17 posts tagged with "release"

Published on October 3, 2026

On the same day as 1.8.3 comes Uni-Verein 1.8.4, a small bug-fix release: sending mail works on the iPhone again, and if a page ever fails to load, the app stays usable from now on.

Highlights​

• 📱 Mail works on the iPhone again: Opening "Mail" no longer shows a blank white screen
• 🛟 No more blank screens after errors: If a page fails to load, you now see an error message with a reload button. The navigation stays usable, so you can switch to another page
• 🔄 Smoother updates: If the app is open while a new version is deployed, it reloads once on its own instead of failing to open a page

Fixes​

• 📱 Mail on iPhone (UV-51): Opening "Mail" on an iPhone no longer shows a blank white screen. The mail editor was accessed after it had already been closed, and the resulting error took down the whole app
• 🛟 Error message instead of a blank screen: If a page runs into an error, an error message ("Hier ist etwas schiefgelaufen") with the buttons "Erneut versuchen" and "Neu laden" now appears in the content area. The sidebar and the mobile bottom navigation keep working, and switching to another page clears the error
• 🔄 Missing page files after an update: If the app was still open from the previous version and a page file of that version no longer exists, the app now reloads once and loads the current version. If the file is still missing after that, the error message appears instead of reloading again and again

⚠️ Upgrade Notes​

• Always update with docker-compose-update.yml, as described in the README
• No database migration is needed
• No changes to your settings or the API are needed

Why These Updates Matter​

A blank screen is the worst feedback for users: you don't know what happened or what to do next. With the error message and the navigation staying usable, everyone can carry on even after an unexpected error, and the automatic reload after updates prevents many such cases in the first place.

What's Next?​

Real-world feedback is, as always, very welcome via GitHub Issues. Check back here again soon!

Published on October 3, 2026

Uni-Verein 1.8.3 prepares the SEPA export for the changes that apply from November 15, 2026: the direct debit file (pain.008.001.08) follows the EPC rules for SDD Core 2025 and uses structured addresses. Checks are also stricter, so no file is produced that the bank would reject, and the mobile view has been tidied up.

Highlights​

• 🏦 SEPA export ready for November 2026: The direct debit file follows the EPC rules for SDD Core 2025 and the new structured address rules that apply from 15 November 2026
• ✅ More reliable SEPA files: IBANs and the creditor identifier are checked including their check digits, text is converted to the SEPA character set (e.g. ä → ae), and every transaction gets its own unique ID
• 💳 Members without BIC are no longer skipped: They are now exported as NOTPROVIDED, as SEPA allows
• 📱 Better mobile view: The icons in the bottom navigation are aligned again, and the user management no longer runs off the screen

Fixes​

• 🏦 SEPA export follows current rules (UV-50): The export (pain.008.001.08) follows the EPC rules for SDD Core 2025 and the address rules from 15 November 2026:
  • Addresses are fully structured (street, postal code, town, country) instead of a single free-text address line
  • Text uses the SEPA character set (e.g. ä → ae)
  • Every transaction gets a unique ID, so several open contributions of the same member no longer collide
  • Members without a BIC are exported as NOTPROVIDED instead of being skipped
  • The club's BIC, the IBANs, and the creditor identifier are checked including their check digits. Contributions with an invalid IBAN are left out of the file
  • An export without collectible contributions shows a message instead of producing an empty file
  • Deleted exports no longer appear in the export history
• 📱 Mobile navigation (UV-48): The icons in the mobile bottom navigation are aligned again. Inactive tabs hid their label only visually, so "SEPA Export" wrapped to two lines and pushed the bank icon up. All tabs now show a short, single-line label (e.g. "SEPA", "Mail", "Auswertung") and the active tab no longer shifts
• 📱 Mobile user management (UV-49): The user management no longer overflows the screen on mobile. The long "Benachrichtigungseinstellungen" tab label had widened the whole page. It is now shortened to "Benachrichtigungen", the tabs scroll if space runs out, and the tab indicator stays inside the rounded corners

Improvements​

• 🐳 The frontend Docker image is built with Node 24 instead of Node 20, which has been end-of-life since April 2026. The runtime image (nginx) is unchanged
• 📦 Updated dependencies: MailKit 4.18.1 and the Tiptap mail editor 3.31.4, plus several development tools

⚠️ Upgrade Notes​

• Always update with docker-compose-update.yml, as described in the README
• No database migration is needed
• Check your SEPA settings before the next export: The club's street and postal code are now written as a structured address, so make sure they are filled in. The creditor identifier is now checked including its check digits, so a mistyped one stops the export with an error message instead of producing a file the bank would reject
• Members without a BIC are now included in the export. Previously they were silently left out. Check the export before uploading it to your bank if you relied on that
• If there are no collectible contributions, you now get a message instead of an empty file

Why These Updates Matter​

From November 15, 2026, new rules for structured addresses apply to SEPA files. Banks reject files that don't comply, and that happens exactly when contributions are due to be collected. With the stricter checks, mistakes now surface directly in the export instead of after the bank has rejected the file. The fixes to the mobile view also make using the app on a phone pleasant again.

