From 6a575520aac6237a93b30c22b47a175bc29d4d5e Mon Sep 17 00:00:00 2001
From: Ulas Kalayci <ulas.kalayci@googlemail.com>
Date: Mon, 27 Apr 2026 12:51:10 +0200
Subject: [PATCH] chore: release v0.26.5

---
 CHANGELOG.md               | 5 +++++
 package-lock.json          | 4 ++--
 package.json               | 2 +-
 server/index.js            | 6 +++---
 server/routes/birthdays.js | 2 +-
 5 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 661e095..2204630 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.26.5] - 2026-04-27
+
+### Changed
+- Birthdays: increased maximum photo upload size from ~0.9 MB to 5 MB
+
 ## [0.26.4] - 2026-04-27
 
 ### Changed
diff --git a/package-lock.json b/package-lock.json
index 77e069c..dae52df 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "oikos",
-  "version": "0.26.4",
+  "version": "0.26.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "oikos",
-      "version": "0.26.4",
+      "version": "0.26.5",
       "license": "MIT",
       "dependencies": {
         "bcrypt": "^6.0.0",
diff --git a/package.json b/package.json
index 6814249..908907b 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "oikos",
-  "version": "0.26.4",
+  "version": "0.26.5",
   "description": "Self-hosted family planner - calendar, tasks, shopping, meal planning, budget and more. Private, open-source, no subscription.",
   "main": "server/index.js",
   "type": "module",
diff --git a/server/index.js b/server/index.js
index be4759d..6b87d77 100644
--- a/server/index.js
+++ b/server/index.js
@@ -87,8 +87,8 @@ app.set('trust proxy', process.env.TRUST_PROXY !== undefined ? process.env.TRUST
 // --------------------------------------------------------
 // Request-Parsing
 // --------------------------------------------------------
-app.use(express.json({ limit: '1mb' }));
-app.use(express.urlencoded({ extended: true, limit: '1mb' }));
+app.use(express.json({ limit: '7mb' }));
+app.use(express.urlencoded({ extended: true, limit: '7mb' }));
 
 // JSON-Parse-Fehler abfangen (gibt sonst HTML zurück)
 app.use((err, req, res, next) => {
@@ -96,7 +96,7 @@ app.use((err, req, res, next) => {
     return res.status(400).json({ error: 'Invalid JSON in request body.', code: 400 });
   }
   if (err.type === 'entity.too.large') {
-    return res.status(413).json({ error: 'Request body too large (max. 1 MB).', code: 413 });
+    return res.status(413).json({ error: 'Request body too large (max. 7 MB).', code: 413 });
   }
   next(err);
 });
diff --git a/server/routes/birthdays.js b/server/routes/birthdays.js
index 91141da..6b80e71 100644
--- a/server/routes/birthdays.js
+++ b/server/routes/birthdays.js
@@ -6,7 +6,7 @@ import { deleteBirthdayArtifacts, hydrateBirthday, syncBirthdayArtifacts, syncAl
 
 const log = createLogger('Birthdays');
 const router = express.Router();
-const MAX_PHOTO_LENGTH = 900_000;
+const MAX_PHOTO_LENGTH = 6_990_507; // ~5 MB raw image in base64
 const PHOTO_RE = /^data:image\/(png|jpeg|jpg|webp|gif);base64,[A-Za-z0-9+/=]+$/;
 
 function validatePhotoData(val) {