v3.43.0

3.43.0 (2026-05-07)

Features

• add admin dark mode and SEO/robots.txt settings (9c2a0d2)
• add bulk category editing for photos (#157) (eca36c7)
• add category hero/cover photo selection (#163) (6c30e2c)
• add configurable upload batch size for reverse proxy compatibility (#208) (02a46e0)
• add COOKIE_SECURE=auto for mixed HTTPS/HTTP deployments (#298) (b1dfbe4)
• add COOKIE_SECURE=auto for mixed HTTPS/HTTP deployments (#298) (15a8ab4)
• add customizable event types with admin management (f8881d5)
• add Dutch (nl) locale and fix missing translation keys across all locales (b54a80d)
• add Dutch locale and fix missing translation keys (e32da68)
• add Gallery Premium and Gallery Story layouts (Beta) (e179def)
• add hero image focal point picker with anchor positioning (#162) (734868a)
• add justified layout modes and aspect-ratio-aware mosaic (#146) (608bbd5)
• Add justified layout modes and aspect-ratio-aware mosaic (#146) (ef2ae00)
• add justified/rows layout mode to masonry gallery (#146) (e081b56)
• add justified/rows layout mode to masonry gallery (#146) + security fixes (cd1d504)
• add optional event date and expiration settings (3079eaa)
• add optional event date and expiration settings (2151147), closes #118
• add original filename preservation and Lightroom export support (a59f414)
• add original filename preservation and Lightroom export support (9872ad3)
• add per-event custom logo upload with bug fixes (85170b8)
• add per-event hero logo customization options (0790a1d)
• add per-gallery thumbnail scale setting (#172) (#251) (ee46088)
• add photo cap per event and Portuguese (pt-BR) locale (1fa222e)
• add photo cap per event and Portuguese locale (088de43)
• add quilted layout, fix mosaic, and backfill photo dimensions (#146) (46ed1bc)
• add thumbnail settings UI to admin panel (3a30fea)
• add thumbnail settings UI to admin settings page (#206) (7d6d2f5)
• add update instructions dialog, email notifications, and capture date sorting (50c0990), closes #181
• add visual WYSIWYG email template editor (#229) (04a7ea8)
• branding: 8-token CI palette + force color mode + dark-mode consistency (8050927)
• branding: force color mode (dark or light) site-wide (5a162fc)
• branding: inline force color mode with auto-save + clearer palette help text (67d7d8d)
• branding: per-family generic fallback via meta.json (dcff451)
• branding: preview each font in its own face in the picker dropdown (b4f9b65)
• branding: self-hosted webfonts with filesystem scanner (d04bf28)
• branding: self-hosted webfonts with filesystem scanner (bac51fe)
• cms: add external URL toggle for imprint and privacy pages (b2c8161)
• cms: add per-page external URL override — backend (66423bb)
• cms: admin UI for external imprint/privacy URL (a4e3d10)
• cms: redirect legal links to external URL when configured (c5bba50)
• configurable upload batch size for reverse proxy compatibility (9b7495e)
• configurable upload batch size for reverse proxy compatibility (4243363)
• customisable 404 + gallery-not-found pages via CMS (#324) (4f77905)
• decouple hero header from gallery layouts (#158) (7b8d8bd)
• draft mode, admin branding, and workflow improvements (dc98206)
• draft mode, admin branding, and workflow improvements (40332a7)
• dynamic website title from branding settings (d29aab7)
• email: expand email palette to 8 tokens + Sync from Branding button (47b6b39)
• events: add Photos column to admin events list (#384) (d561db8)
• events: add Photos column to admin events list (#384) (ffb4318)
• events: bulk delete with password confirmation (#384) (647aea2)
• events: bulk delete with password confirmation (#384) (48d538f)
• events: prefill admin email + admin picker on event creation (3fe8e61)
• events: prefill admin email + admin picker on event creation (ee56b67)