What's Next?​

Real-world feedback is, as always, very welcome via GitHub Issues. Check back here again soon!

Published on September 30, 2026

Uni-Verein 1.8.2 continues the security work from 1.8.1: mail bodies are sanitized on the server, IBANs are masked for regular users, and changing your password now requires the current one. On top of that come a dedicated sender name for mails and the club logo in the sidebar.

Highlights​

• 🛡️ Safer mails: Mail bodies are sanitized on the server. Only the formatting the mail editor can produce is kept, scripts, event handlers, javascript: links, forms, and iframes are stripped
• 🔒 IBANs masked for regular users: Only ADMIN and FINANCIAL_MANAGER see full IBANs, the USER role sees them masked except for the last 6 characters
• 🔑 Password change requires the current password: Wrong attempts count towards the login lockout
• ✉️ Sender name for mails: New "Sender name" field in the mail settings, so mails can show up as e.g. Vorstand <vorstand@verein.de>
• 🖼️ Club logo in the sidebar: The sidebar now shows the logo from the general settings

New Features​

• ✉️ Sender name (UV-47): The mail settings have a new optional "Sender name" field that recipients see as the sender. Previously the "Sender email (From)" value was used as both name and address, so entering a name there made sending mails fail. The sender email field now only accepts a valid address
• 🖼️ Club logo in the sidebar (UV-24): The logo from the general settings appears in the top-left corner of the sidebar, both expanded and collapsed. The first letter of the club name is still used when no logo is uploaded

Security​

• 🛡️ Sanitized mail bodies (UV-17): The body of mails sent via /mail/send is sanitized server-side with HtmlSanitizer. Text, headings, lists, links, images, color, and alignment are kept. Scripts, event handlers, javascript: links, forms, and iframes are removed, and data: URLs are only allowed for inline images (no SVG). Markdown release notes in firmware update mails also no longer render raw HTML
• 🔒 Masked IBANs (UV-26): Full IBANs of members are only returned to ADMIN and FINANCIAL_MANAGER. The USER role gets them masked except for the last 6 characters (member list, member create/update responses, and the "Pending members" review queue), so they can still check an IBAN and replace it with a new one. A masked IBAN sent back to the API is treated as unchanged and never stored
• 🔑 Current password required (UV-30): Changing your own password now requires the current password, both in the profile settings and when an admin edits their own account in the user management. Wrong attempts count towards the login lockout. Admins can still reset other users' passwords without it
• 🧰 The transitive build dependency serialize-javascript was bumped to 7.1.2 to fix GHSA-gfhx-hw2g-v5hg (XSS via unescaped </script> in serialized function bodies, severity low)

⚠️ Upgrade Notes​

• Always update with docker-compose-update.yml, as described in the README
• The database migration (AddMailFromName) runs automatically on startup. Existing mail settings keep working, the new sender name is simply empty until you set it
• If you entered a name in "Sender email (From)" as a workaround, move it to the new "Sender name" field. The sender email field now only accepts a valid address

Why These Updates Matter​

Email is a sensitive channel: anyone sending content from the editor should be able to rely on no active code travelling along. Masked IBANs make sure that bank details are only fully visible to those who really need them, and asking for the current password protects accounts even when someone briefly sits at an unlocked computer. A sender name and the logo also make the club easier to recognize in the inbox and in the interface.

What's Next?​

Real-world feedback is, as always, very welcome via GitHub Issues. Check back here again soon!

Published on September 26, 2026

Uni-Verein 1.8.1 is a security release: the installation gets HTTPS out of the box, the login becomes much more resistant to attacks, uploads are checked more strictly, and all containers now run without root privileges.

