v2.5.1

Patch release: security hardening, bug fixes, dependency pinning, and CI cleanup.

Security

• SQL injection — set-pref route hardened via static column lookup map (was interpolating user-controlled column names).
• Authorization tightening — delete-invite upgraded from authenticateToken to admin-only.
• Open redirect — login redirect parameter now validated as a relative path before use.
• Error-detail leak — authenticateAdmin catch block no longer surfaces internal error specifics.

Bug fixes

• Dashboard delete-user link was passing the current user's id/username instead of the target row's — data-loss-class bug.
• Implicit global — missing const on response in comments and single-comment-thread routes.
• PRAGMA foriegn_keys typo in lazy-delete-sessions migration — SQLite silently ignored it, so FK enforcement wasn't actually active during that migration.

Dependencies

• @types/bun: latest → ^1.3.0
• Dockerfile base: oven/bun:latest → oven/bun:1

Internal

• CI workflow: removed dead dev branch logic from publish-docker.yml. The dev branch is being retired in favor of GitHub Flow (feature branches → main via PR). Also fixes a latent bash syntax error in the removed block.

Full changelog: v2.5.0...v2.5.1

v2.5.0

What's Changed

• Utilize preview images instead of full size, based on screen size; referrer improvements and formatting tweaks by @PortableProgrammer in #19

Full Changelog: v2.4.7...v2.5.0

v2.4.7

What's Changed

• Fixes 403 errors and adds web manifest by @PortableProgrammer in #18

Full Changelog: v2.4.6...v2.4.7

v2.4.6

What's Changed

• Experimental web-app support by @PortableProgrammer in #16
• Miscellaneous fixes and tweaks by @PortableProgrammer in #17

Full Changelog: v2.4.5...v2.4.6

v2.4.5

What's Changed

• Fix intermittent media path join issues by @PortableProgrammer in #15

Full Changelog: v2.4.4...v2.4.5

v2.4.4

What's Changed

• Fix multiple req.query issues by @PortableProgrammer in #14

Full Changelog: v2.4.3...v2.4.4

v2.4.3

What's Changed

• Chore: Update Express to v5 by @PortableProgrammer in #13

Full Changelog: v2.4.2...v2.4.3

v2.4.2

What's Changed

• Fixed RTFM issue with express changes by @PortableProgrammer in #12

Full Changelog: v2.4.1...v2.4.2

v2.4.1

What's Changed

• Fix duplicate images in comments; dependency updates by @PortableProgrammer in #11

Full Changelog: v2.4.0...v2.4.1

v2.4.0

What's Changed

• [Enhancement] External Link Expansion by @PortableProgrammer in #10

Full Changelog: v2.3.0...v2.4.0