v0.5.0

Security hardening release. The container now runs as a non-root user — existing deployments need a one-time volume permission fix before upgrading (see below).

Security

• Fixed session store expiry bug: stored sessions outlived the cookie by ~1000x; a stolen session ID stayed usable for years instead of 7 days
• Fixed authorization gap: any authenticated user could render any account's MICR line (routing + account number) via the layout preview endpoint
• Session ID regeneration on login, setup, and SSO login (session fixation)
• Password reset links built from new APP_BASE_URL env var instead of the Host header (reset-link poisoning)
• Rate limiting on password reset requests (5/IP/15 min)
• Secure cookies on TLS connections + new TRUST_PROXY env var for reverse-proxy deployments
• OIDC logs no longer record authorization codes, subject IDs, or emails
• QBO import records re-validated server-side; routing numbers validated as 9 digits; upload size caps; atomic user updates; last admin cannot be demoted
• Container runs as unprivileged node user; .dockerignore keeps local .env/database/git files out of published images
• Patched qs transitive dependency (GHSA-q8mj-m7cp-5q26, moderate DoS)

Performance

• Hot-path SQL statements (auth checks, session load/save) prepared once instead of per request

Upgrading from v0.4.x

The data volume was written as root by older images. Fix ownership once before pulling:

docker compose down
docker run --rm -v check-printing-data:/data alpine chown -R 1000:1000 /data
docker compose pull && docker compose up -d

New optional env vars (recommended in production):

Variable	Purpose
APP_BASE_URL	Public URL of the app (e.g. https://checks.example.com) — used in password reset links
TRUST_PROXY	Set to 1 when behind a reverse proxy / TLS termination

Full Changelog: v0.4.6...v0.5.0

v0.4.6

Full Changelog: v0.4.5...v0.4.6

New Features

• Layout editor preview — New "⎙ Preview PDF" button in the check layout editor generates a 3-up PDF with dummy data so you can proof field positions without printing real checks.
• Deposit slip back page — Deposits with more than 30 checks now generate a two-page slip. The front page gains a "FROM REVERSE" row carrying the back-page subtotal; the back page prints as "ADDITIONAL CHECK LISTING" with rows 31–60 and a "Forward to other side" total.
• Deposit panel pre-fills 30 slots — Opening a new or existing deposit now shows all 30 check slots immediately. A single "Add Back Page Rows" button appears once the front page is full and adds all 30 back-page slots at once.

Bug Fixes

• iOS deposit panel — Switched height: 100vh to 100dvh so the Save button is no longer clipped by the iOS browser chrome. The panel body now scrolls internally while the footer stays pinned.
• PDF download on Firefox iOS — Replaced window.open(blob:) with a hidden <a download> click, which Firefox iOS supports. Affects check PDFs and both deposit PDF types.
• Check numbers overlapping row labels — Check numbers on deposit slips were printing on top of the row number; shifted right by 0.12" to clear.

Print Quality Improvements

• Deposit slip check numbers and amounts switched to Courier-Bold for heavier, more scanner-readable ink.
• Darkened label text (#444 → #111) and disclaimer text (#666 → #333) across both slip pages.
• Darkened grid lines (#888 → #333) for better scanner readability (bank feedback).
• "DEPOSIT TICKET" header and depositor/bank block moved down slightly on the front page.
• Back page grid vertically centered on the page; "ADDITIONAL CHECK LISTING" title repositioned accordingly.

v0.4.5

Changes

• feat(layout): add 1/8" grid overlay on check layout editor canvas
• feat(layout): anchor MICR second transit symbol at 2 59/64" from left
• feat(layout): clamp draggable fields to printing safe zone (11/64" sides, 13/64" top, 0.5" bottom)
• feat(layout): render dashed safe-zone outline on layout canvas

v0.2.0 - 2026-03-31

New Features

• User authentication & role-based access: Login system with admin, editor, and viewer roles. Admins manage all accounts; editors can create and print checks/deposits; viewers are read-only.
• Per-account access control: Users can be granted editor or viewer access on a per-account basis.
• Password reset via email: "Forgot password?" flow sends a time-limited reset link via SMTP. Admin-configurable SMTP settings inside the Manage Users modal.
• Multiple checking accounts: Add and manage more than one account. Each account has independent checks, deposits, and layout fields.
• QuickBooks Online CSV import: Import check and deposit records directly from QBO-exported CSV files.
• Deposit slip generation: PDF deposit slips alongside the existing check PDF flow.

Bug Fixes

• Checks printed blank (MICR only) for wizard-created accounts: Default layout fields are now seeded at startup for any account with no layout configuration, and when a new account is created via the setup wizard. Existing installs are fixed automatically on next container restart.
• Edit button in Manage Users did nothing: Inline onclick handlers were blocked by the CSP default-src 'self' header. Switched to event delegation.
• Company address lines 3 & 4 not rendering: company3/company4 were missing from the PDF field resolver.

Security

• Fixed three critical authorization vulnerabilities: IDOR on check/deposit endpoints, cross-account check marking, and missing server-side printed-check guard.
• Fixed medium issues: unbounded PDF/QBO import arrays (DoS), PDF error detail leak.
• Fixed low issues: session invalidation on role change, SESSION_SECRET enforcement.

Dependencies

• nodemailer 6.10.1 → 8.0.4
• path-to-regexp 0.1.12 → 0.1.13
• brace-expansion 5.0.4 → 5.0.5
• picomatch 2.3.1 → 2.3.2

What's Changed

• Bump multer from 1.4.5-lts.2 to 2.1.1 by @dependabot[bot] in #1
• Bump nodemailer from 6.10.1 to 8.0.4 by @dependabot[bot] in #5
• Bump path-to-regexp from 0.1.12 to 0.1.13 by @dependabot[bot] in #3
• Bump brace-expansion from 5.0.4 to 5.0.5 by @dependabot[bot] in #2
• Bump picomatch from 2.3.1 to 2.3.2 by @dependabot[bot] in #4

New Contributors

• @dependabot[bot] made their first contribution in #1

Full Changelog: https://github.com/snachodog/check-printing/commits/v0.2.0