release: v0.19.0

Release v0.19.0. See the `## [0.19.0] — 2026-09-29` section of
[CHANGELOG.md](https://github.com/ralksta/immich-folio/blob/dev/CHANGELOG.md)
for the full list.

Highlights: client proofing links (#683), custom content pages (#738),
asset picker search (#740), concurrent-edit detection (#742), env-locked
settings (#739), an accessibility baseline (#741), three security fixes
with advisories (#737, #755, #759), and a pre-release quality pass
(#780–#797).

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>

app/api/og/__tests__/route.test.tsx

@@ -0,0 +1,82 @@
+import { describe, it, expect, vi } from 'vitest';
+import { NextRequest } from 'next/server';
+import type { ReactNode } from 'react';
+
+/**
+ * The share card prints its URL's text on the site's own domain. Only text
+ * the site signed itself (lib/ogImage.ts) may reach it; any other URL gets the
+ * plain site card.
+ */
+
+const config = {
+  authSecret: 'test-secret-that-is-at-least-32-chars-long',
+  siteTitle: 'Jane Doe Photography',
+  theme: { accent: '#e60012' },
+  sitePassword: undefined,
+};
+
+vi.mock('@/lib/config', () => ({
+  getConfig: () => config,
+  getConfigOrNull: () => config,
+}));
+
+let rendered: ReactNode = null;
+vi.mock('next/og', () => ({
+  ImageResponse: class {
+    status = 200;
+    constructor(element: ReactNode) {
+      rendered = element;
+    }
+  },
+}));
+
+const { GET } = await import('../route');
+const { ogImageUrl } = await import('@/lib/ogImage');
+
+/** Every non-empty string in the rendered card, in order. */
+function textOf(node: ReactNode): string[] {
+  if (node === null || node === undefined || typeof node === 'boolean') return [];
+  if (node === '') return [];
+  if (typeof node === 'string' || typeof node === 'number') return [String(node)];
+  if (Array.isArray(node)) return node.flatMap(textOf);
+  if (typeof node === 'object' && 'props' in node) {
+    return textOf((node.props as { children?: ReactNode }).children);
+  }
+  return [];
+}
+
+async function cardText(path: string): Promise<string[]> {
+  rendered = null;
+  const res = await GET(new NextRequest(`http://localhost${path}`) as never);
+  expect(res.status).toBe(200);
+  return textOf(rendered);
+}
+
+describe('GET /api/og', () => {
+  it('renders text the site signed', async () => {
+    const text = await cardText(ogImageUrl('Iceland 2024', '42 photos'));
+    expect(text).toEqual(['Iceland 2024', '42 photos']);
+  });
+
+  it('ignores an unsigned title and shows the site title', async () => {
+    const text = await cardText(
+      `/api/og?title=${encodeURIComponent('Your account is locked — call +1 555 0100')}`,
+    );
+    expect(text).toEqual(['Jane Doe Photography']);
+  });
+
+  it('ignores text whose signature belongs to other text', async () => {
+    const url = new URL(ogImageUrl('Iceland 2024', '42 photos'), 'http://localhost');
+    url.searchParams.set('subtitle', 'send your password to evil.example');
+    const text = await cardText(url.pathname + url.search);
+    expect(text).toEqual(['Jane Doe Photography']);
+  });
+
+  it('keeps a signature intact across non-ASCII text and truncation', async () => {
+    const long = '家族相册 🏔️ '.repeat(40);
+    const text = await cardText(ogImageUrl(long));
+    expect(text).toHaveLength(1);
+    expect(text[0]).not.toBe('Jane Doe Photography');
+    expect(Array.from(text[0]).length).toBe(200);
+  });
+});

app/api/og/route.tsx

@@ -3,7 +3,11 @@
  * Uses next/og (ImageResponse) to create 1200×630 cards.
  * Reads accent color from theme config.
  *
- * GET /api/og?title=Album+Name&subtitle=12+photos
+ * GET /api/og?title=Album+Name&subtitle=12+photos&sig=…
+ *
+ * Only text signed by `ogImageUrl()` (lib/ogImage.ts) is rendered; anything
+ * else gets the plain site card, so the site cannot be made to print
+ * arbitrary text under its own name.
  */
 
 import { ImageResponse } from 'next/og';
@@ -11,6 +15,7 @@ import { NextRequest, NextResponse } from 'next/server';
 import { getConfig } from '@/lib/config';
 import { checkRateLimit, getClientIp, retryAfterSeconds } from '@/lib/rate-limit';
 import { siteLockResponse } from '@/lib/auth';
+import { verifiedOgText } from '@/lib/ogImage';
 
 /**
  * OG image rendering runs satori + resvg per request and each unique ?title
@@ -22,7 +27,7 @@ const OG_RPM = 30;
 
 export async function GET(request: NextRequest) {
   const ip = getClientIp(request);
-  const { theme } = getConfig();
+  const { theme, siteTitle, authSecret } = getConfig();
 
   const { success, resetAt } = checkRateLimit(`og:${ip}`, OG_RPM);
   if (!success) {
@@ -40,9 +45,12 @@ export async function GET(request: NextRequest) {
   const locked = siteLockResponse(request);
   if (locked) return locked;
 
-  const { searchParams } = request.nextUrl;
-  const title = (searchParams.get('title') || 'Gallery').slice(0, 200);
-  const subtitle = (searchParams.get('subtitle') || '').slice(0, 100);
+  // The site title is already in the visitor's language, or falls back to the
+  // locale's own word for "Gallery" (lib/config). It is also the card for any
+  // URL whose text the site did not sign itself.
+  const signed = verifiedOgText(request.nextUrl.searchParams, authSecret);
+  const title = signed?.title || siteTitle || '';
+  const subtitle = signed?.subtitle ?? '';
 
   return new ImageResponse(
     <div
@@ -83,7 +91,8 @@ export async function GET(request: NextRequest) {
         {title}
       </div>
 
-      {/* Subtitle */}
+      {/* Subtitle — printed as the locale spells it. A lowercase transform
+          turned German "25 Fotos" into "25 fotos". */}
       {subtitle && (
         <div
           style={{
@@ -92,7 +101,6 @@ export async function GET(request: NextRequest) {
             fontWeight: 300,
             marginTop: '16px',
             letterSpacing: '0.08em',
-            textTransform: 'lowercase',
           }}
         >
           {subtitle}