v1.2.0

1.2.0 (2026-09-30)

Features

• download a page as a PDF, and present it full screen (#182) (62b768b)

v1.1.0

1.1.0 (2026-09-29)

Features

• add people who already have an account to an organization directly (#180) (cc99589)
• join an organization automatically by email domain (#179) (cebe3de), closes #177

v1.0.0

1.0.0 (2026-09-29)

⚠ BREAKING CHANGES

• api: Email is sent only after the mail server agrees to STARTTLS (or over implicit TLS with SMTP_SECURE=true). If your mail server is a relay without TLS on a network you trust, set SMTP_REQUIRE_TLS=false in app.env (smtp.requireTls: false in Helm values) before upgrading, or sign-in links and invitations stop being sent.
• deploy: The bundled MinIO in deploy/kubernetes runs as user 1000. On storage that doesn't apply fsGroup (k3s local-path, hostPath), hand its volume to user 1000 once before applying the new release, with the pod in "Upgrading to 1.0.0" in docs/upgrading.md; otherwise MinIO stops with "Unable to write to the backend".
• deploy: Docker Compose publishes the app on 127.0.0.1 only. If people or a reverse proxy on another machine reach port 8080 directly, set ARTIFACT_BIND=0.0.0.0 (or the server's address on that network) in deploy/docker-compose/.env before starting the new release, and leave TRUST_PROXY unset unless only the proxy can reach that address.
• api: an agent or access token connected to one workspace can no longer edit, share or delete pages in another workspace through the person's ownership or organization role. Make an access token for the organization (or connect the agent to it) for CI jobs that update its pages.
• api: A SAML provider, or an OIDC provider with "Trust addresses", that lists no email domains no longer links people's existing accounts on their first single sign-on, and nobody's first single sign-on links an instance admin's account. If people with an account should sign in through such a provider, list its email domains under Server admin > Single sign-on before you upgrade.

Features

• api: encrypt the keys in server_secrets with an optional ENCRYPTION_KEY (3b1306e)
• api: record deletions, retention, exports and agents, and log admin actions (bb701e0)
• cli: filter list by tag with --tag (63200d5)
• deploy: take ENCRYPTION_KEY in the env examples and the Helm chart (1ae0c67)

Bug fixes

• api: allow plain-http webhooks to this machine only on a development server (f81b6e0)
• api: cap the console errors and broken links inspect_artifact collects (34b483e)
• api: check email addresses in linear time, and only up to 254 characters (b7ea315)
• api: check the last owner and admin under locks when deleting accounts (6390e6c)
• api: clamp SCIM paging numbers instead of failing on huge ones (efef890)
• api: clear an unverified account when its address is proven, and stop telling accounts apart (314b17b)
• api: count page ownership and tokens only in their own workspace (d6b3cfa)
• api: count shares only for checked addresses or the share's own link (441d0bc)
• api: count upload links toward a limit of their own (672d96e)
• api: don't let single sign-on take over admins or unchecked addresses (9c82ca6)
• api: give each scheduled run one deadline, under Vercel's function limit (d5b40e8)
• api: give up on Google, SMTP and storage requests that stop answering (a8bbe73)
• api: keep single sign-on requests off loopback and link-local addresses (bc9854a)
• api: keep the setup code readable once server secrets are encrypted (ed3cffe)
• api: leave out tags and comment counts of listed pages a member can't open (53fbbc2)
• api: name the workspace field when duplicating or moving asks to choose one (cc49b91)
• api: need a recent sign-in for access tokens, and let a password change sign out agents (8f6e594)
• api: refuse request bodies over 1 MB outside publishing (251e753)
• api: require STARTTLS before sending email (bc77158)
• api: say the 100-file limit counts files besides index.html (0c1df00)
• api: send HSTS over https and lock down the app shell's CSP (a731926)
• api: start before the database is ready, and stop only for keys that can't be opened (c1186bd)
• cli: publish only files inside the folder, and say which page a link file names (f45a71c)
• deploy: harden the Kubernetes manifests like the Helm chart (fc8b975)
• deploy: pass S3_PUBLIC_ENDPOINT in Compose and EMBED_FRAME_ANCESTORS in Helm (b5a5ed6)
• deploy: publish the Compose app on 127.0.0.1 unless ARTIFACT_BIND says otherwise (48bec67)
• require a one-time setup code for the first account on a self-hosted server (4eccd7d)
• web: ask to keep the settings page open during an export only where the build needs it (cb02625)
• web: list share links to send, accept them in the viewer, and re-auth for tokens (fff1904)
• web: make docs heading anchors the same as GitHub's (692ab17)
• web: move focus into delete confirmations and back when they are cancelled (3560b0e)
• web: say page, not artifact, in the not-found page and on the landing page (1a5755d)

