f3622396e7
fix(security): invalidate tokens on password change, enforce session timeout, fix role update
...
- Set password_changed_at when changing password via adminAuth route so
existing JWT tokens are rejected by the auth middleware check
- Enforce session timeout on first request with unseen tokens by checking
token iat against configured timeout (prevents bypass after server restart)
- Convert camelCase roleId/isActive to snake_case role_id/is_active in
frontend updateUser service (fixes silent role update failures)
Resolves GHSA-rqg3-47p5-vgwg
2026-03-16 22:34:32 +01:00
56cf60c570
Merge pull request #242 from the-luap/release-please--branches--beta
...
Build and Push Docker Images / build-frontend (push) Failing after 3m26s
Build and Push Docker Images / build-backend (push) Failing after 3m26s
Build and Push Docker Images / summary (push) Successful in 3s
chore(beta): release 3.19.1-beta.0
2026-03-16 22:32:17 +01:00
2618415aa1
chore(beta): release 3.19.1-beta.0
2026-03-16 21:23:14 +00:00
dfae2c2bc6
Merge pull request #241 from the-luap/fix/external-media-dimensions-and-email-colors
...
fix: external media dimensions, theme race condition, email color customization
2026-03-16 22:22:58 +01:00
bbeedd1888
fix: resolve external media dimensions, gallery theme race condition, and add email color customization
...
- Fix dimension repair for external media by using photoResolver instead of hardcoded paths
- Extract photo dimensions via Sharp during external media import
- Remove duplicate theme useEffect from GalleryView to prevent flash/revert race condition
- Pass event welcome_message to Story layout footer for per-event customization
- Add email_primary_color/email_secondary_color settings with admin UI color pickers
- Add i18n keys for email branding in all 4 locales (en, de, ru, pt)
2026-03-16 22:22:36 +01:00
201965b4b1
Merge pull request #240 from the-luap/release-please--branches--beta
...
Build and Push Docker Images / build-backend (push) Failing after 3m29s
Build and Push Docker Images / build-frontend (push) Failing after 3m29s
Build and Push Docker Images / summary (push) Successful in 2s
chore(beta): release 3.19.0-beta.0
2026-03-16 20:25:20 +01:00
1468c459ba
chore(beta): release 3.19.0-beta.0
2026-03-16 16:24:01 +00:00
088de43f09
Merge pull request #239 from the-luap/feat/photo-cap-and-portuguese-locale
...
feat: add photo cap per event and Portuguese locale
2026-03-16 17:23:37 +01:00
1fa222e9c4
feat: add photo cap per event and Portuguese (pt-BR) locale
...
- Add photo_cap column to events table (migration 074) to limit photos per event
- Enforce photo cap in upload route, returning 400 when limit exceeded
- Pass photo_cap through all event CRUD routes and frontend forms
- Add complete Portuguese (pt-BR) translation (2300+ strings)
- Register pt locale in i18n config, language selector, date formatting
- Add photoCap/photoCapHelp translation keys to all locale files (en, de, ru, pt)
2026-03-16 17:22:54 +01:00
6aceb40595
Merge pull request #238 from the-luap/release-please--branches--beta
...
Build and Push Docker Images / build-frontend (push) Failing after 3m20s
Build and Push Docker Images / build-backend (push) Failing after 3m23s
Build and Push Docker Images / summary (push) Successful in 2s
chore(beta): release 3.18.2-beta.0
2026-03-16 16:26:55 +01:00
431a82eca1
chore(beta): release 3.18.2-beta.0
2026-03-16 15:26:11 +00:00
85a07fcca7
Merge pull request #237 from the-luap/fix/security-dep-updates
...
fix: resolve code scanning security alerts (multer, tar, Node 22)
2026-03-16 16:25:52 +01:00
1f524f2358
fix: update dependencies to resolve code scanning security alerts
...
- Upgrade multer to 2.1.1 (CVE-2026-3520, DoS via malformed requests)
- Update tar override to >=7.5.11 (CVE-2026-31802, CVE-2026-29786)
- Upgrade Node base image from 20-alpine to 22-alpine to fix npm
bundled tar/minimatch CVEs in the Docker image
2026-03-16 16:25:29 +01:00
48a025b915
Merge pull request #236 from the-luap/release-please--branches--beta
...
