Changelog

What new lightbox controls are included?

This release adds edge navigation, a shortcut panel, and modifier-assisted wheel panning.

• Lightbox edge navigation chevrons – mouse-driven browsing with wrap-around between the first and last assets
• In-lightbox keyboard shortcut panel (press ?) documenting all navigation, zoom, and view controls
• Modifier-assisted wheel panning in image-only view – Shift+scroll or a horizontal trackpad swipe pans sideways, Option/Alt+scroll pans vertically, while scroll and pinch-to-zoom continue to zoom

Improvements

• Full keyboard accessibility for the lightbox – focus moves into the dialog on open, Tab cycles through visible controls without escaping to the page behind, and focus returns to the originating element on close
• Image-only view toggle moved from Tab to I, restoring native Tab behavior
• Image navigation now prefers already-cached asset URLs, eliminating a redundant second download when browsing selections
• Expanded automated test coverage across lightbox navigation, zoom, image loading, and focus behavior

Bug Fixes

• Fixed wheel zoom becoming unresponsive after navigating between assets in image-only view
• Fixed horizontal trackpad gestures being misread as zoom-out when no vertical scroll delta was present
• Fixed keyboard focus leaking to the background page after pressing Escape inside a lightbox text field

What changed in the marketing site relaunch?

The relaunch rebuilt the homepage with native WordPress blocks, added interactive demos and marketing pages, and automated codebase stats.

• Homepage rebuilt on native WordPress blocks (Twenty Twenty-Five) – roughly 90% lighter markup with no page-builder dependency
• New interactive demos – before/after tag wiper, AI-tag hotspot photo, and an industry thumbnail marquee, all dependency-free CSS
• New pages – pricing, competitor comparisons (Pics.io, Bynder, Canto), about, Product Hunt, and a technical Show HN brief
• This changelog is now post-driven – each release is a standard post rendered as a release card, with its own URL and RSS entry
• Codebase stats on /show-hn and /product-hunt now auto-generate at deploy time – they cannot drift from reality again
• 30-day money-back guarantee added to all plans

What security and cost controls were added?

This release adds per-account Application Passwords opt-in and a documented AWS cost tripwire ladder.

• Application Passwords opt-in (AUTH-1) – users can enable WordPress application passwords per-account to connect MCP/agent tooling to their library
• AWS cost tripwire ladder – documented alerting thresholds so lifetime-deal economics stay protected as usage grows

What changed for FluentCart 1.6 compatibility?

Storage add-on revocation now follows FluentCart 1.6's renamed subscription-cancellation hook.

• Followed FluentCart 1.6 subscription hook rename (cancelled to canceled) – storage add-on revocation continues to work correctly on subscription cancellation

Which dependencies were updated?

Composer and npm dependencies were updated, including WordPress stubs and a pinned React Hooks ESLint plugin.

• Composer dependencies updated, including adaptation to wordpress-stubs 7.1 for PHPStan analysis
• npm dependencies updated within semver; eslint-plugin-react-hooks pinned at 7.0.1 for lint stability

What architecture improvements shipped?

The release removed the last service-locator call, documented architecture decisions, corrected documentation, and fixed a stale project-sync view.

• StaleProcessingAssetSweeper extracted – removed the last Container::get() call; the entire codebase now resolves dependencies through the DI container
• Architecture Decision Records introduced – significant design decisions now documented in docs/adr/ for future maintainers
• Docs corrected – Free-tier storage claim fixed and stale codebase metrics refreshed

Bug Fixes

• Fixed missing useCallback dependency in useProjectSync that could leave project views showing stale data

What did the pre-launch audit add?

This release adds an Admin role, a gated direct-checkout option, an integration-test harness, and deployment release stamps.

• Admin role activated across the full RBAC surface – team admins can now manage members, projects, and workspace settings
• Direct LTD checkout gate – the on-site purchase endpoint is now behind PICTABASE_ENABLE_DIRECT_LTD so it can be toggled per channel
• Integration test harness – wp-phpunit suite boots the real WordPress stack for end-to-end coverage alongside the unit suite
• Release stamping – every deploy writes commit, tag, and UTC timestamp to RELEASE.txt for provenance

Improvements

• Unified quarantine code generation – one provisioning path for AppSumo, direct LTD, and remediation flows
• Email pipeline extracted – EmailTemplateRenderer and EmailHookRegistrar pulled out of the provisioning service for testability
• Lightbox performance – S3 presigned URLs now cached via WordPress transients, eliminating double-loads
• Storage quota thresholds standardized – amber warning at 80%, hard lockout at 100%, consistent across upload area, quota bar, and account page

Bug Fixes

• Pre-launch audit remediation (Batches A-L) – atomic rate-limit counters, atomic job claims, deduped asset creation, N+1 collapses in invitations and project queries, and deferred sidecar writes
• Closed four WordPress-default attack surfaces identified in the auth audit
• Rate-limited public invitation-token endpoints and hardened share-link / AI-scan paths
• Fixed DI wiring for WebhookPayloadParser and null-safe post field handling

What does the direct lifetime-deal checkout include?

