Release v2.5.12

CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to this project will be documented in this file.
 
+## 2.5.12 - 2026-08-05
+
+### Fixed
+
+- The auth route test now loads the alias bootstrap before the login flow, so isolated test runs do not depend on prior module initialization.
+- The slide editor now blocks pasted data images in TinyMCE so image content must come through the upload flow.
+
 ## 2.5.11 - 2026-08-05
 
 ### Fixed

package.json

@@ -1,6 +1,6 @@
 {
   "name": "pulse-signage",
-  "version": "2.5.11",
+  "version": "2.5.12",
   "private": false,
   "description": "Pulse Signage application with MySQL and media storage",
   "repository": {

src/web/public/js/slides/slide-form-editor.js

@@ -288,6 +288,7 @@ export function createSlideFormEditorController(options) {
       menubar: false,
       branding: false,
       promotion: false,
+      paste_data_images: false,
       plugins: 'lists code advlist fullscreen table',
       toolbar: 'undo redo | fontfamily fontsizeinput | forecolor backcolor bold italic underlineformats removeformat | align lineheight indent outdent bullist numlist table chip | fullscreen',
       toolbar_mode: 'sliding',

test/auth-routes.test.js

@@ -1,6 +1,8 @@
 const test = require('node:test');
 const assert = require('node:assert/strict');
 
+require('../src/common');
+
 const registerAuthRoutes = require('../src/web/routes/auth');
 const renderLoginPage = require('../src/web/routes/auth/login');
 const { createSessionService, normalizeReturnToPath } = require('../src/web/lib/auth/session');

test/slide-form-editor.test.js

@@ -0,0 +1,9 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+
+const slideFormEditorSource = fs.readFileSync(require.resolve('../src/web/public/js/slides/slide-form-editor.js'), 'utf8');
+
+test('slide editor disables pasted data images in TinyMCE', () => {
+  assert.ok(slideFormEditorSource.includes('paste_data_images: false'));
+});