v0.14.0

[0.14.0] - 2026-08-07

Premium cabins finally mean premium prices, and layovers show up in the data.

Added

• Layover capture. Price snapshots now record each itinerary's layover legs (airport and duration) straight from the results page, so connections are part of the price history instead of a mystery.
• Sturdier create-time previews. Long-stay scrapes get a wall-clock completion budget, unequal outbound/return date ranges are handled correctly, and combo guardrails are surfaced instead of silently truncating. Thanks @Alien10140.

Fixed

• Cabin class now reaches Google Flights. Tracking business, premium economy, or first previously stored Economy fares mislabeled as the requested cabin, for previews, recurring scrapes, and the CLI alike. The search query now carries the cabin, the extraction prompt refuses to pass Economy fares off as premium, and LATAM direct booking no longer hardcodes Economy. Thanks @RomJ25.
• New-low alerts recover on premium-cabin trackers. Mislabeled pre-fix history sat permanently below any real business or first fare and silently suppressed every future alert; a one-time baseline cutoff clears the poisoned markers while keeping chart history intact.
• Preview split scrape failures and token usage are preserved instead of dropped, and preview cache limits and date guardrails are stabilized. Thanks @Alien10140.

Changed

• cabinClass is validated at every trust boundary: API routes reject unknown values, the natural language parser clamps model drift, and the extraction prompt only accepts known cabin labels.
• Dependency updates across npm, GitHub Actions, and Tauri, including the OpenAI SDK v7.

Desktop installers

Download the installer for your OS from the assets below, open it, and choose "Run it on this computer" or "Connect to an instance".

v0.13.2

[0.13.2] - 2026-07-24

Tracker controls where you can reach them, and a scraper that waits for real prices.

Added

• Tracker controls above the chart. Scrape status, check interval, filters, sources, and delete now sit directly under the route header on chart pages instead of below the chart, so tweaking a tracker no longer means scrolling past the price history. Thanks @Alien10140.

Fixed

• Google Flights results load reliably again. Sec-Fetch stealth headers were leaking onto the results request and hanging the page, and the loading gate now waits for a real price signal instead of the empty results container. Native hosts also run Chromium multi process by default, ending sporadic crashes. Thanks @gwendolinw.
• The sources picker no longer pushes chart pages wider than the screen on phones; on narrow screens it wraps as individual chips.
• Update checks now resolve the latest web release correctly by ignoring desktop tags.

Changed

• Dependency updates across npm and GitHub Actions.

v0.13.1

[0.13.1] - 2026-07-11

The interface now speaks five languages.

Added

• UI internationalization. The whole interface is available in English, Spanish, Portuguese, German, and French. The language follows a cookie, so no URLs change and English stays the default. Pick your language in Settings under Appearance. Thanks @ssantss.
• Language picker in the setup wizard. First run now offers the language choice on the wizard's first step, and switching mid setup keeps anything already entered.

Changed

• A key parity test now guards all five locales in CI, missing translations fall back to English at runtime, and admin only strings no longer ship in the payload of public pages.

Desktop installers

Download the installer for your OS from the assets below, open it, and choose "Run it on this computer" or "Connect to an instance".

v0.13.0

[0.13.0] - 2026-07-10

Editable trackers, honest prices in every currency, and provider keys managed from the admin UI.

Added

• Edit a running tracker in place. Dates, stops, airlines, cabin, and price cap can be changed on an active tracker without deleting and recreating it, and the chart marks when the filters changed so price history stays interpretable. (requested by @garrynutter)
• Provider API keys from the admin UI. Anthropic, OpenAI, and Google keys can be set in the admin config or the setup wizard and are stored encrypted at rest, so a key change no longer requires editing env files and restarting. (reported by @Relaxdaws)
• Desktop app: a Restart action that recreates the stack and a visible path to the config file. (#151)

Fixed

• Prices now format correctly in every currency. One Intl based formatter replaces the manual symbol table and six ad hoc code paths: ISO codes instead of the ambiguous $, correct grouping and decimals in each currency's own locale (a Colombian fare reads COP 228.290, not $228,290), applied across the app, notifications, community pages, and the chart. Thanks @ssantss.
• High denomination fares (COP, JPY, VND) are no longer rejected by a price cap tuned for dollars, across search, ingest, preview, and the scraper. Thanks @ssantss.
• Currency detection now resolves every browser locale through Intl instead of a partial region table, so regional and macro locales map to a real currency. Thanks @ssantss.
• Follow ups to the 0.12.0 extraction report (reported by @Darth-Ness): Docker images ship browsers.json so the scraper can always launch Chromium, OLLAMA_HOST is respected inside Docker instead of being forced to localhost, extraction tolerates misspelled or aliased model output keys, and installs from before the project rename are prompted to migrate instead of silently freezing.

Changed

• Dependency updates across web, desktop (Tauri 2.11.5), and CI actions.

Desktop installers

Download the installer for your OS from the assets below, open it, and choose "Run it on this computer" or "Connect to an instance".

desktop-v0.13.1

[0.13.1] - 2026-07-11

The interface now speaks five languages.

