v0.3.7

What's changed

• AI: clear error when image generation hits a text-only provider
• AI: add Zhipu AI (GLM) provider preset with CogView image generation
• Backend: 540p preview proxies for large videos, Range/HEAD on asset content, longer daemon start grace
• Video: server ffmpeg timeline renderer with nested-sequence flattening and export range
• Video editor: full timeline editing suite
• Video editor: close out the bug and gap backlog
• Version history: correctness and safety fixes from the review
• Video editor: URL import uses the in-app modal instead of the native browser prompt
• Fix skewed Version-history timestamps by pinning the DB session to UTC (#7)
• Editor: image and frame interaction fixes
• Editor: Templates panel in the left rail with page-size suggestions
• Collab bridge: keep the session's first edit undoable before room sync
• Security: harden storage key handling and export download URLs (code scanning) (#8)
• Video editor: validate export job ids at the download call sites

Platform notes

• Each archive contains just the self-contained hycanvas binary with the frontend embedded; see the README for setup (.env, PostgreSQL). The first-run wizard generates the configuration for you, and .env.example in the repository documents every setting.
• First run: ./hycanvas service start daemonizes the server (pidfile + logfile next to the binary; Linux, macOS, and Windows) and asks whether to set up in the browser or in the terminal. The browser wizard at /installation/step-1 is unlocked by the one-time access secret it prints; the CLI wizard asks the same questions right there. Other verbs: stop, restart, status, log -f. ./hycanvas start runs in the foreground.
• The macOS binaries are not signed or notarized. If macOS quarantines the download, run xattr -d com.apple.quarantine hycanvas or right-click the binary and choose Open.
• ffmpeg is only required for server-side video export; everything else works without it.

What's Changed

• Fix skewed Version-history timestamps by pinning the DB session to UTC by @devadattas in #7
• Security: resolve CodeQL path-injection and request-forgery alerts by @devadattas in #8

Full Changelog: v0.3.6...v0.3.7

v0.3.6

What's changed

• Docs: redact private disk paths from setup wizard screenshots
• Analytics: optional runtime Google Analytics injection

Platform notes

• Each archive contains just the self-contained hycanvas binary with the frontend embedded; see the README for setup (.env, PostgreSQL). The first-run wizard generates the configuration for you, and .env.example in the repository documents every setting.
• First run: ./hycanvas service start daemonizes the server (pidfile + logfile next to the binary; Linux, macOS, and Windows) and asks whether to set up in the browser or in the terminal. The browser wizard at /installation/step-1 is unlocked by the one-time access secret it prints; the CLI wizard asks the same questions right there. Other verbs: stop, restart, status, log -f. ./hycanvas start runs in the foreground.
• The macOS binaries are not signed or notarized. If macOS quarantines the download, run xattr -d com.apple.quarantine hycanvas or right-click the binary and choose Open.
• ffmpeg is only required for server-side video export; everything else works without it.

Full Changelog: v0.3.5...v0.3.6

v0.3.5

What's changed

• Security: use origin-checked URL parsing for the post-auth redirect
• Lines: make resize actually scale the stroke (gizmo, panel, magic resize)
• Elements: remove the Line/Arrow tiles (toolbar drawing tools are the one way)
• Color picker: viewport-clamped fixed popover so the panel never clips it
• Profiles: regional preferences (timezone, time format, week start)
• Profiles: default the timezone to the browser's
• README: add editor-in-action GIF and a sample design
• Photo grids: whole-grid resize re-lays cells
• Editor: image picker on empty frames, visible pen anchors and cursor
• Editor: resize drags flip through zero like a mirror
• Dashboard and settings: URL-addressable sections and tabs
• Dashboard: lazy-load design and template previews
• Uploads: stop labeling every 413 as a storage quota error
• Editor: wheel scroll works over canvas overlays
• Editor: active page follows the scroll, inserts join the active page
• Pages bar: pinned controls, on-top size menu, calm thumbnail strip
• Editor: the Rotate around pivot actually takes effect
• Engine: text effects render on curved text
• Engine: declare the optional arc method on CanvasLike

Platform notes

• Each archive contains just the self-contained hycanvas binary with the frontend embedded; see the README for setup (.env, PostgreSQL). The first-run wizard generates the configuration for you, and .env.example in the repository documents every setting.
• First run: ./hycanvas service start daemonizes the server (pidfile + logfile next to the binary; Linux, macOS, and Windows) and asks whether to set up in the browser or in the terminal. The browser wizard at /installation/step-1 is unlocked by the one-time access secret it prints; the CLI wizard asks the same questions right there. Other verbs: stop, restart, status, log -f. ./hycanvas start runs in the foreground.
• The macOS binaries are not signed or notarized. If macOS quarantines the download, run xattr -d com.apple.quarantine hycanvas or right-click the binary and choose Open.
• ffmpeg is only required for server-side video export; everything else works without it.

