This website requires JavaScript.
fb32a8cabc
Merge PR #164
2026-05-06 11:59:48 +02:00
3a4c65276d
Merge PR #165
2026-05-06 11:59:45 +02:00
08207e2f16
Merge PR #163
2026-05-06 11:59:42 +02:00
59321d88ca
⚡ Bolt: [performance improvement] Optimize map bucketing memory and deduplicate getMapData promises
2026-05-05 10:44:12 +00:00
8ab1a3d5ea
Fix scrypt hash generation in plaintext fallback
2026-05-05 10:34:52 +00:00
ebf60b12c3
Improve PhotoGrid screen reader accessibility
2026-05-05 10:24:39 +00:00
71381342d6
🛡️ Sentinel: [security improvement]\n\nAdded rate limiting to the /api/health endpoint using the shared checkRateLimit utility. This prevents potential DoS attacks by restricting the number of requests per IP, utilizing the configured rateLimitRpm.
2026-05-03 10:20:32 +00:00
8c573314d6
fix(about): resolve TOCTOU vulnerability by migrating to async file I/O
2026-04-28 11:16:18 +00:00
a344228fb9
chore(deps-dev): bump prettier from 3.8.2 to 3.8.3
2026-04-27 07:48:48 +00:00
64eff62db4
chore(deps): bump the nextjs group with 2 updates
2026-04-27 07:48:20 +00:00
56f0305763
perf(map): chunk album fetching to prevent OOM errors (#138 )
2026-04-24 22:12:45 +02:00
f18d9ae3d9
🛡️ Sentinel: [CRITICAL] Fix rate limit DoS vulnerability (#136 )
2026-04-24 22:12:42 +02:00
93ac1c20e8
Add [role="button"]:focus-visible to app/tokens.css for proper keyboard focus indication on custom button elements. (#130 )
2026-04-21 22:52:08 +02:00
a61c577a94
chore(deps-dev): bump @types/node from 20.19.37 to 20.19.39 (#84 )
2026-04-21 22:51:55 +02:00
431e7c0553
🛡️ Sentinel: [improvement] Add Content Security Policy Report-Only header (#86 )
2026-04-21 22:51:50 +02:00
006ba539ab
fix(rate-limit): mitigate cache flooding vulnerability (#94 )
2026-04-21 22:51:46 +02:00
bb7c1aa1bd
Improve rate-limit headers in auth API (#102 )
2026-04-21 22:51:42 +02:00
3bbec5a4ac
🛡️ Sentinel: [CRITICAL/HIGH] Upgrade token encryption to AES-GCM (#117 )
2026-04-21 22:51:39 +02:00
13fcfe8436
Fix IP spoofing vulnerability in rate limiter by prioritizing request.ip (#132 )
2026-04-21 22:51:35 +02:00
16e1c7647b
🎨 Palette: [UX improvement] Auto-focus Close button in Lightbox (#104 )
2026-04-21 22:51:31 +02:00
b803daf8f9
chore(deps): bump the react group with 2 updates (#107 )
2026-04-21 22:51:29 +02:00
e8709b9ae9
feat(a11y): consolidate ARIA announcements on interactive cards (#133 )
2026-04-21 22:51:26 +02:00
fef4c73e86
⚡ Bolt: Cache parsed YAML to prevent repetitive synchronous file I/O (#91 )
2026-04-21 22:51:22 +02:00
264e48b3cc
perf: return Buffer directly instead of wrapping in Uint8Array (#131 )
2026-04-21 22:51:19 +02:00
972ace5833
chore(deps-dev): bump prettier from 3.8.1 to 3.8.2 (#108 )
2026-04-21 22:51:17 +02:00
bb751c32ef
perf: add promise deduplication for getAssetInfo (#134 )
2026-04-21 22:51:15 +02:00
17398dea39
feat: implement album-level password protection
2026-04-07 23:04:03 +02:00
e739fdb518
🎨 Palette: [UX improvement] Add aria-hidden to decorative SVGs (#70 )
2026-04-01 12:46:20 +02:00
dbc525e8d8
feat(performance): Add promise deduplication for ImmichClient.getAlbum (#69 )
2026-04-01 12:46:12 +02:00
258c36899c
fix(auth): secure plaintext password comparison against timing attacks (#68 )
2026-04-01 12:46:04 +02:00
b8833b4e60
🛡️ Fix global DoS vulnerability in rate limiter (FIFO eviction)
2026-04-01 12:45:46 +02:00
bf72a88d6c
perf: implement proper LRU Cache and ETag optimizations
2026-03-27 11:11:23 +01:00
af7e2e9206
feat: add aria-label to BackLink component (#10 )
2026-03-27 10:52:39 +01:00
59153c9f48
