0.5.0

0.5.0 (2026-08-03)

⚠️ Security fix - update recommended for PUBLIC_MODE=server instances

This release closes an unauthenticated Server-Side Request Forgery (SSRF) / open proxy in server mode.

What was wrong. The generic provider proxy /api/proxy/… had no mode check and no session check, and the auth guard deliberately exempts every /api path. In server mode it was therefore reachable by anyone who could reach the instance. With the default (empty) PROXY_ALLOWED_ORIGINS, it forwarded to any HTTP(S) target it was given, following redirects, with an Authorization header supplied by the caller.

Impact. An unauthenticated attacker could use the instance as a network client: probing hosts reachable from your server, including private addresses and the cloud metadata endpoint (169.254.169.254). Unlike the web-fetch tool, this route had no private-address protection.

What was not affected.

• Your stored provider API keys. They are encrypted at rest and never travelled through this route; the Authorization header was the attacker's own.
• Conversations and other user data, this route reads no application data.
• Local mode (PUBLIC_MODE=local), which is unchanged: the proxy exists there so the browser can reach Ollama on localhost and providers without permissive CORS.

The fix. /api/proxy/… now returns 404 in server mode. There is no functional change: the browser already talks to /api/llm/<serverId>, the authenticated proxy that verifies your session, checks you may use that server, and injects the decrypted key server-side.

If you cannot update right now, set an allow-list, it closes the open-relay behaviour on any version:

PROXY_ALLOWED_ORIGINS="https://api.openai.com,http://localhost:11434"

---

🗃️ Two data-loss fixes, equally worth updating for

• A failed read was indistinguishable from an empty account. When the app came back to the foreground it re-read your conversations; if that read failed, a server restarting underneath it, a network blip, the empty result was treated as real data, and the next save replaced every stored conversation with the single one still open on screen. Reads now fail loudly, saving pauses, and a toast says so.
• Every save rewrote the whole collection. Saving one conversation deleted and reinserted all of them, so a second client holding a slightly older list silently erased what the first had added, the ordinary PWA-plus-browser situation. Conversations are now written one at a time.

✨ Also in this release

• Full-text search across every conversation (⌘K / Ctrl+K), with per-message excerpts and jump-to-passage. Server mode uses a SQLite FTS5 index; local mode scans in memory.
• Conversations load on demand instead of all at boot, the sidebar now carries titles and dates, not entire histories.

Upgrading

podman pull ghcr.io/cedhuf/hollama:0.5.0

Back up your SQLite file first. This release adds migration 6, which creates the full-text index and fills it from your existing conversations. It runs once, is not reversible to the previous schema version, and makes the first start after the update noticeably longer in proportion to your history.