v0.4.0

Upgrading

• Webhooks to an address on your own network (ntfy, Home Assistant) now need
  WEBHOOK_ALLOW_PRIVATE=true.
• An SMTP server with a user and no TLS at all now needs
  SMTP_ALLOW_PLAIN=true.

Added

• Guests can delete their own photos, from the photo itself, at any time.

• The documentation website: every release's docs with a version switcher and
  search, and the wiki generated from the same files.

• Two-step verification (authenticator app codes) for admin accounts, with
  recovery codes; owners can reset it for a lost phone.

• Scheduled backups (node-cron) to a folder or an S3 bucket, with rotation,
  a list to download or restore from, and an alert when one fails.

• Update notifications: the admin shows new releases with their notes; owners
  get an email and a webhook once per version.

• One-click updates from the admin with the optional updater container: a
  backup, the new image, a health check, automatic rollback, and an update
  history listing the migrations each update applied.

• Demo mode (DEMO_MODE=true): seeded events, a shared account, a nightly
  reset, nothing sent out. docker-compose.demo.yml runs one.

Changed

• Settings are split into five areas (account, team, notifications, data,
  system), each a page of its own; the list says which area needs attention:
  two-step verification off, no automatic backups, no email server, an update
  waiting.
• The language picker lists each language under its own name with its name in
  the current language beside it ("Italiano, italien"), works from the
  keyboard, and opens upwards near the bottom of the screen. The event form's
  default language reads the same way.
• The events list is paged (20 per page) with a search that filters as you
  type; photo counts are only computed for the events on screen, so the
  dashboard and the list stay fast with hundreds of events.
  GET /api/admin/events takes page, perPage and q.

Security

• A HEIC photo is refused above MAX_IMAGE_MEGAPIXELS before it is decoded: a
  small crafted file could declare a huge image and exhaust the server's memory.
  HEIC is decoded straight into sharp, without a JPEG round trip.
• Guest uploads and guestbook messages are also limited per event and per
  address, uploads being received share a memory budget counted in bytes,
  at most 3 images are decoded at once with 12 waiting (guests' phones retry
  on their own) and uploads stop when the disk has less than
  512 MB free: a script dropping its cookie was a new guest with a fresh
  budget every time.
• Wrong access codes, gallery passwords and admin passwords are counted before
  they are checked, so parallel guesses can't slip past the limits; a
  successful sign-in no longer clears the limit for other accounts.
• Webhooks can't reach private, loopback or link-local addresses, however
  they are written and whatever a name resolves to at connection time, unless
  WEBHOOK_ALLOW_PRIVATE=true.
• The saved SMTP password is dropped when the server or account changes, and
  the login is only sent over TLS (SMTP_ALLOW_PLAIN=true for a local relay).
• An owner's own password changes only from their account page, with the
  current one.
• A demo instance sends no email or webhook, whatever triggers it.
• Strict-Transport-Security when PUBLIC_URL is https://.
• Account email addresses are checked with a bounded pattern: the previous one
  could be made to backtrack for minutes.
• Every page carries a nonce-based Content-Security-Policy.
• Photo compression no longer loads a worker script from a CDN: guests'
  browsers never contact a third party.

What's Changed

• chore(deps): bump mediabunny from 1.61.0 to 1.61.3 in the dependencies group by @dependabot[bot] in #10
• chore(deps-dev): bump typescript from 5.9.3 to 6.0.3 by @dependabot[bot] in #12

Full Changelog: v0.3.0...v0.4.0