Changelog

Version history and notable changes. The full log is also in the repo root CHANGELOG.md.

[1.4.5] — 2026-10-23

Improved

Gallery: searchable tag filter dropdown; top search matches tag names on images

Fixed

Storage / backup: live full-restore progress; redirect home to sign in when done

[1.4.4] — 2026-10-10

Fixed

Cap login verification supports hashwx challenges and still accepts older SHA-256 site keys

[1.4.3] — 2026-10-09

Added

Telegram storage backend: store images in a channel or group; public URLs stay on PicHost; optional API proxy

[1.4.2] — 2026-09-23

Fixed

Gallery batch tagging and upload token auth (incl. legacy API_UPLOAD_TOKEN)

Improved

Single API token per account; upload tagNames only; tag management sort/mobile layout; API doc table layout

[1.4.1] — 2026-09-16

Added

Upload policy (Settings → Basic): max size, allowed formats, rate limits, preserve originals; env override
Upload API: optional tagNames for tagging by name (create or reuse)

Improved

Configurable login rate limits; settings layout updates

[1.4.0] — 2026-09-09

Added

Tags: per-user colored tags; Settings management; batch tagging on upload/gallery; OR / AND gallery filters
Activity log: login, delete, settings, tag operations; date and user filters
API: tag and tagging endpoints; upload tagIds; list/stats tag filters

Docs

Screenshots and README updated for v1.4 UI

[1.3.0] — 2026-09-07

Added

Site backup / restore / cross-backend sync with job center; CLI backup-export, backup-restore, storage-sync

[1.2.8] — 2026-09-04

Improved

Dual-domain: confirm dialog on save/setup with lockout risks and clear-domains recovery; no longer blocks save based on current Host

Added

Ops CLI: clear-domains clears site/image URL settings from DB (docker exec pichost clear-domains)

Docs

FAQ and dual-domain / reverse-proxy guides updated with recovery steps

[1.2.7] — 2026-09-03

Added

Login verification: slider, Cloudflare Turnstile, or Cap on login/register; configure under Settings → Access
Ops CLI: slider resets verification to the local slider (docker exec pichost slider)

Improved

[1.2.6] — 2026-09-01

Added

Admin UI: redesigned Settings, API, Gallery, and Storage pages; API page includes live debugging
Gallery filter: filter by storage backend
Storage IDs: new R2 / COS / OSS / S3 backends get r2-*, cos-*, oss-*, or s3-* prefixes

Improved

Activity log table styling and path truncation
Storage backend card metadata layout
Docs site and README screenshots updated

[1.2.5] — 2026-08-31

Added

Gallery page: nav “Stats” renamed to “Gallery” (/gallery); click a thumbnail for a detail modal (full image, dimensions, upload source, storage path, link copy)
List actions: select all / invert selection; single-image delete moved into the detail modal
Upload source: gallery API returns web / API upload source (from activity logs)

Improved

README tech stack section

Removed

/stats route (no compatibility redirect)

[1.2.4] — 2026-08-31

Fix

Empty referer whitelist still blocked hotlinks: with no Referer whitelist configured, direct browser access worked but embedded images on blogs/forums returned 403; protection now runs only when a whitelist is configured

[1.2.3] — 2026-08-30

Fix

Short links + date-based storage: bare filename URLs (e.g. https://host/xxx.webp) no longer map to flat images/xxx.webp; SQLite index resolves the full images/YYYY/MM/xxx.webp key so thumbnails and short links work again

[1.2.2] — 2026-08-30

Restart the service after upgrading so middleware and API updates take effect.

Dual-domain settings & Host isolation

Fixes

Issue	Description
Site URL cleared by mistake	Saving Settings could write an empty `site_base_url` when disabling dual-domain or editing only the image URL
Config vs effective URL mixed	`GET /api/settings` used to blend DB values with `request.origin`, confusing the Settings UI
Third-host bypass	Unlisted hosts (`pages.dev`, bare IP, old image domains) were not blocked by middleware

Improvements

Settings API (GET /api/settings)

Field	Meaning
`siteBaseUrl` / `imageBaseUrl`	Configured values (DB → env), no request fallback
`effectiveSiteBaseUrl` / `effectiveImageBaseUrl`	Link generation, falls back to request origin when unset
`runtime.currentOrigin`	Detected access URL (display only, not saved)
`runtime.hostRole`	`site` / `image` / `unknown` / `single`