Highlights​

• 🔐 HTTPS out of the box: A new docker-compose-tls.yml plus Caddyfile puts Caddy in front of the stack and automatically fetches a Let's Encrypt certificate. This is now the recommended installation path
• 🛡️ Hardened login: Per-IP rate limiting, no more hints about whether a username exists, and lockouts last at most 15 minutes instead of up to 24 hours
• 🔑 No more default admin password in use: Logging in with admin123 now forces you to set a new password first
• 📦 Safer uploads and containers: Receipt files are checked by their actual content, upload sizes are capped, and every container runs as a non-root user

New Features​

• 🔐 HTTPS with Let's Encrypt (UV-27): docker-compose-tls.yml and Caddyfile set up automatic HTTPS (requires a DNS record plus ports 80 and 443). The self-update flow detects and supports both setups and also updates the Caddyfile. nginx recovers the real client IP behind Caddy, so rate limiting and audit logs keep working
• 🚦 Login rate limiter (UV-31): /auth/login is limited per IP address (default 20 requests per window, configurable via RateLimiting:AuthLogin:PermitLimit)
• 🔑 Forced password change (UV-25): Logging in with the default password admin123 opens a dialog that can't be dismissed until a new password is set
• 🔍 Automated dependency checks (UV-42): npm audit --audit-level=high runs in CI, plus Dependabot (one bundled weekly PR, no major updates)

Improvements​

• 🔒 Authentication by default (UV-41): Endpoints now require authentication by default. Intentionally public ones (login, self-enrollment, public page configuration, /health) are explicitly allowed
• ⏱️ Fairer lockouts (UV-45): Failed login attempts expire after 15 minutes, and the lockout is capped at 15 minutes (previously up to 24 hours)
• 👤 Admin protection (UV-25): The default admin account is only created when no users exist at all. Admins can no longer delete their own account or change their own role
• 🧾 Uploads checked by content (UV-32): Receipt files are validated by their magic bytes (PNG, JPEG, GIF, WebP, PDF) instead of the type reported by the browser. SVG and unknown formats are rejected. Downloads send X-Content-Type-Options: nosniff and Content-Disposition: attachment
• 📏 Upload limits (UV-43): The global request limit drops from 10 GB to 100 MB, only the backup restore keeps 10 GB. Receipt files and the CSV import of members are capped at 10 MB per file, and oversized PDFs are rejected right in the browser
• 🧱 Security headers (UV-33): Both nginx configs send CSP, X-Frame-Options, nosniff, Referrer-Policy, and Permissions-Policy
• 🌐 CORS (UV-28): Allowed origins are configured via Cors:AllowedOrigins (empty in production) instead of allowing any localhost origin
• 🔗 Safe confirmation links (UV-35): Self-enrollment links use a stored PublicBaseUrl instead of the request's Host header, preventing phishing links via forged hosts
• 📦 Containers without root (UV-37): All containers run as non-root users, with cap_drop: [ALL] and no-new-privileges where possible
• 🗝️ Secrets (UV-38, UV-39): The init script generates random database passwords and only prints the names of the .env keys, not their values. .env.example ships placeholders only instead of real keys
• 🧰 Dependencies (UV-40): Serilog.Sinks.File is pinned to the stable 7.0.0, the unused BCrypt.Net-Next was removed, plus minor/patch updates for backend and frontend

Fixes​

• 🖥️ Blank screen after login (UV-18): After an update, stale lazily-loaded parts of the app could cause an empty screen. The app now reloads automatically when a new service worker takes over
• 🔔 Firmware hint (UV-46): The firmware-update hint now compares real version numbers and only shows when a newer version actually exists
• 🕵️ Username enumeration (UV-44): Login response timing no longer reveals whether a username exists. Raw usernames are no longer written to the log
• 🌍 Forged IP headers (UV-34): X-Real-IP is only trusted from private/internal networks, so IP-based rate limits can no longer be bypassed with a spoofed header

⚠️ Upgrade Notes​

• Always update with docker-compose-update.yml, as described in the README. Proxy and frontend now listen on port 8080 inside the container (the host port stays 80), so nginx.conf and the compose file have to be replaced together. The update script does this for you
• logs/ and receipts/ must be writable by the non-root backend (UID 1654). The update script handles this via docker-compose-ini.yml. On a manual setup, run chown -R 1654:1654 logs receipts
• Self-enrollment users: If self-enrollment was already enabled before this update, an admin has to open the general settings and save them once. This stores the public URL used in confirmation links. Until then, new submissions fail
• The database migration (AddLastFailedLoginAttemptAndPublicBaseUrl) runs automatically on startup

Why These Updates Matter​

A club management system holds names, addresses, and bank details, so it should be run as securely as possible. With HTTPS out of the box, a more robust login, and stricter checks for uploads and network access, 1.8.1 closes a whole series of possible attack surfaces at once. Running the containers without root privileges also limits the damage should something ever go wrong.

