v1.73.2

Changelog 1.73.2

Fixed

• When the connection dropped and came back, the page reloaded at once. If the browser said "online" too early, or the connection flickered, that reload could pull you back to the page you had just left. The page now waits a moment (1.5 seconds), checks that you are still online, and only then reloads. A flicker does not reload it.

Changed

• The Docker image now runs on PHP 8.5.11.

v1.73.1

Changelog 1.73.1

New

• One command on a VPS: deploy/vps/install.sh sets up a fresh Ubuntu 24.04 or Debian 13 server: Apache, PHP, the newest release (checked against its SHA-256) and HTTPS from Let's Encrypt. --lan installs it on a home network without a domain. It never replaces a site that is already there.
• Proxmox VE: deploy/proxmox/homebase-hub-lxc.sh, run on the host, makes a small Debian 13 container that starts with the host and installs the site in it.
• App stores: ready files for Unraid, CasaOS (and ZimaOS), Umbrel and YunoHost in deploy/. On YunoHost your data lives outside the site, so removing the app keeps it, and the site's own security headers are kept although YunoHost's web server would replace them.
• Synology and TrueNAS: steps on the website's Install page, using the Docker image.

v1.73.0

Changelog 1.73.0

New

• Docker: each release is also an image, ghcr.io/jackpison/homebase-hub, for PCs, servers and Raspberry Pi. It holds PHP and Apache, so the site is protected exactly as on a web host. compose.yaml starts it on port 8080; compose.caddy.yaml adds HTTPS from Caddy for your domain.
• Updates in Docker work as on any host: the first start copies the site into a volume, Settings › Updates and Go Back work, and a newer image never replaces a site that is already there.
• A VPS: ready settings for Apache and for nginx in deploy/, and every step on the website's Install page. nginx ignores the .htaccess files, so its file closes site-data and sends the same security headers itself.

Security

• Behind your own proxy: a new setting, HUB_TRUSTED_PROXY, names your proxy's address. Only then does the site believe it about each visitor's address (login limits, Devices) and HTTPS. A visitor who writes these headers themselves is ignored, as before.

Fixes

• Updates: when the site cannot reach its own address from the server (Docker with another port, or a proxy in front), the check after an update asks the web server directly, instead of undoing a good update.

v1.72.3

Changelog 1.72.3

Fixes

• Tools › Markdown Editor: the text box now fits inside its card, below the Bold to Quote buttons, instead of running past the bottom of the card.

Security

• Settings: the sections open from a fixed list, as the security scan asked; the screen is the same.

v1.72.2

Changelog 1.72.2

Security

• Settings: an address such as #constructor opens the Overview instead of a broken page. Only the site's own sections can open.
• Settings › Appearance › Colors: only real colour codes (like #1a2b3c) are put into the page.
• Cards: every part of a card that goes into the page is escaped, including its ID.
• Links › Import Bookmarks: picture and media tags in a bookmarks file are removed completely, also when one is hidden inside another, and event attributes (like onclick) are made harmless before the file is read.
• Home Settings › Backgrounds: the picture sources' names and counts are put into the page as plain text.

v1.72.1

Changelog 1.72.1

Maintenance

• Tools libraries updated (each within its own major version, so nothing should change in how Tools work):
  • @neslinesli93/qpdf-wasm 0.3.0 → 0.3.1
  • pdfjs-dist 6.4.299 → 6.5.438

v1.72.0

Changelog 1.72.0

Added

• Import Center (Settings › Backup & Restore › Import): another app's export, read here in the browser and shown first with ticks. A calendar (.ics) or Todoist (CSV) goes to Tasks; Google Keep (Takeout .zip), Notion (Markdown .zip) or notes (.txt, .md, .html, such as Apple Notes exported by an app) to Info as a new private tab; Raindrop (CSV), Pocket or browser bookmarks (.html) to Links as a new private tab, a category per folder or tag; a spreadsheet of cards (CSV, its columns matched and changeable) to Cards. What is already there is not added twice, the page saves it the usual way (locked Cards stay locked), and Undo takes it back.
• Offline Reading (Settings › Overview › Start Here): a switch per device, off by default, needs https. On, Home, Links, Info, Cards and Tasks open without a connection, read-only, with an "Offline" note; back online they load fresh. A page is kept once you have opened it, including the one you switch it on from. Log Out deletes the copy; switching it off deletes it and its service worker.
• Calendars You Follow (Tasks Settings): paste a calendar's address (Google's secret iCal address, an Apple public link, Outlook, a school's calendar). The server fetches it then and every 6 hours; its events show read-only in the Calendar, the day panel and Home's Today. The address is never shown in full. Nothing is fetched until you add one.
• More ways to repeat a task: on chosen weekdays (Every Weekday, Mon/Wed/Fri, every 2 weeks on Tuesday), on the last day of the month, or on the nth weekday (the 2nd Tuesday, the last Friday). Quick Add understands "weekdays". The calendar link carries the new rules.
• Home widgets (off until switched on in Edit › Settings › Widgets): Upcoming Bills (priced tasks still to pay this month, and the total), Recent Links (opened on this device), Recent Files (once Files has opened them in that tab) and Server Status (the same overview as Settings).
• Search everywhere: also Cards, the Scratch Pad, every Settings item, Files' names (once Files opened them in that tab) and, while you are on a page, the locked tabs it has unlocked. Results are grouped with counts, a small typo still finds it, and the empty box shows your recent searches.

