release: v0.13.0 (#535)

Twenty-nine commits since v0.12.0. See CHANGELOG.md for the full list
and the upgrade notes.

Ten additions — the SEO package (site URL, robots.txt, sitemap.xml,
JSON-LD), slideshow mode, opt-in original downloads, copy-link,
previous/next album navigation, alt text from the Immich description,
per-album location precision, the update notice, a Help tab, and a
subpage cover grid separate from its photo grid. Two fixes: CJK album
slugs, and the lightbox control bar.

Photo of the Day (#476) was built on `dev` and reverted as not planned;
it never appears in a release.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01DmsHVRL9yQvckUB1ZpVWre

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

lib/__tests__/downloadName.test.ts

@@ -0,0 +1,87 @@
+import { describe, it, expect } from 'vitest';
+import { safeDownloadName, contentDisposition } from '@/lib/downloadName';
+
+const LF = String.fromCharCode(10);
+const CRLF = String.fromCharCode(13, 10);
+const NUL = String.fromCharCode(0);
+const QUOTE = String.fromCharCode(34);
+
+/** True if the string holds any control character. */
+const hasControlChar = (value: string) =>
+  Array.from(value).some((character) => {
+    const code = character.charCodeAt(0);
+    return code < 32 || code === 127;
+  });
+
+describe('safeDownloadName', () => {
+  it('passes an ordinary camera filename through', () => {
+    expect(safeDownloadName('DSCF1234.JPG')).toBe('DSCF1234.JPG');
+  });
+
+  it('keeps non-ASCII letters, which are a legitimate part of a name', () => {
+    expect(safeDownloadName('Fr\u00fchling am Meer.jpg')).toBe('Fr\u00fchling am Meer.jpg');
+  });
+
+  /** The header injection this exists to prevent. */
+  it.each([
+    ['a newline', `a${LF}X-Evil: 1.jpg`],
+    ['a CRLF', `a${CRLF}X-Evil: 1.jpg`],
+    ['a null byte', `a${NUL}b.jpg`],
+  ])('strips %s', (_label, raw) => {
+    expect(hasControlChar(safeDownloadName(raw))).toBe(false);
+  });
+
+  it('neutralises path separators and traversal', () => {
+    expect(safeDownloadName('../../etc/passwd')).not.toContain('/');
+    expect(safeDownloadName('..\\..\\secret.jpg')).not.toContain('\\');
+    expect(safeDownloadName('../evil.jpg').startsWith('.')).toBe(false);
+  });
+
+  it('removes the quotes and semicolons that delimit header parameters', () => {
+    expect(safeDownloadName(`a${QUOTE};b.jpg`)).toBe('ab.jpg');
+  });
+
+  it.each([
+    ['undefined', undefined],
+    ['empty', ''],
+    ['whitespace', '   '],
+    ['only dots', '...'],
+  ])('falls back to a generic name for %s', (_label, raw) => {
+    expect(safeDownloadName(raw)).toBe('photo');
+  });
+
+  it('never returns an empty name', () => {
+    for (const raw of ['///', QUOTE.repeat(3), '..', ' . ', NUL]) {
+      expect(safeDownloadName(raw).length).toBeGreaterThan(0);
+    }
+  });
+
+  it('bounds the length', () => {
+    expect(safeDownloadName('x'.repeat(5000)).length).toBeLessThanOrEqual(200);
+  });
+});
+
+describe('contentDisposition', () => {
+  it('marks the response as an attachment', () => {
+    expect(contentDisposition('DSCF1234.JPG')).toMatch(/^attachment; /);
+  });
+
+  it('carries both a plain and a percent-encoded filename', () => {
+    const header = contentDisposition('Fr\u00fchling.jpg');
+    expect(header).toContain('filename="Fr_hling.jpg"');
+    expect(header).toContain("filename*=UTF-8''Fr%C3%BChling.jpg");
+  });
+
+  it('never emits a control character, whatever it is given', () => {
+    expect(hasControlChar(contentDisposition(`a${CRLF}X-Evil: 1.jpg`))).toBe(false);
+  });
+
+  it('never emits an unbalanced quote', () => {
+    const header = contentDisposition(`a${QUOTE}b.jpg`);
+    expect((header.match(/"/g) ?? []).length % 2).toBe(0);
+  });
+
+  it('survives a missing name', () => {
+    expect(contentDisposition(undefined)).toContain('filename="photo"');
+  });
+});