v1.1.0

Running and updating your site

• Add a live terminal console with six scrollable views: Overview, Tasks, Content, Logs, System, and Configuration. Plain/off modes, ASCII output, freshness indicators, and graceful shutdown controls support different terminals.
• Protect interactive administrator passwords with hidden entry and confirmation. Add bounded --password-stdin input for administrator creation and password resets.
• Rewrite the guides around download, first run, everyday use, and administration, with separate configuration/developer references and preserved screenshots and licensing.
• Replace automatic installation with a manual, read-only Admin → Software updates check that links to a newer published stable GitHub release. Installation remains a backup/stop/replace/start operation; remove the former updater service, IPC, signing/package tools, and deployment permissions.
• Prepare five versioned native CLI ZIPs for Linux x86_64/ARM64, Intel/Apple silicon Mac, and Windows x86_64, with a shared SHA256SUMS.txt and a draft GitHub release. ZIPs contain the executable, README, LICENSE, and CHANGELOG; native downloads do not bundle ffmpeg or the full online guides. The separate tagged container workflow remains available.

Backups, requests, and account safety

• Publish backups atomically with streaming checksums, online SQLite snapshots, bounded archive validation, and safe retention. Restore requires the server to be stopped, validates staged content before installation, and preserves recovery data when rollback cannot complete.
• Keep session-bound CSRF tokens stable, validate origins/proxy metadata/cookies consistently, and delay multipart asset publication until validation succeeds.
• Charge account-import quota only after complete multipart CSRF validation, with an atomic quota check/record. Submissions rejected for missing or invalid form tokens no longer consume the account's import quota; staged uploads retain bounded streaming and cleanup guards.
• Require a CSRF-protected POST to prepare account deletion. GET/HEAD confirmation navigation cannot create or replace a deletion intent; the no-JavaScript warning/confirmation flow and final confirmation checks remain available.
• Bound media processing, uploads, password work, database queues, and Tor forwarding. Fix cancellation cleanup, make profile/onboarding updates atomic, and preserve access to original video downloads. Drain admitted HTTP requests on SIGTERM.

Build and compatibility

• Upgrade the compiler/minimum supported Rust version to 1.99.1 and current dependencies, including Arti 0.48.0, retaining rusqlite 0.40.2 for a single compatible SQLite linkage.
• Split large source files into subsystem modules and extract embedded assets. Remove the former broad application/Playwright suites and runners; retain the current terminal/CLI and focused CSRF route regressions.
• Simplify CI and issue forms, validate native builds/tests on all five platforms, and remove the unused systemd service example.
• Bump the package, lockfile entry, container version metadata, and current usage examples to 1.1.0. CLI output, console display, update comparison/user agent, and backup manifests derive the app version from Cargo. Database schema 4, account archive format 1, and backup format 1 are unchanged.

Known limits and upgrade notes

• Dependency Audit is report-only: success means a valid advisory report was produced, not that dependencies are free of advisories. Upstream RUSTSEC-2023-0071 (rsa 0.9.10) and RUSTSEC-2026-0387 (crypto-bigint 0.5.5) remain open, with maintenance warnings for transitive bincode 2.0.1 and paste 1.0.15; inspect the current report before deployment.
• Keep a full-site backup before upgrading from v1.0.0. Browser/live restore and automatic installation are no longer available; use offline restore and manual updates.
• RustPost remains a single-community service without federation. Search/reporting are basic, broader accessibility review is outstanding, and synchronous media conversion can delay uploads. Optional ffmpeg improves conversion/thumbnail support; original-format playback depends on the browser.
• Console/log retention is bounded and best effort. Counts can be stale or unavailable, filesystem calls have no hard deadline, and there is no hard whole-process shutdown deadline for stuck filesystem operations. Displayed onion status does not prove external Tor reachability; native interactive Windows and SSH/tmux behavior still need separate validation.