The release adds on-site checkout, a secure code vault, dynamic pricing, and expanded security and test coverage.

• Direct LTD checkout flow – Seamless on-site purchase with FluentCart integration, magic redirect to account, and 4-code cap enforcement
• Code vault system – Secure redemption, quarantine, and refund handling with channel segregation (AppSumo vs direct)
• Dynamic pricing display – Single source of truth for LTD pricing across frontend and backend

Improvements

• Security hardening – Foundation audit completed with F2/F4/F5/F9 data-leak protections, interface extractions for testability, and strict UTC discipline
• Test coverage expansion – 50+ new unit tests covering license provisioning, entitlement services, asset deletion, and account state management
• Code quality – Split god-objects into SRP-aligned controllers, extracted interfaces for dependency injection, and removed wpdb dependencies from service layer
• Documentation – Comprehensive operational launch checklist, AppSumo reviewer FAQ, and security whitepaper updates

Bug Fixes

• Fixed asset position jump on rotation
• Fixed Project screen scrolling issues
• Fixed lightbox zoom passive wheel warning
• Fixed LTD channel edge cases for refunded users

In Development

• Advanced Metadata & Taxonomy Management:Enhanced tools for large-scale library maintenance, including the ability to merge categories, mass-rename terms, and manage complex tag hierarchies to prevent “metadata bloat” as your library grows.
• Agency-Scale Batch Export Engine: Note: This is an infrastructure-intensive feature slated for Advanced Tier/Agency add-ons.

Under Consideration

• Native WordPress Gutenberg Integration:A seamless bridge between your PictaBase library and the WordPress editor. This feature will allow you to browse, search, and insert assets directly into your pages and posts without ever leaving the block editor or manually re-uploading files.
• Interactive Client Proofing & Selection Evolving our current sharing capabilities into a two-way collaboration tool. This update will allow external clients to “Favorite,” “Approve,” or “Reject” specific assets within their branded galleries, with real-time status syncing back to the PictaBase dashboard.
• Facial Recognition: Automated person detection and matching across your entire photo library. This feature uses AWS Rekognition to identify faces in new uploads and automatically match them against existing face collections, making it effortless to find “all photos of this person” without manual tagging.

What did the launch-readiness patch improve?

This patch focuses on infrastructure maturity, monitoring, background-job reliability, and support readiness rather than new features.

• Engineering resources for this patch were dedicated exclusively to infrastructure maturity rather than feature expansion, ensuring the core engine is hardened for the initial user influx.

Improvements

• This update prioritizes launch-day stability and support responsiveness. By upgrading internal telemetry for AI processing, the platform is equipped for faster incident resolution during high-traffic periods. Background job reliability was reinforced with strict UTC discipline and improved retry logic to ensure consistent performance across global server regions.

Bug Fixes

• n/a

What does the AppSumo launch entry record?

The related v1.0.0 foundational release lists AWS S3 integration, signed CloudFront delivery, AI-driven metadata, hierarchical taxonomies, and stacking up to four AppSumo codes.

What did the foundational DAM release introduce?

The first release introduced S3-backed asset delivery, AI-assisted metadata extraction, hierarchical taxonomies, and AppSumo code stacking.

• Launching the foundational PictaBase engine, built for professional-grade visual asset management. Key capabilities include native AWS S3 integration with signed CloudFront delivery, AI-driven metadata extraction, and a hierarchical taxonomy system tailored for complex industry workflows. The release also includes a robust stacking system supporting up to 4 AppSumo codes.

Improvements

• This release established an enterprise-grade codebase by enforcing 100% strict typing and zero-error PHPStan Level 8 static analysis. Security was a primary focus, resulting in a custom embedded authentication flow that eliminates traditional CMS vulnerabilities and rigorous header validation to protect asset security.

Bug Fixes

• Initial stabilization efforts addressed critical session synchronization and UI state hydration to ensure a seamless onboarding experience. Fixes also included filename normalization for cross-OS compatibility and mathematical edge-case handling for high-tier license stacking.