🔒 Patched a high-severity image vulnerability — sharp 0.35.3 clears four libvips CVEs that were reachable from remote fediverse media and /_next/image. npm audit is now 0 vulnerabilities, for the first time since June.
📱 Phone notifications now actually work on a fresh install — the 🔔 menu used to offer "Enable" on a server with no push keys, then fail with a cryptic error. It now says Set up phone notifications and does the whole thing in one click.
🔔 Generate your Web Push keys from the admin — no .env editing, no npx web-push generate-vapid-keys. The private key is stored encrypted at rest, and rotating keys correctly re-enrols your devices.
📖 A third theme — "Classic Blog" — a left sidebar of your bio, recent posts and links beside a serif reading column, on warm charcoal with a pine-green accent.
🎨 Themeable text colour — text now resolves through a content-* ramp instead of fixed greys, so themes can move body copy and not just backgrounds. Nothing changes visually; this is the groundwork for light themes and a custom palette.
🖼️ Set your avatar and banner during first-run setup — a fresh install lands looking like you, no later trip to the admin panel.
⏱️ Set session and app-token lifetimes from the admin — no more ADMIN_SESSION_TTL_DAYS env editing.
📝 Web Push and theming are properly documented — including the iOS "Add to Home Screen" requirement, which is a hard prerequisite and wasn't written down anywhere.
Upgrading: npm run update. No schema changes, no breaking changes.
Full changelog: https://github.com/TemujinCalidius/FediHome/blob/main/CHANGELOG.md