
...
- Add Update Instructions Dialog with environment-specific commands (Docker/Git/Standalone)
- Add email notification settings for new version alerts
- Add "Sort by Capture Date" option using EXIF metadata extraction
- Fix E2E tests by loading environment variables via dotenv
- Add test-images/ and backend/*.db to .gitignore
Closes #181
2026-02-16 16:23:57 +01:00
d239857d9a
chore(beta): release 3.13.1-beta.0
2026-02-15 21:49:34 +00:00
edf3a43950
chore(beta): release 3.13.0-beta.0
2026-02-06 23:35:55 +00:00
2c35543e73
chore(beta): release 3.12.0-beta.0
2026-02-06 22:29:57 +00:00
e05fd64760
chore(beta): release 3.11.0-beta.0
2026-02-06 20:46:15 +00:00
10ff6b118c
chore(beta): release 3.10.1-beta.0
2026-02-03 16:25:51 +00:00
8ddec6ed8b
chore(beta): release 3.10.0-beta.0
2026-02-03 14:56:50 +00:00
7bf1e5c0f9
chore(beta): release 3.9.0-beta.0
2026-02-01 21:58:22 +00:00
9ec0e2e7c0
chore(beta): release 3.8.0-beta.0
2026-01-30 07:34:38 +00:00
c40f34d3de
chore(beta): release 3.7.0-beta.0
2026-01-28 21:54:14 +00:00
b4978c0869
chore(beta): release 3.6.0-beta.0
2026-01-27 10:45:56 +00:00
32fc939c7a
chore(beta): release 3.5.0-beta.0
2026-01-25 14:24:28 +00:00
9c8b5e9fd6
chore(beta): release 3.4.0-beta.0
2026-01-22 13:00:33 +00:00
f4da354ae7
chore(beta): release 3.3.0-beta.0
2026-01-21 16:06:24 +00:00
237eeea5a6
chore(beta): release 3.2.5-beta.0
2026-01-18 14:35:30 +00:00
cf38305f28
chore(beta): release 3.2.4-beta.0
2026-01-17 14:08:09 +00:00
b613f8fbc7
chore(beta): release 3.2.3-beta.0
2026-01-16 14:19:26 +00:00
e808e529cd
chore(beta): release 3.2.2-beta.0
2026-01-16 13:53:31 +00:00
b5f06af126
chore(beta): release 3.2.1-beta.0
2026-01-16 13:35:53 +00:00
7805e89bfe
chore(beta): release 3.2.0-beta.0
2026-01-16 08:43:36 +00:00
d603567e21
chore(beta): release 3.1.0-beta.0
2026-01-15 20:03:57 +00:00
c6fdd38e84
Merge pull request #115 from the-luap/fix/codeql-v4-upgrade
...
feat: pre-generated watermarks and mobile upload button improvements
2026-01-15 15:03:25 -05:00
1be974afbb
feat: pre-generate watermarks for instant lightbox loading
...
Previously watermarks were applied on-the-fly when viewing photos in the
lightbox, causing 1+ minute load times for high-resolution images.
This change pre-generates watermarked versions during upload and when
watermark settings change, enabling instant image loading (~50-100ms).
- Add database migration for watermark_path tracking (061)
- Add watermarkGeneratorService for batch operations
- Extend watermarkService with save-to-disk capability
- Modify gallery endpoint to serve pre-generated files
- Add background regeneration when branding settings change
- Add npm script for migrating existing photos
Closes #112
2026-01-15 21:00:10 +01:00
b12621b994
chore(main): release 2.4.0
2026-01-15 19:18:31 +00:00
0f7551ab5b
chore(main): release 2.3.4
2026-01-15 15:24:23 +00:00
e945bc9413
chore(main): release 2.3.3
2026-01-15 14:23:34 +00:00
f29b77998b
chore(main): release 2.3.2
2026-01-15 13:02:43 +00:00
7b5916d3b9
chore(main): release 2.3.1
2026-01-15 11:45:24 +00:00
a0f38053d3
chore(beta): release 3.0.1-beta.0
2026-01-15 11:35:58 +00:00
2add85eccf
chore: sync package.json versions to 2.3.0
2026-01-15 11:19:05 +00:00
github-actions[bot]