Full Changelog: v0.3.4...v0.3.5

v0.3.4

What's changed

• Add CAPTCHA (Turnstile / reCAPTCHA) on the auth forms
• Security: resolve CodeQL findings in auth redirect, ReDoS, and CI hardening

Platform notes

• Each archive contains just the self-contained hycanvas binary with the frontend embedded; see the README for setup (.env, PostgreSQL). The first-run wizard generates the configuration for you, and .env.example in the repository documents every setting.
• First run: ./hycanvas service start daemonizes the server (pidfile + logfile next to the binary; Linux, macOS, and Windows) and asks whether to set up in the browser or in the terminal. The browser wizard at /installation/step-1 is unlocked by the one-time access secret it prints; the CLI wizard asks the same questions right there. Other verbs: stop, restart, status, log -f. ./hycanvas start runs in the foreground.
• The macOS binaries are not signed or notarized. If macOS quarantines the download, run xattr -d com.apple.quarantine hycanvas or right-click the binary and choose Open.
• ffmpeg is only required for server-side video export; everything else works without it.

Full Changelog: v0.3.3...v0.3.4

v0.3.3

What's changed

• deps: patch dompurify, esbuild, vite, shell-quote, postcss for Dependabot alerts
• Text resize: two-phase side handles (reflow, then scale font)

Platform notes

• Each archive contains just the self-contained hycanvas binary with the frontend embedded; see the README for setup (.env, PostgreSQL). The first-run wizard generates the configuration for you, and .env.example in the repository documents every setting.
• First run: ./hycanvas service start daemonizes the server (pidfile + logfile next to the binary; Linux, macOS, and Windows) and asks whether to set up in the browser or in the terminal. The browser wizard at /installation/step-1 is unlocked by the one-time access secret it prints; the CLI wizard asks the same questions right there. Other verbs: stop, restart, status, log -f. ./hycanvas start runs in the foreground.
• The macOS binaries are not signed or notarized. If macOS quarantines the download, run xattr -d com.apple.quarantine hycanvas or right-click the binary and choose Open.
• ffmpeg is only required for server-side video export; everything else works without it.

Full Changelog: v0.3.2...v0.3.3

v0.3.2

What's changed

• Compound paths: schema v15 contours so imported line art keeps its holes
• Uploads panel: keep the import buttons inside their grid cells
• Dark mode: readable labels on neutral-900 buttons
• Set the social share banner (Open Graph + Twitter)
• Set the social share banner (Open Graph + Twitter)
• README: point the banner at the brand-hosted image
• README: point the banner at the brand-hosted image
• Remove the unused committed README banner
• Remove the unused committed README banner
• Image placeholders: photo-grid layouts, drop-to-fill hints, shape fill adjust
• Charts: adjustable text size (schema v16 ChartStyle.fontSize)
• Text editing: faithful edit mode, formatting shortcuts, richer controls

Platform notes

• Each archive contains just the self-contained hycanvas binary with the frontend embedded; see the README for setup (.env, PostgreSQL). The first-run wizard generates the configuration for you, and .env.example in the repository documents every setting.
• First run: ./hycanvas service start daemonizes the server (pidfile + logfile next to the binary; Linux, macOS, and Windows) and asks whether to set up in the browser or in the terminal. The browser wizard at /installation/step-1 is unlocked by the one-time access secret it prints; the CLI wizard asks the same questions right there. Other verbs: stop, restart, status, log -f. ./hycanvas start runs in the foreground.
• The macOS binaries are not signed or notarized. If macOS quarantines the download, run xattr -d com.apple.quarantine hycanvas or right-click the binary and choose Open.
• ffmpeg is only required for server-side video export; everything else works without it.

Full Changelog: v0.3.1...v0.3.2

v0.3.1

HyCanvas v0.3.1

A configuration and polish release. No file-format schema change, so upgrading is a binary swap with no migration.