Upgrading

• Single sign-on no longer links some existing accounts. The first sign-in through a provider never takes over an instance admin's account, and a provider that lists no email domains links an existing account only when it marked the address as verified itself or created the account over SCIM. People with an account who haven't signed in through such a provider yet (a SAML provider, or an OIDC one with Trust addresses) now see a message to sign in the way they did before. If they should use single sign-on, list the provider's email domains under Server admin → Single sign-on; accounts already linked keep working. See Linking existing accounts.
• Keep the server log if you need a record of what admins do. Admin actions, deleted accounts and organizations, and changes to people's sign-in are written to it as JSON lines with an event field; there is no instance-level audit log in the app. See The security log.
• Requests are limited to 1 MB, except publishing (POST /api/publish and MCP, which keep their limits) and the single sign-on settings (3 MB). Larger requests are refused with 413. See Limits.
• Single sign-on no longer follows redirects or reaches loopback and link-local addresses. If a SAML provider's metadata URL redirects, enter the address it redirects to. An identity provider on the same machine as the server (`...

cli: v0.6.0

0.6.0 (2026-09-29)

Features

• cli: filter list by tag with --tag (63200d5)

Bug fixes

• cli: publish only files inside the folder, and say which page a link file names (f45a71c)

v0.6.1

0.6.1 (2026-09-28)

Bug fixes

• ops: start Hosted migrate over REST, which the fine-grained token allows (ceb7fe1)

v0.6.0

0.6.0 (2026-09-28)

Features

• api: compare two versions of a page and diff_versions for agents (ce0104b)
• api: inspect_artifact lets agents check a page before sharing it (9e3b1a3)
• api: inspect_artifact lets agents check a page before sharing it (ec534c7), closes #137
• api: update some files of a page without republishing all of it (150a9c4)
• cli: publish --only and --remove to update some files of a page (eeb61ca)
• cli: publish --watch publishes a new version whenever files change (4ee03a4)
• compare two versions of a page (cde769d)
• duplicate a page, or move it to another workspace (8fb4f34)
• duplicate a page, or move it to another workspace (7e764df), closes #140
• export all data of an account or organization (f8f3973)
• export all data of an account or organization (c98972b), closes #144
• pin comments to an element of the page (aee5f6b)
• pin comments to an element of the page (3d697e0), closes #142
• publish --watch with live updates in the viewer (a40d1be)
• tags on pages, and search inside page content (99cf7cc), closes #145
• update one file of a page without republishing all of it (8939c76)
• web: compare two versions from the history, side by side or as changes (51aa9d5)
• webhooks with Slack and Discord formats (cca476f)
• webhooks, tags and search inside pages (includes #155) (5e16c7c)
• web: show new versions of an open page without a reload (97dc00f)

Bug fixes

• api: keep the server running when a webhook round fails (69f8a18)
• api: say only "No page you can edit" when an update targets such a page (e4e3d67)
• web: keep the compare controls in the main landmark and name the version pickers by their labels only (2bb7255)

Upgrading

• The database gains tables for data exports, webhooks and their deliveries, and a column for comments pinned to an element. They are added on the first start, and 0.5.0 still runs on the new schema.

