Screenshot-a-Day v0.1.1

Screenshot-a-Day v0.1.1

Screenshot-a-Day v0.1.1 is a focused reliability and security patch for self-hosted v0.1.0 installations. It hardens administrator recovery and keeps sensitive one-time values and form feedback beside the controls that produced them.

Highlights

• Administrator recovery is atomic: the one-time recovery token is consumed with the password update and all administrator sessions are revoked in the same transaction.
• Browser clients whose sessions expire or are revoked return to the explicit Login route with actionable messaging.
• Logout never falls back to the completed setup experience, including during reload and back/forward navigation.
• Capture-profile and webhook-creation forms expose local pending, success, validation, and network states without discarding failed input.
• API tokens and webhook signing secrets provide adjacent copy confirmation plus a full-value selection fallback when clipboard access is unavailable.
• Publication destination dialogs protect unsaved changes from accidental backdrop, Escape, and cancel dismissal.
• Capture cards show sharp top-of-page previews instead of stretched full-page thumbnails. Existing preview artifacts rebuild automatically from retained originals after upgrade; full screenshots remain unchanged.
• The project website self-hosts its fonts.

Upgrade from v0.1.0

No database migration is included in this release, but data migrations are forward-only in general. Take a consistent backup before upgrading:

docker compose stop worker api
docker compose cp api:/data ./screenshot-a-day-backup-v0.1.0
docker compose start api worker

Update the checkout to the annotated v0.1.1 tag, retain the existing .env and sad-data volume, then pull and recreate the services:

git fetch --tags origin
git checkout v0.1.1
docker compose pull
docker compose up -d
docker compose ps
curl -fsS http://localhost:4400/version
docker compose logs --tail=100 api worker

Do not use docker compose down -v; removing the volume deletes the default SQLite database and captured artifacts.

After startup, the API repairs existing preview artifacts in the background and marks attached static galleries for republishing. This may briefly increase CPU and disk activity on installations with long capture histories. Full-resolution originals are read but never modified.

Images

The release is distributed through GitHub Container Registry:

ghcr.io/arts-link/screenshot-a-day-api:0.1.1
ghcr.io/arts-link/screenshot-a-day-worker:0.1.1

The release workflow publishes linux/amd64 and linux/arm64 images, SBOMs, provenance attestations, and immutable image digests in the GitHub Release body.

Security

Password recovery now invalidates all existing administrator sessions. This is intentional: after a successful recovery, sign in again with the new password on every browser or API client.

Do not report vulnerabilities in a public issue. Use the repository's private vulnerability reporting flow described in the security policy.

See the changelog for the complete release contents.

Immutable image digests

• ghcr.io/arts-link/screenshot-a-day-api@sha256:776784b0e0369bd3e112151a9309036658bcae492e4968ea6507128c81a94aad
• ghcr.io/arts-link/screenshot-a-day-worker@sha256:5dcf8c6455fc7edce7949a0c60a8f9ea43b6f8db69838bef45f6520b650df3d7

Screenshot-a-Day v0.1.0

Screenshot-a-Day v0.1.0

Screenshot-a-Day is a self-hosted visual history for websites. This initial release schedules reproducible Chromium, Firefox, and WebKit captures, compares changes, publishes galleries and GIF/WebM timelines, and sends signed webhooks.

Highlights

• Self-hosted API, browser worker, administrator UI, and public galleries.
• Encrypted target headers and cookies, private-network protection, and explicit sharing modes.
• Cross-browser capture profiles, schedules, retention, side-by-side and split comparisons, overlays, and heatmaps.
• Focused Compare and Configuration workspaces with profile-first, 12-frame pagination across administrator, built-in public, and portable static galleries.
• Docker Compose deployment with a single persistent data volume.
• Complete interactive REST API documentation and signed webhooks with pause, rotation, test-delivery, status, and deletion controls.
• Bounded and rate-limited pixel comparisons, security response headers, and exact status-aware capture pagination.
• In-place schedule save feedback, explicit enabled/disabled state and next-run timing, plus actionable administrator-only capture failure reasons.
• A guarded release restore rehearsal with isolated volumes and timestamped integrity, retained-image digest, and fresh cross-browser evidence.
• Experimental remote MCP access for scoped project discovery, capture-history inspection, and capture triggering through the existing API process.

Install

The release is distributed only through GitHub Container Registry:

ghcr.io/arts-link/screenshot-a-day-api:0.1.0
ghcr.io/arts-link/screenshot-a-day-worker:0.1.0

Clone the v0.1.0 source, generate the three secrets described in .env.example, and start the pinned images:

git clone --branch v0.1.0 https://github.com/arts-link/screenshot-a-day.git
cd screenshot-a-day
cp .env.example .env
# Set SAD_ENCRYPTION_KEY, SAD_SESSION_SECRET, and SAD_WORKER_TOKEN.
docker compose pull
docker compose up -d
docker compose logs api

Continue at /setup with the one-time token from the API log. Read the deployment guide before exposing the service publicly.

Supply-chain verification

The release workflow publishes linux/amd64 and linux/arm64 images. GitHub provenance attestations and SBOM attestations are attached to each immutable image digest. The generated GitHub Release body records those digests.

With the GitHub CLI, verify an image against this repository:

gh attestation verify oci://ghcr.io/arts-link/screenshot-a-day-api:0.1.0 --repo arts-link/screenshot-a-day
gh attestation verify oci://ghcr.io/arts-link/screenshot-a-day-worker:0.1.0 --repo arts-link/screenshot-a-day

Supported platforms and limitations

The supplied images support Docker-compatible linux/amd64 and linux/arm64 hosts. Docker Desktop can run them on supported macOS and Windows hosts through its Linux VM.

This is a pre-1.0 release. Database migrations are forward-only, horizontal API scaling is not supported with the default SQLite storage, and operators are responsible for storage, TLS, backups, monitoring, retention, and target authorization. Pixel comparisons are profile-specific and limited to 16 million decoded pixels. The /mcp endpoint is experimental and uses manually configured API bearer tokens rather than OAuth discovery. Screenshot-a-Day includes no product telemetry. Captures are not signed, certified, or tamper-proof; only outbound webhooks are cryptographically signed.

Security

Do not report vulnerabilities in a public issue. Use the repository's private vulnerability reporting flow described in the security policy.

See the changelog for the complete release contents.

Immutable image digests

• ghcr.io/arts-link/screenshot-a-day-api@sha256:c984ea31b70ee37026783ed2d0d9ad957e76428a2c4d61e5902ec80b755c45a3
• ghcr.io/arts-link/screenshot-a-day-worker@sha256:5dd56d20d79d2c57e495776755cbe300944754b0e72e146d550b14961a224340