Bump version to 1.9.5

CHANGELOG.md

@@ -7,6 +7,8 @@ and this project follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [1.9.5] - 2026-08-27
+
 ### Fixed
 
 - The public event-alias route (`/:redirectUrl`, used for short links like `/camp-2025`) is a catch-all matching any unmatched top-level path, so every bot/scanner probe for a nonexistent page (`/wp-login.php`, `/.env`, etc.) was hitting the backend and firing a live database query. Both the frontend route and the `GET /api/events/by-alias/:redirectUrl` endpoint now reject anything that isn't a plausible alias (letters/numbers/hyphens/underscores) before touching the database, instead of forwarding scanner noise straight through — this traffic pattern could exhaust the database connection pool and take the server down under load.

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "event-management-backend",
-  "version": "1.9.4",
+  "version": "1.9.5",
   "description": "Event Management System Backend",
   "main": "src/index.js",
   "scripts": {

frontend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hope-events-frontend",
-  "version": "1.9.4",
+  "version": "1.9.5",
   "private": true,
   "scripts": {
     "dev": "next dev --turbopack",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "hope-events",
-  "version": "1.9.4",
+  "version": "1.9.5",
   "main": "index.js",
   "scripts": {
     "dev:backend": "cd backend && npm run dev",