• events: Sync from Branding button in gallery theme customizer + clarified default inheritance (bdbe7b8)
• events: tree view for external media folder picker (cdd40ac)
• events: tree view for external media folder picker (f927b09)
• frontend: dedupe /public/settings via shared usePublicSettings hook (#325) (3d4ae4d)
• gallery layouts, bulk category editing, and hero header improvements (7037106)
• gallery layouts, hero customization, bulk categories & event types (d9e00dc)
• gallery layouts, hero customization, event types, and UX improvements (#146, #155-163, #170, #171) (4280444)
• gallery: decouple header style from layout, add banner option (1f1a856)
• gallery: decouple header style from layout, add banner option (24d7277)
• gallery: decouple header style from layout, add banner option (aff29c9)
• gallery: icon-only menu, accent Download CTA (#386) (876b35b)
• gallery: icon-only menu, accent Download CTA, logo aligned (#386) (de8ad5f)
• guest selections with per-person identity (#292) (3856ba2)
• guest selections with per-person identity (#292) (ad4e5a7)
• i18n: add Brazilian Portuguese (pt-BR) locale (375f512)
• i18n: improve pt locale with pt-BR phrasings, remove duplicate pt-BR file (f25559c)
• improve gallery layouts with aspect-ratio-aware masonry and mosaic modes (#146) (aacfcd5)
• improve hero image UX and live preview (#163, #158) (d63f67a)
• multilingual email templates with translations table (8c5996e)
• multilingual email templates with translations table (f50d7c0)
• native multi-arch Docker images (Apple Silicon, ARM64 Linux) (df30618)
• native S3 storage backend (#328) + presigned download follow-up (1b717ce)
• new features and bug fixes for beta release (151e1bf)
• optional customer phone field gated by global toggle (#322) (be6cb28)
• original filename in admin UI, update dialog, and security hardening (3ea9d5b)
• original filename in admin UI, update dialog, security hardening, and bug fixes (bcf2745)
• outbound webhooks for event/photo lifecycle (#327) (c488f48)
• per-event custom logos, customizable event types, and multiple bug fixes (4c08160)
• photo visibility control with client access (#172) (4a93e4e)
• photo visibility control with client access (#172) (e1b6e43)
• pre-generate watermarks for instant lightbox loading (1be974a), closes #112
• pre-generated watermarks and mobile upload button improvements (c6fdd38)
• pre-zip download all and photo replacement by name (#312, #313) (d3f1206)
• pre-zip download all and photo replacement by name (#312, #313) (e18afd3)
• presigned download UI + S3 prefix walker auto-importer (follow-ups) (446d80a)
• public v1 API + token management + OpenAPI docs (#322) (808b15b)
• register Russian locale and add to language selector (6f95b8c)
• S3 storage + webhooks + settings dedupe + backup fixes (06d54be)
• show original filename in admin UI (#184) (0891be1)
• sort photos by capture date with configurable default sort (#283) (8805fa5)
• sort photos by capture date with configurable default sort (#283) (633d4a0)
• support Apple Silicon natively via multi-arch images (c282a72)
• theme: expand color settings to 8-token CI palette + alt button (114aab5)
• upload: async photo processing — backend (PR-B part 1) (851744c)
• upload: async photo processing — frontend (PR-B part 2) (3b827b8)
• upload: async photo processing + fix(auth): /auth/session symmetry (loop fix) (907bcf1)
• upload: two-state UI + temp dir cleanup (PR-A of async processing) (86dfcc4)
• visual WYSIWYG email template editor (703c03f)
• warn about low thumbnail resolution when selecting beta themes (ee3f6ae)
• warn about low thumbnail resolution with beta themes (aef9b4e)
• webhooks: enrich event.* payloads with customer contact + share_token (#341) (7ea4801)
• webhooks: enrich event.* payloads with customer contact + share_token (#341) (1e69d5f)

