v1.2.0

torq on Your Phone

torq can now be installed like an app, straight from the browser: no app store, no download. The native iOS app is on hold for now (why); this is the way to use torq on your phone.

New

• Install as an app: in Safari tap Share → Add to Home Screen, in Chrome ⋮ → Install app, or use the install icon in desktop Chrome/Edge. torq opens in its own window with its own icon.
• Instant start: torq keeps its own files on the device and starts without waiting for the network. None of your data is stored on the phone; everything still comes from your server.
• Offline screen: when your server can't be reached, torq says so clearly and offers Try again, instead of a browser error.
• Automatic updates: after you upgrade the server, open apps switch to the new version on the next page change. If you're in the middle of typing, a Reload now hint appears instead, so nothing is lost.
• Install hint: phones and tablets see a short, dismissible hint on the dashboard; the steps are always under Settings → About.
• Back links on service entries and repair projects, since installed apps have no browser back button. Downloads and exports no longer replace the app view.

Good to know

• Installing and the offline start need torq to be reached over HTTPS. Over plain HTTP on your home network, torq works as before.
• On iPhone and iPad, the home-screen app has its own sign-in: sign in once more after adding it.
• Details are in docs/install-on-phone.md.

Upgrading

Nothing to do. If you run torq behind a reverse proxy, make sure it doesn't cache /sw.js or /manifest.webmanifest longer than torq says (torq sends Cache-Control: no-cache for both).

v1.1.0

Ready for the Mobile App

This release prepares torq for the upcoming iOS app. The web app is unchanged except for the new Devices page.

New

• Devices: Settings → Devices lists every browser and app your account is signed in with, including when it was last active and from which IP address. You can sign out a single device, for example a lost phone, or all others at once.
• Token sign-in for apps: apps and scripts can sign in with "token": true and send Authorization: Bearer <token> instead of a cookie. Tokens expire after 30 days without use, like browser sessions.
• Server check: GET /api/v1/instance tells a client which server it is talking to before signing in, including the API level for feature detection.

API

• The API now has a machine-readable contract, openapi.yaml (OpenAPI 3.1), attached to this and every future release. Tests check it against the server on every change.
• Within /api/v1, changes are additive only from now on. The rules and the sign-in details are in docs/api.md.

Upgrading

Nothing to do: a database migration runs automatically on start. If you run torq behind a reverse proxy, please don't add CORS headers (see docs/api.md).

v1.0.2

Security Hardening

This release adds no new features. It fixes the findings of a security audit and moves the project to the app-torq organization.

Security

• Login throttling: failed logins for a username are now throttled per client IP, so nobody can lock another user out from everywhere. A global per-username limit still applies after 50 failures. A successful login no longer resets the failure count of its IP.
• Password hashing: concurrent argon2id runs are capped at the CPU count, so a burst of login requests can no longer exhaust memory. Usernames over 32 bytes and passwords over 1024 bytes are rejected before hashing.
• CSV export: text cells that a spreadsheet would run as a formula (starting with =, +, -, @) are now prefixed with '.

Other changes

• The repository moved to app-torq/torq. The container image is now ghcr.io/app-torq/torq; please update your docker-compose.yml.
• CI actions are pinned to commit SHAs, and Dependabot keeps dependencies up to date.

v1.0.1

Added Demo

This release did not add new features, but I added a demo at https://demo.torq-app.tech.

🚀 Initial Release

Initial Release

For a detailed description of torq features, please consult the Wiki. You can also find installation instructions there for various deployment methods.