Koko210/immich-folio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
70313fa2a6fd8a62acb63d1f00f666a7a669d1c5
immich-folio/package.json

45 lines
1.1 KiB
JSON
Raw Normal View History

Initial commit from Create Next App
2026-02-13 23:26:37 +01:00
{
"name": "immich-lightbox",
security: fix pre-auth bypasses and restore Immich 3.x compatibility (#378) Seven security issues from an audit, plus album pages and the map coming up empty against Immich 3.x. Verified against a real Immich 3.0.3 instance in a production build. Security: - Admin session forgery via a hardcoded 'dev-fallback-secret' signing key that bypassed the production AUTH_SECRET guard - /api/map ignored album passwords and returned working asset tokens; rewriting ?size=thumbnail to ?size=original downloaded full-resolution originals from protected albums - Admin login had no rate limit, and the client IP came from a spoofable header, so rotating it bypassed every limit in the app - Raw Immich asset UUIDs were serialized into the RSC payload - Album tokens never expired server-side; a captured token replayed forever - Path traversal into the Immich API via an unvalidated album id - /admin ran with no enforced CSP (only Report-Only reached it) TRUSTED_PROXIES is replaced by TRUSTED_PROXY_HOPS. The old variable matched proxy IPs against the socket peer address, which self-hosted Next.js never exposes, so the check could never pass: unset, the limiter read a spoofable header; set, every request shared one bucket and a single client could rate-limit the whole site. Migrates automatically. Immich 3.x: GET /albums/:id no longer embeds assets. Assets now come from POST /search/metadata with withExif: true — without that flag EXIF is omitted and grid aspect ratios, the lightbox panel and map markers stay empty. Drops support for Immich below 3.0, which now logs a warning. Upgrade: requires Immich 3.0+; set TRUSTED_PROXY_HOPS (nginx = 1); visitors of protected areas and admin sessions must log in once more. 91 unit tests (25 new); the new admin-auth and rate-limit cases were confirmed to fail against the pre-fix code. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-20 18:57:57 +02:00
"version": "0.9.0",
chore: make project open source under MIT license
2026-03-08 17:45:32 +01:00
"license": "MIT",
Initial commit from Create Next App
2026-02-13 23:26:37 +01:00
"scripts": {
"dev": "next dev",
"build": "next build",
"start": "next start",
feat: visual polish & UX — fade-in, theme toggle, scroll-to-top, footer, cursor, badge - Add FadeIn component (IntersectionObserver scroll-reveal + load animation) - Add dark/light theme toggle (useSyncExternalStore + localStorage) - Add scroll-to-top button (appears after 300px scroll) - Add configurable footer with social links (gallery.yaml) - Add crosshair cursor on photo grid items - Add 'X photos' count badge on subpage cover images - Add light theme color palette in tokens.css
2026-02-14 11:47:26 +01:00
"lint": "eslint .",
"format": "prettier --write .",
"format:check": "prettier --check .",
"test": "vitest",
"test:unit": "vitest run",
"test:coverage": "vitest run --coverage",
"test:e2e": "playwright test"
Initial commit from Create Next App
2026-02-13 23:26:37 +01:00
},
"dependencies": {
feat(admin): add asset picker with favorites, drag-and-drop reordering, preview links, and keyboard shortcuts - Asset Picker: Visual browser for hero images with Favorites tab (shown first) and All Photos tab. Includes infinite scroll and UUID fallback input for assets not easily found in the grid. - Drag & Drop: All lists (hero images, standalone albums, subpage albums, subpage tiles) are now reorderable via drag handles using @dnd-kit. - Preview Links: 'Preview Site' button in save bar, '↗ Site' in header, and per-subpage preview links with URL slug preview shown inline. - Keyboard Shortcuts: ⌘+S / Ctrl+S to save in both Pages and Settings tabs. - Unsaved Changes Guard: beforeunload warning prevents accidental data loss. - New API route /api/admin/assets for browsing Immich assets with pagination and favorites filter via search/metadata endpoint.
