Skip to content

1.1.0

Choose a tag to compare

View all tags
@MrDDream MrDDream released this 21 Oct 15:09
· 12 commits to main since this release
1.1.0
5ca668b

ShortcutWall 1.1.0 is a complete overhaul: a new interface, a much simpler admin area, automatic logos, backups, and a full security hardening pass.

🐳 Docker image

docker compose pull && docker compose up -d

ghcr.io/mrddream/shortcutwall:1.1.0 (also tagged 1.1 and latest), now built for linux/amd64 and linux/arm64. See the README for a fresh install.

⚠️ Before upgrading from 1.0.0

  • Credentials are now required: in production the app refuses to start while ADMIN_PASS keeps its default value or SESSION_SECRET is missing or shorter than 32 characters. Set both in .env (openssl rand -hex 32 for the secret).
  • New docker-compose.yml: the service is renamed shortcutwall and credentials only come from .env. If you replace your compose file, run docker compose down once before docker compose up -d.
  • Data folders must be writable by uid 1000 (the image runs as a non-root user): sudo chown -R 1000:1000 data public/uploads if needed.
  • Folder shortcuts and .url downloads were removed. Website shortcuts are unchanged.

✨ What's new

  • New interface: modern design, light and dark themes (following the system), larger cards, mobile layout, language picker with flags, instant search (/) and sort.
  • Admin in dialogs: add and edit websites without leaving the list; server errors show inside the dialog without losing your input; undo a deletion for 15 seconds.
  • Automatic logos: Fetch favicon picks the best icon a site offers and checks it is a real image; logos are stored in the app and downsized to 256 px (a 1.6 MB logo becomes ~10 KB), so a site blocking hotlinking can no longer break the wall.
  • Export / import: a JSON backup with every shortcut and its logos; import can merge or replace (a replace can be undone for 15 seconds).
  • Faster: compressed responses, logos cached by the browser, data file cached in memory.

🔒 Security

  • Outgoing requests can no longer reach private networks, even through a redirect or DNS rebinding (SSRF).
  • Session cookies, credentials and API keys are never written to the logs.
  • Uploaded files are checked to really be images and stored under generated names.
  • No server session for anonymous visitors; login limited to 10 failed attempts per IP every 15 minutes.
  • The image no longer contains .env or data, runs as non-root with read-only code, and is ~50 MB smaller.
  • Atomic writes of the data file; npm audit: 0 vulnerabilities; Node.js 26.

🐛 Fixes

  • CSS and JavaScript did not load when the app was served over plain HTTP on a local network address.
  • A crash (error 500) on some malformed form submissions; a logo whose file name contained # was broken; switching language from the admin went back to the home page.

Full changelog: 1.0.0...1.1.0

Assets 2
Loading