Paul Nothaft ea394b5ee5 Merge pull request #1280 from PicPeak/fix/security-scan-batch-1 ...

fix(security): batch 1 — zxcvbn DoS, revocation forgery, unlink traversals, stored Content-Type, edge middleware

2026-09-03 12:36:32 +02:00

..

public

fix(csp): external bootstrap script to survive strict reverse-proxy CSP (#564)

2026-05-31 22:35:00 +02:00

scripts

feat(faces): People in this gallery — face recognition via an optional ML sidecar (#1074) (#1075)

2026-08-18 22:37:28 +02:00

src

docs: document the upload allow-list and the chunked-upload type rule

2026-09-03 11:35:21 +02:00

.dockerignore

…

.env.example

fix(brand-title): runtime substitution so GHCR-image users can override (#521 follow-up)

2026-05-21 10:00:21 +02:00

.env.production.example

fix(brand-title): runtime substitution so GHCR-image users can override (#521 follow-up)

2026-05-21 10:00:21 +02:00

.gitignore

…

audit-frontend.json

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

docker-entrypoint.sh

fix(brand-title): runtime substitution so GHCR-image users can override (#521 follow-up)

2026-05-21 10:00:21 +02:00

Dockerfile

chore(security): close 21 frontend image CVEs — nginx 1.30 base + apk cache-bust

2026-07-16 10:29:31 +02:00

Dockerfile.dev

fix(security): scan triage cleanup — drop dead deps, harden Docker/nginx/postMessage

2026-05-07 22:31:51 +02:00

Dockerfile.prod

fix(security): resolve Docker image CVEs for code scanning alerts

2026-03-02 23:06:15 +01:00

eslint.config.js

Fix mobile overlay and deps per #43

2025-10-29 12:19:43 +01:00

i18next.config.ts

i18n: fail safe on empty strings, normalise German to Sie

2026-09-02 09:43:10 +02:00

index.html

fix(branding): point HTML favicon link at /favicon.ico (the real Safari fix)

2026-06-03 19:01:55 +02:00

nginx.conf

fix(analytics): serve self-hosted trackers same-origin so CSP stops blocking

2026-09-02 09:43:10 +02:00

nginx.dev.conf

fix(nginx): honour outer X-Forwarded-Proto when behind a reverse proxy (#547)

2026-05-22 13:32:01 +02:00

package-lock.json

chore(deps): apply non-breaking npm audit fixes

2026-09-03 10:58:11 +02:00

package.json

chore(main): release 3.122.6-beta.0 (#1279)

2026-09-03 06:50:57 +00:00

postcss.config.js

…

tailwind.config.js

feat(theme): expand color settings to 8-token CI palette + alt button

2026-05-05 16:04:43 +02:00

tsconfig.app.json

feat: overhaul public landing page and backup tooling

2025-09-19 16:39:18 +02:00

tsconfig.json

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

tsconfig.node.json

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

vite.config.ts

feat(deploy): make the all-in-one image installable without a shell (#1124)

2026-08-22 18:37:12 +02:00

vitest.setup.ts

…