Security release

This release contains a security fix for GHSA-69xv-wmgg-3qp3.
Affected versions: 1.12 through 1.20.0. Versions 1.11.5 and earlier are not affected.

All self-hosted operators on 1.12+ should upgrade immediately.

Upgrade

docker pull ghcr.io/shelf-nu/shelf.nu:1.20.1
# or, if you track :latest
docker pull ghcr.io/shelf-nu/shelf.nu:latest

Then restart your container. No database migration is required.

Reported by https://github.com/KennethWussmann — thank you.

What's Changed

• chore(deps): bump cookie from 0.4.2 to 0.7.2 by @dependabot[bot] in https://github.com/Shelf-nu/shelf.nu/pull/2362
• fix: remove unused swiper package by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2363
• feat: add structured feedback modal with email notifications by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2357
• fix: eslint setup and validate script after Turborepo migration by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2364
• fix: add .eslintignore to lint task inputs in turbo.json by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2365
• fix: wrong user role shown on team member profile pages by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2366
• fix: resolve React 19 hydration error #418 in production by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2371
• fix: prevent client-side crash on user assets list page by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2373
• feat: add audit toggle to admin dashboard organization page by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2375
• fix: skip onboarding questions for invited users by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2370
• fix: onboarding name fields not taking equal width by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2374
• feat: add audit toggle to admin dashboard organization page by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2377
• feat: add client-side Sentry error capturing by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2372
• fix(docs): image path and update documentation link by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2378
• fix: resolve missing custodian error for checked-out kits by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2379
• chore: migrate from husky to lefthook for faster commit hooks by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2380
• fix: retry 5xx StorageApiError in createSignedUrl() by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2381
• fix: inventory value text wrap + newest assets tablet overflow by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2358
• fix: disable location hierarchy popover for base and self-service users by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2382
• fix: resolve workspace name display for addon subscriptions by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2383
• fix: lift FeedbackModal to layout level to fix mobile click-through bug by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2384
• fix: split full name into firstName/lastName when accepting invite by @iuryeng in https://github.com/Shelf-nu/shelf.nu/pull/2369
• fix: clear stale husky hooksPath in prepare script by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2387
• Fix: make prepare script self healing by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2388
• fix: address multiple Sentry issues from client-side tracking by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2386
• fix: address bulk Sentry issues from production tracking by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2392
• fix: mobile Check-in button triggers form save instead of opening dropdown by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2391
• fix: prevent duplicate team trial welcome email by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2393
• fix: manage subscriptions button type by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2394
• feat: transfer workspace ownership with optional subscription transfer by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2395
• feat: improve ICS calendar export for bookings by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2389
• fix: add type="submit" to all bulk action dialog confirm buttons by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2396
• docs: rewrite README with accurate tech stack and setup by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2398
• chore(deps): bump all packages to latest minor/patch versions by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2400
• fix: downgrade missing custodian log from error to warn by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2401
• feat: require explicit type prop on all Button components by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2397
• fix: prevent emails from being sent to soft-deleted users by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2404
• chore(deps): bump hono from 4.12.5 to 4.12.7 by @dependabot[bot] in https://github.com/Shelf-nu/shelf.nu/pull/2409
• feat: show asset location in audit scan list on mobile by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2407
• Fix booking deduplication to use composite kit-booking key by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2408
• fix: add explicit form association to checkout dialog buttons by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2403
• fix: batch refresh expired asset image URLs server-side by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2402
• fix: guard against malformed FormData in login and OTP routes by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2413
• fix: filter non-actionable browser and extension errors in Sentry by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2415
• fix: propagate error context in audit session completion by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2418
• fix: suppress noisy validation errors from Sentry by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2414
