release: v0.19.1

Patch release for the Next.js advisory GHSA-vcvr-r3jv-pc5j (critical,
RCE in the Node.js `ImageResponse` from `next/og`).

- #743 — `next` and `eslint-config-next` 16.3.5 → 16.3.6
- #744 — prettier 3.9.8 → 3.9.9 (dev only)
- `chore(release): v0.19.1` — CHANGELOG, README "Latest" line, version

Folio uses `next/og` in `/api/og`. Title and subtitle are site-signed
since #767 and unsigned requests fall back to the site title, so
visitor-chosen text never reached the SVG. The upgrade is still the fix.

Checked on `dev` at 5dab342: `tsc --noEmit` clean, lint 0 errors,
`format:check` clean, 178 files / 2147 tests pass, `npm run build`
succeeds.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>

CHANGELOG.md

@@ -7,6 +7,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 Releases up to and including v0.9.2 are documented in the
 [GitHub releases](https://github.com/ralksta/immich-folio/releases).
 
+## [0.19.1] — 2026-10-01
+
+### Security
+
+- **Next.js 16.3.6** ([#743](https://github.com/ralksta/immich-folio/pull/743)).
+  Next.js 16.2.0 to 16.3.5 carry
+  [GHSA-vcvr-r3jv-pc5j](https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j)
+  (critical): the Node.js `ImageResponse` from `next/og` can execute code when
+  attacker-controlled values reach the SVG it renders. Folio renders its share
+  cards with it in `/api/og`. The title and subtitle there are HMAC-signed by
+  the site since v0.19.0 ([#767](https://github.com/ralksta/immich-folio/pull/767)),
+  and an unsigned request falls back to the site title, so a visitor could not
+  put text of their choosing on the card. Upgrade anyway: the signed values
+  include album names from Immich.
+
+### Changed
+
+- Prettier 3.9.9 ([#744](https://github.com/ralksta/immich-folio/pull/744)),
+  development only.
+
 ## [0.19.0] — 2026-09-29
 
 ### Security