Hono + D1 v5.0.0

This is the first version that runs on Hono + Cloudflare Workers + Cloudflare D1.

Self-hosted version is no longer available. For last self-hostable version, please visit v4.0.0 .

The API is the same as last version, this version is just a rewrite.

Last Self-host Release v4.0.0

Merge pull request #20 from SamWang8891/dev

Release v4.0.0: server-side 307 redirects, theme follow-OS, dependency bumps

Major release, v3.0.0

Pika v3.0.0

A ground-up rebuild. The entire frontend has been rewritten in React 19, links now expire, and the stack is hardened from top to bottom.

---

✨ What's New

React 19 Frontend

The vanilla JS frontend is gone — Pika now runs on React 19 + Vite, bringing a modern component architecture, faster builds, and a much better developer experience.

🎨 Woodland Cozy Design

A brand-new visual identity featuring a warm terracotta & cream palette, smooth animations, and a fully responsive mobile-first layout. Dark and light modes are built in, with QR codes that regenerate their colors on theme toggle.

⏳ Link Expiration

Links are no longer permanent by default. Choose from 1 hour, 12 hours, 1 day, 7 days (default), or never — expired records are automatically cleaned up and their keywords freed for reuse.

🔔 Toast Notifications

A polished notification system with contextual colors for success, error, warning, and info states. Anchored bottom-right on desktop, centered on mobile.

🛡️ Admin Panel Upgrades

The admin table now displays created and expires timestamps with color-coded badges for at-a-glance status.

---

🔒 Security Hardening

• Removed plaintext password logging — print(new_password) leak in cred.py is gone
• Specific exception handling — bare except replaced with targeted argon2 exceptions
• Startup validation — server refuses to start if SECRET_KEY or BEARER_TOKEN are unset
• Race condition prevention — UNIQUE constraint on urls.short
• Redirect scheme validation — only https:// and http:// URLs are followed
• Negative expiry rejection — invalid expiry values are no longer accepted
• Secrets file permissions — .env files now use chmod 600 instead of 777
• CORS lockdown — removed nginx wildcard * that overrode backend CORS policy

---

🐛 Bug Fixes

Backend

• custom_keyword.strip() return value was silently discarded
• Custom keyword duplicate check compared short to itself instead of the original URL
• Dictionary exhaustion crashed the server — now returns 503 Service Unavailable
• Expired records blocked reuse of their keywords
• exit() after DB init killed the container on first run
• Missing is_reset_password.txt caused a crash on fresh installs
• Password reset now uses change_cred() instead of dropping the login table
• GetRecordsSchemas.records type corrected from dict to list[dict]
• URL space validation added to the API
• Typo: "sucessfully" → "successfully"

Frontend

• Safari SVG blur caused by image-rendering: pixelated
• Clipboard copy failures were silently swallowed
• Logo click now resets home page state (clears QR / results)
• QR code and copy button icon scale properly on small screens
• Config cache is cleared on fetch failure to allow retry
• Placeholder text no longer suggests hyphens that the regex rejects
• adminCheck failure in ChangePassword no longer causes an infinite spinner

Infrastructure

• setup.sh: fixed WEB_EXPOSED_PORT space-after-equals bug
• setup.sh: .env files are now overwritten instead of appending duplicates
• setup.sh: docker availability check moved before password-reset block
• Removed deprecated version field from docker-compose.yaml
• nginx: added try_files for SPA client-side routing
• Removed non-existent packages from requirements.txt and package.json
• GitHub Actions: fixed extglob syntax so !(pika) pattern parses correctly

---

⚠️ Breaking Changes

Change	Migration
API path /api/v2 → /api/v3	Update any external integrations or bookmarks
New DB columns created_at, expires_at	Requires database re-initialization
Vanilla JS frontend removed	No action needed — the React build replaces it

---

📝 Docs

• Updated README content and license year
• Renamed README_zh-tw.md → README.zh-tw.md for consistency

Major release, v2.0.0

fix: fix GitHub action create_release.yaml

Bug fix, v1.3.1

Update:

• Python packages version
• npm packages

Fix:

• (Attempt) Safari on all platforms icon not showing in the QR code
• Python FastAPI path error

For more info: see #12.

Minor update, v1.3.0

• Upgrade packages version
• Added "just generate QR code of original URL" feature

See #10.

Patch, v1.2.2

Fix docs error, see #9.

Patch, v1.2.1

Minor UI and setup script fix. #8

Minor update, v1.2.0

The page will now show "Redirecting..." when doing the redirecting job.

Minor fix to readme file.

#7

Bug fixes, v1.1.0

Change how screenshots in README look and fixed some bugs. See #3 and #6.