# Changelog v1.2.0

### Heads up before upgrading

- A database migration adds a `report_history` table. It runs automatically on first launch; no manual step required.

### Features

#### Unassigned filter

- The Reports assignee filter now includes **Unassigned**, so you can list reports with no assignee.

#### Report activity history

- Report detail shows a JIRA-style **Activity** timeline (created, status, priority, and assignee changes).
- History is stored server-side and exposed via `GET /api/reports/:id/history`.

#### Share selected reports

- Bulk actions replace **Export Excel** with a **Share** dropdown.
- Download selected reports as **Excel (.xlsx)** or **CSV (.csv)**.
- Shared files include only **Title**, **Description**, and **URL**.
- **URL** is the BugPin report detail permalink (`/admin/reports/<id>`), so recipients open the report in BugPin.

### Fixes

- Report export permalinks now use `/admin/reports/<id>`, matching email/notification links and the real Admin Console route (previously `/reports/<id>` omitted the `/admin` basename).
- Reports list pagination no longer resets to page 1 when using Next/Previous.
- The documented `bun run reset-password <email>` command now exists. It generates a temporary password for a locked-out account and invalidates that user's sessions. Runs from the container root, matching the docs (`docker exec -it bugpin bun run reset-password <email>`).

### Security

- Avatar serving is now confined to the requesting user's own directory. Path traversal in the `GET /api/users/me/avatar/:filename` route is rejected (encoded `..`, path separators, and NUL bytes), so a crafted filename can no longer read files outside the avatars directory.
- Report updates (`PATCH /api/reports/:id`) now use the validated request body instead of the raw payload, dropping the `forwardedTo` field. This closes a mass-assignment gap where clients could inject forwarded-integration references directly.
- Invitation acceptance consumes its token atomically. Concurrent accepts for the same token can no longer both succeed, preventing duplicate account activation or token reuse.
- Bumped `sharp` to `^0.35.3` (libvips 8.18.3) to resolve GHSA-f88m-g3jw-g9cj, a high-severity advisory affecting image processing of untrusted input in versions prior to 0.35.0.

### Maintenance

- Added `xlsx` for Excel share downloads; downloads use a shared blob helper that revokes object URLs after download.