RustPost v1.0.0 - First Release

RustPost 1.0.0 is the first stable release of the single-binary, self-hosted microblogging server.

Highlights

• Server-rendered posts, replies, reposts, profiles, media, search, notifications, moderation controls, backups, and optional embedded Tor onion service.
• Protected accounts with approval for new followers, plus instance announcements and maintenance mode.
• Account export and import, configurable deletion grace period, username history, and administrator forced password reset/logout.
• SQLite schema version 4 with migration support for compatible pre-release databases.
• One rustpost-cli binary for serving and administration. Embedded Arti/Tor crates are pinned to 0.46.0, and the minimum supported Rust version is 1.91.

Download the archive and matching .sha256 file for your platform below. See the README for install and first-run instructions and the changelog for the complete changes.

Container

Pull ghcr.io/csd113/rustpost:1.0.0 (or ghcr.io/csd113/rustpost:latest). Both tags point to the same Linux amd64/arm64 image. See the container instructions for persistent storage and first-run setup.

Dependency advisory: cargo audit reports RUSTSEC-2023-0071 in transitive Arti rsa 0.9.10; no fixed upgrade is available. The README records the accepted exception and two upstream maintenance warnings.

v0.1.6 - Pinned Profiles

v0.1.6 - Pinned Profiles

Profiles and Timelines

• Added profile timeline tabs for posts, replies, media, and liked posts.
• Added pinned profile posts with owner-only pin/unpin controls and automatic cleanup when a pinned post is deleted.
• Added a liked-posts visibility setting so users can make their likes private while still seeing their own likes.
• Preserved relationship and moderation visibility rules across profile tabs, pinned posts, private likes, blocked users, muted users, suspended accounts, and anonymous viewers.

Posting and Composer

• Added server-enforced post editing during a configurable short edit window, with no-JS edit forms and edited markers on changed posts.
• Added live mention autocomplete to composer text areas backed by bounded /mentions suggestions.
• Greyed out composer submit buttons when text exceeds the configured character limit.

Onboarding and Notifications

• Added first-run account onboarding for new users with profile setup, optional avatar upload, and follow suggestions.
• Grouped notifications by activity target, added grouped read/open handling, and improved empty-state rendering across feeds, lists, search, bookmarks, and notifications.

Admin, Settings, and Operations

• Added posts.post_edit_window_seconds to settings and deep server settings, including validation from 0 to 300 seconds.
• Added an admin backups page for creating backup archives from the web UI.
• Refactored the backup restore workflow around staged extraction and clearer restore handling.

Privacy, Security, and UI Fixes

• Hardened mention suggestions so wildcard characters cannot broaden searches and unavailable or hidden users stay excluded.
• Hid private likes from profile likes tabs, notifications, and visible like counts except for the liker.
• Rejected non-image onboarding/profile-picture uploads before creating profile avatar state.
• Fixed the no-JS banner so it appears only when JavaScript is disabled.
• Restored the compact Tor onion address pill with a disclosure and copy control.

Migrations and Compatibility

• Added migrations for onboarding completion state and liked-post visibility.
• Existing active users are marked as already onboarded, deleted users remain incomplete, and existing users keep public likes by default.
• Bumped the crate version to 0.1.6 and refreshed Cargo.lock.

v0.1.5 - Safety, Media, and Link Previews

v0.1.5 - Safety, Media, and Link Previews

Posts and Composer

• Added YouTube link previews for posts so shared video links render with richer inline context.
• Polished the post composer UI and tightened the shared shell sidebar spacing.
• Added a compact quote action icon while preserving the existing posting flow.
• Added a no-JS banner and progressive enhancement fallback behavior for interactive page controls.

Media Safety and Storage

• Added NSFW media marking, blur-by-default rendering, per-user NSFW blur preferences, and admin controls for marking existing media posts.
• Added a migration and settings support for global NSFW blur defaults.
• Added duplicate media detection with canonical media reuse and cleanup so repeated uploads can share stored variants safely.
• Improved original upload handling so original and transcoded variants share stable basenames.

