Paul Nothaft
37bf894412
Closes the open Trivy code-scanning alerts for app-side dependencies. The npm-bundled CVEs in /usr/local/lib/node_modules/npm (picomatch, brace-expansion, ip-address inside the Node image itself) are deferred to a separate Node-base-image PR — they're build-environment-side and need their own compatibility testing. | Package | From | To | CVEs cleared | |---|---|---|---| | axios (backend + frontend) | 1.14.0 | 1.15.2 | CVE-2026-42264 (HIGH), CVE-2026-42043 (HIGH), CVE-2026-42035 (HIGH), CVE-2026-42033 (HIGH), CVE-2026-42044, CVE-2026-42042, CVE-2026-42041, CVE-2026-42040, CVE-2026-42039, CVE-2026-42038, CVE-2026-42037, CVE-2026-42036, CVE-2026-42034, CVE-2026-40175, CVE-2025-62718 | | nodemailer (backend) | ^7.0.13 | ^8.0.5 | GHSA-vvjj-xcjg-gr5g, GHSA-c7w3-x93f-qmm8 | | i18next-http-backend (frontend) | ^3.0.2 | ^3.0.5 | CVE-2026-41691 | | uuid (backend) | ^11.1.0 | ^11.1.1 | CVE-2026-41907 | | postcss (frontend, devDep) | ^8.4.21 | ^8.5.10 | CVE-2026-41305 | For transitives whose direct parents haven't released a version that picks up the patched range, pinned via npm overrides: | Package | Min | CVE | |---|---|---| | follow-redirects (backend + frontend) | >=1.16.0 | GHSA-r4q5-vmmm-2653 | | fast-xml-parser (backend) | >=5.7.0 | CVE-2026-41650 | | @tootallnate/once (backend) | >=3.0.1 | CVE-2026-3449 | | ip-address (backend) | >=10.1.1 | CVE-2026-42338 | PR #268 originally pinned axios to 1.14.0 to avoid a supply-chain attack on a specific compromised version range. The 1.15.x series are post-incident upstream releases — clean. Confirmed with the maintainer before bumping. * `npx tsc --noEmit` (frontend) — clean * `npx vite build` (frontend) — clean (~4s, existing bundle-size warning, not new) * Backend module-load smoke test — all critical modules load (`auth`, `adminAuth` middleware, `emailProcessor`, `recaptcha`, `storage`) with the new axios + nodemailer * Lockfile re-verification — every targeted CVE now resolves to the patched version range * npm-bundled CVEs inside `/usr/local/lib/node_modules/npm/` — picomatch CVE-2026-33671 (HIGH), CVE-2026-33672, brace-expansion CVE-2026-33750, ip-address (npm-internal) CVE-2026-42338. These live in the Node base image and require a Node base image bump with its own compatibility testing — separate PR. Targeting `beta` so the bumps go through the normal release-please flow before promotion to `main`.
PicPeak
PicPeak lets you create password-protected, time-limited photo galleries for your clients — hosted on your own server. No subscriptions, no storage limits, no third-party access to your photos.
Demo
Try it out at demo.picpeak.app.
Admin panel: demo.picpeak.app/admin — login with [email protected] / Demo2026!
The demo resets periodically.
Features
Gallery Management — Create galleries, upload photos via drag & drop, set passwords and expiration dates. Galleries auto-archive when they expire. Events start as drafts so you can upload and prepare before notifying the client.
Client Experience — Responsive galleries that look great on any device. Guests can browse, download individual photos or everything at once. Optional guest uploads and feedback (likes, comments, ratings).
Themes & Branding — 11 built-in theme presets, custom CSS templates, configurable colors/fonts/layouts. White-label your admin panel and login page with your own logo and company name.
Email Notifications — Automated gallery creation, expiration warning, and archive emails. Multilingual templates (EN, DE, NL, PT, RU) editable from the admin UI.
Photo Protection — Watermarking, right-click prevention, canvas rendering, DevTools detection. Configurable per gallery.
External Media — Reference photos from a mounted folder instead of uploading. PicPeak reads originals in place and generates thumbnails on demand.
Multi-Language — Full UI translations for English, German, Dutch, Portuguese, and Russian. Email templates support all languages independently.
Analytics — Built-in view/download tracking plus optional Umami integration for privacy-focused analytics.
Video Support — Upload and stream MP4, WebM, MOV alongside photos. FFmpeg bundled via npm.
Multiple Admins — Role-based access control with super admin, admin, and editor roles.
Quick Start
git clone https://github.com/the-luap/picpeak.git
cd picpeak
cp .env.example .env
# Edit .env — set at least JWT_SECRET and passwords
docker compose up -d
Open http://localhost:3000 and log in with the credentials from your .env.
Permissions: Set
PUIDandPGIDin.envto match your host user (id -u/id -g) so Docker volumes are writable.
See the Deployment Guide for reverse proxy setup, SSL, external media, and production configuration.
Screenshots
Admin Dashboard
Event Management
Analytics
Comparison
| PicPeak | PicDrop | Scrapbook.de | |
|---|---|---|---|
| Self-hosted | Yes | No | No |
| Monthly cost | $0 | $29-199 | 19-99 EUR |
| Storage | Unlimited | 50-500 GB | 100-1000 GB |
| Custom branding | Full | Limited | Limited |
| Open source | Yes | No | No |
| API | Yes | Paid | No |
Tech Stack
- Backend: Node.js, Express, PostgreSQL (or SQLite)
- Frontend: React, TypeScript, Tailwind CSS
- Infrastructure: Docker, Nginx, Redis
- Processing: Sharp (images), FFmpeg (video)
Release Channels
Stable (stable / latest) — Production-ready. Use this for real deployments.
Beta (beta) — Early access to new features. May have rough edges.
# Set in .env
PICPEAK_CHANNEL=stable # or beta
# Update
docker compose -f docker-compose.production.yml pull
docker compose -f docker-compose.production.yml up -d
The admin dashboard notifies you when updates are available.
Contributing
We welcome contributions — bug fixes, features, translations, documentation. See CONTRIBUTING.md for setup instructions.
Documentation
- Deployment Guide — Installation, configuration, reverse proxy, external media
- Admin API (OpenAPI) — Machine-readable API spec
- Admin API Quickstart — Authentication and testing guide
- Security Policy
Contributors
Thanks to the people whose code, reports, and feedback have shaped PicPeak:
- @Luca-Timo — native Apple Silicon multi-arch images, external-URL toggle for legal CMS pages, lazy-loaded folder tree picker, admin-email picker, self-hosted webfont system, gallery header/banner decoupling, and several typed-API refactors.
- @Rekoo-PS — sharp-eyed bug reporter and product feedback. Filed the issues that drove the login-loop fix, gallery-loading skeleton work, mobile-lightbox overhaul, admin-events search-counter fix, photo-count column, and bulk-delete workflow. Also a BuyMeACoffee supporter.
If you've contributed and aren't listed here, please open a PR.
License
MIT — use it for personal or commercial projects.