v0.2.0-alpha.2

Fixed

• Stop presenting a text-only video card when its cover can no longer be
  fetched. Searchy now shows an explicit retry response and does not create a
  Vido download intent for that unusable card.
• Record a grid selection only after its media was sent successfully.
• Remove SepiaSearch from the default discovery pool after a live result linked
  to an unreachable PeerTube instance and timed out in Vido. Bilibili and
  PeerTube remain as the two pinned discovery video engines.

v0.2.0-alpha.1

Changed

• Search the relevance-oriented core and long-tail discovery engine pools in
  parallel, with a 30% discovery share that rises to 50% for weak core results.
• Rank deduplicated media using SearXNG score, reciprocal rank, title coverage,
  engine consensus, media quality, host diversity, and balanced image/video
  scheduling.
• Use each Searchy user's language for SearXNG and add one English core fallback
  for weak non-English results. Operator-set LANGUAGE remains authoritative.
• Keep the proven SearXNG 2026.6.24-e3126b89e production digest after the
  2026.7.16-9f9c00819 candidate regressed DuckDuckGo Images under load. Pin an
  eight-second request budget and explicit core and discovery engine defaults.

Fixed

• Keep all contributing engines and positions during deduplication while
  preserving the primary engine used by existing analytics.
• Accept protocol-relative HTTPS media, upgrade known Bilibili HTTP hosts, and
  select the first safe HTTPS candidate instead of the first non-empty URL.
• Preserve valid width, height, and resolution metadata for quality ranking.

Privacy and operations

• Upgrade golang.org/x/text to v0.39.0 to fix reachable vulnerability
  GO-2026-5970 in Unicode normalization used through pgxpool.
• Keep query text out of logs, analytics, grid sessions, and benchmark output;
  cache and singleflight isolation now also include the resolved language.
• Add no database migration, proxy, Tor route, public SearXNG route, or new
  secret. SAFE_SEARCH=0, IMAGE_PROXY=false, and direct egress remain.
• Add a read-only 36-query synthetic benchmark covering exact, long-tail, and
  multilingual searches. Against the live candidate it improved average
  keyword relevance@10 by 18.6%, kept the exact-query group non-regressing,
  returned no empty cases, kept usable HTTPS at 100%, and measured a 1.5-second
  primary p95 even with one image core engine degraded.

v0.1.0

Private search, personal downloads

Searchy reaches its first stable release with fast image and video search across Telegram.

What's new

• Inline search plus numbered result grids in direct messages and groups.
• Personal video and audio downloads through Vido with the clicking user's settings.
• Private handoff for shared group cards and inline results.
• Shared language preferences and useful statistics without storing search text.

Privacy and reliability

• Queries are never persisted or logged.
• Search remains available if analytics, Core, or the Vido bridge is temporarily unavailable.
• Owner-bound actions and Telegram file reuse prevent accidental duplicate delivery.

v0.1.0-rc.1

Fixed

• Reject an empty pinned-engine set instead of falling back to SearXNG
  categories, which could fan out to every enabled engine and overload the
  private instance.
• Align the public, operator, and agent documentation with v0.1.0-rc.1, the
  production Vido bridge, the single physical core-postgres deployment, and
  the complete Searchy × Vido RC smoke gate.

v0.1.0-beta.3

Fixed

• Show exactly one v before the version in the About panel, regardless of
  whether the build metadata uses a release tag (v0.1.0-beta.3) or a bare
  semantic version (0.1.0-beta.3).

v0.1.0-beta.2

Changed

• Keep the original in-chat Searchy delivery when the user who selected a
  group video presses Download, but redirect any other group member through a
  personal Vido deep link. Vido applies the clicking user's settings and sends
  the result only in that user's private chat, with no extra group message.

Security

• Derive the personal Vido intent through Core without returning the source URL
  to Searchy. The new token is bound to the clicking user and the exact original
  group card (chat_id plus message_id), retains the source for at most the
  card's six-hour lifetime, and rejects copied callback data.

Operations

• Requires Core v0.1.0-rc.2 (migration 006) and Vido v2.3.5-beta.3.

v0.1.0-beta.1

Fixed

• Keep one Searchy process alive while the shared local Telegram Bot API warms
  up, retrying transient getMe failures for up to two minutes while still
  failing immediately for permanent configuration or token errors.

Operations

• Extend the container health start period beyond the bounded Bot API warm-up
  window so health-gated rollouts do not fail while startup is still retrying.
• GitHub Release titles now match their version tags exactly without a project
  name prefix.

v0.1.0-alpha.5

Fixed

• Keep the Vido bridge reconnectable when core-postgres is unavailable during
  Searchy startup, so Download buttons recover without restarting the bot.
• Deliver Vido's exact terminal reason to Searchy users for unsupported links,
  2 GB limits, DRM, authentication, source rate limits, timeouts, unavailable
  media, video-only mismatches and audio extraction failures.
• Record a durable sending boundary before every Telegram operation. A lost
  ACK can no longer downgrade a delivered operation or trigger an automatic
  duplicate after restart; uncertain delivery requires an explicit owner-bound
  retry.
• Renew long delivery leases, reject malformed plans durably, invalidate every
  cached item in a failed album, and keep terminal notifications alive across
  Searchy restarts.

Security

• Resolve and reject symlinks inside the read-only shared cache, and keep source
  URLs/tokens out of delivery failures and bridge logs.

Operations

• Requires core migration 005_vido_searchy_bridge_reliability.sql and Vido
  v2.3.5-alpha.2.

v0.1.0-alpha.4

Fixed

• Omit reply_markup entirely when a DeliveryPlan operation has no buttons;
  this fixes standalone audio delivery on the strict local Bot API.
• Delete the webhook with a parameterless GET, removing the local Bot API's
  empty-multipart startup warning without dropping pending updates.

v0.1.0-alpha.3

Fixed

• Validate the bot token with a parameterless HTTP GET so Searchy can start on
  the pinned local Telegram Bot API server. The Telegram library's malformed
  empty multipart request was accepted by the cloud API but returned an empty
  response from the local server.

Security

• Startup transport errors never include the bot-token-bearing request URL.