chore(deps): bump the nextjs group with 2 updates (#43 )
2026-03-27 10:51:26 +01:00
741dba3576
chore(deps): bump actions/checkout from 4 to 6 (#13 )
2026-03-27 10:51:23 +01:00
1704cd87fc
⚡ Bolt: [Deduplicate concurrent album fetches] (#50 )
2026-03-27 10:50:00 +01:00
f4778d09f6
chore(deps-dev): bump @types/node from 20.19.33 to 20.19.37 (#17 )
2026-03-27 10:37:56 +01:00
88dc8dcbeb
chore(deps): bump actions/checkout from 4 to 6 (#13 )
2026-03-27 10:37:13 +01:00
457d92e657
chore(deps): bump the react group with 2 updates (#15 )
2026-03-27 10:36:28 +01:00
43d5b4d15d
🛡️ Sentinel: Add rate limiting to /api/og endpoint (#47 )
2026-03-27 10:36:25 +01:00
c8f75e4615
feat(a11y): enhance accessibility of password gate form (#46 )
2026-03-27 10:36:22 +01:00
5ebc900851
feat(ux): Add proper ARIA attributes to Lightbox modal and EXIF toggle (#45 )
2026-03-27 10:36:19 +01:00
228771decc
Merge PR 36 and resolve ci.yml conflict
2026-03-22 10:03:02 +01:00
6a45dc3657
Add aria-label to input fields for better accessibility (#39 )
2026-03-22 09:57:29 +01:00
e3e5972b32
⚡ Bolt: Optimize base64 decoding for ThumbHash (#40 )
2026-03-22 09:51:25 +01:00
db19504c91
chore(deps-dev): bump eslint from 9.39.2 to 9.39.4 (#16 )
2026-03-22 09:51:19 +01:00
1f83bad3a7
chore(deps): bump actions/setup-node from 4 to 6 (#14 )
2026-03-22 09:51:11 +01:00
8cd96d4dac
Fix CI failures due to AUTH_SECRET and missing Playwright types
2026-03-20 11:38:33 +00:00
cdc26c00ac
🛡️ Sentinel: [HIGH] Cache health check endpoint to prevent upstream DoS
2026-03-20 11:33:38 +00:00
e9154cedb8
fix(security): resolve rate-limiting IP spoofing and eviction bypass
2026-03-15 07:41:49 +01:00
922302ce5c
chore: implement audit action items and translate hardcoded German text
2026-03-15 07:32:42 +01:00
3fa47f7031
chore: add GitHub community files and CI pipeline
2026-03-13 13:00:19 +01:00
a97b261c14
fix: raise map rate limit 30→120/min, allow 5min private browser cache
2026-03-13 12:55:07 +01:00
6c20218369
security: fix XSS in map popups, refactor HeroTextContent, add evict test
2026-03-13 12:52:09 +01:00
c610ad2a7d
fix(map): show HTTP status code in error message for easier debugging
2026-03-13 12:31:21 +01:00
60b86b540f
fix: move DevToolbar dynamic import to Client Component
2026-03-13 12:28:59 +01:00
33fd31e926
refactor: deslop — remove dead botanica preset, extract shared helpers
2026-03-13 11:56:40 +01:00
d64a7239d1
refactor: audit improvements - rate limit ceiling, map route protection, lazy DevToolbar, lang=de
2026-03-13 11:41:56 +01:00
3b657b625c
fix(hero): fix mosaic layout full-width + update screenshots
2026-03-13 11:34:16 +01:00
5f8693e19e
docs: replace studio screenshots and heroes with correct versions from generator
2026-03-13 11:16:39 +01:00
43c59f4bc9
chore: clean up repo root and improve .gitignore
2026-03-13 10:33:07 +01:00
f9315ad7d6
Merge pull request #9 from ralksta/fix/exif-rate-limit-3163002533333096016
2026-03-13 10:10:11 +01:00
63e6a2f784
🛡️ Sentinel: [HIGH] Fix missing rate limiting on /api/exif/[id]
2026-03-12 11:30:45 +00:00
a0364ac9f0
fix: remove request.ip which was removed in Next.js 15+
2026-03-11 23:36:40 +01:00
8926fc27b7
perf: add bounded in-memory LRU cache for thumbhash decoding
2026-03-11 23:34:04 +01:00
c0740f0db5
a11y: remove ScrollToTop from tab order and hide from screen readers when not visible
2026-03-11 23:33:51 +01:00
c845df4afb
feat(lightbox): add keyboard shortcut 'i' for EXIF toggle and title tooltips on navigation buttons [#3 ]
2026-03-11 23:33:00 +01:00
f3890fc6bc