• Data exports are built in your bucket under exports/, and the storage sweep deletes them after their link expires. Nothing to configure; with S3_PUBLIC_ENDPOINT set, downloads go straight from the bucket.

• The server may make outbound HTTPS requests to the webhook addresses your workspace admins add, from the first worker. If your firewall limits outbound traffic, allow the destinations you want (such as hooks.slack.com or discord.com). Requests to private and reserved addresses are always refused; see Webhooks can't reach private networks.

• On hosts without a long-running server (Vercel), webhook retries run with GET /api/cron/sweep, or more often with the new GET /api/cron/webhooks; schedule it every few minutes if your host allows. See CRON_SECRET in the configuration reference.

• Search looks inside pages, and pages have tags. The database gains a table for tags and one for the words of each page's current version, with a full-text index. They are added on the first start and nothing existing changes, so 0.5.0 still runs on the new schema. Take a backup first; see Before you upgrade.

• Index the pages you already have. New versions are indexed as they are published. Pages from before the upgrade are indexed by the storage sweep a few hundred at a time (every few hours, or on each /api/cron/sweep); to have search find all of them right away, run once after the upgrade:

  • Docker Compose: docker compose exec app node dist/scripts/backfill-search.js
  • Kubernetes: kubectl -n the-artifact exec deploy/the-artifact -c app -- node dist/scripts/backfill-search.js
  • From a checkout: pnpm --filter @the-artifact/api search:backfill

  It reads each page's HTML from object storage, so it takes a while on a large server; the app keeps serving meanwhile, and running it again picks up where it stopped. See Search.

The same notes are in the docs: Upgrading to 0.6.0.

v0.5.0

0.5.0 (2026-09-28)

Bug fixes

• accept only same-origin paths after sign-in (0bc2804)
• api: accept only plain email addresses and send mail to one mailbox (beeb1a5)
• api: answer 404 for malformed page ids and version numbers (5c87998)
• api: check membership and two-factor sign-in on every agent request, revoke a refresh token family on reuse (a2ad6d2)
• api: check the request's origin on state-changing requests (ae7de7e)
• api: count wrong passwords and codes before checking them (d708015)
• api: don't reveal whether content is already stored for someone else (a6166d7)
• api: join by invitation link only for addresses nobody checked (6945491)
• api: limit a SCIM token to its organization (863669c)
• api: log unexpected errors in the JSON format without query parameters (9cf0adb)
• api: misc hardening: upload shortcuts, invitations without email, error logs, control characters (62ad024)
• api: refuse control characters in titles and names (46b3850)
• api: scope SCIM tokens and recheck agent tokens and content links (b56976b)
• api: tighten agent redirect addresses and keep emails out of a log line (c70dc02)
• api: treat IPv4-compatible and reserved IPv6 ranges as not public for screenshots (9d095fc)
• ask for a fresh sign-in before adding a first password (837e443)
• deploy: wait for the real Postgres server, not the one that initialises it (de355c3)
• deploy: wait for the real Postgres server, not the one that initialises it (9ddccc6)
• harden sign-in redirects, request origins and attempt limits (6245056)
• response hardening (malformed ids, nosniff, self-hosted fonts, email addresses, robots.txt) (7f81f1b)
• send nosniff on every response and serve robots.txt (b0a3b04)
• web: self-host the web fonts (8dd4b46)

Performance

• api: batch view counts in memory and write them every 5 seconds (766cc3c)
• api: batch view counts in memory and write them every 5 seconds (3d78cea), closes #122
• api: check, decode and hash large inline publishes on worker threads (2b434ce), closes #121
• api: give S3 the blob's hash instead of hashing it again (331a616), closes #121
• api: keep large inline publishes off the main thread (64b95e6)
• api: parse MCP request bodies once (459ab96), closes #121
• api: render THUMBNAIL_CONCURRENCY thumbnails at a time (44968a8)
• api: render THUMBNAIL_CONCURRENCY thumbnails at a time (616ec6a), closes #120
• api: run one worker process per CPU with node:cluster (cd4e671)
• api: run one worker process per CPU with node:cluster (93014d5), closes #118
• api: serve page files with one query when warm (ebda495)
• api: serve page files with one query when warm (a91200b), closes #119

