v3.44.0

3.44.0 (2026-05-27)

Features

• api/v1: accept category_id on POST /events/:id/photos (2d5a2ad)
• api/v1: accept category_id on POST /events/:id/photos (6901e26)
• branding: Customer dashboard header toggles in Branding page (b252cb6)
• branding: toggle login-page logo frame + size (75e41eb)
• clients: scaffold top-level Clients section with sub-nav around Accounts (9091ed4)
• customer accounts (#354) — recurring logins, profile, password reset, branded customer surface (fe52953)
• customers: "Manage galleries" dialog on customer detail page (6d1af7a)
• customers: "Manage galleries" dialog with immediate access revocation + section reorder + portal-flag revert (9be9296)
• customers: customer portal (#354) on top of feature-flags reorg (087ef45)
• customers: email customer when admin adds new gallery access (c02c947)
• customers: replace-assignments endpoint for a single customer (5377b88)
• downloads: preserve original camera filenames on download (opt-in) (#493) (826e43e)
• downloads: preserve original camera filenames on download (opt-in) (#493) (7eeef2b)
• email-templates: categorise + link to feature flags (84c06af)
• email-templates: categorise + sub-categorise + link to feature flags (2cae3fe)
• email-templates: group Templates UI by category + Feature off chip (5ec26fc)
• email-templates: group Templates UI by category with core sub-sections (53eecb6)
• email-templates: seed missing locale translations + post-075 templates (e3150e4)
• email-templates: seed missing nl/pt/ru/fr translations (358f7ee)
• events: default Guest Feedback ON via admin setting (#520) (3465b55)
• footer: hideable legal links + socials + promo banner (#441 + #440) (f3505c2)
• footer: hideable legal links + socials + promo banner (#441 + #440) (3a731e7)
• gallery: revoke customer-minted JWTs when assignment is removed (55a5846)
• i18n: add Spanish (es) locale (#510) (061712e)
• install: skip legacy chain when modern bootstrap fingerprint detected (#530) (8f0108c)
• lightbox: medium-resolution preview tier (#492) (3083c74)
• lightbox: medium-resolution preview tier (#492) (61f1d13)
• lightbox: multi-photo Web Share save-to-Photos on iOS (#557) (d5823c7)
• lightbox: save photo to Photos app on mobile via Web Share (#531) (b2bbf7e)
• lightbox: surface original camera filenames (#508) (33de294)
• localization: add French translations for fit options in thumbnails (2c12885)
• localization: add i18next configuration and CLI commands for localization management (74e87b9)
• localization: add i18next extraction helper & refactor backup configuration component to tsx (e7228b0)
• localization: add missing translations (86ee6c8)
• localization: improve English translations for clarity and consistency (46b99c6)
• localization: update thumbnail settings and add fit options translations (5fc427c)
• og: per-event opt-in to use hero photo as social-share preview (#474) (d856340)
• og: per-event opt-in to use hero photo as social-share preview (#474) (0bc7e2a)
• settings: Features tab + sidebar reorg with feature-flag gating (c3798e1)
• settings: Features tab + sidebar reorg with feature-flag gating (15e3336)
• translations: add French language support and improve localization handling (a5db4bd)