• perf: batch username check and parallelize assets/new loader by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2416
• fix: resolve client-side React runtime errors by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2417
• feat: add purchasable barcodes addon with self-service trials by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2405
• fix: allow addon linking when both addons share one subscription by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2420
• fix: resolve new Sentry issues (1CN, 1CP, 1AY, 1B1, 1BA) by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2421
• feat: add haptic feedback to QR/barcode scanner on detection by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2422
• feat: add auto-charge safety nets for addon and platform trial subscriptions by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2424
• feat: add display name field for SSO users by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2426
• fix: client-side dropdown filter now searches nested fields like email by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2431
• feat: add TeamMemberNote model for admin notes on user profiles by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2429
• feat: hide personal workspaces for SSO users by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2432
• fix: ensure error boundary errors always reach Sentry by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2433
• fix: address P0-P2 Sentry issues from weekly error review by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2439
• chore(deps-dev): bump happy-dom from 20.5.0 to 20.8.9 by @dependabot[bot] in https://github.com/Shelf-nu/shelf.nu/pull/2440
• chore(deps): bump nodemailer from 7.0.13 to 8.0.4 by @dependabot[bot] in https://github.com/Shelf-nu/shelf.nu/pull/2437
• feat: granular booking email notifications by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2423
• fix: optimize checkout transaction and suppress expected errors by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2443
• feat: add Cloudflare Web Analytics support and document tracking scripts by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2468
• feat: make user-prefs cookie cross-domain for marketing site by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2442
• fix: scope toast notifications to originating browser tab by @iuryeng in https://github.com/Shelf-nu/shelf.nu/pull/2368
• feat(audit): add archive audit lifecycle by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2438
• feat: bulk update existing assets via CSV import by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2428
• fix: restore asset name column in CSV export by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2477
• chore(deps): bump hono from 4.12.7 to 4.12.12 by @dependabot[bot] in https://github.com/Shelf-nu/shelf.nu/pull/2476
• perf: skip custom field definitions in asset table query by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2472
• perf: parallelize entity query with asset query in advanced loader by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2473
• chore(deps-dev): bump vite from 7.3.1 to 7.3.2 by @dependabot[bot] in https://github.com/Shelf-nu/shelf.nu/pull/2475
• perf: parallelize layout loader, cache middleware regexes, skip empty queries by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2474
• chore(deps): bump lodash from 4.17.23 to 4.18.1 by @dependabot[bot] in https://github.com/Shelf-nu/shelf.nu/pull/2478
• perf: eliminate redundant renders and duplicate DB calls on asset index by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2471
• perf: optimize loaders for assets, bookings, and settings routes by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2483
• chore(deps): bump nodemailer from 8.0.4 to 8.0.5 by @dependabot[bot] in https://github.com/Shelf-nu/shelf.nu/pull/2482
• fix: use correct SEQUENCE value in iCal export by @pj-gridx in https://github.com/Shelf-nu/shelf.nu/pull/2485
• chore: update patch/minor deps and trivial major bumps by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2484
• fix: address weekly sentry issues (round 4) by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2487
• chore: batch 2 — moderate major package upgrades by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2488
• fix: show full yearly price instead of incorrect monthly conversion by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2489
• chore: delete PRD-granular-booking-notifications.md by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2490
• fix(security): scope booking notes to organization to prevent cross-tenant IDOR by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2492
• feat: bulk archive audits from index page by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2481
• chore(deps): bump hono from 4.12.12 to 4.12.14 by @dependabot[bot] in https://github.com/Shelf-nu/shelf.nu/pull/2491
• fix: reduce sidebar toggle lag on CMD+B by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2479
• fix(sentry): suppress 4xx-equivalent and aborted-request noise by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2496
• fix(sentry): suppress auth + not-found wrapper noise by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2497
• fix(sentry): finish weekly cleanup — wrap-aware not-found, hard-filte… by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2498
• feat(audit): permanently delete archived audits (single + bulk) by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2494
• fix(working-hours): compare override dates as absolute calendar days by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2500
• fix(location): enforce org scope on asset and kit relational mutations by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2501
• chore(asset): tighten sort parameter parsing and validation by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2502

