Veyra 1.2.0 — Active session management

Added

• Add active-session management in Settings.
• Allow users to remotely sign out sessions on other devices.

Security and maintenance

• Apply non-breaking dependency security updates.
• Refresh Alpine runtime security packages in the Docker image.
• Align package, compose, and Docker Hub documentation versions at 1.2.0.

CI verification: server and web tests, typecheck, build, dependency audit, and container verification all pass.

Veyra 1.1.5

Unified storage summaries

• Unified typography across the account and instance storage cards.
• Added consistent tabular alignment for storage values.
• Replaced browser-native capacity bars with rounded, theme-aware indicators.
• Improved storage summary spacing and value badges.

Verification

• 28 automated tests passed.
• Type checking and production builds passed.
• npm audit reports 0 vulnerabilities.
• CI container build and scan passed.

Veyra 1.1.4

Polished Settings controls

• Modernized the Storage backend selector with rounded, theme-aware styling and a consistent dropdown indicator.
• Replaced the browser-native branding logo input with an accessible themed picker.
• Added clear upload progress text and supported-format guidance.
• Refined the branding accent picker and focus feedback across Settings fields.

Verification

• 28 automated tests passed.
• Type checking and production builds passed.
• npm audit reports 0 vulnerabilities.
• CI container build and scan passed.

Veyra 1.1.3

Modern reverse-upload request form

• Restyled the Instructions and Expires controls with rounded, theme-aware surfaces.
• Added consistent hover and focus feedback plus a helpful instructions placeholder.
• Kept the styling scoped to the reverse-upload request form.
• Updated nanoid to 3.3.18 to clear the latest high-severity advisory.

Verification

• 28 automated tests passed.
• Type checking and production builds passed.
• npm audit reports 0 vulnerabilities.
• CI container build and scan passed.

Veyra 1.1.2

Version metadata consistency

• Health and public configuration endpoints now derive the application version from package metadata.
• The web fallback configuration uses the same package version.
• Added integration coverage to prevent version drift in future releases.

Verification

• 28 automated tests passed.
• Type checking and production builds passed.
• npm audit reports 0 vulnerabilities.
• CI container build and scan passed.

Veyra 1.1.1

Security observability

• Request failure logs now include the HTTP method, query-free path, client IP, and response status.
• Query strings are excluded from failure logs to avoid exposing tokens or other sensitive URL parameters.
• Updated brace-expansion and fast-uri transitive dependencies to address high-severity security advisories.

Verification

• 28 automated tests passed.
• Type checking and production builds passed.
• npm audit reports 0 vulnerabilities.
• CI container build and scan passed.

Veyra 1.1.0

What's new

• Added a cryptographically secure share-password generator with one-click copy.
• Added an explicit, disabled-by-default option to include the password in the initial recipient email.
• Added password copy on the success screen while the value remains available in the current browser tab.
• Updated the Docker Compose defaults to adrianbrisca/veyra:1.1.0.

Security

• Share passwords remain hash-only at rest.
• A password selected for email delivery is supplied only during upload finalization and verified against the stored scrypt hash.
• The password is not stored in SQLite, upload-session data, API responses, URLs, or audit events.
• Manual email retries always send only the share link.
• Password-bearing email content is HTML-escaped and the password is excluded from the subject.

Verification

• 28 automated tests passed.
• TypeScript type checks and production builds passed.
• npm audit reported 0 vulnerabilities.
• Required GitHub checks verify and container passed, including the container security scan.

Veyra 1.0.0

Veyra 1.0.0 is the first public release of a modern, security-focused, self-hosted file-sharing platform.

Highlights

• Resumable file and folder uploads with progress, speed, ETA, pause, and crash recovery
• Per-file, per-share, per-user, and instance quotas with free-space protection
• QR codes, safe previews, direct links, Range requests, and streamed Download all ZIP archives
• Reverse upload requests with an owner-only private inbox
• Multi-user accounts, invitations, TOTP 2FA, recovery codes, email verification, and password recovery
• Controlled branding and aggregate-only global administration
• Optional fail-closed ClamAV quarantine, OIDC with PKCE, and S3-compatible storage
• Six responsive themes

Reliability and security

• Durable object-deletion outbox with bounded retry
• Offset reconciliation and restart-safe finalization for resumable uploads
• Idempotent completion effects to prevent duplicate notifications
• Sequential archive streaming to bound sockets and memory use
• Hash-only public capability lookup, AES-256-GCM protected recoverable secrets, strict CSP, rate limits, and non-root Docker runtime

Verification

• 23 automated tests passed
• GitHub Actions build and test workflow passed
• npm audit: 0 vulnerabilities
• Trivy image scan: 0 HIGH/CRITICAL vulnerabilities and 0 secrets
• Migration validated against a consistent copy of a live Veyra 0.6.0 database

See the README for installation, reverse-proxy, ClamAV, S3, OIDC, SMTP, and capacity configuration.