Documentation

• complete the upgrade notes for 0.5.0 (e76e6a3)

Upgrading

• A SCIM token for an organization reaches only that organization's members. It no longer lists or changes other accounts, and it suspends or changes the email address only of members who are in no other organization and aren't instance admins; deactivating anyone else removes them from the organization. If your IdP uses a token for an organization to manage people who aren't in it, invite them to the organization, or make a token for every account under Server admin → Provisioning (SCIM). See What a token for an organization reaches.
• Organizations that require two-factor sign-in now also refuse agents and access tokens of members who haven't set up a second factor. Before you upgrade, check the Members list of such organizations for people whose CI publishes there without 2FA on. See Requiring two-factor sign-in.
• The Docker image starts one worker process per CPU, up to 8, instead of one process, so a server with several cores serves more. Each worker takes about 250 MB of memory. With Docker Compose on a server with little memory, or one that runs other things, set WEB_CONCURRENCY in app.env (1 keeps a single process). The Kubernetes manifests and the Helm chart keep one process unless you give the pod a CPU limit or set it; see Using more cores. Each worker has its own database pool; with the defaults the server opens about 20 connections at most, 10 with one worker (DATABASE_POOL_MAX). See More than one worker.
• Changes from a browser session must come from the app itself. Requests that change something and are signed in with the session cookie are refused with 403 unless the browser says they come from this server's address (Origin or Sec-Fetch-Site). The web app, agents, the CLI and anything using an access token or Authorization: Bearer are unaffected. A script of your own that posts to /api with a copied session cookie has to send Origin: <APP_URL>, or use an access token instead.
• Adding a first password or a second factor asks you to sign in again if you signed in a while ago, the same as changing a password already did.
• New email addresses are checked more strictly (no quotes, angle brackets, spaces or similar). Existing accounts keep signing in with the address they have.
• Two thumbnails render at a time by default (THUMBNAIL_CONCURRENCY), so a server with thumbnails on uses a little more memory while rendering. Set it to 1 for the old behaviour.
• The app loads its fonts from your server, no longer from Google, and a self-hosted install answers /robots.txt with Disallow: / for everything except link previews.
• The database gains two columns, for refresh token reuse detection and for accounts whose address was never confirmed by email. They are added on the first start, and 0.4.0 still runs on the new schema.

The same notes are in the docs: [Upgrading to 0.5.0](https:...

v0.4.1

0.4.1 (2026-09-28)

Bug fixes

• web: keep long values and headers inside the screen on phones (8d20b3b)

v0.4.0

0.4.0 (2026-09-28)

Features

• cli: use the hosted service when no server is given (5b416b5)
• sample pages, linked from the README and the landing page (3f5a9f1)
• sample pages, linked from the README and the landing page (795213c)

Bug fixes

• send addresses that end in a slash to the API on Vercel (a33444e)
• send addresses that end in a slash to the API on Vercel (46c5011)
• web: docs' Pricing link lands on pricing; feat(cli): hosted service by default (031a876)
• web: the docs' Pricing link lands on the pricing section (8594da2)
• web: tidy the share dialog's link options and add a Never choice for link expiry (62d73fd)
• web: tidy the share dialog's link options and add a Never choice for link expiry (90eac44)

v0.3.0

0.3.0 (2026-09-28)

