release: v0.19.0

Release v0.19.0. See the `## [0.19.0] — 2026-09-29` section of
[CHANGELOG.md](https://github.com/ralksta/immich-folio/blob/dev/CHANGELOG.md)
for the full list.

Highlights: client proofing links (#683), custom content pages (#738),
asset picker search (#740), concurrent-edit detection (#742), env-locked
settings (#739), an accessibility baseline (#741), three security fixes
with advisories (#737, #755, #759), and a pre-release quality pass
(#780–#797).

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>

app/api/webhook/route.ts

@@ -7,7 +7,8 @@
  *
  *   HMAC-SHA256(WEBHOOK_SECRET, raw request body)
  *
- * If WEBHOOK_SECRET is not set, the endpoint returns 501.
+ * If WEBHOOK_SECRET is not set, the endpoint returns 501. Bodies over
+ * MAX_BODY_BYTES are refused with 413 before the signature is checked.
  *
  * Supported Immich event types:
  *   - album.updated      → invalidates the specific album
@@ -23,10 +24,23 @@ import { createHmac, timingSafeEqual } from 'crypto';
 import { immich } from '@/lib/immich';
 import { env } from '@/lib/env';
 import { checkRateLimit, getClientIp } from '@/lib/rate-limit';
+import { readBytesCapped } from '@/lib/requestBody';
 
 // Tight rate limit — webhooks should come from one trusted source only
 const WEBHOOK_RPM = 60;
 
+/**
+ * Largest body the route reads before the signature is checked. The payload
+ * is a small JSON object (`{ "event": "album.updated", "albumId": "<uuid>" }`,
+ * well under 1 KiB), so 64 KiB leaves ample headroom for extra fields while
+ * keeping an unauthenticated sender from making the server buffer and hash
+ * an arbitrarily large body.
+ */
+const MAX_BODY_BYTES = 64 * 1024;
+
+/** An HMAC-SHA256 hex digest: exactly 64 hex characters. */
+const SIGNATURE_PATTERN = /^[0-9a-f]{64}$/i;
+
 /** Album-scoped Immich webhook events. */
 const ALBUM_EVENTS = new Set(['album.updated', 'album.assetAdded', 'album.assetRemoved']);
 
@@ -46,13 +60,24 @@ export async function POST(request: NextRequest) {
     return NextResponse.json({ error: 'Too many requests' }, { status: 429 });
   }
 
+  // ── Body size ──────────────────────────────────────
+  // The declared length is refused before a byte is read; the capped reader
+  // covers a missing or understated Content-Length and chunked bodies.
+  const declared = Number(request.headers.get('content-length') ?? '');
+  if (Number.isFinite(declared) && declared > MAX_BODY_BYTES) {
+    return NextResponse.json({ error: 'Payload too large' }, { status: 413 });
+  }
+
   // ── Read body (needed for HMAC verification) ───────
-  let rawBody: string;
+  let rawBody: Buffer | null;
   try {
-    rawBody = await request.text();
+    rawBody = await readBytesCapped(request, MAX_BODY_BYTES);
   } catch {
     return NextResponse.json({ error: 'Failed to read request body' }, { status: 400 });
   }
+  if (rawBody === null) {
+    return NextResponse.json({ error: 'Payload too large' }, { status: 413 });
+  }
 
   // ── Signature verification ─────────────────────────
   const signature = request.headers.get('x-immich-signature');
@@ -63,13 +88,11 @@ export async function POST(request: NextRequest) {
 
   const expected = createHmac('sha256', env.WEBHOOK_SECRET).update(rawBody).digest('hex');
 
-  let signatureValid = false;
-  try {
-    signatureValid = timingSafeEqual(Buffer.from(signature, 'hex'), Buffer.from(expected, 'hex'));
-  } catch {
-    // Buffer lengths differ → invalid hex or wrong length
-    signatureValid = false;
-  }
+  // Anything but a 64-character hex digest is refused before decoding, so a
+  // malformed or over-long header gets the same answer as a wrong one.
+  const signatureValid =
+    SIGNATURE_PATTERN.test(signature) &&
+    timingSafeEqual(Buffer.from(signature, 'hex'), Buffer.from(expected, 'hex'));
 
   if (!signatureValid) {
     console.warn(`[Webhook] ⚠️ Invalid signature from ${ip}`);
@@ -79,7 +102,7 @@ export async function POST(request: NextRequest) {
   // ── Parse payload ──────────────────────────────────
   let payload: { event?: string; albumId?: string } = {};
   try {
-    payload = JSON.parse(rawBody);
+    payload = JSON.parse(new TextDecoder().decode(rawBody));
   } catch {
     return NextResponse.json({ error: 'Invalid JSON payload' }, { status: 400 });
   }