What's Next?​

Real-world feedback is, as always, very welcome via GitHub Issues. Check back here again soon!

Published on September 20, 2026

Uni-Verein 1.8.0 makes self-enrollment originally built for short-term use such as a trade fair booth - ready for permanent operation: registrations now only create a member after the email address is confirmed and a logged-in person has reviewed them, instead of immediately. On top of that comes a new opt-in notification for new registrations and a security fix for already-paid receipts.

Highlights​

• 📝 Hardened self-enrollment: Email confirmation (48h) plus a review queue instead of creating the member directly
• 🔔 Opt-in notification: Any logged-in user can get an email whenever a new registration comes in
• 🔒 Receipt fix: A regular user can no longer delete a receipt that's already been marked as paid

New Features​

• 📝 Self-enrollment: The public form no longer creates a member directly, it first requires confirming the submitted email address via a link valid for 48 hours. Only then does the registration land in the "Pending members" tab of member management, visible to every logged-in role, where it can be approved or rejected
• ✍️ Motivation instead of category: Applicants instead provide a short motivation plus required IBAN and BIC, a member category is only assigned by the reviewer when approving
• 🛡️ Hardened for everyday use: Per-IP rate limiting, stricter email validation, a requirement that mail settings are configured before self-enrollment can be enabled, and a mobile-friendly view for the review queue
• 🔔 New-enrollment notification: Any logged-in user, regardless of role, can opt in via a new toggle in the notification settings to receive an email for every newly confirmed registration, off by default

Fixes​

• 🔒 Deleting a paid receipt: A regular user could still delete their own receipt even after an Admin or Finance Manager had marked it as paid, because the delete check only looked at receipt ownership, not the paid status. Deleting a paid receipt as a regular user now returns an error, and the delete button is hidden for it. Admins and Finance Managers can still delete paid receipts

Why These Updates Matter​

The original self-enrollment feature was built for short-term use, such as quickly signing up new members at an event. Running it permanently on the club website needs more safeguards: email confirmation prevents registrations with incorrect or someone else's address, the review queue keeps the board in control of every new admission, and the opt-in notification means nobody has to manually check whether something new is waiting.

What's Next?​

Real-world feedback is, as always, very welcome via GitHub Issues. Check back here again soon!

Published on September 5, 2026

Uni-Verein 1.7.0 makes onboarding new members easier: prospective members can now sign themselves up through a public form, no account needed. This release also ships important security updates for a couple of dependencies.

New Features​

• 📝 Self-enrollment: A new, publicly reachable form lets prospective members sign themselves up as a member, no account required
• 🔒 Server-enforced hidden fields: Data that only users may set or that is assigned automatically (task within the club, date fields, SEPA consent) is hidden from the public form and enforced server-side
• 🚫 Duplicate checks: Email address and IBAN are checked for duplicates just like when an user creates a member, and rejected on a match
• 🔗 "Self-enrollment" toggle: A new setting in the general club settings that turns the public form on or off, including a button to directly share the link

Improvements​

• 🧩 Member-creation logic was consolidated into a shared MemberService.CreateMemberAsync instead of being duplicated between user creation and self-enrollment
• 🧩 Recurring EF Core queries were unified behind a new ReferenceDataService
• 🌐 frontend/nginx.conf now serves the SPA with a try_files fallback to index.html

Security​

• 🔐 Updated the fast-uri and @tiptap/* dependencies, closing four High-severity SSRF/host-confusion advisories and one Moderate-severity prototype-pollution-to-XSS advisory

Why These Updates Matter​

Self-enrollment takes a lot of manual work off a club board's plate: instead of creating every new member one by one, you simply share the form's link and prospective members enter their own details. Server-enforced fields and the duplicate checks keep data quality on par with an admin-created member. The security updates also close known vulnerabilities in dependencies the project relies on.

What's Next?​

As always, feedback and feature requests are very welcome via GitHub Issues. Check back here again soon!

Published on August 25, 2026

Uni-Verein 1.6.0 brings a small but noticeable improvement to everyday club work: finance managers are now notified by email as soon as a new receipt is submitted, so nobody has to check the receipts page manually anymore.

