feat(docs): add v1.17.2 changelog and auto-update in release workflow

- Add v1.17.2 entry to docs/changelog.md
- Add "Update docs changelog" step to release workflow that
  auto-prepends .release-notes.md to the docs changelog on
  each release, then commits and pushes to trigger docs deploy

.github/workflows/release.yml

@@ -69,6 +69,41 @@ jobs:
             --notes-file /tmp/release-notes.md
           echo "Release notes updated successfully."
 
+      - name: Update docs changelog
+        if: steps.notes.outputs.has_notes == 'true' && steps.check.outputs.version
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ steps.check.outputs.version }}
+        run: |
+          CHANGELOG="apps/docs/changelog.md"
+          if [ ! -f "$CHANGELOG" ]; then
+            echo "No docs changelog found, skipping."
+            exit 0
+          fi
+          NOTES="/tmp/release-notes.md"
+          # Build the new entry: ## vX.Y.Z header + release notes body (skip the first ## Highlights/Upgrade sections wrapper)
+          {
+            echo ""
+            echo "## v${VERSION}"
+            echo ""
+            # Strip the ## Highlights header and ## Upgrade section, keep the rest
+            sed '1{/^## Highlights$/d}' "$NOTES" | sed '/^## Upgrade$/,/^---$/d' | sed '/^---$/d'
+            echo ""
+            echo "[Full diff on GitHub](https://github.com/snapotter-hq/SnapOtter/compare/v$(git tag --sort=-v:refname | grep -E '^v[0-9]' | sed -n '2p' | sed 's/^v//')...v${VERSION})"
+            echo ""
+            echo "---"
+            echo ""
+          } > /tmp/changelog-entry.md
+          # Insert after the "# Changelog" header
+          sed -i '/^# Changelog$/r /tmp/changelog-entry.md' "$CHANGELOG"
+          # Commit and push
+          git config user.name "SnapOtter"
+          git config user.email "snapotter.hq@gmail.com"
+          git add "$CHANGELOG"
+          git commit -m "docs: update changelog for v${VERSION}" || true
+          git push origin HEAD:main || true
+          echo "Docs changelog updated for v${VERSION}."
+
   prebuilt:
     name: Archive (${{ matrix.arch }})
     needs: release

apps/docs/changelog.md

@@ -4,6 +4,61 @@ description: Release notes and version history for SnapOtter. See what's new, im
 
 # Changelog
 
+## v1.17.2
+
+New HTML to Image tool, WCAG 2.2 AA accessibility, security hardening from penetration testing, and 5 critical Docker fixes.
+
+### New features
+
+- **HTML to Image**: Capture screenshots of URLs or raw HTML as PNG/JPEG/WebP. Full-page captures, custom viewports, dark mode.
+- **Docker _FILE secret convention**: Mount sensitive env vars as files instead of plain-text. (#205)
+- **Enterprise licensing and S3 storage**: Optional commercial license key and S3-compatible object storage.
+- **Shape editor improvements**: Fill/stroke transparency, RGBA color picker, dash line styles.
+- **Pre-built release archives**: Download tarballs from GitHub Releases for non-Docker installs (Proxmox, bare metal, LXC). (#202)
+
+### Improvements
+
+- **WCAG 2.2 AA accessibility**: Skip navigation, focus trapping, aria-live regions, reduced motion support, correct contrast ratios. (#209)
+- **Mobile responsiveness**: Responsive settings, SSE auto-reconnect on mobile tab switch. (#203, #204)
+- **Background removal quality**: Edge smoothing, color decontamination, output format selection.
+- **Italian translation**: ~145 new strings by @albanobattistella. (#206)
+- **Per-tool API documentation**: 53 doc pages with parameters, examples, and response formats.
+- **AI model downloads**: Retry logic with exponential backoff for HuggingFace. (#201)
+
+### Bug fixes
+
+- Fresh Docker containers were completely unusable (rate limit blocked all requests).
+- Face detection AI tools (blur-faces, red-eye-removal, enhance-faces, passport-photo) failed on all platforms.
+- HEIC files broken on ARM (libheif symbol mismatch).
+- Upscale and restore-photo AI bundles failed to install on ARM.
+- OCR used wrong CUDA version on GPU containers.
+- SSRF guard bypass via hex IPv4-mapped IPv6 addresses. (Credit: @tonghuaroot)
+- iPhone HEIC decoding with auxiliary images. (#183, #199)
+- Real-ESRGAN CUDA OOM on 8GB GPUs. (#200)
+- 6 production Sentry errors and 7 QA bugs. (#208)
+
+### Security
+
+- 10 penetration test findings addressed (XFF bypass, malformed JSON crashes, unbounded pipelines, audit log XSS, TRACE method, and more). (#207)
+- SSRF hex IPv6 bypass blocked. (Credit: @tonghuaroot)
+- Dockerfile base images pinned by digest.
+
+### Upgrade
+
+```bash
+docker pull snapotter/snapotter:1.17.2
+```
+
+Or with Docker Compose:
+
+```bash
+docker compose pull && docker compose up -d
+```
+
+[Full diff on GitHub](https://github.com/snapotter-hq/SnapOtter/compare/v1.17.1...v1.17.2)
+
+---
+
 ## v1.17.1
 
 Live demo, per-tool landing pages, and a batch of polish fixes.