Bug Fixes

• add allow_user_uploads to gallery API responses (691e3ab)
• add lightbox loading spinner and watermark cache invalidation (050ed37)
• add STORAGE_PATH to production docker-compose (cdda709)
• address beta feedback - gallery layout fixes, Russian locale, email logo (#249) (486239a)
• address bugs and feature requests from discussion #317 (6cfff6f)
• address Shannon security assessment findings (37 vulnerabilities) (#254) (23cd9cb)
• admin photo feedback filters have no effect (#293) (9ed8a2b)
• admin: tab underlines use accent (not accent-dark) for proper highlight color (565ae45)
• apply password change fix to regular modal + longer toast delay (#263) (c63bc47)
• apply password change redirect fix to regular modal too (#263) (147dc28)
• apply sort direction in gallery and respect show_feedback_to_guests (#302, #303) (3716ff5)
• apply sort direction in gallery view and respect show_feedback_to_guests (#302, #303) (dffe057)
• auth: /auth/session must enforce session timeout symmetrically (#350 recurrence) (c8e09c2)
• auth: /auth/session must enforce session timeout symmetrically (#350 recurrence) (b106da1)
• auth: /auth/session must reject tokens that adminAuth/galleryAuth would reject (f905f7e)
• auth: /auth/session must verify issuer claim like adminAuth (#350) (83dedbc)
• auth: make /auth/session verify the issuer claim like adminAuth (#350) (88a6c6a)
• backup: cron schedule mapping + manifest format detection + bigint coerce (ab4095f)
• backup: incremental backups against S3 + jsonb stats parsing (e232f9f)
• branding: admin sidebar uses accent-dark, primary buttons follow CI token (fc2bce3)
• branding: comprehensive sweep — replace remaining primary-* legacy colors with accent tokens (578a174)
• branding: selected-state accent colors, force-mode actually flips galleries, compact color picker layout (5b410ed)
• branding: working tooltips, high-contrast selected states, gallery chrome follows accent (b19bb0c)
• checkbox and toggle settings not persisting after page refresh (808ed1d), closes #117
• cms: apply dark mode to CMS editor, public CMS, and admin modals (d2a10f6)
• cms: nl/pt/ru i18n + gate external_url in public response (08d0462)
• cms: nl/pt/ru i18n + gate external_url in public response (bce5c1f)
• correct invitation activation validation and add missing translations (991aa98), closes #129
• correct invitation email link URL path (86fa104), closes #129
• correct storage path resolution in multiple files (#96) (0e3674b)
• correct storage path resolution in multiple files (#96) (3ccb815)
• database migration restart bug, lightbox loading spinner, and watermark cache invalidation (7c58749)
• dedupe parallel admin 401 redirects to /admin/login (038e84c)
• discussion #317 issues and #318 archive crash (2f2f405)
• display welcome message in gallery and fix guest thumbnail URLs (#306, #307) (b05c36a)
• display welcome message in gallery and fix guest thumbnail URLs (#306, #307) (9323bef)
• docker compose v2 syntax and add missing ADMIN_PASSWORD to .env.example (#189) (0817443)
• docker: install system ffmpeg on Alpine, drop broken bundled binary (3ab8a64)
• docker: install system ffmpeg on Alpine, drop broken bundled binary (96818c7)
• dynamic website title from branding settings (4701edc)
• email: render conditionals, localise password placeholders, fix caller/template variable drift (0767203)
• email: render conditionals, localise password placeholders, fix caller/template variable drift (e8052ad)
• event-specific custom CSS settings not being saved (dadef81), closes #136
• events search/counters (#346), lazy gallery skeleton (#321), smooth lightbox swipe (#348) (6229b38)
• events without expiration date incorrectly shown as expired (c4f16eb)
• events: admin-set password on reset, full-URL gallery_link in all emails (0d1f82d)
• events: admin-set password on reset, full-URL gallery_link in all emails (ff50c74)
• events: coerce expires_in_days to Number before addDays (e5712d8)
• events: coerce expires_in_days to Number before addDays (db29d0e)
• events: match scrollbar to theme in external folder tree picker (bd42ee1)
• events: server-side search/pagination to remove first-100 cap (#346) (a5b20ca)