Save API (PATCH /api/settings)

New body field domainSeparation (true / false)
domainSeparation: true requires both URLs with different hostnames
domainSeparation: false allows clearing the site URL
Without domainSeparation, cannot clear siteBaseUrl while dual-domain is active

Settings / setup UI

Form uses configured values; “Active” line shows effective*
Shows detected access URL; no longer auto-fills window.location.origin
“Use detected URL” button (opt-in)
Confirmation modal when disabling dual-domain
Warning when hostRole === 'unknown' with dual-domain on

Host middleware

When dual-domain is on, unlisted hosts get 404 at the app layer (all methods)
localhost / 127.0.0.1 exempt in development
Complements Nginx default_server — use both layers in production

Docs

Rewrote Cloudflare deployment
Updated Dual-domain separation for third-host blocking
Added this changelog page

Upgrade notes

No database migration or CLI step
If the site URL was cleared earlier: re-enter it in Settings, or set SITE_BASE_URL in env and restart
Production: match proxy server_name to Settings; keep a default server block

[1.2.1] — 2026-08-29

Added

Slide puzzle login captcha
VitePress docs site on GitHub Pages
npm run docs:dev / docs:build / docs:preview

Fixed

Gallery not refreshing after delete on stats page
Pagination jump with type="number" input
Copy-link format preference not persisting off home route
Captcha UI alignment

Improved

README trimmed; details moved to docs
Dual-domain docs: unknown Host risk, Cloudflare guide

[1.2.0] — 2026-08-28

Changed

All images under data/images/; parallel top-level folders beside images are no longer used

Added

Startup index sync (disk scan, legacy key normalization, orphan cleanup)

[1.1.x] summary

Version	Highlights
1.1.5	API upload preview fix; file existence check before serve
1.1.4	Date-based storage paths; site host blocks image URLs
1.1.3	Dual-domain (`SITE_BASE_URL` / `IMAGE_BASE_URL`); Host middleware
1.1.0	Multi storage backends (S3 / R2)

Older entries: GitHub CHANGELOG.

Changelog ​

[1.4.5] — 2026-10-23 ​

Improved ​

Fixed ​

[1.4.4] — 2026-10-10 ​

Fixed ​

[1.4.3] — 2026-10-09 ​

Added ​

[1.4.2] — 2026-09-23 ​

Fixed ​

Improved ​

[1.4.1] — 2026-09-16 ​

Added ​

Improved ​

[1.4.0] — 2026-09-09 ​

Added ​

Docs ​

[1.3.0] — 2026-09-07 ​

Added ​

[1.2.8] — 2026-09-04 ​

Improved ​

Added ​

Docs ​

[1.2.7] — 2026-09-03 ​

Added ​

Improved ​

[1.2.6] — 2026-09-01 ​

Added ​

Improved ​

[1.2.5] — 2026-08-31 ​

Added ​

Improved ​

Removed ​

[1.2.4] — 2026-08-31 ​

Fix ​

[1.2.3] — 2026-08-30 ​

Fix ​

[1.2.2] — 2026-08-30 ​

Dual-domain settings & Host isolation ​

Fixes ​

Improvements ​

Docs ​

Upgrade notes ​

[1.2.1] — 2026-08-29 ​

Added ​

Fixed ​

Improved ​

[1.2.0] — 2026-08-28 ​

Changed ​

Added ​

[1.1.x] summary ​

Changelog

[1.4.5] — 2026-10-23

Improved

Fixed

[1.4.4] — 2026-10-10

Fixed

[1.4.3] — 2026-10-09

Added

[1.4.2] — 2026-09-23

Fixed

Improved

[1.4.1] — 2026-09-16

Added

Improved

[1.4.0] — 2026-09-09

Added

Docs

[1.3.0] — 2026-09-07

Added

[1.2.8] — 2026-09-04

Improved

Added

Docs

[1.2.7] — 2026-09-03

Added

Improved

[1.2.6] — 2026-09-01

Added

Improved

[1.2.5] — 2026-08-31

Added

Improved

Removed

[1.2.4] — 2026-08-31

Fix

[1.2.3] — 2026-08-30

Fix

[1.2.2] — 2026-08-30

Dual-domain settings & Host isolation

Fixes

Improvements

Docs

Upgrade notes

[1.2.1] — 2026-08-29

Added

Fixed

Improved

[1.2.0] — 2026-08-28

Changed

Added

[1.1.x] summary