3.44.0 (2026-05-27)
Features
- api/v1: accept category_id on POST /events/:id/photos (2d5a2ad)
- api/v1: accept category_id on POST /events/:id/photos (6901e26)
- branding: Customer dashboard header toggles in Branding page (b252cb6)
- branding: toggle login-page logo frame + size (75e41eb)
- clients: scaffold top-level Clients section with sub-nav around Accounts (9091ed4)
- customer accounts (#354) — recurring logins, profile, password reset, branded customer surface (fe52953)
- customers: "Manage galleries" dialog on customer detail page (6d1af7a)
- customers: "Manage galleries" dialog with immediate access revocation + section reorder + portal-flag revert (9be9296)
- customers: customer portal (#354) on top of feature-flags reorg (087ef45)
- customers: email customer when admin adds new gallery access (c02c947)
- customers: replace-assignments endpoint for a single customer (5377b88)
- downloads: preserve original camera filenames on download (opt-in) (#493) (826e43e)
- downloads: preserve original camera filenames on download (opt-in) (#493) (7eeef2b)
- email-templates: categorise + link to feature flags (84c06af)
- email-templates: categorise + sub-categorise + link to feature flags (2cae3fe)
- email-templates: group Templates UI by category + Feature off chip (5ec26fc)
- email-templates: group Templates UI by category with core sub-sections (53eecb6)
- email-templates: seed missing locale translations + post-075 templates (e3150e4)
- email-templates: seed missing nl/pt/ru/fr translations (358f7ee)
- events: default Guest Feedback ON via admin setting (#520) (3465b55)
- footer: hideable legal links + socials + promo banner (#441 + #440) (f3505c2)
- footer: hideable legal links + socials + promo banner (#441 + #440) (3a731e7)
- gallery: revoke customer-minted JWTs when assignment is removed (55a5846)
- i18n: add Spanish (es) locale (#510) (061712e)
- install: skip legacy chain when modern bootstrap fingerprint detected (#530) (8f0108c)
- lightbox: medium-resolution preview tier (#492) (3083c74)
- lightbox: medium-resolution preview tier (#492) (61f1d13)
- lightbox: multi-photo Web Share save-to-Photos on iOS (#557) (d5823c7)
- lightbox: save photo to Photos app on mobile via Web Share (#531) (b2bbf7e)
- lightbox: surface original camera filenames (#508) (33de294)
- localization: add French translations for fit options in thumbnails (2c12885)
- localization: add i18next configuration and CLI commands for localization management (74e87b9)
- localization: add i18next extraction helper & refactor backup configuration component to tsx (e7228b0)
- localization: add missing translations (86ee6c8)
- localization: improve English translations for clarity and consistency (46b99c6)
- localization: update thumbnail settings and add fit options translations (5fc427c)
- og: per-event opt-in to use hero photo as social-share preview (#474) (d856340)
- og: per-event opt-in to use hero photo as social-share preview (#474) (0bc7e2a)
- settings: Features tab + sidebar reorg with feature-flag gating (c3798e1)
- settings: Features tab + sidebar reorg with feature-flag gating (15e3336)
- translations: add French language support and improve localization handling (a5db4bd)
Bug Fixes
- activity-log: smart feature_flags_updated rendering + 33 missing activity types (4703fd5)
- activity-log: smart feature_flags_updated rendering + 33 missing types (fad2de5)
- admin-users: normalise date fields to ISO across DB drivers (#485) (d300426)
- admin-users: normalise date fields to ISO across DB drivers (#485) (b6b58d0)
- admin: test email always sends, regardless of update availability (#418) (9326a42)
- admin: test email always sends, regardless of update availability (#418) (c2b1854)
- api/v1: accept color_theme + create feedback row on event create (#550) (7ef0e40)
- api/v1: accept color_theme + create feedback row on event create (#550) (1b521e7)
- api/v1: scope category lookup to event_owned or global (92bb9e1)
- auth: default COOKIE_SECURE to 'auto' in production + first-install UX (#427) (e1c9382)
- auth: default COOKIE_SECURE to 'auto' in production + first-install UX (#427) (5c7de96)
- auth: restore COOKIE_SECURE='auto' default for production (adfa29e)
- brand-title: runtime substitution so GHCR-image users can override (#521 follow-up) (efa6b4a)
- branding: socials + promo round-trip from DB to form (#460) (bd2288e)
- branding: socials + promo round-trip from DB to form (#460) (ae64a6a)
- bug-batch-518: lightbox comments toggle + further fixes (633a2ae)
- categories: strip diacritics from auto-generated slugs (a747eb3)
- categories: strip diacritics from auto-generated slugs (848430e)
- ci: pin TRIVY_PLATFORM per matrix arch (post-#477 follow-up) (6750f5d)
- ci: pin TRIVY_PLATFORM per matrix arch (post-#477 follow-up) (c3256dc)
- ci: scan multi-arch images per-arch by digest, pin trivy-action (#476) (1144e9d)
- ci: scan multi-arch images per-arch by digest, pin trivy-action (#476) (caf0d61)
- ci: trivy-action tag is v0.36.0 (was 0.28.0 — does not exist) (40e176c)
- create-event: branding-default theme survives eventTypes refetch (d62c529)
- create-event: branding-default theme survives eventTypes refetch (#323-B) (37d487d)
- create-event: re-apply Branding theme on stale→fresh settings (#323-B) (401abf7)
- customer-portal: post-merge fixes for event save, theme fonts, and customer→gallery handoff (9776d8a)
- customer-routes: Cache-Control: no-store on customer endpoints (#470) (3122dd0)
- customer: customer sidebar active state matches admin pattern (8d9d0be)
- customer: don't log customer out on transient session-refresh errors (9e418c7)