Bug Fixes

• activity-log: smart feature_flags_updated rendering + 33 missing activity types (4703fd5)
• activity-log: smart feature_flags_updated rendering + 33 missing types (fad2de5)
• admin-users: normalise date fields to ISO across DB drivers (#485) (d300426)
• admin-users: normalise date fields to ISO across DB drivers (#485) (b6b58d0)
• admin: test email always sends, regardless of update availability (#418) (9326a42)
• admin: test email always sends, regardless of update availability (#418) (c2b1854)
• api/v1: accept color_theme + create feedback row on event create (#550) (7ef0e40)
• api/v1: accept color_theme + create feedback row on event create (#550) (1b521e7)
• api/v1: scope category lookup to event_owned or global (92bb9e1)
• auth: default COOKIE_SECURE to 'auto' in production + first-install UX (#427) (e1c9382)
• auth: default COOKIE_SECURE to 'auto' in production + first-install UX (#427) (5c7de96)
• auth: restore COOKIE_SECURE='auto' default for production (adfa29e)
• brand-title: runtime substitution so GHCR-image users can override (#521 follow-up) (efa6b4a)
• branding: socials + promo round-trip from DB to form (#460) (bd2288e)
• branding: socials + promo round-trip from DB to form (#460) (ae64a6a)
• bug-batch-518: lightbox comments toggle + further fixes (633a2ae)
• categories: strip diacritics from auto-generated slugs (a747eb3)
• categories: strip diacritics from auto-generated slugs (848430e)
• ci: pin TRIVY_PLATFORM per matrix arch (post-#477 follow-up) (6750f5d)
• ci: pin TRIVY_PLATFORM per matrix arch (post-#477 follow-up) (c3256dc)
• ci: scan multi-arch images per-arch by digest, pin trivy-action (#476) (1144e9d)
• ci: scan multi-arch images per-arch by digest, pin trivy-action (#476) (caf0d61)
• ci: trivy-action tag is v0.36.0 (was 0.28.0 — does not exist) (40e176c)
• create-event: branding-default theme survives eventTypes refetch (d62c529)
• create-event: branding-default theme survives eventTypes refetch (#323-B) (37d487d)
• create-event: re-apply Branding theme on stale→fresh settings (#323-B) (401abf7)
• customer-portal: post-merge fixes for event save, theme fonts, and customer→gallery handoff (9776d8a)
• customer-routes: Cache-Control: no-store on customer endpoints (#470) (3122dd0)
• customer: customer sidebar active state matches admin pattern (8d9d0be)
• customer: don't log customer out on transient session-refresh errors (9e418c7)
• customer: preserve slug-scoped gallery tokens on auth provider mount (7ac1d14)
• customer: unwrap /customer/* from RequireFeature gate (da08a58)
• downloads: apply original-filename toggle to individual downloads too (#507) (38343e6)
• email-templates: backfill subcategory + customer password reset translations (2343a16)
• email: parse JSON-encoded language setting before using as locale (ebc7da2)
• email: parse JSON-encoded language setting before using as locale (f12062f)
• event: correct updating client access (d00f6fa)
• event: ensure client share token is generated only when necessary (916580a)
• events: admins can clear expiration on edit even when 'Require expiration' is ON (#426) (3fd8af3)
• events: admins can clear expiration on edit even when "Require expiration" is ON (#426) (e544561)
• events: clamp page state when totalPages drops below current page (#442) (b4e30a4)
• events: clamp page state when totalPages drops below current page (#442) (9c4a96f)
• events: CustomerAccountPicker hooks order crashed /admin/events/new (2a7ae07)
• events: preserve branding inheritance when saving events with null color_theme (d5a37df)
• events: strip customer_account_ids from update spread (dde72a1)
• events: TDZ ReferenceError on /admin/events from #442 fix (#454) (2f63188)
• events: typed-DELETE confirmation for bulk delete (#417) (e165ee5)
• events: typed-DELETE confirmation for bulk delete (#417) (99e420b)
• external-media: pre-generate thumbnails so reference-mode galleries load fast (#423) (e2ffd9f)
• external-media: pre-generate thumbnails so reference-mode galleries load fast (#423) (f3d0f16)
• features-tab: icon tiles + preview pills follow CI accent (15d01f3)