Added

• UI internationalization. The whole interface is available in English, Spanish, Portuguese, German, and French. The language follows a cookie, so no URLs change and English stays the default. Pick your language in Settings under Appearance. Thanks @ssantss.
• Language picker in the setup wizard. First run now offers the language choice on the wizard's first step, and switching mid setup keeps anything already entered.

Changed

• A key parity test now guards all five locales in CI, missing translations fall back to English at runtime, and admin only strings no longer ship in the payload of public pages.

Desktop installers

Download the installer for your OS from the assets below, open it, and choose "Run it on this computer" or "Connect to an instance".

v0.12.0

[0.12.0] - 2026-06-13

Reliable price extraction across every model, a platform refresh (Next.js 16, Prisma 7), and clearer bug reports.

Fixed

• Searches no longer all end in "Flights exist but none matched your filters." The extractor compared each price exactly as the model returned it, so a model that wrote the price as a string with a currency symbol or a thousands separator ("$189", "1,189") had every row thrown out and the whole search collapsed. Prices are now read from any common format (currency symbols, and both US and EU grouping and decimals), the JSON reader copes with reasoning blocks, code fences, wrapper objects, and stray text around the array, and a row is dropped only when it truly has no price or airline. This mostly affected smaller and local models. (reported by @Darth-Ness)
• The Claude Code extraction provider no longer inherits a stray ANTHROPIC_BASE_URL or auth token from the host, which could quietly point it at the wrong endpoint and fail every extraction.

Changed

• Platform upgrade. Next.js 16, Prisma 7 (a lighter, Rust-free database client), TypeScript 6, ESLint 10, Vitest 4.1, Plotly 3, and a Node 26 base image, with dependency updates now grouped per ecosystem and given a cooldown before they land.
• The app uses the real Flight Finder logo for its icons, favicon, and on-page brand mark.

Added

• Structured GitHub issue forms for bug reports and feature requests, so a report carries the version, deployment, provider, model, and logs needed to reproduce it.
• Secret scanning in CI to catch accidentally committed credentials.

v0.11.0

[0.11.0] - 2026-06-10

Install Flight Finder without ever touching a terminal, and run it for a whole household: a native desktop app, passwordless profiles like Netflix, a personal theme per person, and a guided way to reach it from a phone.

Added

• No-terminal desktop app. A native launcher (macOS .dmg, Windows .exe, Linux .AppImage) that, on first run, either runs the stack on this computer (Host mode) or connects to an existing instance (Client mode), each in its own window. Installers build automatically on every published release and are linked from a new /download page.
• Households without passwords. In multi user mode a member can be passwordless: the login screen becomes a "Who's using Flight Finder?" picker where each person taps their face to sign in, Netflix style, and guests can be quick-added with generic names. Each member keeps their own trackers, a flight-themed profile avatar, and preferences.
• Personal theme families. Six colour families (Altitude, Midnight, Cyberpunk, Tron, Autumn, Solar), each with a matching light and dark palette. Pick a family once and the light/dark toggle flips within it; members keep a personal theme while admins set the instance default.
• Reach it from a phone, guided. An interactive guide in Instance settings (same Wi-Fi, Tailscale, Cloudflare quick and named tunnels, or your own domain) walks the OS-specific commands, and /connect shows a QR code carrying the member avatar plus native share buttons. The installer offers a consent-first reachability choice that defaults to no exposure.
• Unified navigation. One avatar menu on every page (your trackers, account & appearance, connect a device, and admin destinations) plus a persistent Flight Finder home logo, replacing the old per-page button toolbars.
• Admin toggle for accepting community registrations. The hub-side control that lets other instances register to contribute their data is now an admin toggle in Settings (default off, opt-in), next to a clearer explainer of why to enable Community Data Sharing. The COMMUNITY_REGISTRATION_OPEN env var still works as an override.
• Flight-themed profile avatars (generated art with an emoji fallback), maskable PWA icons for a proper Android home-screen install, and OS-aware hints for any tool you need to install.

Fixed

• Fresh self-hosted instances now show the setup wizard again: setup-complete keys on whether an admin password has been set, not on the provider column's NOT NULL default.
• The session cookie's Secure flag now follows the actual request protocol instead of NODE_ENV, so Safari can sign in over http://localhost or a LAN IP (a Secure cookie was silently dropped there, bouncing every request back to /login).
• The service worker no longer caches the HTML shell, so a redeploy is picked up on the next load instead of serving a stale page.
• Instance settings now renders dynamically, so a member's personal theme is correct on that page too rather than showing a statically-baked default.
• Notification and VPN channel secrets encrypted before v0.10.0 now decrypt after upgrading, via a backward-compatible key-derivation fallback, so upgrading no longer requires re-entering them. They are re-encrypted under the stronger derivation the next time they are saved.

v0.10.0

[0.10.0] - 2026-06-05

This release adds new-low price alerts with pluggable notification channels, CLI account recovery for multi user mode, and the full results of a security audit and remediation (PR #109).