Features

• api: count page views and record who opened a page (47f007f)
• api: SAML connections for single sign-on, and SCIM provisioning (b92e228)
• api: trust the hosted service's first license signing key (3f7781f)
• api: trust the hosted service's first license signing key (d416d15)
• api: verify license keys offline and gate enterprise features on them (c91cea0)
• ee: audit log for organizations (061bbff)
• ee: audit log for organizations (1374f07)
• ee: record the hosted service's sign-up funnel and show it in Server admin (d509a8d), closes #50
• ee: sign-up funnel for the hosted service (fcd8d55)
• ee: stop offering new organizations on the hosted service until billing (8b36c28)
• ee: stop offering new organizations on the hosted service until billing (0762ba9)
• ee: terms of service, privacy policy, sub-processors and a DPA (e48887c)
• ee: terms of service, privacy policy, sub-processors and a DPA (d95cfa9)
• ee: Vercel analytics on the hosted service only, without secrets in addresses (b56db21)
• license keys for self-hosted installs (1a3e60d)
• link sharing that expires, needs a password, or is reset with a new key (8d73823)
• link sharing that expires, needs a password, or is reset with a new key (819e3d9)
• SAML single sign-on and SCIM provisioning (Enterprise) (36634cb)
• serve pages from a separate content domain with CONTENT_ORIGIN (d769db1)
• serve pages from a separate content domain with CONTENT_ORIGIN (06811c8), closes #40
• single sign-on with OpenID Connect (Enterprise) (35ddeab)
• single sign-on with OpenID Connect for licensed self-hosted installs (b276e1c)
• tell self-hosted admins about new releases (a2b2fb9)
• tell self-hosted admins about new releases (27cbb85), closes #39
• version retention per organization (Enterprise) (d741f7b)
• version retention per organization as an enterprise feature (d786fc4)
• view counts and who opened a page (fc092a1)
• web: enter a license key in Server admin, and issue keys on the hosted service (e4f8a19)
• web: SAML providers in Single sign-on, and SCIM tokens in Server admin (94aa347)
• web: show a page's views and who opened it in the viewer (a7d6232)

Bug fixes

• api: sign upload links without a checksum of the empty body (80364ff)
• api: sign upload links without a checksum of the empty body (9f1a9bd)
• refuse vbscript: OAuth redirects and strip nested tags from heading ids (3042bca)
• refuse vbscript: OAuth redirects and strip nested tags from heading ids (c668667)
• web: give the views count its own class and label versions on their own (9811041)
• web: keep the SSO test result through a remounted effect, and open e2e pages in their own context (a85d0e2)

Upgrading

• Take a backup first. The database gains tables and columns for license keys, the release check, page views, link sharing options, version retention, the audit log, single sign-on and SCIM. They are added on the first start and nothing existing changes, so 0.2.0 still runs on the new schema if you have to roll back. See Before you upgrade.
• The admin area tells you about new releases. Once a day, when an admin opens Server admin, the server asks GitHub's public releases API for the newest release; nothing about your server is sent. On a server without internet access, or if you don't want the request, set RELEASE_CHECK=false in app.env (releaseCheck: false in Helm values). See New releases.
• Consider a separate domain for pages on a server reachable from the internet. With CONTENT_ORIGIN set, pages load from a second address, so a page that escaped its sandbox still couldn't reach your sign-in cookies. It needs a second DNS name and certificate pointing at the same server, and your proxy must pass the original Host. Nothing changes if you leave it empty. See A separate domain for pages.
• Enterprise features need a license key. Single sign-on (OpenID Connect and SAML), SCIM provisioning, the audit log and version retention are off until an instance admin enters a key under Server admin → License. Everything that 0.2.0 did stays free and needs no key. The key is checked on your server; nothing is sent anywhere. See Licenses. The terms for the code in ee/ changed with this: read LICENSE-EE if you modify or redistribute it.
• New optional settings: AUDIT_LOG_RETENTION_DAYS (default 365). LICENSE_SIGNING_KEY is for the hosted service only; leave it unset. See Configuration.
• Page entry files are revalidated on every open. To count views, a page's main HTML file is now sent with Cache-Control: private, no-cache instead of an hour of caching. Unchanged pages answer with a short 304, and the page's other files keep their cache, but a busy server sees more requests for entry files.

The same notes are in the docs: Upgrading to 0.3.0.