- install driver.js and add 9-step tour covering libraries, lenses,
collections, search, statistics, appearance, upload, and book bucket
- first step context-aware: points to welcome card on first run, falls
back to settings nav when libraries already exist
- tour state persisted in user.settings JSONB, survives across devices
- skip on mobile; any dismissal (skip or done) marks tour complete
- theme the tour popover with app design tokens (card, primary, radius)
- add "Take the tour again" button in Settings > Account (desktop only)
- download correct arch binary from projectx-tools during image build
- use system binary at /usr/local/bin/kepubify when available, fall back to runtime download for local dev
- implement OIDC provider and identity repositories
- allow linking/unlinking multiple OIDC identities to a single user
- update login UI to display and handle multiple providers
- add audit events for OIDC login and user provisioning
- improve callback error messages and state validation
- add OIDC provider schema and initial migration
- allow .local domains in SSRF check when allowLocal=true (dev only)
- skip DNS resolution for explicitly local hostnames to avoid private IP block
- pass allowLocal based on NODE_ENV via ConfigService in AppSettingsService
- omit client_secret from token exchange body for public clients
- add 'metadata' to book_files_role_chk (opf/nfo files were being rejected)
- rename 'supplementary' to 'supplement' in classify.ts to match DB
- export FILE_ROLES const as single source of truth for valid roles
- add contract tests: every classifyFile output must be a FILE_ROLES member
- add schema test: book_files_role_chk must contain all FILE_ROLES values
- improve responsive layouts and controls across dashboard, home, lens, collection, authors, and book detail surfaces
- modernize settings and metadata provider UIs, including the floating dashboard settings action and cleaner section composition
- add synced or per-view cover sizing and spacing behavior, plus expanded mobile filter and sort control patterns
- extend backend filtering with library rules and increase hardcover ID limits across schema, DTO validation, and migration metadata
- apk upgrade in runtime stage to fix OpenSSL CVEs (CVE-2025-15467 CRITICAL, CVE-2025-69419 HIGH)
- remove npm from runtime image to eliminate npm-bundled CVEs
- update fastify to 5.8.5 and force via pnpm override (CVE-2026-33806 HIGH)
- switch vitest pool to threads to fix flaky audio extractor tests
- simplify unit test setup with direct instantiation
neon