2026-05-29 17:59:25 +02:00
"@dnd-kit/core": "^6.3.1",
"@dnd-kit/sortable": "^10.0.0",
"@dnd-kit/utilities": "^3.2.2",
feat: photography features & image optimizations - Hero carousel: gallery.yaml hero accepts single UUID or array, crossfade component - Full-bleed single albums: subpages with 1 album skip grid, render photos directly - EXIF on hover: camera/lens/focal length overlay on grid items (toggle via exifOnHover) - Customizable grid: columns/gap/aspectRatio/layout (masonry|uniform) via gallery.yaml - Per-subpage grid overrides: each subpage can override global grid config - True masonry: per-image aspect ratios from EXIF dimensions - next/image migration: homepage hero, album covers, grid thumbnails, about portrait - ThumbHash blur placeholders and dominant color backgrounds - Custom next/image loader via image proxy with width/quality params - Lightbox fade-in transition with dominant color background - Password-protected subpages, health check, rate limiting, OG images
2026-02-14 10:30:27 +01:00
"js-yaml": "^4.1.1",
feat: add smart map view with location-level clustering - /map page with Leaflet (CartoDB dark tiles) - Photos clustered by city/country (not per-photo) - /api/map endpoint with encrypted cover asset IDs - Configurable via gallery.yaml (map: true/false) - Conditional nav link in header - CSP updated for Leaflet CDN and tile servers - Theme-aware popups with cover thumbnails and album links
2026-02-15 23:07:04 +01:00
"leaflet": "^1.9.4",
chore(deps): bump the nextjs group with 2 updates Bumps the nextjs group with 2 updates: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.1 to 16.2.4 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](https://github.com/vercel/next.js/compare/v16.2.1...v16.2.4) Updates `eslint-config-next` from 16.2.1 to 16.2.4 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](https://github.com/vercel/next.js/commits/v16.2.4/packages/eslint-config-next) --- updated-dependencies: - dependency-name: next dependency-version: 16.2.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nextjs - dependency-name: eslint-config-next dependency-version: 16.2.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com>
2026-04-27 07:48:20 +00:00
"next": "16.2.4",
chore(deps): bump the react group across 1 directory with 3 updates (#223) Bumps the react group with 3 updates in the / directory: [react](https://github.com/facebook/react/tree/HEAD/packages/react), [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) and [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom). Updates `react` from 19.2.5 to 19.2.6 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.6/packages/react) Updates `@types/react` from 19.2.14 to 19.2.15 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `react-dom` from 19.2.5 to 19.2.6 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.6/packages/react-dom) Updates `@types/react` from 19.2.14 to 19.2.15 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) --- updated-dependencies: - dependency-name: "@types/react" dependency-version: 19.2.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: react - dependency-name: "@types/react" dependency-version: 19.2.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: react - dependency-name: react dependency-version: 19.2.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: react - dependency-name: react-dom dependency-version: 19.2.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: react ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-31 10:03:14 +02:00
"react": "19.2.6",
"react-dom": "19.2.6",
chore: remove unused 3P dependencies (zod, gray-matter, bcryptjs) and switch to native implementations
2026-03-08 21:12:52 +01:00
"thumbhash": "^0.1.1"
Initial commit from Create Next App
2026-02-13 23:26:37 +01:00
},
"devDependencies": {
feat: visual polish & UX — fade-in, theme toggle, scroll-to-top, footer, cursor, badge - Add FadeIn component (IntersectionObserver scroll-reveal + load animation) - Add dark/light theme toggle (useSyncExternalStore + localStorage) - Add scroll-to-top button (appears after 300px scroll) - Add configurable footer with social links (gallery.yaml) - Add crosshair cursor on photo grid items - Add 'X photos' count badge on subpage cover images - Add light theme color palette in tokens.css
2026-02-14 11:47:26 +01:00
"@playwright/test": "^1.58.2",