New Features​

• 🔔 Receipt notifications: Finance managers now receive an email whenever a new receipt is submitted, whether by a regular user or an admin. A finance manager is never notified about a receipt they submit themselves
• ⚙️ Notification settings: A new "Notification settings" tab in each user's own account settings. It's visible to every role as a placeholder for future settings, but the receipt-notification toggle itself only shows for finance managers. The feature is enabled by default and can be turned off at any time

Under the Hood​

• 🧱 A new, generic per-user settings table (type + enabled flag) lays the groundwork for further notification and preference types in the future, without requiring further schema changes

Why This Update Matters​

Until now, finance managers had to actively check the receipts page to see if something new had been submitted. The automatic notification removes that step, so receipts get processed faster without an extra manual check.

What's Next?​

The new settings table was deliberately kept generic, more notification types will follow. Feedback and feature requests are, as always, very welcome via GitHub Issues. Check back here again soon!

Published on August 14, 2026

Uni-Verein 1.5.0 brings one of the biggest new features since launch: receipt management. Receipts and invoices can now be submitted directly in Uni-Verein, automatically read via on-device OCR, and visualized by month, category, and year in a brand-new receipt analytics dashboard.

New Features​

• 📎 Receipt management: A new "Receipts" section where regular users see their own submissions, while admins and finance managers see all submitted receipts including who submitted them. The list can be filtered by period, category, and status (open/paid)
• 🤖 OCR scan on submission: When uploading a photo or PDF, the receipt is scanned directly in the browser using on-device OCR and automatically fills in the amount and receipt date, without overwriting fields that are already filled in. Merchant, category, payment method, and description can be added manually as well, payment method can only be set by admins and finance managers
• 📸 Direct camera button: When the app is installed, submitting a receipt offers a dedicated camera button in addition to the regular file upload
• ✅ Mark as paid: Admins and finance managers confirm receipts as paid, an action that can't be undone afterwards. Regular users can only edit or delete their own, still-open receipt within 15 minutes of submitting it
• 🗑️ Delete & restore: Deleted receipts are soft-deleted first (trash-can principle). Admins can show deleted receipts in the list, restore them, or permanently delete them along with all attached files
• 📤 Export as ZIP: Admins and finance managers can export the currently filtered receipt list as a ZIP containing a CSV overview and all attached files
• 📊 Receipt analytics: A new analytics area for admins and finance managers with a bar chart of expenses per month (stacked by category), a pie chart per category with the year's total in the middle, and an overview comparing total expenses across years
• 🏷️ Manage receipt categories: A new setting for creating custom categories such as office supplies, travel expenses, or catering, a category can only be deleted once no receipt is assigned to it anymore

Improvements​

• 💾 Backup with receipts: In addition to the regular database backup, a full backup including all uploaded receipt files is now available as a ZIP download. When restoring, Uni-Verein automatically detects whether a plain SQL file or a full ZIP backup was selected, both can be restored via "Select backup file"

Why These Updates Matter​

Receipt and expense management has been one of the most-requested features from club treasurers: instead of collecting receipts and entering them into a spreadsheet by hand, members now submit them directly in Uni-Verein, with the OCR scan taking care of most of the typing. For the board and finance managers, the new receipt analytics dashboard provides instant visibility into spending, no separate spreadsheet required.

What's Next?​

Receipt management is a first step toward more comprehensive financial features, real-world feedback is, as always, very welcome via GitHub Issues. Check back here again soon!

Published on July 28, 2026

Uni-Verein 1.4.0 is here – with a long-requested dark mode and a bigger change under the hood: the database engine switches from MariaDB to PostgreSQL. Existing installations are migrated automatically and safely by the updater.

Highlights​

• 🌓 Dark mode: the app now follows your OS/browser color scheme by default, with a manual toggle next to the language switcher
• 🐘 PostgreSQL instead of MariaDB: the database engine has been switched to PostgreSQL. Existing installations are migrated automatically and safely by the updater (see Important Upgrade Notes below)

⚠️ Important Upgrade Notes (Breaking Change)​

This release changes the database engine from MariaDB to PostgreSQL. Always update using the official updater never set VERSION in .env by hand or swap in a newer docker-compose-prod-image.yml yourself, as that skips the required database migration and will break your installation.

curl -O https://raw.githubusercontent.com/uni-verein/uni-verein/main/docker-compose-update.yml
docker compose -f docker-compose-update.yml run --rm update

