Deploy Notes 08.16.2026

Random Thoughts from a Restless Mind

Category: Deploy Notes

Published On: August 16, 2026

💧 The Droplets

Routine maintenance week - system packages updated, reboots applied. No infrastructure changes this time around.

🎬 They Said It! — v2026.8.3 — theysaidit.app

The site has a blog now. "Random Thoughts" lives at /blog - short pieces about the movies in the collection, written and published straight from the admin. What makes it more than a bolted-on blog is the linking: each post lists the movies it's about as cards, and each of those movie pages grows a matching "Random Thoughts" section pointing back. Prose and data pages feed each other. There's an Atom feed, sitemap and structured data support, and scheduled publishing - date a post in the future and it appears on its own, no deploy required.

Adding a movie also lost its last command-line step. A "Fetch TMDB Image" button now sits on every movie in the admin - click it, and the best textless still gets searched, stored, and shown to you on the spot, with the matched TMDB title and id named so a plausible-but-wrong match is visible immediately instead of on the public site later. A bulk version on the Ops page drains missing images ten at a time.

Also fixed: share previews. The site-wide fallback image had been pointing at a Google Drive link that quietly stopped being publicly readable, so any page without its own artwork shared as a bare link everywhere - Discord, X, iMessage, all of it. The share card is now a self-hosted asset that deploys with the code, so a third party's sharing settings can never break it again. Rounding things out, this release includes a security update to EasyAdmin covering an access-control bypass in custom admin actions - directly relevant given the new fetch button.

🧙 Accumulated Knowledge — v2026.8.3 — accumulatedknowledge.app

You can finally change your password without pretending you forgot it. My Account → Change Password: confirm your current password, pick a new one that clears the same rules as registration, done. A confirmation email goes out on every change, so if someone else ever rotates your password, you find out immediately with a link to lock things back down.

The hardening around it is the meat of the release: the page requires a full sign-in (a "remember me"-only session gets asked for the password first), a successful change signs out remember-me sessions on your other devices, clears any outstanding reset links, and rotates your session id. Attempts are rate limited so a borrowed session can't sit there guessing, and account-security events now land in a dedicated audit log on the server.