diff --git a/CHANGELOG.md b/CHANGELOG.md index 49bcc8e..f723780 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,183 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [Unreleased] — v3 (major rewrite) + +### Added + +- New shared TypeScript package `@cryptgeon/shared` as single source of truth for crypto, content codec and API client (crypto + compression + payload + types). +- Shared payload codec: `packContent` / `unpackContent` (encode → LZ4 → XChaCha20-Poly1305 and reverse). +- New `pg`-backend storage of note hashes in the cache. + +### Changed + +- Encryption from AES to **XChaCha20-Poly1305** (client-side); dropped `occulto`. +- All API bodies switched to **MessagePack**. +- Frontend migrated to SvelteKit + `@cryptgeon/shared`. +- CLI rebuilt with `vite-plus` (bundles all deps) and imports from `@cryptgeon/shared`. + +### Breaking changes + +- Endpoints moved to `/api/v3/notes/` and `/api/v3/status`; health check to `/healthz`. +- `meta.extra` holds client-opaque data (e.g. scrypt derivation params), size-limited (`EXTRA_SIZE_LIMIT`, default 512 bytes). +- Inner payload is msgpack: `{ type: "text", data }` or `{ type: "files", data: [{ name, mime, size, data }] }`. +- Env renames: `REDIS` → `CACHE`, `REDIS_PREFIX` → `CACHE_PREFIX`; new `EXTRA_SIZE_LIMIT`. +- Docker `redis` service → `cache`; healthcheck → `http://127.0.0.1:8000/healthz`; image stays `valkey/valkey:7-alpine` (swap for any RESP-compatible). +- Storage switched to cache hashes with atomic `HINCRBY` view counting; the per-note lock (`lock.rs`) is removed. +- Notes can have **both** `views` and `expiration` set simultaneously. +- v2 notes are **not migrated**: flush the cache before deploying v3; v2/v3 notes are not interoperable. + +## [2.9.3] - 2026-06-25 + +### Added + +- Basic file drag-and-drop support. + +### Changed + +- Publish to GitHub Container Registry instead of DockerHub. + +### Fixed + +- #207: keep audio/other file mime types intact. +- Localization key typo `note_to_big` → `note_too_big`. + +## [2.9.2] - 2026-06-07 + +### Added + +- Image paste support. +- Czech translation. +- `THEME_HOME_LINK` environment variable. +- Docker compose: prevent anonymous volume creation. + +### Changed + +- Replace Redis with Valkey in docker-compose files. +- Rust 2024 edition compat, watchexec and axum 0.8 updates. +- Switched license checker package. +- Frontend cleanup and readme/docs cleanup. + +### Security + +- Updated dependencies (ring, npm_and_yarn group). + +## [2.9.1] - 2025-02-27 + +### Added + +- Docs about running Redis in RAM-only mode. + +### Fixed + +- Password eye toggle not working. + +### Security + +- Updated dependencies. + +## [2.9.0] - 2025-01-18 + +### Changed + +- Frontend rework: migrate to Svelte 5. +- Update Redis documentation link in compose. + +### Fixed + +- Fix race condition on the delete endpoint by introducing locks to guarantee the view counter. + +## [2.8.4] - 2025-01-02 + +### Added + +- Chinese (zh-TW) translations. +- Basic auth example (nginx). + +## [2.8.3] - 2024-09-27 + +### Added + +- Options to add an imprint: `IMPRINT_URL`, `IMPRINT_HTML`. + +## [2.8.2] - 2024-09-20 + +### Added + +- Raycast extension links. + +### Changed + +- Add `type="button"` to form elements. +- Bump pnpm version. + +## [2.8.1] - 2024-09-02 + +### Changed + +- Move shared package into the CLI. +- Add a guide. + +## [2.8.0] - 2024-08-27 + +### Changed + +- Migrate backend from actix to axum (major refactor). +- More robust config, body limit via axum. +- Use container for test pipeline; skip size/expiration quirks in Safari. + +### Fixed + +- Typos in English localization. + +## [2.7.0] - 2024-08-23 + +### Added + +- Better programmatic access to the shared client. +- Redis TLS feature, dynamically-linked and native musl targets. +- French blog post and improved French translations. + +### Changed + +- Bump redis crate to 0.25.2. + +## [2.6.1] - 2024-05-04 + +### Added + +- Polish