• features: customer-portal card uses 'Clients' to match sidebar wording (441cc41)
• features: customer-portal card uses 'Clients' to match sidebar wording (dec2f5d)
• feedback: three guest-mode bugs from #538 (filter, like state, count leak) (c900be9)
• feedback: three guest-mode bugs reported in #538 (5311588)
• gallery: hide Like button when guest feedback is off (#506) (9d2db9a)
• gallery: serve thumbnails / photos / hero via storage abstraction (#432) (d3007b0)
• gallery: serve thumbnails / photos / hero via storage abstraction (#432) (83d79f4)
• header: hide language name on mobile to free the title (#523) (4b4ecfd)
• i18n: drive customer "Preferred language" select from SUPPORTED_LANGUAGES (#510) (51890e1)
• i18n: settings page resets UI language to server default (482e91b)
• import: capture photo dimensions in fileWatcher + s3AutoImporter (#447) (5b14854)
• import: capture photo dimensions in fileWatcher + s3AutoImporter (#447) (936a277)
• install: defer events.hero_photo_id FK to break circular reference (#484) (62b3ed6)
• install: defer events.hero_photo_id FK to break circular reference (#484) (87834a7)
• install: drop racy migration step + add missing frontend container (#484) (d4155c4)
• install: self-chowning entrypoint kills fresh-install restart loop (#484) (42c5cda)
• install: self-chowning entrypoint kills fresh-install restart loop (#484) (1505775)
• install: silence clean-install postgres log noise (#484) (99e60a2)
• install: silence clean-install postgres log noise (#484) (86b33d4)
• install: silence pg healthcheck noise + drop legacy workers container (#484) (d39406b)
• install: silence pg healthcheck noise + drop legacy workers container (#484) (0b0b1bb)
• install: skip legacy chain on recovery-state DBs + schema-drift CI (#530) (a0ebc97)
• lightbox+events: Android download lag, multi-photo Web Share re-land, theme branding inheritance (e016f51)
• lightbox: align swipe-neighbour height + stop black flash on commit (#505) (d2d5509)
• lightbox: eliminate download lag on Android by skipping the blob round-trip (0479521)
• lightbox: fill the heart icon when liked (#538 follow-up) (3e39112)
• lightbox: fill the heart icon when liked (#538 follow-up) (600c29d)
• lightbox: hide comments toggle when allow_comments=false (#518) (d44e1ad)
• lightbox: pan zoomed image with single-finger touch on mobile (#532) (53139b8)
• lightbox: restrict Web Share save-to-Photos path to iOS (#554) (578397b)
• lightbox: restrict Web Share save-to-Photos path to iOS (#554) (2a309c7)
• nginx: honour outer X-Forwarded-Proto when behind a reverse proxy (#547) (b351d17)
• nginx: honour outer X-Forwarded-Proto when behind a reverse proxy (#547) (5488de3)
• og: brandable static title + wider crawler UA coverage (#521) (b960639)
• promo-banner: center by default + admin alignment selector (#482) (d1034ce)
• promo-banner: center by default + admin alignment selector (#482) (a803491)
• public-site: honor dark theme surface colors (8b72721)
• recover three orphaned commits from #527 (BRAND_TITLE runtime, Web Share, pan zoom) (9607b46)
• security: scan triage cleanup — drop dead deps, harden Docker/nginx/postMessage (7abfeb9)
• security: scan triage cleanup — drop dead deps, harden Docker/nginx/postMessage (6b6191a)
• server: drop missing requireCustomerPortal middleware import (4fa7225)
• server: mount /api/admin/feature-flags route (f048011)
• settings page resets UI language to server default (165ebce)
• settings: neutralize sidebar icons for a consistent palette (2f00bbd)
• settings: readable contrast on accent-tinted icon tiles + pills (bf7ef14)
• theme: 'Same as body' heading font no longer inherits stale value (35f5b86)
• upload: restore configurable batch-size for reverse proxies (#509) (98f3c3d)
• upload: wire drag-and-drop on admin + user upload zones (#504) (577c4bd)

Reverts

• customer-portal: make the global flag UI-only, drop the kill-switch middleware (3f44193)

Documentation

• contributing: update branch reference from main to beta (ed37caf)
• contributing: update branch reference from main to beta (c114749)
• localization: enhance French language support and improve i18next configuration (d1bc5e0)