Build and Push Docker Images / build-frontend (push) Failing after 3m20s
Build and Push Docker Images / build-backend (push) Failing after 3m25s
Build and Push Docker Images / summary (push) Successful in 3s
chore(beta): release 3.18.1-beta.0
2026-03-16 15:02:04 +01:00
c652ae0ead
chore(beta): release 3.18.1-beta.0
2026-03-16 14:01:13 +00:00
9a6d2e8e3a
Merge pull request #235 from the-luap/fix/email-preview-wrapper
...
fix: wrap email preview with full styled header/footer template
2026-03-16 15:00:56 +01:00
fc0911acf8
fix: wrap email preview with full styled header/footer template
...
The email template preview modal was showing only raw body HTML without
the styled wrapper (green header bar, logo, footer with company name)
that processTemplate() applies when sending. This made preview not match
what recipients actually receive.
Extract wrapEmailHtml() from processTemplate() and reuse it in the
preview endpoint. Also fix logo URL to use FRONTEND_URL consistently.
Closes #229
2026-03-16 15:00:37 +01:00
f77802325a
Merge pull request #234 from the-luap/release-please--branches--beta
...
Build and Push Docker Images / build-backend (push) Failing after 3m37s
Build and Push Docker Images / build-frontend (push) Failing after 3m37s
Build and Push Docker Images / summary (push) Successful in 2s
chore(beta): release 3.18.0-beta.0
2026-03-16 10:22:14 +01:00
74c9a5fbcd
chore(beta): release 3.18.0-beta.0
2026-03-16 08:38:17 +00:00
703c03fbee
Merge pull request #233 from the-luap/feat/visual-email-editor
...
feat: visual WYSIWYG email template editor
2026-03-16 09:37:57 +01:00
6f95b8c26c
feat: register Russian locale and add to language selector
...
Import ru.json translations in i18n config and add Russian with flag
to the language selector dropdown.
2026-03-16 09:35:03 +01:00
7250c427b9
fix: shorten Save button label on email template editor
...
Change "Save Changes" to "Save" for cleaner toolbar layout.
2026-03-16 09:29:24 +01:00
04a7ea80f9
feat: add visual WYSIWYG email template editor ( #229 )
...
Replace raw HTML textarea with TipTap-based rich text editor for email
templates. Includes formatting toolbar, variable insertion dropdown,
source/visual toggle, and dark mode support. Add Mailhog service to
docker-compose for local email testing.
2026-03-15 22:05:27 +01:00
c0a5cd56c8
Merge pull request #232 from the-luap/i18n/ru-missing-keys
...
i18n: add missing Russian translations for thumbnails and photo dimensions
2026-03-15 20:12:22 +01:00
908ab08815
Merge beta to resolve conflicts for PR #232
2026-03-15 20:02:27 +01:00
52ab609597
i18n: add missing Russian translations for thumbnails and photo dimensions
...
Adds 38 missing keys for settings.thumbnails and settings.photoDimensions
that were added after the initial Russian localization PR (#216 ).
2026-03-15 19:48:41 +01:00
fafcfbf4e6
Merge pull request #216 from Ih0rd/russian-localization
...
basic Russian localization
2026-03-15 19:47:25 +01:00
f07602553c
Merge pull request #228 from the-luap/release-please--branches--beta
...
Build and Push Docker Images / build-backend (push) Failing after 3m24s
Build and Push Docker Images / build-frontend (push) Failing after 3m25s
Build and Push Docker Images / summary (push) Successful in 3s
chore(beta): release 3.17.2-beta.0
2026-03-11 21:54:58 +01:00
56f497c5f1
Merge pull request #227 from the-luap/release-please--branches--main
...
Build and Push Docker Images / build-backend (push) Failing after 3m29s
Build and Push Docker Images / build-frontend (push) Failing after 3m40s
Build and Push Docker Images / summary (push) Successful in 3s
chore(main): release 2.6.1
2026-03-11 21:54:39 +01:00
d2663bff81
chore(beta): release 3.17.2-beta.0
2026-03-11 19:48:06 +00:00
b52cf1f741
chore(main): release 2.6.1
2026-03-11 19:48:05 +00:00
308e086263
Merge pull request #226 from the-luap/fix/security-reporting-policy
...
fix: update security policy with private reporting channels
2026-03-11 20:47:51 +01:00
7f7736282f
Merge pull request #225 from the-luap/fix/security-reporting-policy
...
fix: update security policy with private reporting channels
2026-03-11 20:47:41 +01:00
67b0f32456
fix: update security policy with proper contact email and private reporting
...
