notify-bridge/RELEASE_NOTES.md

v0.2.6 (2026-04-22)

Bug-fix release. Notably: saving settings was silently overwriting the Telegram webhook secret with its own display mask, invalidating HMAC on every webhook-mode bot after any settings save. Also fixes template-editor variable discovery for provider-specific command slots (/search, /status, /repos, /issues, /boards), asset enrichment (city / country / favorite) for Immich /search / /find / /person / /place, and video rendering in command media groups.

Bug Fixes

• Don't clobber the Telegram webhook secret with its mask on save — GET /settings returns the secret masked as ***<last4>; the frontend bound that masked value into state and shipped it back on any Save, so the PUT handler persisted the mask as the new secret. The next GET re-masked the mask to itself, so the UI showed no corruption while HMAC verification silently broke for every webhook-mode bot. Incoming values that begin with *** are now treated as unchanged; empty strings still clear the secret explicitly. Operators running webhook-mode bots should save the page once with a known-good secret after upgrading. (8531168)
• Surface Variables button / autocomplete for provider-specific command slots — the command-template-configs UI only resolved slot variables against the shared catalog, so Immich's /search and /status, Gitea's /repos / /issues, and Planka's /boards offered no autocomplete. It now resolves against the active provider (varsRef[provider_type][slot]) first, falling back to shared entries. (fab6169)
• Enrich raw Immich search results through build_asset_dict — /search, /find, /person, /place previously handed raw API rows to templates, so city / country (from exifInfo) and is_favorite (mapped from isFavorite) were missing and templates couldn't render location or favorite indicators. Now normalised the same way as notification events. (fab6169)
• Videos render correctly in command media groups — /latest, /random, /favorites were sending videos as still thumbnails because the media-group path duplicated asset-typing logic. Extracted build_telegram_asset_entry into a shared helper so the notification dispatcher and command groups agree on video typing and /video/playback URLs. (fab6169)
• Command media groups reuse the Telegram file_id cache — send_media_group was re-uploading assets on every repeat command instead of honoring the cache the notification dispatcher already populates. Now shares the cache, avoiding re-upload churn. (fab6169)

---

All Commits

• fab6169 — fix(commands): enrich search assets, surface variables for all command slots (alexei.dolgolyov)
• 8531168 — fix(settings): don't clobber webhook secret with its mask on save (alexei.dolgolyov)