• events: show customer phone in event details view (#331) (4c73d22)
• events: stop mapping branding_logo_position onto hero_logo_position (af2b062)
• events: stop mapping branding_logo_position onto hero_logo_position (ef1c875)
• external media dimensions, theme race condition, email color customization (dfae2c2)
• floor password_changed_at when comparing against JWT iat (793e410)
• fonts: drop immutable Cache-Control to allow font replacement rollout (5703fcb)
• gallery: default controls to inline for every layout (045e9ea)
• gallery: lazy-render skeleton grid for fast loads (#321 follow-up) (d9d8137)
• gallery: preserve sidebar controlsStyle on banner migration (05dadff)
• gallery: single-finger swipe nav in mobile lightbox (#332) (4c8eba0)
• gallery: use ref for swipe-start to avoid stale-closure miss (#332) (fcddfe0)
• gallery: WCAG-safe Download button text + extract HeaderDownloadButton (#401 follow-ups) (04e928d)
• gallery: WCAG-safe Download button text + extract HeaderDownloadButton (#401 follow-ups) (0c80abd)
• guest feedback flow bugs in Masonry grid and PhotoLightbox (#292) (54badef)
• guest feedback flow bugs in Masonry grid and PhotoLightbox (#292) (77f07e9)
• handle null dates in dashboard and gallery pages (c5a8ffc)
• hero header state and preview in admin theme editor (#158) (f554f46)
• improve ghost button visibility in admin dark mode (4912e2b)
• improve password validation errors and event list UX (#170, #171) (171abb3)
• improve photo serving, category filters, and upload chunking (#155, #156, #161) (fa4c838)
• increase upload limit to 1GB and fix category filters (#155, #156) (397d33a)
• issue #203 file type validation + security CVE fixes (8017171)
• lightbox: mobile toolbar clipping + iOS safe-area + viewport-fit (#336) (42a7ae4)
• lightbox: smooth carousel swipe + drop instructional hint (#348) (743086d)
• mobile lightbox + share previews + customer phone bug triage (1e40677)
• mobile upload button not visible in gallery (#113) (cacaffa)
• mobile upload button visibility in gallery (2a2c23d), closes #113
• mobile upload button visibility in gallery (df7dbff), closes #113
• mobile upload button visibility in gallery (#113) (05a5307)
• mobile upload button visibility in gallery (#113) (6cb4342)
• nginx: proxy /fonts requests to backend (e6c03e4)
• pin npm to v10 in backend Dockerfile (ddefd3a)
• pin npm upgrade to v10 in backend Dockerfile (978e447)
• prevent backend crash on archive when admin_email is null (#318) (e4b0f96)
• prevent database migration restart failures (83a4344), closes #107
• remove non-functional watermark toggle from Feature Toggles (d4a15db)
• render minimal/none header styles, cap hero height, switch category hero images (#158, #162, #163) (bc6c48b)
• resend gallery email fails for events without password (6b3ead7), closes #137
• resolve admin invitation flow issues and improve STORAGE_PATH documentation (41bf6ff)
• resolve code quality issues and add missing i18n keys (#162, #163) (329d224)
• resolve code scanning security alerts (multer, tar, Node 22) (85a07fc)
• resolve external media dimensions, gallery theme race condition, and add email color customization (bbeedd1)
• resolve issues #194, #195, #196, #197 (33af088)
• resolve issues #194, #195, #196, #197 (5ea4ef3)
• resolve issues #194, #195, #196, #197 (33483cf)
• resolve issues #194, #195, #196, #197 (cd00bc1)
• resolve JWT iat timing issue in password change (#263) (c031b1e)
• resolve mixed light/dark mode styling in admin UI (#175) (f8c8abd)
• resolve password change redirect loop (#263) and file watcher crash (#269) (b23c51b)
• resolve password change redirect loop and file watcher crash (835bdf5), closes #269
• resolve redirect loop after mandatory password change (#263) (07fc5e6)
• resolve redirect loop after mandatory password change (#263) (3c8d344)
• respect allowed_file_types setting for upload validation (#203) (fe07a14)
• respect optional email settings in event creation (831ea6a)
• respect optional email settings in event creation (#217) (9c44a0e)
• restore aspect-ratio layouts and improve hero image quality (#180) (3974ba5)
