Update dependency ejs to v7

Release-Bump: major

package-lock.json

@@ -7,8 +7,8 @@
       "name": "plainpages",
       "dependencies": {
         "@larvit/log": "2.3.0",
-        "ejs": "6.0.1",
+        "ejs": "7.0.2",
-        "lucide-static": "1.58.0",
+        "lucide-static": "1.59.0",
         "postgres": "3.4.9"
       },
       "devDependencies": {
@@ -387,9 +387,9 @@
       }
     },
     "node_modules/ejs": {
-      "version": "6.0.1",
+      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/ejs/-/ejs-6.0.1.tgz",
+      "resolved": "https://registry.npmjs.org/ejs/-/ejs-7.0.2.tgz",
-      "integrity": "sha512-UaaM14yby8U3k02ihS1Bmj5Kz2d7CCQM1scxpgs4Mhkq8F1wR2gl3+Ts4h5Ne4Mnt7M9m4Dw7jsuMr3+xO4vZA==",
+      "integrity": "sha512-LcDSEP6Oclb9sTiSyG0MpG0RuKvLDRxCOOt+2sIk+kdk1rMkFU8SRnT0qaNt5zvU0LOV1YXXOvIoZL/sKwabvw==",
       "license": "Apache-2.0",
       "bin": {
         "ejs": "bin/cli.js"
@@ -399,9 +399,9 @@
       }
     },
     "node_modules/lucide-static": {
-      "version": "1.58.0",
+      "version": "1.59.0",
-      "resolved": "https://registry.npmjs.org/lucide-static/-/lucide-static-1.58.0.tgz",
+      "resolved": "https://registry.npmjs.org/lucide-static/-/lucide-static-1.59.0.tgz",
-      "integrity": "sha512-VFE2ZEq3yEwjBH0El9CA9lHgDWKKXPKgKxFzX+/JN1FPa4maQbtl/pT4B62aJkUEpODT5octDsyGy7tPVE2svQ==",
+      "integrity": "sha512-MuHZYaXbHgzN2QO6D3OM19bj09A+8GJiFSdXIMlbnLLEGQQ9+NRH2KaCxuivevD3Y23vM74kV17XBifgtqhfEg==",
       "license": "ISC"
     },
     "node_modules/postgres": {

package.json

@@ -17,8 +17,8 @@
   },
   "dependencies": {
     "@larvit/log": "2.3.0",
-    "ejs": "6.0.1",
+    "ejs": "7.0.2",
-    "lucide-static": "1.58.0",
+    "lucide-static": "1.59.0",
     "postgres": "3.4.9"
   },
   "devDependencies": {

todo.md

@@ -2,6 +2,7 @@
 
 ## Unfinnished work
 
+- [ ] **Publish every release to Docker Hub, and give the Hub page its short description.** Today Hub's newest tag is 0.4.0 (2026-09-10), while git has v0.4.1–v0.4.12, and the overview still says 0.4.0. No `release.yml` run exists for the tags auto-release pushes as `renovate-bot`, so neither the images nor the overview reach Hub; find out why Gitea doesn't fire `push: tags` for them, fix it, and backfill the missing tags. The short description is empty. fejkdata already did this (`../fejkdata`, commits `51d924a` and `34c8234`), and two parts port directly: a `dockerhub/description.txt`-style one-liner, which here can ride the existing PATCH as its `description` field; and a unit test that the description opens a README sentence and every command the overview shows appears in the README. fejkdata also syncs the page on any push to `main` that changes it, with its own Read/Write/Delete token in an environment only `main` may use, so the image-push token needs no Delete scope. Decide whether that fits here, where `{{VERSION}}` must render a released tag.
 - [ ] Rename the plugin "admin" to something less generic, like "auth-admin" or "users-groups-admin".
 - [ ] Guard the group paths against self-lockout, or accept them explicitly. The self-revoke guard covers only your own *direct* grants on the Users screen; unticking a permission on a group you belong to, removing yourself from that group, or deleting it can all still strip your own effective access with no warning. Recorded in AGENTS.md as a known gap — the robust fix is a "last effective holder" check, which needs a reverse Keto query.
 - [ ] The permission picker has no concurrency baseline, so two operators editing the same user/group silently discard each other's change. Sketch: post the rendered set as a hidden baseline; if it no longer matches Keto, re-render with "this changed while you had the page open" rather than applying.