Security

• Full security audit remediation (PR #109). Fixed a stored XSS on the public share and landing pages (unescaped JSON-LD). Hardened admin and user sessions with server-side token expiry, revocation on password change, and constant-time secret comparisons. Centralized client IP extraction so the login, parse, preview, and community rate limits can no longer be bypassed by spoofing X-Forwarded-For. Closed SSRF holes in notification channels: per-user webhook, ntfy, and SMTP targets are validated, resolved and pinned against DNS rebinding, and redirects are rejected. Locked down the agentic CLI extraction providers (Claude Code, Codex) so a prompt injection in a scraped page cannot run commands or read host files, and now sanitize and fence all scraped HTML as untrusted data for every provider. Bounded previously unbounded endpoints, gated /api/alerts and the analytics write endpoint, added a Content Security Policy and other security headers, and removed stray state and secrets from the git tree and the Docker build context.

Added

• New-low price alerts and notification channels (#106): get notified when a tracked flight reaches a new low. Pluggable channels for Telegram, email, ntfy, and webhooks, managed from a new admin GUI, with configurable absolute and percentage drop thresholds. Also adds a pause/resume scraping toggle, GUI-configurable provider rate limits and preview limits, self-service password change, and a button to disable multi user mode. Reported by @garrynutter.
• CLI account recovery for multi user mode (#102): two recovery commands for a self hosted admin who is locked out. flight-finder reset-password <username> <new-password> sets a known password for any user; flight-finder disable-accounts turns multi user mode off and clears the stored admin credential, dropping the instance back to solo self hosted mode where no login is required. Both run inside the web container against the live database. Reported by @garrynutter.
• Ko-fi support links.

Changed

• Community price-sharing registration is now OFF by default. Set COMMUNITY_REGISTRATION_OPEN=true to allow public key registration.
• Scrape timestamps now render in each viewer's own local timezone.
• Self-hosted instances use the global server theme, and the public tracker page is forced dynamic so theme and prices stay fresh (#89). Reported by @antoniods97.

Fixed

• Analytics history now persists across container recreates instead of resetting.
• The price history table and other timestamp displays no longer trigger a client hydration mismatch.

Upgrade notes

• The database schema gained ExtractionConfig.adminSessionsValidFrom; prisma db push runs on deploy.
• Notification and VPN channel secrets are now encrypted with a stronger key derivation, so existing secrets must be re-entered once after upgrading.
• New env var TRUSTED_FORWARDED_FOR: set it to false if the app is not behind a trusted reverse proxy (the default trusts the proxy, which is correct behind the bundled Caddy).

v0.9.5

[0.9.5] - 2026-06-02

Fixed

• CLI header box alignment and brand (#96): the terminal header drew its own border and padded a line by hand, so the right edge drifted out of column, and it still showed the pre rename FAIRTRAIL brand. It now renders on a self sizing box that stays aligned and reads FLIGHT FINDER. Reported by @backslashV.

Changed

• Remaining CLI brand strings now read flightfinder (#96): the leftover fairtrail references in user facing CLI output (the usage hints, the tmux pane command, the version line) were swept to flightfinder. The deprecated fairtrail command still works as an alias.

v0.9.4

Added

• Price history grouped by flight (#89): the tracker page (/q/[id]) now collapses its history into one row per flight, showing the latest price, change, seats and book link, cheapest first, with each flight's full series one click away. After a week of scraping the table stays readable instead of growing into a flat wall of every snapshot. Reported by @antoniods97.
• Configurable max tracked flights per route (#89): new maxTrackedPerRoute setting in /admin/config (default 10, range 1-50) drives how many flights you can select to track per route, replacing the hardcoded 10. It is still bounded by Max flights per date, since you can only pick from the flights that were extracted.
• Trackers expire once their departure day has passed (#96): a tracker whose travel date is in the past stops scraping automatically instead of running forever. Reported by @backslashV.
• CLI --json output and headless polish (#96): flightfinder --json emits a single tracker or the full list as JSON, and the headless view header now shows airport codes.

Fixed

• App defaults to self-hosted (#89): the per-tracker edit controls hid on any browser without a delete token because the entrypoint never exported SELF_HOSTED, so a stack that omitted the variable ran in hosted mode. A migrated tracker that lost its localStorage token lost its controls. The image now defaults to self-hosted and flight-finder.org is the only deployment that opts into hosted mode; CLI provider install moved to its own INSTALL_CLI_PROVIDERS flag so production behavior is unchanged. Reported by @antoniods97.
• Offline Prisma schema push (#96): the runtime image bundles the Prisma CLI instead of fetching it with npx at startup, so the schema push works without round-tripping the npm registry and a failed push halts startup instead of masking the error behind a misleading "Schema ready".
• CLI booking URL no longer truncated (#96): the best price card was rebuilt so it stops cutting off the booking link, and the CLI package now ships its package.json so Node resolves the module type.