From c04d3ba27e292486333821337b4cb0230b59718c Mon Sep 17 00:00:00 2001
From: null <koga.industries@gmail.com>
Date: Sat, 9 May 2026 20:25:05 -0500
Subject: [PATCH] v0.19.4: bump version to 0.19.4 in package.json and login
 screen

---
 DEVELOPMENT_LOG.md    | 23 +++++++++++++++++++++++
 client/lib/version.js |  8 +++++---
 package.json          |  2 +-
 3 files changed, 29 insertions(+), 4 deletions(-)

diff --git a/DEVELOPMENT_LOG.md b/DEVELOPMENT_LOG.md
index 76fd77f..3cc2c53 100644
--- a/DEVELOPMENT_LOG.md
+++ b/DEVELOPMENT_LOG.md
@@ -603,3 +603,26 @@ The `handleLegacyDatabase()` function in `db/database.js` checks for a database
 This ensures backward compatibility with existing deployments while preventing duplicate migrations.
 
 ---
+
+---
+
+## v0.19.4 — Session Token Expiry Cleanup
+
+**Date:** 2026-05-09
+**Status:** COMPLETED
+
+### Agents
+- **Neo** — Implemented cleanupExpiredSessions(), v0.43 migration, periodic purge, per-user login cleanup (19m)
+- **Bishop** — Verified all tests pass: Docker build, migration, startup logs, login, interval (3m 5s)
+- **Hudson** — Security audit: 5 PASS, 1 FAIL (SESSION_CLEANUP_INTERVAL_MS validation — fixed by Ripley)
+- **Ripley** — Fixed Hudson finding (interval validation), committed v0.19.4, pushed, deployed
+
+### Files Modified
+- `db/database.js` — cleanupExpiredSessions(), v0.43 migration, COLUMN_WHITELIST
+- `server.js` — Startup cleanup, periodic interval, input validation for SESSION_CLEANUP_INTERVAL_MS
+- `services/authService.js` — Per-user expired session cleanup on login and createSession
+- `docs/Engineering_Reference_Manual.md` — Session cleanup documentation
+
+### Commits
+- `399882f` — v0.19.4: session token expiry cleanup
+- `3a1d613` — docs: v0.19.4 changelog, remove completed item from FUTURE.md
diff --git a/client/lib/version.js b/client/lib/version.js
index d439e6c..8b2939d 100644
--- a/client/lib/version.js
+++ b/client/lib/version.js
@@ -1,12 +1,14 @@
-export const APP_VERSION = '0.19.2';
+export const APP_VERSION = '0.19.4';
 export const APP_NAME    = 'BillTracker';
 
 export const RELEASE_NOTES = {
-  version: '0.19.2',
+  version: '0.19.4',
   date: '2026-05-09',
   highlights: [
     { icon: '🛡️', title: 'Legacy database migration fix', desc: 'Users upgrading from older versions can now log in.' },
     { icon: '🔒', title: 'Security hardening', desc: 'Path traversal protection, content redaction, error sanitization.' },
     { icon: '🪟', title: 'React Error Boundaries', desc: 'App no longer crashes to white screen on errors.' },
+    { icon: '🧹', title: 'Session token cleanup', desc: 'Expired sessions auto-purged on startup, daily, and on login.' },
+    { icon: '🔑', title: 'Admin password reset', desc: 'INIT_ADMIN_PASS now resets existing admin passwords on legacy DBs.' },
   ],
-};
+};
\ No newline at end of file
diff --git a/package.json b/package.json
index c439f12..0f2acca 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "bill-tracker",
-  "version": "0.19.2",
+  "version": "0.19.4",
   "description": "Monthly bill tracking system",
   "main": "server.js",
   "scripts": {