feat: photography features & image optimizations - Hero carousel: gallery.yaml hero accepts single UUID or array, crossfade component - Full-bleed single albums: subpages with 1 album skip grid, render photos directly - EXIF on hover: camera/lens/focal length overlay on grid items (toggle via exifOnHover) - Customizable grid: columns/gap/aspectRatio/layout (masonry|uniform) via gallery.yaml - Per-subpage grid overrides: each subpage can override global grid config - True masonry: per-image aspect ratios from EXIF dimensions - next/image migration: homepage hero, album covers, grid thumbnails, about portrait - ThumbHash blur placeholders and dominant color backgrounds - Custom next/image loader via image proxy with width/quality params - Lightbox fade-in transition with dominant color background - Password-protected subpages, health check, rate limiting, OG images
2026-02-14 10:30:27 +01:00
"@types/js-yaml": "^4.0.9",
chore: implement audit action items and translate hardcoded German text
2026-03-15 07:32:42 +01:00
"@types/leaflet": "^1.9.21",
Initial commit from Create Next App
2026-02-13 23:26:37 +01:00
"@types/node": "^20",
"@types/react": "^19",
"@types/react-dom": "^19",
feat: visual polish & UX — fade-in, theme toggle, scroll-to-top, footer, cursor, badge - Add FadeIn component (IntersectionObserver scroll-reveal + load animation) - Add dark/light theme toggle (useSyncExternalStore + localStorage) - Add scroll-to-top button (appears after 300px scroll) - Add configurable footer with social links (gallery.yaml) - Add crosshair cursor on photo grid items - Add 'X photos' count badge on subpage cover images - Add light theme color palette in tokens.css
2026-02-14 11:47:26 +01:00
"@vitest/coverage-v8": "^4.0.18",
Initial commit from Create Next App
2026-02-13 23:26:37 +01:00
"eslint": "^9",
chore(deps): bump the nextjs group with 2 updates Bumps the nextjs group with 2 updates: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.1 to 16.2.4 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](https://github.com/vercel/next.js/compare/v16.2.1...v16.2.4) Updates `eslint-config-next` from 16.2.1 to 16.2.4 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](https://github.com/vercel/next.js/commits/v16.2.4/packages/eslint-config-next) --- updated-dependencies: - dependency-name: next dependency-version: 16.2.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nextjs - dependency-name: eslint-config-next dependency-version: 16.2.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com>
2026-04-27 07:48:20 +00:00
"eslint-config-next": "16.2.4",
feat: visual polish & UX — fade-in, theme toggle, scroll-to-top, footer, cursor, badge - Add FadeIn component (IntersectionObserver scroll-reveal + load animation) - Add dark/light theme toggle (useSyncExternalStore + localStorage) - Add scroll-to-top button (appears after 300px scroll) - Add configurable footer with social links (gallery.yaml) - Add crosshair cursor on photo grid items - Add 'X photos' count badge on subpage cover images - Add light theme color palette in tokens.css
2026-02-14 11:47:26 +01:00
"eslint-config-prettier": "^10.1.8",
chore(deps-dev): bump eslint-plugin-prettier from 5.5.5 to 5.5.6 (#253) Bumps [eslint-plugin-prettier](https://github.com/prettier/eslint-plugin-prettier) from 5.5.5 to 5.5.6. - [Release notes](https://github.com/prettier/eslint-plugin-prettier/releases) - [Changelog](https://github.com/prettier/eslint-plugin-prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/eslint-plugin-prettier/compare/v5.5.5...v5.5.6) --- updated-dependencies: - dependency-name: eslint-plugin-prettier dependency-version: 5.5.6 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-20 20:56:50 +02:00
"eslint-plugin-prettier": "^5.5.6",
chore(deps-dev): bump prettier from 3.8.2 to 3.8.3 Bumps [prettier](https://github.com/prettier/prettier) from 3.8.2 to 3.8.3. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.2...3.8.3) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.8.3 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2026-04-27 07:48:48 +00:00
"prettier": "^3.8.3",
feat: visual polish & UX — fade-in, theme toggle, scroll-to-top, footer, cursor, badge - Add FadeIn component (IntersectionObserver scroll-reveal + load animation) - Add dark/light theme toggle (useSyncExternalStore + localStorage) - Add scroll-to-top button (appears after 300px scroll) - Add configurable footer with social links (gallery.yaml) - Add crosshair cursor on photo grid items - Add 'X photos' count badge on subpage cover images - Add light theme color palette in tokens.css
2026-02-14 11:47:26 +01:00
"typescript": "^5",
"vitest": "^4.0.18"
Initial commit from Create Next App
2026-02-13 23:26:37 +01:00
}
chore: remove unused 3P dependencies (zod, gray-matter, bcryptjs) and switch to native implementations
2026-03-08 21:12:52 +01:00
}
Reference in New Issue Copy Permalink