v0.12.2

Security

• js-yaml pinned to ^4.2.0 via npm override — resolves the quadratic-complexity DoS in merge-key handling (GHSA-h67p-54hq-rp68, Dependabot alert #63). Dev-only transitive dependency via shadcn → cosmiconfig.

Full Changelog: v0.12.1...v0.12.2

v0.12.1

Security

Patch dependency advisories flagged by Dependabot:

• dompurify 3.4.2 → 3.4.11 (alerts #41–#47, #52)
• multer 2.1.1 → 2.2.0 (alerts #48, #49)
• form-data 4.0.5 → 4.0.6 (alert #57)
• undici pinned to ^7.28.0 via npm override (alerts #50, #51, #58–#62)

Dev-only / Windows-only advisories (vite #55/#56, @babel/core #53) were assessed as not exploitable in deployment and dismissed in Dependabot.

Full Changelog: v0.12.0...v0.12.1

v0.12.0

What's new

Bundle Images module

A new fifth module that uses the Gemini image-generation API to composite individual product photos into a single 500×500 white-background PNG for product bundle listings on the website.

Features:

• Upload 2–6 source product images (PNG/JPEG/WebP, white or transparent background)
• Optional per-image product description to improve placement accuracy
• Generates a clean studio-composite image via Google Gemini (gemini-3-pro-image by default)
• Output is normalised to exactly 500×500 pixels with a white background via Sharp
• Accept or Regenerate workflow — each regeneration produces a new versioned URL
• Copy URL and Download buttons on accepted images
• Public image URL (/images/{id}/bundle-{v}.png) ready to use directly on the website
• Source files and output automatically purged after 7 days

Admin settings:

• System instruction and model are admin-configurable in Settings → LLM Instructions → Bundle Images tab
• Model defaults to gemini-3-pro-image; can be switched to gemini-3.1-flash-image or gemini-2.5-flash-image

Note: Gemini image models reconstruct images generatively. The prompt instructs strongly for product fidelity but minor visual differences from source images are possible; the Pro model gives the best results.

---

Full changelog: v0.11.1...v0.12.0

v0.11.0

ProductLens v0.11.0 builds on the Bulk Content Generator with a Pimcore-ready export, UI consolidation, and a full security pass.

Features

• Bulk Content Generator – paginated jobs: the Recent Jobs list now shows 5 jobs per page with Previous/Next controls. The page resets to the first page on a new upload and clamps automatically as old jobs are purged. (55405d1)

Fixes

• Pimcore-ready bulk export: the job output is now produced by populating the official Marketing Information import template instead of a generated workbook. The exact sheet names (Bulk Upload marketinginfo), the hidden SelectFields sheet, and the Language drop-down validation are preserved, so Pimcore accepts the file. (2fbc9ef)
• Bulk job download & failure visibility: the job-list endpoint now returns hasOutput and per-row results, so a completed job keeps its Output download button and shows per-row failure messages after a page refresh or a new upload — not just while it is being polled. (069af61)

Security

• Resolved Dependabot alerts: react-router bumped to 7.16.0, fixing the vendored turbo-stream RCE, the protocol-relative open redirect, and the __manifest path-expansion DoS; tmp path traversal and the brace-expansion numeric-range DoS pinned via npm overrides. (aedbf61)
• Cleared remaining npm audit advisories: the qs stringify DoS and the exceljs → uuid buffer bounds-check issue are fixed via scoped overrides, avoiding the breaking exceljs downgrade. npm audit now reports zero vulnerabilities. (6f19f34)

UI / Refactor

• Unified Content Generator navigation: the standalone "Bulk Generator" menu item is removed; the Simple and Bulk views now live under a single "Content Generator" nav item with Simple/Bulk tabs. Deep links to /content-generator/bulk continue to work. (9897e48)

Docs

• Slimmer agent guidance: CLAUDE.md is trimmed to the always-relevant rules, with the backend file map, per-module mechanics, test inventory, and Docker/CI moved into a new docs/ directory referenced from CLAUDE.md. (eb1ddcd)

Full Changelog: v0.10.0...v0.11.0

v0.10.0

Bulk Content Generator

New module for generating Gemini marketing copy across many SKUs at once.

• Upload a single-product or bundle .xlsx and generate B2B marketing copy per row via a sequential in-process job queue.
• Download a Pimcore-ready output .xlsx: IM SKU | MPN | Language | Marketing Information (HTML).
• HTML output is composed identically to the single-product "Copy HTML" path (marketing paragraphs + Key Selling Points), rendered server-side via jsdom + DOMPurify.
• REST API at /api/content-generator/bulk: upload, list, status, per-job input/output downloads, and bundled sample templates.
• FIFO worker with startup recovery; bulk jobs are user-scoped and purged after 7 days alongside workflows.
• New React page at /content-generator/bulk with live progress polling, failed-row detail, and download buttons; Bulk Generator nav entry.
• Up to 200 rows per upload; per-row field caps mirror the single-product validator.

Full Changelog: v0.9.1...v0.10.0

v0.9.1

Fixes

• Strip leaked ===MARKETING=== marker from generated content. When Gemini omitted or garbled the ===BULLETS=== marker (common with Search grounding), parseGeminiResponse fell through to the tolerant fallback and returned the entire raw text — including the leading ===MARKETING=== line — as the marketing body, which then rendered as <p>===MARKETING===… in copied HTML.

  The parser now slices the body after the marketing marker when bullets are missing, and the final fallback strips any stray marker tokens. Added a regression test and tightened the existing one.

Full changelog: v0.9.0...v0.9.1

ProductLens v0.9.0

ProductLens v0.9.0

Highlights

• Added admin-editable Content Generator LLM instructions and templates.
• Added SQLite-backed prompt/tuning settings with history, reset, and revert.
• Added Gemini model, temperature, max output token, and Google Search grounding controls.
• Added Settings navigation with Users and LLM Instructions.
• Added soft-delete user handling while preserving report and LLM history attribution.
• Updated Content Generator prompt preview to reflect current DB-backed settings.
• Added backend and frontend tests for LLM settings, soft-delete behavior, and page rendering.

Verification

• npm run lint
• npm test
• npm run build

Docker image build and publish is handled by GitHub Actions on the pushed main branch.

v0.8.2

Full Changelog: v0.8.1...v0.8.2

v0.8.1

Full Changelog: v0.8.0...v0.8.1

v0.8.0

Full Changelog: v0.7.3...v0.8.0