release: v0.19.0

Release v0.19.0. See the `## [0.19.0] — 2026-09-29` section of
[CHANGELOG.md](https://github.com/ralksta/immich-folio/blob/dev/CHANGELOG.md)
for the full list.

Highlights: client proofing links (#683), custom content pages (#738),
asset picker search (#740), concurrent-edit detection (#742), env-locked
settings (#739), an accessibility baseline (#741), three security fixes
with advisories (#737, #755, #759), and a pre-release quality pass
(#780–#797).

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>

app/[...path]/__tests__/path-depth.test.ts

@@ -0,0 +1,78 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+/**
+ * The catch-all answers one segment (subpage, content page, standalone album)
+ * and two (subpage/album). A third segment used to fall through to the
+ * one-segment branch, which only reads `path[0]`: `/travel/iceland/anything`
+ * rendered the Travel subpage and `/iceland/x/y` the Iceland album, each with
+ * a 200, under an endless supply of URLs.
+ */
+
+const NOT_FOUND = new Error('NEXT_NOT_FOUND');
+
+vi.mock('next/navigation', () => ({
+  notFound: () => {
+    throw NOT_FOUND;
+  },
+}));
+vi.mock('next/headers', () => ({
+  cookies: async () => ({ get: () => undefined }),
+}));
+vi.mock('@/lib/admin/auth', () => ({ isAdminAuthenticated: async () => false }));
+
+const immich = vi.hoisted(() => ({
+  isSubpageSlug: vi.fn((slug: string) => slug === 'travel'),
+  getSubpageAlbums: vi.fn(),
+  getAlbumBySlug: vi.fn(),
+  getStandaloneAlbums: vi.fn(async () => []),
+  getSubpages: vi.fn(async () => []),
+  getAssetInfo: vi.fn(async () => null),
+}));
+vi.mock('@/lib/immich', () => ({ immich }));
+
+const ALBUM = {
+  id: 'album-1',
+  albumName: 'Iceland',
+  slug: 'iceland',
+  assets: [],
+  albumThumbnailAssetId: null,
+};
+
+import PathPage, { generateMetadata } from '../page';
+import { getServerDictionary } from '@/lib/i18n/server';
+
+const call = (path: string[]) => ({
+  params: Promise.resolve({ path }),
+  searchParams: Promise.resolve({}),
+});
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  immich.getAlbumBySlug.mockResolvedValue(ALBUM);
+  immich.getSubpageAlbums.mockResolvedValue({
+    subpage: { slug: 'travel', name: 'Travel', albumIds: ['album-1', 'album-2'] },
+    albums: [ALBUM, { ...ALBUM, id: 'album-2', slug: 'norway', albumName: 'Norway' }],
+  });
+});
+
+describe('catch-all path depth', () => {
+  it.each([[['iceland', 'x', 'y']], [['travel', 'iceland', 'extra']], [['travel', 'a', 'b', 'c']]])(
+    'answers %j with a 404',
+    async (path) => {
+      await expect(PathPage(call(path))).rejects.toBe(NOT_FOUND);
+      expect(immich.getAlbumBySlug).not.toHaveBeenCalled();
+      expect(immich.getSubpageAlbums).not.toHaveBeenCalled();
+    },
+  );
+
+  it('gives a three-segment path no album metadata, only the not-found title', async () => {
+    const meta = await generateMetadata(call(['iceland', 'x', 'y']));
+    expect(meta.title).toBe(getServerDictionary().error.notFoundTitle);
+    expect(immich.getAlbumBySlug).not.toHaveBeenCalled();
+  });
+
+  it('still renders one and two segments', async () => {
+    await expect(PathPage(call(['iceland']))).resolves.toBeTruthy();
+    await expect(PathPage(call(['travel', 'iceland']))).resolves.toBeTruthy();
+  });
+});