New Contributors

• @iuryeng made their first contribution in https://github.com/Shelf-nu/shelf.nu/pull/2369

Full Changelog: https://github.com/Shelf-nu/shelf.nu/compare/[email protected]@1.20.1

🏗 Monorepo Migration (Major Change)

Shelf has moved from a single-app repository to a pnpm + Turborepo monorepo.

This improves dependency management, build performance, and long-term scalability.
If you're self-hosting or customizing Shelf, this section matters.

What Changed

• Package manager: npm → pnpm (v9.15.4)
• Commands renamed (see mapping below)
• Database schema moved
  • From: app/database/schema.prisma
  • To: packages/database/prisma/schema.prisma
• Project structure updated
  • The Remix app now lives in apps/webapp/ instead of the root

🔄 Upgrading

1️⃣ Install pnpm

corepack enable
corepack prepare [email protected] --activate

Or install globally:

npm install -g [email protected]

2️⃣ Install dependencies

pnpm install

You can safely delete:

• node_modules
• package-lock.json

The monorepo now uses pnpm-lock.yaml.

3️⃣ Start developing

pnpm webapp:dev

🔁 Command Changes

| Before (npm) | After (pnpm) |
|--------------------------------|-----------------------------|
| npm run dev | pnpm webapp:dev |
| npm run build | pnpm webapp:build |
| npm run start | pnpm webapp:start |
| npm run test -- --run | pnpm webapp:test -- --run |
| npm run validate | pnpm webapp:validate |
| npm run lint | pnpm turbo lint |
| npm run typecheck | pnpm turbo typecheck |
| npm run db:generate-type | pnpm db:generate |
| npm run db:prepare-migration | pnpm db:prepare-migration |
| npm run setup | pnpm webapp:setup |

📁 New Project Structure

shelf/
├── apps/
│   └── webapp/          ← Remix app (was at root before)
├── packages/
│   └── database/        ← Prisma schema, migrations, and client
├── tooling/
│   └── typescript/      ← Shared tsconfig
├── turbo.json
├── pnpm-workspace.yaml
└── .env                 ← Still at the root

🌱 Environment Variables

No changes required.
The .env file remains at the monorepo root.

🐳 Docker

Official Docker images continue to work.

If you use a custom Dockerfile:

• App entrypoint is now:

  apps/webapp/start.sh
  

• It runs:

  node ./build/server/index.js
  

• Builds now rely on turbo prune for efficiency.

🧩 Custom Prisma Schema Changes

If you modified the Prisma schema, move it from:

app/database/schema.prisma

to:

packages/database/prisma/schema.prisma

Migrations now live in:

packages/database/prisma/migrations/

✨ Features

• feat: redesign Dashboard → Home with Stripe-inspired widget grid by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2350
• feat: migrate to pnpm + Turborepo monorepo by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2351

🐛 Fixes

• fix: prevent "Create new audit" link from treating "new" as audit ID by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2360

🧹 Chores

• chore(deps-dev): bump minimatch from 3.1.2 to 3.1.4 by @dependabot[bot] in https://github.com/Shelf-nu/shelf.nu/pull/2359

Full Changelog:
https://github.com/Shelf-nu/shelf.nu/compare/[email protected]@1.20.0

🎉 [email protected]

🔎 Audits

• feat: Audits by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2037

Introducing Audits — a powerful new way to verify, review, and ensure the integrity of your assets and locations.
This is the headline feature of 1.19.0 and lays the foundation for structured inventory validation inside Shelf.

🚀 Features

• feat(booking): show asset tags in booking list by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2274
• feat(admin): add account status column to users dashboard by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2265
• feat: allow webp uploads by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2278
• Add email search to team members filter by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2280
• feat: handle add-on products gracefully in Stripe webhook events by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2281
• feat: add positive state filter options for custody, location, and kit by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2283
• feat(currency): add comprehensive ISO 4217 currency support by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2291
• feat: add DynamicSelect/DynamicDropdown for upcoming bookings filter by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2293
• feat: add asset removal from location page directly by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2295
• feat: implement activity logging for LOCATIONS by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2286
• feat: add optional cancellation reason to booking cancellation by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2298
• feat: add unpaid invoice warning banner and improve subscription status display by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2299
• feat(stripe): update Stripe SDK/API version and add invoice.overdue webhook handler by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2307
• feat: add asset sorting to booking page and PDF export by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2306
• feat: add camera selector to scanner for multi-camera devices by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2308
• feat(invites): add optional message field to workspace invitations by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2279
• feat: add subscription transfer to workspace ownership transfer by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2314
• feat: send booking updated email to custodian on changes by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2322
• feat(emails): add custom email footer with live preview by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2328
• feat(bookings): add require explicit check-in setting by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2334
• feat(filters): add chevron to operator selector for discoverability by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2338
• feat: add contextual empty states for list pages and dashboard widgets by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2324
• Add ability to change user roles in workspace settings by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2317
• Display booked assets in booking notification emails by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2313
• feat(bookings): implement auto-archive for completed bookings by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2211

🐛 Fixes

• fix: keep selected category visible inside CustomFieldsForm's category select by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2272
• fix(qr): guard contact owner action for unclaimed codes by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2275
• fix(assets): image upload failure handling when duplicating assets by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2276
• fix: prevent orphaned custody records in booking and kit operations by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2284
• fix: parse pasted markdown text in ProseMirror editor by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2296
• fix: render duplicate barcode import errors as a grouped table by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2297
• fix(assets): make Enter key trigger save instead of add another by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2301
• fix(stripe): skip admin notification for $0 trial invoices by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2310
• fix(auth): resolve account limbo between confirmation and invite by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2331
• fix(security): scope unscoped custody and asset queries to org by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2346
• fix(storage): mitigate Supabase 429 rate-limit errors on image refresh by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2347
• fix: preserve unsupported image format error message for users by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2348
• ...and numerous stability, Sentry, Stripe, import, Prisma, and routing fixes improving reliability across the app.

