0.10.0

0.10.0 (2026-08-14)

Bug Fixes

• data: stop reporting a signed-out boot as a failed load (c663610)
• search: resolve reread requests against the source index (086bcc5)
• server: treat a session whose user is gone as signed out (f1658a6)
• settings: run the transparency slider from glass to tint (ce51f10)
• sidebar: show the persona strip only once the grid is out of view (a456d66)
• sidebar: stop clipping the active ring in the condensed persona strip (9cdef0a)

Features

• settings: add a switch for the sidebar's translucent bars (5995fd5)
• settings: pair the transparency switch with an amount around a midpoint (921711d)
• sidebar: condense early and let the grid fold once it is off screen (f9ac2ff)
• sidebar: condense the header once the list scrolls (5e2866f)
• sidebar: float the bars over the list they sit on (c2d8280)
• sidebar: fold the persona grid away when the strip takes over (a6e8ebe)
• sidebar: smooth the condensed header and mark persona conversations (c087c7a)
• ui: make surface transparency a level rather than a switch (59005a6)
• ui: narrow the transparency range and float the conversation header (f35d531)

Reverts

• sidebar: drop the grid fold and keep the simple condensed header (09a0bc3)
• sidebar: go back to the strip following the header (25e3058)
• ui: leave the modal opaque over its blurred overlay (4501315)

0.9.0

0.9.0 (2026-08-06)

Bug Fixes

• connections: ask Infomaniak for a product ID instead of a whole URL (73ea847)
• make the knowledge save button save, and unblock the Docker build (36fd9a1)
• mobile context menu, keyboard and theme colour (f34a038)
• search: aim queries at the sources that hold the answer (bac029f)
• search: don't lose the router decision to the model's reasoning (5b5d242)
• search: scope the no-search notice to the current message (1349eeb)

Features

• chat: carry tool definitions and tool calls through the strategies (7829476)
• chat: detect native tool-calling support and make it selectable (4e1201e)
• search: drive web search and page reads with native tool calls (950e98e)
• search: keep an index of what was found, and let the model reread it (77eb950)

0.8.0

0.8.0 (2026-08-05)

Bug Fixes

• open the collection picker instead of swallowing its click (c62680f)

Features

• add a code view to the knowledge editor and make its title look editable (62751ee)
• draw compaction in the conversation and tidy hover states (2ac3f65)
• edit knowledge in a dialog and copy a conversation from the sidebar (1dd7711)
• group knowledge into collections (d2c9352)
• lay collections out as foldable sections instead of a folder to enter (a610de7)
• one add-context menu with a searchable knowledge picker (2e8c974)
• pick or create a collection without leaving the editor (7bced1e)
• read attached documents in the browser (6bb9598)
• right-click a sidebar row for pin, knowledge and delete (1142fd6)
• show what a compaction freed and quiet down the summary (f9245f2)

0.7.0

0.7.0 (2026-08-04)

Bug Fixes

• align the version row and move the release link onto the badge (7498f5b)
• generate the SvelteKit tsconfig on install so dev and the docs build work on a clean checkout (876636e)
• keep the update status row stable while a check runs (4781a9b)
• show the documentation logo on dark backgrounds (35729fd)
• update auth and kit to patch a critical advisory (360c508)

Features

• compact long conversations to keep them within the context window (cc8637b)
• link the documentation and the maintainer from the about panel (8e994df)
• report when updates were last checked and what the check found (0ee1028)

0.6.0

0.6.0 (2026-08-03)

🦙 Hollama Next is now Llooma /ˈluː.mə/

Same app, same llama, its own name. The fork has diverged far enough from Hollama that sharing its name was becoming confusing, for the upstream project as much as for this one.

What changes for you

• The repository is now cedhuf/llooma. GitHub redirects the old URLs, and your existing git remote keeps working.
• The container image moved to ghcr.io/cedhuf/llooma. The old path is no longer published. A registry does not redirect the way a repository does, so an instance still pulling ghcr.io/cedhuf/hollama will simply stop seeing updates quietly, with no error.

Repoint it:

image: ghcr.io/cedhuf/llooma:latest

What you don't have to do, your data migrates itself

• The SQLite database is renamed from hollama.db to llooma.db on first start, -wal and -shm included. Look for Migrated hollama.db to llooma.db in the container logs; it runs once.
• Browser storage keys are carried over on first load.
• Backup files exported before the rename restore exactly as they did before, and always will, an exported file has no way of knowing the app changed its name.

Back up your data directory before updating anyway. The migration is tested, but your database is not the one it was tested on.

Bug Fixes

• jump to the searched message on client-side navigation too (13e684e)
• keep the full-search button in reach whatever the list length (1d81511)

Features

• list the available keyboard shortcuts in settings (40bc84c)
• rename storage keys to Llooma and migrate existing data (8a6b00e)
• rename the app to Llooma (bb5bdbe)

0.5.0

0.5.0 (2026-08-03)

⚠️ Security fix - update recommended for PUBLIC_MODE=server instances

This release closes an unauthenticated Server-Side Request Forgery (SSRF) / open proxy in server mode.

