chore(release): v1.3.0 — "Diary" (#29)

Roll [Unreleased] into [1.3.0]; bump version 1.2.0 → 1.3.0. Adds the react-router
7.17.0 security bump (#27) to the changelog.

Co-authored-by: bndct-devops <petutschnig.benedict@gmail>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: 3 people

CHANGELOG.md

@@ -6,6 +6,8 @@ All notable changes to Tome are documented here. Format loosely follows
 
 ## [Unreleased]
 
+## [1.3.0] — 2026-06-05 — "Diary"
+
 ### Added
 - **Single sign-on (OIDC).** Tome can now authenticate against an external
   OpenID Connect identity provider (Pocket ID, Authelia, Authentik, Keycloak,
@@ -148,6 +150,11 @@ All notable changes to Tome are documented here. Format loosely follows
   in EPUBs and `<Genre>` in CBZ `ComicInfo.xml`. Applies to newly imported books;
   existing books are not retroactively re-tagged.
 
+### Security
+- Updated `react-router` to 7.17.0, clearing four advisories (an RCE in vendored
+  turbo-stream plus three DoS / open-redirect issues). None were exploitable in
+  Tome's static SPA, but the alerts are now resolved. (#27)
+
 ## [1.2.0] — 2026-06-02 — "Press"
 
 ### Added

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "tome"
-version = "1.2.0"
+version = "1.3.0"
 description = "Self-hosted ebook library"
 requires-python = ">=3.12"
 dependencies = [