Account and Admin Controls

• Added optional registration CAPTCHA support with single-use challenge validation.
• Exposed CAPTCHA and NSFW blur settings through deep admin settings.
• Expanded the admin users investigation panel with richer search and post-context tooling.

Privacy, Networking, and Performance

• Added gzip compression for browser text responses while leaving media and binary uploads uncompressed.
• Added configurable Tor mirror display in the header and refined the Tor header into a compact status link.
• Kept the embedded Tor client alive through shared ownership for more reliable background onion service operation.

Release Prep

• Bumped the crate version to 0.1.5 and refreshed Cargo.lock.
• Preserved the ignored Playwright artifact policy while removing tracked Playwright test artifacts from the branch.
• Fixed focused Clippy findings in the composer, CAPTCHA, media, and rendering paths.

v0.1.4 - Layout Foundation

v0.1.4 - Layout Foundation

Core UI Layout

• Rebuilt the shared page shell around a centered three-column layout for desktop with a stable primary reading column.
• Collapsed smaller screens to a single readable column with reachable navigation and no horizontal drift.
• Standardized feed, thread, profile, search, settings, form, and admin surfaces around shared card and column primitives.
• Added objective Playwright layout coverage for Chromium and WebKit across mobile, tablet, and desktop viewports.

Navigation and Screenshots

• Added matching icons to the main navigation links, including home, following, search, notifications, bookmarks, profile, admin, login, register, and logout.
• Refreshed the README/changelog screenshots from the updated local demo layout.

Home feed	Profile

Threaded replies	Media posts

Mobile layout

v0.1.3 - Control Room

v0.1.3 - Control Room

Admin Control Room

• Added an admin deep server settings page for changing core site, post, account, and media limits from the web UI.
• Deep settings changes now show a confirmation step with friendly labels, old and new values, and explicit save/discard intents.
• Deep settings writes preserve unrelated settings file values and comments while validating the rewritten configuration before saving.
• Added coverage for valid deep settings updates, invalid submissions, preview/discard flows, and confirmation intent handling.

Account Settings

• Expanded account settings into a fuller profile, privacy, and account controls area.
• Added persisted dark mode as a per-user setting.
• Added profile location support.
• Added muted users and muted words management, including timeline/search filtering for muted terms.
• Added password change support with current-password validation and confirmation matching.
• Moved blocked users, muted users, muted words, password changes, and delete-account access into the settings surface.

Account Deletion

• Added a multi-step account deletion flow with CSRF protection, password confirmation, and a short-lived delete intent.
• Account deletion now removes the user profile, posts, sessions, social relationships, notifications, reports, likes, bookmarks, reposts, muted words, and owned media rows.
• Media file cleanup is constrained to known upload directories and rejects unsafe paths before database mutation.
• File cleanup failures after database scrub are logged without leaving account data behind.

Timeline and UI

• Post timestamps render as non-linked text instead of extra self-links.
• Thread views continue to show timestamps while timeline cards stay compact.
• Account settings, deep settings, danger states, lists, and dark mode received matching layout and style updates.

Release Prep and CI

• Bumped the crate version to 0.1.3 and refreshed Cargo.lock.
• Kept Playwright-related files ignored while preserving the ignored test-artifact policy.
• Fixed focused Clippy findings for stderr output and optional listener handling.
• Reduced upload handling complexity so strict Clippy passes without the old too_many_lines expectation.
• Made startup dashboard path assertions portable for Windows CI and cfg-gated Unix-only terminal helpers.

v0.1.2

Delete tests/e2e directory

v0.1.1 Terminal User Interface

What's Changed

• T UI by @csd113 in #1

Full Changelog: v0.1.0-Alpha...v0.1.1-TUI

v0.1.0 Alpha

Full Changelog: https://github.com/csd113/RustPost/commits/v0.1.0-Alpha