What was wrong. The generic provider proxy /api/proxy/… had no mode check and no session check, and the auth guard deliberately exempts every /api path. In server mode it was therefore reachable by anyone who could reach the instance. With the default (empty) PROXY_ALLOWED_ORIGINS, it forwarded to any HTTP(S) target it was given, following redirects, with an Authorization header supplied by the caller.

Impact. An unauthenticated attacker could use the instance as a network client: probing hosts reachable from your server, including private addresses and the cloud metadata endpoint (169.254.169.254). Unlike the web-fetch tool, this route had no private-address protection.

What was not affected.

• Your stored provider API keys. They are encrypted at rest and never travelled through this route; the Authorization header was the attacker's own.
• Conversations and other user data, this route reads no application data.
• Local mode (PUBLIC_MODE=local), which is unchanged: the proxy exists there so the browser can reach Ollama on localhost and providers without permissive CORS.

The fix. /api/proxy/… now returns 404 in server mode. There is no functional change: the browser already talks to /api/llm/<serverId>, the authenticated proxy that verifies your session, checks you may use that server, and injects the decrypted key server-side.

If you cannot update right now, set an allow-list, it closes the open-relay behaviour on any version:

PROXY_ALLOWED_ORIGINS="https://api.openai.com,http://localhost:11434"

---

🗃️ Two data-loss fixes, equally worth updating for

• A failed read was indistinguishable from an empty account. When the app came back to the foreground it re-read your conversations; if that read failed, a server restarting underneath it, a network blip, the empty result was treated as real data, and the next save replaced every stored conversation with the single one still open on screen. Reads now fail loudly, saving pauses, and a toast says so.
• Every save rewrote the whole collection. Saving one conversation deleted and reinserted all of them, so a second client holding a slightly older list silently erased what the first had added, the ordinary PWA-plus-browser situation. Conversations are now written one at a time.

✨ Also in this release

• Full-text search across every conversation (⌘K / Ctrl+K), with per-message excerpts and jump-to-passage. Server mode uses a SQLite FTS5 index; local mode scans in memory.
• Conversations load on demand instead of all at boot, the sidebar now carries titles and dates, not entire histories.

Upgrading

podman pull ghcr.io/cedhuf/hollama:0.5.0

Back up your SQLite file first. This release adds migration 6, which creates the full-text index and fills it from your existing conversations. It runs once, is not reversible to the previous schema version, and makes the first start after the update noticeably longer in proportion to your history.

0.4.0

0.4.0 (2026-07-30)

Bug Fixes

• define the composer tool menu once instead of in each composer (32c8da7)
• offer the page-reading tool on the home composer too (be41d32)
• search when the model does not know, and admit when it has not searched (ea195b3)
• stop auto-follow fighting the reader and set the reasoning apart (7b7b111)

Features

• close the timeline with a Done step and let it follow along while the model works (fbe8419)
• enforce shared models and locked prompts in the LLM proxy (6a1a6b6)
• keep the whole reasoning trace when the model reads a page (ab56346)
• show what a turn did as one timeline instead of widgets that flicker (e6075f9)

0.3.0

0.3.0 (2026-07-29)

Bug Fixes

• stop dialogs scrolling themselves when a revealed control takes focus (c480590)
• tell the model when the pages it asked for could not be read (a6d45d3)

Features

• announce a new release with a dismissible toast (7e23e9e)
• let the model open a search result instead of answering from snippets (df63098)
• read the pages a message links to instead of searching around them (284a7b3)

0.2.0

0.2.0 (2026-07-29)

First tagged release

The app doesn't change in this release, it's the point where the fork stops being a moving target and starts having version numbers.

Since the fork, some few of the mdifications

Providers - Claude and Infomaniak added alongside Ollama and any OpenAI-compatible server, picked from a card grid instead of a dropdown. Each connection gets its own colour and label, shown wherever its models appear, and its own display names so mistral/Mistral_Small-24B-Instruct can read as something human.

Chat - AI-generated conversation titles, web search per message, interactive choices when a request is ambiguous, system prompts at three levels, and a message layout rebuilt from scratch: the assistant answers as plain prose, you speak in a bubble, actions sit under the message they act on.

Personas - reusable characters with an avatar, a system prompt, a model, a greeting and their own knowledge. Importable from OpenWebUI exports, pinnable to the sidebar, shareable across a team in server mode.

Server mode - multi-user with email/password and OIDC sign-in, per-user storage in SQLite, and provider API keys that never leave the server.

Interface - six themes with light and dark ramps, settings rebuilt on shared components, dialogs full screen on phones, English and French with automatic fallback, and a new logo. Also a major ui rework since the fork, and a working pwa.

Under the hood - Svelte 4 → 5, Tailwind 3 → 4, npm → pnpm, Node 20 → 26, Electron removed (todo : tauri desktop version).

The full list is in CHANGES.md.

What this release actually changes

• Images are published per release, not on every push to main.
• :latest follows releases. Each one is also tagged with its version, so ghcr.io/cedhuf/hollama:0.2.0 works if you'd rather pin.
• The update check has something to read. Settings → About → Check now was querying an empty release list until now, so it always answered "up to date".

Versions start at 0.2.0: 0.1.0 was tagged as a baseline and never released.

Still an early preview — expect rough edges, and see the disclaimer in the README.