nodemailer and basic-ftp are only fixed in their next major, so this
takes both, along with argon2 0.45, ssh2-sftp-client 12, archiver 8,
@astrojs/react 7 and the minor bumps.
- archiver 8 has no default export any more, only `ZipArchive`. Our own
`src/types/archiver.d.ts` still declared the old default, so `tsc` would
have stayed green while every ZIP download threw at runtime. The local
declaration is gone; `@types/archiver` 8 matches the real API now.
- nodemailer 10 ships its own types; `@types/nodemailer` is gone.
- Existing argon2 hashes still verify (hash made with 0.41, verified
with 0.45).
- basic-ftp 6 no longer silently redirects the data connection when an
FTP server behind NAT announces its private address. That is the
library's deliberate secure default. If a delivery target that worked
before fails now, press "Test connection" — the error names the cause.
- `baseUrl` is out of tsconfig.json (TypeScript 7 removed it; the `@/`
alias was never used).
- engines: Node >= 22.12, which pg-boss and @astrojs/react now require.
Deliberately not taken: pg-boss 12 cannot migrate the v10 queue schema
in place, and TypeScript 7 is a toolchain switch with no security gain.
Both get their own change.
The critical advisory in the dependency tree (GHSA-26w7-cxv4-gfx2, remote code
execution through AVIF image optimisation) has no fix inside Astro 5, so this
moves to Astro 7.3.2 with @astrojs/node 11 and current sharp. `npm audit` now
reports nothing. The only code the jump needed: `csp` graduated out of
`experimental`, and sharp's `Sharp` type is a named export now.
Also fixed, both found by testing with every module switched on rather than
only the print-only default:
- `src/pages/index.astro` passed `dict` to the studio island without ever
defining it, so the studio page returned 500 on any instance with the AI
module on. The print-only default redirects away from that page, which is
why the earlier run never hit it.
- The print studio fetched `/api/delivery-targets` even with the delivery
module off. The route answered 404 exactly as designed, but it left a red
line in the console of every print-only instance, which reads like a fault.
It now asks only when there is a module to ask, and hides the card otherwise.
Plus: the first-run box sizes itself to its content instead of miscounting
padding, and the README's counts are recounted rather than remembered.
Verified against a live instance on a fresh database, in both module sets:
sign-in, module gating, the German interface, an eight-up passport sheet and
its PDF. 124 tests, type check, build and secret scan all clean.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nh4A79bbqT9dcd2inzYUdg
- CI pinned Node 20, but `node --test` with type stripping needs 22.6, so the
workflow could never have gone green. CI and `engines` now say 22.6.
- `docker compose up -d` failed on the documented path: the compose files
require DB_PASSWORD and .env.example never mentioned it. Documented, and the
README no longer claims "three secrets".
- The secret scanner treated any comment line as safe, so a pasted `.env`
fragment — the usual way a key gets committed — slipped through. Verified
against planted keys before and after.
- Module pages were not guarded: with KLARBILD_MODULES=print a signed-in user
could still open /shares, /library and /queue and read about features the
instance does not have. They now redirect, matching the API's 404 behaviour.
- German left in the English build: `bild.<ext>` as a download fallback, and
31 t() keys with no German at all — the whole main navigation among them, so
a German instance rendered its nav in English. Dictionary now covers every
key in the source (1,067 entries).
- Third-party names removed from the data as well as the labels: the `theframe`
format id is now `tv169`, and the dead Cricut admin field is gone.
- Dockerfile ignored the committed lockfile; it now copies it and uses `npm ci`.
- Dropped an unused dependency (@aws-sdk/s3-request-presigner — storage.ts
explains why presigned URLs are not needed), a dead `/g/` entry in the
unauthenticated path list, and an undocumented N8N_WEBHOOK_URL that nothing
read. Documented TRUSTED_PROXIES, which the rate limiter does read.
- Migration 004 still had "nas" in its filename; README said A6–A2 where the
list runs A6–A1; two committed screenshots were referenced nowhere.
124 tests green, type check clean, build clean, secret scan clean.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nh4A79bbqT9dcd2inzYUdg
A self-hosted print studio: images at exact physical sizes, sheet layout with
crop marks, tiling, 1:1 PDF. Everything else — image generation, delivery,
share links, mail, Telegram — is an optional module that is off by default.
This is the neutral public twin of a private tool. Compared to that original:
- optional modules behind KLARBILD_MODULES; the default install is print-only
- English interface with German as a full second language (1,038 strings);
the English sentence is the translation key
- no built-in accounts — first boot creates one admin from ADMIN_USERNAME /
ADMIN_PASSWORD, or generates a password and logs it once
- delivery and backup targets are generic SFTP/FTPS endpoints, off by default
- English routes, English identifiers, English comments throughout
- two compose files: print-only by default, everything in the full one
- AGPL-3.0, CI (build, tests, type check, secret scan), CONTRIBUTING, SECURITY
124 tests green, type check clean, verified end to end against a live instance.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nh4A79bbqT9dcd2inzYUdg
till