⚡ Performance & Reliability

• fix: handle Prisma transient errors with retry and correct error reporting by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2340
• (PRD) Add server-side workspace persistence for cross-device consistency by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2282

🧹 Chores, CI & Maintenance

Dependency bumps, router updates, lint fixes, test pipeline improvements, and cleanup across the board including:

• chore: remove unused swiper package and dead carousel code by @DonKoko
• multiple dependency updates (lodash, hono, qs, brace-expansion, etc.)
• CI improvements for npm and pnpm compatibility

🌱 New Contributors

• @wotan-allfather made their first contribution in https://github.com/Shelf-nu/shelf.nu/pull/2309

Full Changelog: https://github.com/Shelf-nu/shelf.nu/compare/[email protected]@1.19.0

🚀 Features

• feat: change default asset index mode to ADVANCED by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2202
• Feat: create inline entities by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2219
• feat: add saved asset filter presets by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2187
• feat: Filter Kits and Assets by Custody on Locations view by @manish-singh-bisht in https://github.com/Shelf-nu/shelf.nu/pull/2226
• feat: colored tags by @pj-gridx in https://github.com/Shelf-nu/shelf.nu/pull/2230
• feat: redesign updates modal as full-page Midjourney-style layout by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2206
• feat(custom-fields): add usage count column to Custom Fields list by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2250

🐛 Fixes

• fix: skip booking time restrictions for admin/owner users by @Copilot in https://github.com/Shelf-nu/shelf.nu/pull/2223
• fix: filter cookies not working with RR7 single fetch by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2228
• fix: client-side filter cookie paths and clear functionality by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2229
• fix(kits): custody card showing for partially checked-in kits by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2231
• fix(assets): handle deleted assets gracefully in image refresh API by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2232
• fix(assets): prevent Sentry spam from transient Supabase HTML errors by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2234
• fix: issue with bookings from and to migration by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2236
• fix: resolve Select component hydration issue in booking dialog by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2237
• fix: reverting docker version to node:22 by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2239
• fix: resolve infinite render loop in CodePreviewDialog by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2240
• fix: resolve QR code download issue on Safari/iPad by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2241
• fix: simplify the text of updates learn more link by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2245
• fix: ensure host headers for React Router CSRF protection in dev mode by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2254
• fix: include all tags in model filters by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2255
• fix: downgrade missing thumbnail asset log by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2256
• fix: set emails footer year to 2026 by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2257
• fix: remove qrId column from example asset import csv to reduce confusion of users on first import by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2258
• fix: avoid capturing csv parse errors by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2259
• fix(auth): show rate-limit signup error by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2260
• fix(booking): default intent for implicit submits by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2261
• fix(import): don't capture errors related to non-existent qr codes by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2263
• fix(asset-import): guard kit and custodian resolution by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2264
• fix(asset-reminder): skip missing reminders in worker by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2266
• fix(storage): broaden supabase html error detection by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2268
• fix(storage): retry signed url on fetch failed by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2269

⚡ Performance

• perf: cache selected organization per request by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2267

🧹 Chores

• chore(deps): bump express from 4.21.2 to 4.22.1 by @dependabot[bot] in https://github.com/Shelf-nu/shelf.nu/pull/2227
• chore(deps): bump jws from 3.2.2 to 3.2.3 by @dependabot[bot] in https://github.com/Shelf-nu/shelf.nu/pull/2233
• chore: update react and react-dom by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2235
• chore(deps): bump qs from 6.14.0 to 6.14.1 by @dependabot[bot] in https://github.com/Shelf-nu/shelf.nu/pull/2249
• chore: bump react-router to fix vulnerability by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2253
• chore(deps): bump hono from 4.11.3 to 4.11.4 by @dependabot[bot] in https://github.com/Shelf-nu/shelf.nu/pull/2262
• chore: bump react-router-hono-server to 2.23.0 by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2270
• chore: skip error capturing for booking conflicts by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2271

📚 Documentation

• docs: Add OTP length configuration to Supabase setup guide by @Copilot in https://github.com/Shelf-nu/shelf.nu/pull/2243

🌱 New Contributors

• @manish-singh-bisht made their first contribution in https://github.com/Shelf-nu/shelf.nu/pull/2226
• @pj-gridx made their first contribution in https://github.com/Shelf-nu/shelf.nu/pull/2230

Full Changelog: https://github.com/Shelf-nu/shelf.nu/compare/[email protected]@1.18.6