Repository navigation
⚙️ Release 1.0.5 – Product Photos, Duplicate Warranties & a Currency Fix
Version 1.0.5 is a quality-of-life release. Product photos get easier at every step: paste a URL, take the photo first, or capture it in the browser on mobile. Warranties can be duplicated instead of retyped, grid cards get a tidier overflow menu, and a mapping fix restores the Total Value card for everyone whose default currency is not the US dollar.
📷 Product Photos
- Photo by URL (#207): the add and edit forms now accept a photo URL next to the upload and camera options. The server downloads the image once, verifies it really is an image (PNG, JPG, WebP or GIF), and stores it like an uploaded photo. Fetches are guarded: public http(s) addresses only, a size cap, a timeout, and a redirect limit. An uploaded file still wins when both are given.
- Photo comes first (#146): the photo upload now opens the Add Warranty form's Product tab, with its preview, so you can read the purchase date and serial number straight off the receipt photo as you type, instead of switching to a separate program.
- Mobile photo capture (#249, by canni): a new Take Photo button opens the camera directly on mobile, and the photo never enters the phone's gallery. Photos are downscaled in the browser to at most 2048px (JPEG) before upload, EXIF-orientation-safe, so multi-megabyte phone photos stop inflating storage and slowing uploads.
🗂️ Warranty Cards & Forms
- Duplicate warranty: every card gains a Duplicate action that opens the Add Warranty form prefilled with the original's details (name, purchase date or duration, price, vendor, model, serial numbers, warranty type, notes and tags). A manufacturer warranty and an extended warranty on the same product no longer need everything retyped. Photos, documents and claims are not copied.
- Grid view overflow menu: grid card headers carried six icon buttons next to the product name, and names truncated at 200px while the buttons took more room than the title. Claims and Edit stay visible; Archive, Void/Unvoid, Duplicate and Delete move into an overflow (⋯) menu with text labels. The title cap is gone and names wrap instead of truncating. List and table views are unchanged.
- Other documents accept more than archives (#222): the Other Document picker in the add form and both edit modals only offered ZIP/RAR files, even though the server has always accepted PDFs and images there too. It now offers every type the server accepts (PDF, PNG, JPG, WebP, GIF, ZIP, RAR).
- Purchase Price tooltip (#223): the Purchase Price label in the add and edit forms now carries a help icon: the field is the price paid for the product, not the cost of the warranty, and a warranty included with a product simply takes the product's price.
- Claims blocked on voided warranties: a voided warranty's coverage is dead, but new claims could still be filed against it. Claim creation now returns a clear error, the claims view hides the Add Claim button for voided warranties and explains why, and claims recorded before the void stay fully editable. Un-voiding restores claim creation.
🔑 Admin
- Provider column and editable email (#134): the admin Users list now shows how each account signs in (Local / OIDC), without exposing the raw OIDC subject. The Edit User dialog's email field, previously shown disabled, is now editable, with format and uniqueness validation, so an admin can fix a user's email without touching the database.
💱 Dashboard
- Total Value no longer zero for most currencies (#289): the Total Value card sums only warranties in your default currency, but the symbol lookup behind it covered only 18 of the 89 supported currencies. Anyone whose default currency was outside that short list (reported for the Serbian Dinar) silently fell back to US dollars and saw a Total Value of 0.00 in their own symbol. The lookup is now completed from the supported-currency list in the dashboard statistics, warranty creation, CSV import, and the frontend: every symbol that belongs to exactly one supported currency resolves to it. Symbols shared by several currencies keep their established resolution.
🔒 Security
- Stored XSS fixes: an internal audit found three places where stored, user-controlled values were rendered without safe encoding, and all three are fixed: usernames in the admin Users list (Settings), stored document URLs in warranty document links, and serial numbers in the legacy edit form shared by the main and status pages. Labels, icons, and layout are unchanged.
- Security dependency update: Authlib 1.9.1 → 1.9.2, carrying the upstream fix GHSA-f3fg-34g9-v7jx (ID-JAG access tokens limited to the scopes granted in the claim).
🐳 Docker
- Smaller image: the Docker image is now 354 MB (down from 405 MB for 1.0.4 on amd64). Python dependencies install into a virtualenv in the builder and the runtime copies only that, supervisor is the pip package instead of the Debian package, and the entrypoint's database wait uses a short Python probe instead of the PostgreSQL client. Behaviour is unchanged: same base image, same startup flow.
- Clearer startup logs: the container log opens with the running version and a short configuration summary (database host, port, name and user, nginx on or off, upload limit, memory mode, frontend URL), the database wait reports progress and fails with the host and port it tried, step failures stop startup with one clear line, and nginx errors now appear in
docker logs. A Warracker banner prints once the app passes its health check. No passwords are ever printed. Docker/compose file fixed: the compose file in the Docker folder shipped with a broken environment line that made the whole file invalid YAML, and its SECRET_KEY line read a variable name no shipped example defines, so a documented SECRET_KEY was silently ignored. Both are fixed; the file now parses and honors${SECRET_KEY:-}like the root compose file.
🌐 Localization
- No more "undefined" labels: form labels built in the first moments after page load could render the literal text "undefined" while translations were still loading. Every translation lookup now falls back to the English string when the translation is not ready yet, across the form, list and component scripts.
🔧 Dependencies & Runtime
- gunicorn 24.1.1 → 26.2.0 and gevent 24.11.1 → 26.9.0 (the new gevent ships Python 3.15 wheels, ending the from-source compile that slowed multi-arch builds), python-dateutil 2.9.0 → 3.0.0, setuptools 84.0.0 → 84.2.1, and the Python 3.15 slim base image digest refreshed.
🧪 Project
- The test suite grows to 64 tests in CI, including new regression coverage for the currency mapping, the stored-XSS fixes, and the Docker folder compose file.
- The README screenshots are refreshed for 1.0.5, including a dark-mode set: all five warranty statuses on one screen, product photos and documents on every card, and multiple tags per card. The wiki User Guide is updated to match, and its CSV import field reference is corrected (flexible date parsing, no hidden caps on warranty months or days).
Upgrading: back up (database + uploads volume), pull the new image, recreate the container. No migrations need manual steps. One note on database credentials (#221): DB_USER, DB_PASSWORD, DB_ADMIN_USER, and DB_ADMIN_PASSWORD should now be set explicitly. The built-in defaults still work in 1.0.5, but startup logs a deprecation warning naming any of the four that are not set, and the defaults will be removed in 1.0.6, when all four become required. Both shipped compose files and the Unraid template already set all four, so installs following the shipped templates only need to check for the warning.
📸 Screenshots
Home page, grid view: every warranty status on one screen, with a product photo, documents, and multiple tags on every card:
Grid view card menu: Archive, Void, Duplicate and Delete in the overflow menu, with text labels:
Status dashboard: summary cards including Total Value and Void:
