Yuvomi

Fixed

• A public address typed without a scheme no longer poisons the installer’s derived settings. The advanced step’s address field is free text; an entry like yuvomi.example.com was taken as is and ended up scheme-less in the .env as BASE_URL and in every displayed OAuth redirect URI. The field now only wins over the derivation from host and port when it names a full http:// or https:// origin.

Security

• Resolved all open code-scanning findings. The screensaver settings trim trailing slashes off the Immich URL without a regular expression that backtracks on adversarial input, the calendar stores its birthday-layer visibility toggle as a plain literal (the value was never more than a toggle), and five test-suite checks now match URLs and markup exactly instead of by substring.