v0.6.0

Released: 2026-07-19

Changes since v0.5.0 (677ef07..merge of #117).

Features

Editable S3 destination key (PR #117 by @gabrielforster): When "Upload to S3" is toggled in the image picker or video dialog, a text field lets you choose where the object lands instead of the fixed frankmd/YYYY/MM/<filename>. Pre-filled with the key the server would have generated, so the default flow stays one click. Tabs where the browser holds the file (Drop/paste, Folder, Local re-upload) edit the full key; tabs where the server owns the filename (Web/Google/Pinterest, AI, video) edit just the folder prefix. Custom values are sanitized server-side (UploadStorage.sanitize_s3_key): nested prefixes are allowed, while empty, . and .. segments — and therefore leading slashes, //, and traversal — are dropped; a value that sanitizes to nothing falls back to the default key. The choice is per-upload and resets when the dialog closes.

Image S3 object keys are now sanitized like video keys (image/video parity): spaces and special characters in filenames become _ (e.g. my photo (1).jpg → my_photo__1_.jpg) instead of being stored raw and URL-encoded. If you link S3 assets by convention, new uploads of such filenames will have different key shapes than before.
The three previously-inlined S3 key builders now route through a single UploadStorage.s3_key, and region/URL fallbacks are deduplicated (s3_region / s3_url).

Long-standing CI flake fixed: LogsControllerTest's missing-log-file test renamed the shared log/test.log away, racing sibling tests in other parallel worker processes. The class is now serialized across processes with an advisory flock. This was the intermittent "Ruby tests failed" that recurred in CI for weeks.

loofah 2.25.1 -> 2.25.2, rails-html-sanitizer 1.7.0 -> 1.7.1 (transitive patches)

#118 tracks removing skip_forgery_protection from the upload endpoints — custom S3 keys raise the stakes of the pre-existing CSRF exemption.