• restore aspect-ratio layouts and improve hero image quality (#180) (5cef7fd)
• revert /api prefix in adminPhotos.js to avoid double-prefix (094276d)
• revert /api prefix in adminPhotos.js to avoid double-prefix (#307) (ceb2a09)
• security: invalidate tokens on password change, enforce session timeout, fix role update (85a60a2)
• security: invalidate tokens on password change, enforce session timeout, fix role update (f362239)
• security: resolve all npm audit vulnerabilities (4272618)
• security: resolve Docker image CVEs for code scanning alerts (cbecb93)
• security: token invalidation on password change, session timeout enforcement (0a3a537)
• security: token invalidation on password change, session timeout enforcement (7ca9631)
• set JWT iat after password_changed_at to prevent token rejection (#263) (b1d1667)
• share: OG/Twitter-card metadata for gallery share URLs (#333) (5275621)
• shorten Save button label on email template editor (7250c42)
• show upload button in mobile topbar instead of sidebar (ae181cf), closes #113
• sync backend package-lock.json for security deps (bb81fa5)
• sync backend package-lock.json with security dep updates (03e1989)
• sync header_style DB column with theme editor selections (#158) (2288309)
• sync header_style DB column with theme editor selections (#158) (a19e7c4)
• theme picker buttons no longer submit the parent form (#326) (2eead52)
• theme save without Live Preview, Branding default on new events, gallery loading flicker (#323, #321) (822be9a)
• theme-preset match loop ignores extra fields like logoUrl (#323) (b63a877)
• theme: centralise force-mode enforcement inside ThemeContext so every gallery flips (21188f4)
• theme: kill initial white frame + theme-aware skeleton tiles (#358 follow-up) (f529c9e)
• theme: kill initial white frame + theme-aware skeleton tiles (#358 follow-up) (1a530ae)
• theme: pre-React bootstrap to kill white-flash on dark galleries (#358) (07b41e6)
• theme: pre-React bootstrap to kill white-flash on dark galleries (#358) (f81a872)
• update dependencies to resolve code scanning security alerts (1f524f2)
• update docker-compose to docker compose and add ADMIN_PASSWORD to .env.example (#189) (a4c6248)
• update packages to fix security vulnerabilities (8097a0c)
• update security policy with private reporting channels (308e086)
• update security policy with private reporting channels (7f77362)
• update security policy with proper contact email and private reporting (67b0f32), closes #223
• use actual photo aspect ratios in masonry columns mode (#146) (8711f96)
• use CSS Columns for gap-free mosaic layout (#146) (821d329)
• use photo dimensions for mosaic aspect ratios (#146) (27ff51e)
• video upload media type, select all, and dimension repair (#203, #220, #180) (fc75bcd)
• video upload, select all, and dimension repair (#203, #220, #180) (a0bb080)
• wire admin photo feedback filters into grid query (#293) (d4b4dc6)
• wrap email preview with full styled header/footer template (9a6d2e8)
• wrap email preview with full styled header/footer template (fc0911a), closes #229
• wrap test email with standard email template (#252) (954a011)

Reverts

• branding: per-option font preview (defer to follow-up) (f410207)

Documentation

• add API_URL environment variable to .env.example files (3e69579)
• add Buy Me a Coffee badge + Support section (46bc894)
• add External Media Library section to deployment guide (#270) (2e1c71c)
• add External Media Library section to deployment guide (#270) (f6ca713)
• clarify file system photo import requires existing event (#269) (5295516)
• clarify file system photo import requires existing event (#269) (ee0baaf)
• emphasize importance of STORAGE_PATH in env example (3397807)
• fonts: cache rollout, stale-list note, meta.json (bd0e052)
• move documentation to docs.picpeak.app, drop in-repo copies (02ed5d4)
• move documentation to docs.picpeak.app, drop in-repo copies (0faf9b3)
• readme: add Contributors section with @Luca-Timo and @Rekoo-PS (c60ab74)
• readme: add Contributors section with @Luca-Timo and @Rekoo-PS (dbe0a30)
• rewrite README — shorter, cleaner (62643f2)
• rewrite README — shorter, cleaner, less AI-sounding (64f6061)