perf: memoize PhotoGrid assets map to prevent re-renders during lightbox navigation [#5 ]
2026-03-11 23:32:40 +01:00
a94b55704e
security: prioritize request.ip over x-forwarded-for to prevent IP spoofing [#4 ]
2026-03-11 23:32:32 +01:00
96fe4db099
security: validate auth input types and limit length to prevent DoS [#1 ]
2026-03-11 23:32:22 +01:00
134eae94e4
feat(subpages): add optional sections with typographic TOC
2026-03-08 23:52:23 +01:00
0eaadeda55
docs: clarify that album grid thumbnails adhere strictly to the cover selection performed in Immich UI
2026-03-08 23:21:25 +01:00
25b9a92e12
feat: propagate subpage subtitle into deep AlbumDetailView headers
2026-03-08 23:16:01 +01:00
7663bcbcd0
refactor: extract individual layout themes from globals.css into modular app/themes/*.css architecture
2026-03-08 22:57:38 +01:00
5667ba01b8
style: align subpage header to correctly adopt layout rules from selected themes
2026-03-08 22:54:23 +01:00
a0777e40e2
style: let theme alignment dictate subpage headers by removing hardcoded text centering
2026-03-08 22:52:44 +01:00
3953db0ff8
style: add global typographic classes for the subpage header block
2026-03-08 22:50:36 +01:00
425e61312d
chore: update .gitignore with server.log and .agent directory
2026-03-08 22:49:14 +01:00
6371a60d0a
chore: add workflow rule for updating documentation whenever user-facing settings change
2026-03-08 22:48:06 +01:00
a99406c382
docs: add title and subtitle documentation for subpages to gallery config
2026-03-08 22:47:38 +01:00
32bb6cb2ca
feat: allow subpages to override title and add subtitle in gallery.yaml
2026-03-08 22:46:27 +01:00
88f03fe2ce
fix: make impressum page dynamic so it reads volume settings at runtime instead of statically compiling to 404
2026-03-08 21:53:20 +01:00
65a661ce84
chore: make .env.local optional in docker-compose
2026-03-08 21:45:10 +01:00
05de957b66
feat: add .env instruction to setup screen
2026-03-08 21:43:26 +01:00
b9993bd29e
fix: gracefully handle Next.js static component fetch rendering when setup configs are completely empty
2026-03-08 21:38:44 +01:00
89bb7c0038
chore: add build network context to docker-compose
2026-03-08 21:31:07 +01:00
59394f5ba2
fix: remove invalid npm flag 'dns-result-order'
2026-03-08 21:28:56 +01:00
801dc14de1
chore: force IPv4 DNS resolution for npm ci in Dockerfile to fix timeout lags
2026-03-08 21:28:10 +01:00
4e4a623181
chore: enable verbose npm ci logging for debug in builder
2026-03-08 21:25:08 +01:00
39feeb58f9
chore: add npm network timeouts to fix docker build stall on servers
2026-03-08 21:22:46 +01:00
7a1dfdc519
chore: remove unused 3P dependencies (zod, gray-matter, bcryptjs) and switch to native implementations
2026-03-08 21:12:52 +01:00
25aefa5b70
feat: implement graceful setup fallback screen when yaml files are missing
2026-03-08 21:04:41 +01:00
9c1333920f
chore: remove settings.yaml and gallery.yaml from repo
2026-03-08 20:56:26 +01:00
a8b18232a0
chore: add content/about.md to .gitignore
2026-03-08 20:54:22 +01:00
29da3368a2
chore: rename about.md to about.md.example
2026-03-08 20:54:03 +01:00
593113e88a
fix: make about.md optional and copy content folder in Dockerfile
2026-03-08 20:53:45 +01:00
170fa6e132
chore: add default AUTH_SECRET to Dockerfile
2026-03-08 20:49:59 +01:00
2a4b9091da
chore: re-add settings and about without history
2026-03-08 20:47:08 +01:00
23d8bf0425
refactor: apply Clean Architecture principles
2026-03-08 18:55:45 +01:00
89dfef6144
docs: consolidate feature ideas into single backlog
2026-03-08 18:40:37 +01:00
Ralksta