- customer: preserve slug-scoped gallery tokens on auth provider mount (7ac1d14)
- customer: unwrap /customer/* from RequireFeature gate (da08a58)
- downloads: apply original-filename toggle to individual downloads too (#507) (38343e6)
- email-templates: backfill subcategory + customer password reset translations (2343a16)
- email: parse JSON-encoded language setting before using as locale (ebc7da2)
- email: parse JSON-encoded language setting before using as locale (f12062f)
- event: correct updating client access (d00f6fa)
- event: ensure client share token is generated only when necessary (916580a)
- events: admins can clear expiration on edit even when 'Require expiration' is ON (#426) (3fd8af3)
- events: admins can clear expiration on edit even when "Require expiration" is ON (#426) (e544561)
- events: clamp page state when totalPages drops below current page (#442) (b4e30a4)
- events: clamp page state when totalPages drops below current page (#442) (9c4a96f)
- events: CustomerAccountPicker hooks order crashed /admin/events/new (2a7ae07)
- events: preserve branding inheritance when saving events with null color_theme (d5a37df)
- events: strip customer_account_ids from update spread (dde72a1)
- events: TDZ ReferenceError on /admin/events from #442 fix (#454) (2f63188)
- events: typed-DELETE confirmation for bulk delete (#417) (e165ee5)
- events: typed-DELETE confirmation for bulk delete (#417) (99e420b)
- external-media: pre-generate thumbnails so reference-mode galleries load fast (#423) (e2ffd9f)
- external-media: pre-generate thumbnails so reference-mode galleries load fast (#423) (f3d0f16)
- features-tab: icon tiles + preview pills follow CI accent (15d01f3)
- features: customer-portal card uses 'Clients' to match sidebar wording (441cc41)
- features: customer-portal card uses 'Clients' to match sidebar wording (dec2f5d)
- feedback: three guest-mode bugs from #538 (filter, like state, count leak) (c900be9)
- feedback: three guest-mode bugs reported in #538 (5311588)
- gallery: hide Like button when guest feedback is off (#506) (9d2db9a)
- gallery: serve thumbnails / photos / hero via storage abstraction (#432) (d3007b0)
- gallery: serve thumbnails / photos / hero via storage abstraction (#432) (83d79f4)
- header: hide language name on mobile to free the title (#523) (4b4ecfd)
- i18n: drive customer "Preferred language" select from SUPPORTED_LANGUAGES (#510) (51890e1)
- i18n: settings page resets UI language to server default (482e91b)
- import: capture photo dimensions in fileWatcher + s3AutoImporter (#447) (5b14854)
- import: capture photo dimensions in fileWatcher + s3AutoImporter (#447) (936a277)
- install: defer events.hero_photo_id FK to break circular reference (#484) (62b3ed6)
- install: defer events.hero_photo_id FK to break circular reference (#484) (87834a7)
- install: drop racy migration step + add missing frontend container (#484) (d4155c4)
- install: self-chowning entrypoint kills fresh-install restart loop (#484) (42c5cda)
- install: self-chowning entrypoint kills fresh-install restart loop (#484) (1505775)
- install: silence clean-install postgres log noise (#484) (99e60a2)
- install: silence clean-install postgres log noise (#484) (86b33d4)
- install: silence pg healthcheck noise + drop legacy workers container (#484) (d39406b)
- install: silence pg healthcheck noise + drop legacy workers container (#484) (0b0b1bb)
- install: skip legacy chain on recovery-state DBs + schema-drift CI (#530) (a0ebc97)
- lightbox+events: Android download lag, multi-photo Web Share re-land, theme branding inheritance (e016f51)
- lightbox: align swipe-neighbour height + stop black flash on commit (#505) (d2d5509)
- lightbox: eliminate download lag on Android by skipping the blob round-trip (0479521)
- lightbox: fill the heart icon when liked (#538 follow-up) (3e39112)
- lightbox: fill the heart icon when liked (#538 follow-up) (600c29d)
- lightbox: hide comments toggle when allow_comments=false (#518) (d44e1ad)
- lightbox: pan zoomed image with single-finger touch on mobile (#532) (53139b8)
- lightbox: restrict Web Share save-to-Photos path to iOS (#554) (578397b)
- lightbox: restrict Web Share save-to-Photos path to iOS (#554) (2a309c7)
- nginx: honour outer X-Forwarded-Proto when behind a reverse proxy (#547) (b351d17)
- nginx: honour outer X-Forwarded-Proto when behind a reverse proxy (#547) (5488de3)
- og: brandable static title + wider crawler UA coverage (#521) (b960639)
- promo-banner: center by default + admin alignment selector (#482) (d1034ce)
- promo-banner: center by default + admin alignment selector (#482) (a803491)
- public-site: honor dark theme surface colors (8b72721)
- recover three orphaned commits from #527 (BRAND_TITLE runtime, Web Share, pan zoom) (9607b46)
- security: scan triage cleanup — drop dead deps, harden Docker/nginx/postMessage (7abfeb9)
- security: scan triage cleanup — drop dead deps, harden Docker/nginx/postMessage (6b6191a)
- server: drop missing requireCustomerPortal middleware import (4fa7225)
- server: mount /api/admin/feature-flags route (f048011)
- settings page resets UI language to server default (165ebce)
- settings: neutralize sidebar icons for a consistent palette (2f00bbd)
- settings: readable contrast on accent-tinted icon tiles + pills (bf7ef14)
- theme: 'Same as body' heading font no longer inherits stale value (35f5b86)
- upload: restore configurable batch-size for reverse proxies (#509) (98f3c3d)
- upload: wire drag-and-drop on admin + user upload zones (#504) (577c4bd)
Reverts
- customer-portal: make the global flag UI-only, drop the kill-switch middleware (3f44193)