release: v0.19.0

Release v0.19.0. See the `## [0.19.0] — 2026-09-29` section of
[CHANGELOG.md](https://github.com/ralksta/immich-folio/blob/dev/CHANGELOG.md)
for the full list.

Highlights: client proofing links (#683), custom content pages (#738),
asset picker search (#740), concurrent-edit detection (#742), env-locked
settings (#739), an accessibility baseline (#741), three security fixes
with advisories (#737, #755, #759), and a pre-release quality pass
(#780–#797).

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>

app/api/og/__tests__/route.test.tsx

@@ -0,0 +1,82 @@
+import { describe, it, expect, vi } from 'vitest';
+import { NextRequest } from 'next/server';
+import type { ReactNode } from 'react';
+
+/**
+ * The share card prints its URL's text on the site's own domain. Only text
+ * the site signed itself (lib/ogImage.ts) may reach it; any other URL gets the
+ * plain site card.
+ */
+
+const config = {
+  authSecret: 'test-secret-that-is-at-least-32-chars-long',
+  siteTitle: 'Jane Doe Photography',
+  theme: { accent: '#e60012' },
+  sitePassword: undefined,
+};
+
+vi.mock('@/lib/config', () => ({
+  getConfig: () => config,
+  getConfigOrNull: () => config,
+}));
+
+let rendered: ReactNode = null;
+vi.mock('next/og', () => ({
+  ImageResponse: class {
+    status = 200;
+    constructor(element: ReactNode) {
+      rendered = element;
+    }
+  },
+}));
+
+const { GET } = await import('../route');
+const { ogImageUrl } = await import('@/lib/ogImage');
+
+/** Every non-empty string in the rendered card, in order. */
+function textOf(node: ReactNode): string[] {
+  if (node === null || node === undefined || typeof node === 'boolean') return [];
+  if (node === '') return [];
+  if (typeof node === 'string' || typeof node === 'number') return [String(node)];
+  if (Array.isArray(node)) return node.flatMap(textOf);
+  if (typeof node === 'object' && 'props' in node) {
+    return textOf((node.props as { children?: ReactNode }).children);
+  }
+  return [];
+}
+
+async function cardText(path: string): Promise<string[]> {
+  rendered = null;
+  const res = await GET(new NextRequest(`http://localhost${path}`) as never);
+  expect(res.status).toBe(200);
+  return textOf(rendered);
+}
+
+describe('GET /api/og', () => {
+  it('renders text the site signed', async () => {
+    const text = await cardText(ogImageUrl('Iceland 2024', '42 photos'));
+    expect(text).toEqual(['Iceland 2024', '42 photos']);
+  });
+
+  it('ignores an unsigned title and shows the site title', async () => {
+    const text = await cardText(
+      `/api/og?title=${encodeURIComponent('Your account is locked — call +1 555 0100')}`,
+    );
+    expect(text).toEqual(['Jane Doe Photography']);
+  });
+
+  it('ignores text whose signature belongs to other text', async () => {
+    const url = new URL(ogImageUrl('Iceland 2024', '42 photos'), 'http://localhost');
+    url.searchParams.set('subtitle', 'send your password to evil.example');
+    const text = await cardText(url.pathname + url.search);
+    expect(text).toEqual(['Jane Doe Photography']);
+  });
+
+  it('keeps a signature intact across non-ASCII text and truncation', async () => {
+    const long = '家族相册 🏔️ '.repeat(40);
+    const text = await cardText(ogImageUrl(long));
+    expect(text).toHaveLength(1);
+    expect(text[0]).not.toBe('Jane Doe Photography');
+    expect(Array.from(text[0]).length).toBe(200);
+  });
+});