- Replace placeholder security@example.com with info@picpeak.app
- Add GitHub Private Vulnerability Reporting links
- Update supported versions table to 2.x.x
Closes #223
2026-03-11 20:21:32 +01:00
25b40c03b0
Merge pull request #224 from the-luap/release/beta-to-main
...
Merge beta into main
2026-03-11 20:19:10 +01:00
28793bba68
Merge main into beta for release/beta-to-main
2026-03-11 20:12:52 +01:00
4ae91142f8
Merge pull request #222 from the-luap/release-please--branches--main
...
Build and Push Docker Images / build-backend (push) Failing after 3m23s
Build and Push Docker Images / build-frontend (push) Failing after 3m18s
Build and Push Docker Images / summary (push) Successful in 2s
chore(main): release 2.6.0
2026-03-11 12:01:51 +01:00
c92879fbd3
chore(main): release 2.6.0
2026-03-11 10:57:06 +00:00
a0bb080586
Merge pull request #221 from the-luap/fix/video-upload-select-all-dimensions
...
fix: video upload, select all, and dimension repair (#203 , #220 , #180 )
2026-03-11 11:56:38 +01:00
fc75bcdfc3
fix: video upload media type, select all, and dimension repair ( #203 , #220 , #180 )
...
- Fix admin video upload missing media_type/mime_type and video processing (#203 )
- Fix Gallery-Premium Select All using atomic callbacks instead of stale closure loop (#220 )
- Add photo dimension repair endpoint and admin UI (#180 )
- Add E2E tests for all three fixes
2026-03-11 11:50:43 +01:00
9877f63aed
Merge pull request #219 from the-luap/release-please--branches--beta
...
Build and Push Docker Images / build-frontend (push) Failing after 3m20s
Build and Push Docker Images / build-backend (push) Failing after 3m20s
Build and Push Docker Images / summary (push) Successful in 2s
chore(beta): release 3.17.1-beta.0
2026-03-08 15:47:06 +01:00
0c98c6b453
chore(beta): release 3.17.1-beta.0
2026-03-08 14:42:28 +00:00
831ea6a3bc
Merge pull request #218 from the-luap/fix/optional-email-event-creation
...
fix: respect optional email settings in event creation
2026-03-08 15:42:14 +01:00
9c44a0ebfa
fix: respect optional email settings in event creation ( #217 )
...
When admin/customer emails were configured as optional in Settings >
Event Creation, the backend still rejected empty values because:
1. express-validator .optional() only skips undefined, not empty strings
— changed to .optional({ values: 'falsy' }) so "" is treated as
absent
2. DB columns host_email and admin_email had NOT NULL constraints
— added migration to make them nullable
3. Email queue insert crashed on null recipient_email
— skip queuing when no customer email is provided
2026-03-08 15:36:38 +01:00
a840ad4594
basic Russian localization
2026-03-06 06:17:30 +03:00
08ac238d0a
Merge pull request #215 from the-luap/release-please--branches--beta
...
Build and Push Docker Images / build-backend (push) Failing after 3m31s
Build and Push Docker Images / build-frontend (push) Failing after 3m31s
Build and Push Docker Images / summary (push) Successful in 3s
chore(beta): release 3.17.0-beta.0
2026-03-05 22:22:58 +01:00
7d967a47ae
chore(beta): release 3.17.0-beta.0
2026-03-05 21:21:48 +00:00
9b7495e005
Merge pull request #214 from the-luap/feat/configurable-upload-batch-size
...
feat: configurable upload batch size for reverse proxy compatibility
2026-03-05 22:21:29 +01:00
e1ad4219a5
Merge pull request #212 from the-luap/revert-210-feat/configurable-upload-batch-size
...
Revert "feat: configurable upload batch size for reverse proxy compatibility"
2026-03-05 22:16:43 +01:00
cc4503ad28
Revert "feat: configurable upload batch size for reverse proxy compatibility"
2026-03-05 22:16:28 +01:00
Paul Nothaft