Changed

• Pages open at once: Links, Info, Cards and Tasks show the data they had last time in that tab while the fresh data loads; the pencil waits until it is in. Log Out clears it.
• Accessibility: a stepper step is a labelled group and says "Step 2 of 3"; the search box tells a screen reader which result is chosen and how many there are; Copy says "Copied". The keys [ and ] open the page before and after. The accessibility check now also runs in WebKit.
• On a page opened over plain http, Copy uses the browser's older copy command; only if that fails too is the text selected, with a note for a phone or a computer.

Fixed

• Narrow phones: the recovery key and the two-step key were cut off at the right on a 320 px screen; they now wrap onto a second line.
• Tasks › Add Task › Repeats › Custom: the number box took the whole row and pushed the Days / Weeks / Months choice out of the window.

For the project

• The weekly security check says when an npm override (minimatch) is no longer needed (scripts/overrides.py). A checklist for trying a release on a real phone: docs/PHONE-CHECKLIST.md.

v1.71.0

Changelog 1.71.0

Changed

Smoother on phones, the iPhone app included.

• Swipe between pages follows your finger. The page moves with it (the bar stays). Let go past a third of the screen, or with a quick flick, and the page slides away while the next one slides in from that side; not far enough, and it springs back. At the first or last page it only gives a little. Before, nothing moved until you let go, and then the page reloaded with a fade.
• Quicker page changes: the fade between pages is 0.26 s in all (it was 0.46 s).
• Reduce Motion: nothing slides under your finger, and a page change is a short fade (it was a cut).
• The top bar hides without restyling the page. It used to change a setting on the whole page, so every element was styled again each time the bar slid away or came back (up to 36 ms on Tasks on a slow phone). Toasts, Tasks' side panels and the Settings menu now slide with the bar.
• The dock's shrink while scrolling only runs when the dock is used.
• The swipe checks for a sideways-scrolling box only once your finger moves sideways, not on every touch.
• Home on a phone: the next background waits 3 seconds after the page is ready (it was 0.6 s), and a next background that is a video is only fetched when you ask for it.

v1.70.0

Changelog 1.70.0

Changed

Settings is sorted so each thing sits where you would look for it. Nothing is lost and no setting changes; old links open the new place.

• Appearance › Bar (new tab): Navigation Style, Show the Bar on the Home Page, Hide the Bar While Scrolling, and the Tabs list (rename, reorder, hide), which was General › Tabs.
• Appearance › Look: Theme, Font and Text Sizes. Text Sizes opens Info's or Cards' sizes from here too (Links keeps its own in Links Settings).
• Appearance › Colors: holds Accent Color (the picker with ten colors). It was in Look and again as a plain row in Colors.
• Appearance › Glass: the only place for the glass switch (Glass on the Bar). Look had a second one.
• General is one page: Site Name, Site Logo and Time Zone.
• Overview › Start Here (was Guided Setup): the setup steps, then Install on Your Phone and Keyboard Shortcuts (they were in General).
• Backup & Restore › Back Up: Send Backups to Telegram (how often, Send Backup Now) moved here from Telegram › Backups. Telegram's Backups card opens it.
• Telegram: four tabs (Status, Setup, Messages, Instant Replies). Send Today's Tasks is in Messages.
• Health › Server Check ends with Files That Do Not Belong (was Updates › Files).
• Updates › What's New: Versions, Version Map and Notes (the Changelog was a section of its own). The menu has eight sections instead of nine.
• The Settings search knows the new places.

v1.69.1

Changelog 1.69.1

Added

• The link field (the idea of Uiverse "itchy-dodo-49" by Bodyhc, MIT, redone in plain HTML and CSS on the site's colours; credited in THIRD-PARTY.md): a label in front, the field, and a copy icon whose tip says COPY, then COPIED. The edge lights up in the accent colour while you type. One shared piece (shell.js HUB.linkField), used in:
  • Links › Add or Edit Link › Address: https:// sits in front (a tap gives http://). A typed or pasted https:// or http:// moves into it; an address with another scheme (mailto:, ftp://) hides it. An arrow opens the link in a new tab; the copy icon copies the whole address. What is saved is the whole address, as before.
  • Files › Share Link: "Link" in front, read-only, with the copy icon (it replaces the Copy button).
  • Settings › Health › Domains and Uptime: https:// in front of the add field; a pasted https:// is dropped, as only the host is kept.
  • Settings › Telegram › Setup › Keep It on Schedule: the two cron lines ("Cron" and "curl"). The key in the web address shows as dots; Copy gives the whole line with the real key.
  • Security › Recovery Key (also in the first-passphrase steps and the Security Checklist) and Two-Step Login's key: "Key" in front, read-only, with the copy icon.

Changed

• Where the browser can't copy (a page opened over plain http), the field is selected and a note says to press Ctrl+C.

Fixed

• Files: a file or folder whose id came out as 16 digits (about 1 in 1,800) could not be removed for good from the Trash: PHP turns such an id into a number, and the clean-up stopped with an error. New ids are never all digits, and ids made before are handled.