v1.4.0

What's Changed

• feat: add opt-in one-click self-update via updater sidecar by @Christianoooooo in #169
• fix: make self-update control volume writable by non-root app by @Christianoooooo in #170
• feat: real installed version + branch-based update detection by @Christianoooooo in #171
• chore: test-update marker to verify self-update pipeline by @Christianoooooo in #172
• fix: self-update must not recreate the database container by @Christianoooooo in #173
• docs: note that the updater must be rebuilt manually to update itself by @Christianoooooo in #174
• fix: upgrade proxy-addr to 2.0.8 (CVE-2026-90711) by @anupamme in #175
• Add per-user and site-wide storage quota management by @Christianoooooo in #176
• Claude/exciting brahmagupta 6spkgr by @Christianoooooo in #177
• feat: bulk-download selected files as a ZIP by @Christianoooooo in #178
• feat: download a whole collection as a ZIP by @Christianoooooo in #179
• Claude/exciting brahmagupta 6spkgr by @Christianoooooo in #180
• fix: keep JPEG APP14 (Adobe) marker when stripping metadata by @Christianoooooo in #181
• Optimize session store writes with lazy touch strategy by @Christianoooooo in #182
• perf: cache static assets and immutable file serving, lean audit export by @Christianoooooo in #183
• Add Pastes feature for sharing code snippets and text by @Christianoooooo in #184
• Remove auto-merge workflow for Claude branches by @Christianoooooo in #185
• ci: run E2E push trigger only on main to avoid duplicate runs by @Christianoooooo in #186
• Add unit test infrastructure and make email validation tests hermetic by @Christianoooooo in #187
• Claude/admiring noether l7bbx9 by @Christianoooooo in #188
• fix: harden file serving, hide delete tokens and share-link file ids by @Christianoooooo in #189
• Claude/security fixes k1 k2 h1 by @Christianoooooo in #190
• fix: revalidate HTTP sessions and rotate/invalidate them on auth changes by @Christianoooooo in #191
• fix: secure cookies/HSTS over HTTPS, loopback port, verify limits, lo… by @Christianoooooo in #192
• Claude/security fixes k1 k2 h1 by @Christianoooooo in #193
• docs: explain Cloudflare Tunnel and containerized proxy setups by @Christianoooooo in #194
• Add encryption at rest and setup token security by @Christianoooooo in #195
• docs: add security audit report with remediation status by @Christianoooooo in #196
• ci: move GitHub Actions to Node 24 versions by @Christianoooooo in #197
• ci: pin runners to ubuntu-24.04 by @Christianoooooo in #198
• Run ffmpeg/ghostscript in an isolated thumbnailer container by @Christianoooooo in #199
• docs: record live verification results in security audit by @Christianoooooo in #200
• docs: translate the automatic updates section by @Christianoooooo in #201
• Fix heading slug generation to match GitHub's algorithm by @Christianoooooo in #202
• docs: record default storage quota in security audit by @Christianoooooo in #203
• docs: record encryption rollout and old-ID decision in security audit by @Christianoooooo in #204
• ci: move runners to ubuntu-26.04 and Playwright to 1.64.1 by @Christianoooooo in #205
• chore(deps): apply non-breaking npm audit fixes by @Christianoooooo in #206
• fix: delete uploads that never got a File record on server errors by @Christianoooooo in #207

Full Changelog: v1.3.0...v1.4.0