translation. + +## [2.6.0] - 2024-03-24 + +### Added + +- `ALLOW_FILES` flag. +- `NEW_NOTE_NOTICE` → `THEME_NEW_NOTE_NOTICE` theme flag. +- French translation update. + +### Changed + +- Reset form when clicking the logo after creating a note. + +## [2.5.1] - 2024-03-04 + +### Changed + +- Reset translation. +- German (`de`) translation update. + +## [2.5.0] - 2024-03-04 + +### Added + +- Expose internal shared functionality for external/programmatic usage. +- German translation updates. + +### Security + +- Updated dependencies (zerocopy). + ## [2.4.0] - 2023-11-01 ### Changed @@ -12,6 +189,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Removed HTML sanitation, display the original message as string - Links are now displayed under the note in a separate section +## [2.3.3] - 2023-08-15 + +### Changed + +- Maintenance. +- Updated dependencies. + +## [2.3.2] - 2023-08-04 + +### Added + +- Spanish readme (`README_ES.md`). + +### Changed + +- Translation and grammar fixes (en, de, de, es). + ## [2.3.1] - 2023-06-23 ### Added @@ -30,6 +224,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Moved to monorepo. +## [2.2.0] - 2023-01-14 + ### Changed - Default port is now 8000, not 5000. diff --git a/docs/v3-breaking-changes.md b/docs/v3-breaking-changes.md deleted file mode 100644 index 98c46c0..0000000 --- a/docs/v3-breaking-changes.md +++ /dev/null @@ -1,66 +0,0 @@ -# v3 Breaking Changes - -A list of changes users and operators need to consider when upgrading from v2 to v3. - -## API - -- All note endpoints moved under `/api/v3/notes/` (was `/api/notes/`) -- Status endpoint moved to `/api/v3/status` (was `/api/status`) -- All request/response bodies are now **MessagePack** (`Content-Type: application/msgpack`), not JSON -- Health check moved to `/healthz` (was `/api/live`) -- Notes can now have **both** `views` and `expiration` set simultaneously (previously mutually exclusive) - -## API payload structure - -The wire format changed entirely. v2 used: - -```json -{ "contents": "", "meta": "", "views": 5, "expiration": 30 } -``` - -v3 uses msgpack: - -``` -{ meta: { views?, expiration?, extra? }, data: } -``` - -- `meta.extra` holds client-opaque data (e.g. scrypt derivation params), size-limited (default 512 bytes) -- `data` is the encrypted blob — the server never inspects its contents -- The encrypted inner payload is itself msgpack: `{ type: "text", data: string }` or `{ type: "files", data: [{ name, mime, size, data }] }` - -## Environment variables - -| v2 | v3 | -| ------------------- | -------------------- | -| `REDIS` | `CACHE` | -| `REDIS_PREFIX` | `CACHE_PREFIX` | -| _(new)_ | `EXTRA_SIZE_LIMIT` | - -The `CACHE` env var accepts any RESP-compatible URL (valkey or redis). -`EXTRA_SIZE_LIMIT` (default `512`) limits the `extra` field size in bytes. - -## Docker / Compose - -- The `redis` service in docker-compose is renamed to `cache` -- Healthcheck URL updated: `http://127.0.0.1:8000/api/live/` → `http://127.0.0.1:8000/healthz` -- The default image stays `valkey/valkey:7-alpine` but operators can swap for any redis-compatible image - -## CLI (`cryptgeon` npm package) - -- Dropped `occulto` dependency — now uses `@noble/ciphers` + `@noble/hashes` internally -- Encryption changed from AES to **XChaCha20-Poly1305** -- The local `shared/` module removed — now imports from `@cryptgeon/shared` (workspace-internal) -- Notes created with v2 (AES) are **not readable** by v3 and vice versa - -## Frontend - -- Dropped `occulto` dependency -- Package import changed from `cryptgeon/shared` to `@cryptgeon/shared` -- Notes created in v2 are not accessible from the v3 frontend - -## Storage - -- Cache storage format changed from JSON blobs to hashes with atomic `HINCRBY` for view counting -- The per-note lock (`lock.rs`) is removed — no longer needed -- Existing v2 notes in cache are **not migrated** and will be inaccessible after upgrade -- Ensure cache is empty (or flush) before deploying v3