diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md
index 3ed48c6..517e924 100644
--- a/RELEASE_NOTES.md
+++ b/RELEASE_NOTES.md
@@ -1,19 +1,27 @@
-# v0.2.5 (2026-04-22)
+# v0.2.6 (2026-04-22)
-Hotfix release on top of v0.2.4 — the settings page couldn't save numeric
-fields after the cache-TTL / max-entries rework. See v0.2.4 notes for the
-main changes (thumbhash-validated cache, settings UX overhaul, mobile-nav
-parity).
+Bug-fix release. Notably: saving settings was silently overwriting the
+Telegram webhook secret with its own display mask, invalidating HMAC on
+every webhook-mode bot after any settings save. Also fixes template-editor
+variable discovery for provider-specific command slots (`/search`, `/status`,
+`/repos`, `/issues`, `/boards`), asset enrichment (city / country / favorite)
+for Immich `/search` / `/find` / `/person` / `/place`, and video rendering
+in command media groups.
## Bug Fixes
-- **Accept numeric values in settings update payload** — Svelte's `bind:value` on `` coerces to a JS number, and Pydantic v2 wouldn't auto-coerce `int → str`, producing a 422 on every save that touched a numeric setting (TTL, max entries) after v0.2.4. Widened numeric fields to `int | str | None` in `SettingsUpdate` and normalized to `str` before persisting. ([d7d0a5d](https://git.dolgolyov-family.by/alexei.dolgolyov/notify-bridge/commit/d7d0a5d))
+- **Don't clobber the Telegram webhook secret with its mask on save** — `GET /settings` returns the secret masked as `***`; the frontend bound that masked value into state and shipped it back on any Save, so the PUT handler persisted the mask as the new secret. The next GET re-masked the mask to itself, so the UI showed no corruption while HMAC verification silently broke for every webhook-mode bot. Incoming values that begin with `***` are now treated as *unchanged*; empty strings still clear the secret explicitly. **Operators running webhook-mode bots should save the page once with a known-good secret after upgrading.** ([8531168](https://git.dolgolyov-family.by/alexei.dolgolyov/notify-bridge/commit/8531168))
+- **Surface Variables button / autocomplete for provider-specific command slots** — the command-template-configs UI only resolved slot variables against the shared catalog, so Immich's `/search` and `/status`, Gitea's `/repos` / `/issues`, and Planka's `/boards` offered no autocomplete. It now resolves against the active provider (`varsRef[provider_type][slot]`) first, falling back to shared entries. ([fab6169](https://git.dolgolyov-family.by/alexei.dolgolyov/notify-bridge/commit/fab6169))
+- **Enrich raw Immich search results through `build_asset_dict`** — `/search`, `/find`, `/person`, `/place` previously handed raw API rows to templates, so `city` / `country` (from `exifInfo`) and `is_favorite` (mapped from `isFavorite`) were missing and templates couldn't render location or favorite indicators. Now normalised the same way as notification events. ([fab6169](https://git.dolgolyov-family.by/alexei.dolgolyov/notify-bridge/commit/fab6169))
+- **Videos render correctly in command media groups** — `/latest`, `/random`, `/favorites` were sending videos as still thumbnails because the media-group path duplicated asset-typing logic. Extracted `build_telegram_asset_entry` into a shared helper so the notification dispatcher and command groups agree on video typing and `/video/playback` URLs. ([fab6169](https://git.dolgolyov-family.by/alexei.dolgolyov/notify-bridge/commit/fab6169))
+- **Command media groups reuse the Telegram `file_id` cache** — `send_media_group` was re-uploading assets on every repeat command instead of honoring the cache the notification dispatcher already populates. Now shares the cache, avoiding re-upload churn. ([fab6169](https://git.dolgolyov-family.by/alexei.dolgolyov/notify-bridge/commit/fab6169))
---
All Commits
-- [d7d0a5d](https://git.dolgolyov-family.by/alexei.dolgolyov/notify-bridge/commit/d7d0a5d) — fix(settings): accept numeric values in update payload *(alexei.dolgolyov)*
+- [fab6169](https://git.dolgolyov-family.by/alexei.dolgolyov/notify-bridge/commit/fab6169) — fix(commands): enrich search assets, surface variables for all command slots *(alexei.dolgolyov)*
+- [8531168](https://git.dolgolyov-family.by/alexei.dolgolyov/notify-bridge/commit/8531168) — fix(settings): don't clobber webhook secret with its mask on save *(alexei.dolgolyov)*
diff --git a/frontend/package.json b/frontend/package.json
index 4bcfa84..69b8889 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,7 +1,7 @@
{
"name": "notify-bridge-frontend",
"private": true,
- "version": "0.2.5",
+ "version": "0.2.6",
"type": "module",
"scripts": {
"dev": "vite dev",
diff --git a/packages/core/pyproject.toml b/packages/core/pyproject.toml
index 674f780..1756cb8 100644
--- a/packages/core/pyproject.toml
+++ b/packages/core/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
[project]
name = "notify-bridge-core"
-version = "0.2.5"
+version = "0.2.6"
description = "Core library for Notify Bridge — service provider abstractions, models, notifications, and templates"
requires-python = ">=3.12"
dependencies = [
diff --git a/packages/server/pyproject.toml b/packages/server/pyproject.toml
index 31805a4..3569cd7 100644
--- a/packages/server/pyproject.toml
+++ b/packages/server/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
[project]
name = "notify-bridge-server"
-version = "0.2.5"
+version = "0.2.6"
description = "Standalone Notify Bridge server — FastAPI REST API with SQLite database"
requires-python = ">=3.12"
dependencies = [