• Before continuing, create a manual backup (database backup and member export, both under Settings → Backup) – the updater asks you to confirm this before it proceeds
• Installations still on MariaDB are updated to v1.3.1 first, if they aren't already there. From v1.3.1, the next update run migrates your database to PostgreSQL and switches the whole stack over. This adds downtime proportional to your database size
• Migration safety net: the cutover runs against an isolated, temporary PostgreSQL instance while your live MariaDB container keeps serving, so nothing is touched until the copy is verified. On success, the old MariaDB container is stopped and its data volume is kept (not deleted) reclaim the space later with docker volume rm <project>_db_data once you've confirmed everything works. On failure, the migration is cleaned up automatically and your MariaDB installation is left completely untouched
• Coming from an older version? The updater only advances one step per run (< v1.3.1 → v1.3.1 → v1.4.0 → latest). If you're updating from before v1.3.1, run the command above repeatedly until it reports "Already up to date"

New Features​

• 🌓 Dark mode: follows prefers-color-scheme by default, or set it manually via a toggle next to the language switcher. The choice is remembered across reloads. Every previously light-only surface (main background, table headers, Backup/Email/SendProgress panels, top bar, login page) is now theme-aware
• 🛠️ UniVerein.DbMigrator: a new tool that performs the MariaDB → PostgreSQL migration described above, copies every table (including soft-deleted rows) in foreign-key-safe order and verifies row counts

Improvements​

• 🐘 Replaced MariaDB with PostgreSQL (postgres:17-alpine) across the whole stack: Docker images, the backend's database provider, and the backup/restore tooling
• 🔄 The updater (docker-compose-update.yml) now understands the MariaDB → PostgreSQL cutover described above and handles it automatically

Bug Fixes​

• 🐛 The demo-mode login dialog could appear even when the app wasn't configured as a demo instance, due to how the demo flag was evaluated

Why These Updates Matter​

Dark mode has been one of the most-requested quality-of-life features, a noticeable difference during evening board meetings, for one. The switch to PostgreSQL, on the other hand, is a strategic decision: it provides a more robust foundation for future features and better data integrity. Since a database engine change is inherently delicate for existing installations, particular care was taken to make the migration safe, automated, and reversible on failure.

What's Next?​

Please plan a short maintenance window for the update, and reach out via GitHub Issues if you run into any problems during the migration. Thanks to everyone who provided feedback for this release. Check back here again soon!

Published on July 26, 2026

Just one day after 1.3.0, Uni-Verein 1.3.1 follows with a clear focus: noticeably better frontend performance and an important security fix.

Improvements​

• 🚀 Lazy loading of frontend routes: Page components (Mail, Members, SEPA, Contributions, user/link/contribution-plan/email/creditor/general/member-category configuration, Audit, Backup) are now loaded on demand instead of being bundled into the initial payload, the main bundle shrinks from about 1.4 MB to about 577 kB
• 🖼️ The icon picker ("Select icon") now caps the number of rendered icon tiles at 250 and prompts for a more specific search beyond that, instead of mounting all ~8,600 icons at once, this previously froze the UI for over a second every time the dialog was reopened
• ⏳ The icon picker now waits for icons to be fully loaded/cached before revealing the grid, showing a loading spinner in the meantime instead of an empty or partially populated dialog
• 🧹 IconPickerDialog.tsx no longer redundantly dynamically imports muiIcons for loadIconNames when it's already imported statically elsewhere, resolving a Vite build warning and allowing the module to be chunked correctly
• ⚙️ The enforce-source-branch CI job from 1.3.0 now also runs for pull requests targeting development, so merging main back into development isn't blocked by a status check that previously only evaluated PRs targeting main

Bug Fixes​

• 🐛 Vite's chunk-size warning for the @mui/icons-material barrel (loaded on demand by the icon picker) is now suppressed via chunkSizeWarningLimit, since that chunk is expected to be large and is never part of the initial page load

Security​

• 🔐 Bumped the brace-expansion npm override to ^5.0.8 to close a high-severity ReDoS advisory (exponential-time expansion of consecutive non-expanding {} groups); the previous override version had drifted out of sync with the lockfile and a duplicate vulnerable copy remained nested under filelist

Why These Updates Matter​

The icon picker in particular had felt noticeably sluggish, thanks to lazy loading and capping the number of rendered icons, the UI now responds much more smoothly. The smaller main bundle also means Uni-Verein loads faster, especially on mobile connections. The ReDoS fix additionally closes a high-severity vulnerability in a transitive dependency.

What's Next?​

This performance work pays off directly in the user experience. Bigger feature additions are up next. Check back soon!