Configurable sign-in methods

Operators can now choose exactly how people sign in and how accounts are created. Email + password, magic link, and OIDC/SSO each have an independent login and signup toggle, set per instance through AUTH_*_ENABLED environment variables.

• Defaults preserve prior behavior, so an existing instance is unchanged unless it opts in.
• The sign-in page shows only the methods you allow; disabled methods are also enforced on the server (their endpoints return 403, not just a hidden button).
• New: magic-link signup, which creates an account when an emailed link is opened (nothing is created until it is clicked).
• Safety guardrails: OIDC toggles are inert unless OIDC is configured, and a configuration that would leave no usable login method keeps password login on and logs a warning, so you cannot lock yourself out.
• Run an SSO-only instance by turning the local methods off and leaving OIDC on. See the README for the recipe and the note about linking existing password accounts.

Sign-in polish

The login screen now waits for the instance's method policy before drawing the form, so a restricted instance no longer briefly shows options it does not allow.

Ownership and positioning

Documentation now names the product on its own terms and attributes the HyScaler trademark to NetTantra Technologies (India) Private Limited, with the legal entity stated where it is load-bearing (NOTICE and the contributor agreement).

Editor

Locked elements are selectable on the canvas, so their unlock controls are reachable without opening the Layers panel; transforms stay blocked while locked.

Platform notes

See the archive descriptions below for setup, .env, and PostgreSQL requirements.

v0.3.0

What's changed

• Seed the CLA signature store
• Replace hycanvas.app with domains we own
• Use the hycanvas.com domain for the licensing contact
• Claim only HyScaler as a registered trademark
• Add a shipped-vs-pending feature checklist
• Lift the slide-transition compositor into @hc/engine (F28 FR-13)
• Sync the F28 spec with the shipped transition compositor
• Add the shared-link deck player (F28 FR-26, AC-7)
• Sync F28 docs with the shipped web player
• Export a whole deck with its transitions (F28 FR-19 groundwork)
• Sync F28 docs with deck animated export
• Add the second-display presenter view (F28 FR-15, AC-3)
• Sync F28 docs with the second-display presenter view
• Add slide masters, layouts, and a swappable deck theme (F28 FR-3, FR-4)
• Sync F28 docs with the master/layout/theme model (schema v11)
• Surface slide layouts and deck themes in the editor (F28 FR-3, FR-4)
• Add the accessibility foundation: alt text, decorative, reading order (F28 FR-29)
• Sync F28 docs with the accessibility foundation (schema v12)
• Add the Reading Order pane and follow it for Tab navigation (F28 FR-29)
• Sync F28 docs with the Reading Order pane
• Add the page build-order timeline and apply-to-all (F28 FR-10)
• Sync F28 docs with the build-order timeline
• Add slide sections with section-aware present navigation (F28 FR-5)
• Sync F28 docs with slide sections (schema v13)
• Make schema-version tests immune to later bumps
• Add stock facet filters and colorful-first browsing
• Exempt HyScaler personnel from the CLA gate
• Add the grid/outline slide overview (F28 FR-5)
• Emit an accessibility structure tree in PDF export (F28 FR-22)
• Export a whole deck as one tagged PDF (F28 FR-22)
• Embed images in PDF export (F28 FR-22)
• Offer an accessible PDF in the export dialog (F28 FR-22)
• Templates: illustrated catalog of 100 built-ins with curated landing order
• Effects: per-effect level controls, schema v14 shadow normalization
• Present: preload design fonts and assets in the audience window
• Attribute HyScaler to NetTantra Technologies (India) Private Limited
• Embed the design's own fonts in PDF export (F28 FR-22)

Platform notes

• Each archive contains just the self-contained hycanvas binary with the frontend embedded; see the README for setup (.env, PostgreSQL). The first-run wizard generates the configuration for you, and .env.example in the repository documents every setting.
• First run: ./hycanvas service start daemonizes the server (pidfile + logfile next to the binary; Linux, macOS, and Windows) and asks whether to set up in the browser or in the terminal. The browser wizard at /installation/step-1 is unlocked by the one-time access secret it prints; the CLI wizard asks the same questions right there. Other verbs: stop, restart, status, log -f. ./hycanvas start runs in the foreground.
• The macOS binaries are not signed or notarized. If macOS quarantines the download, run xattr -d com.apple.quarantine hycanvas or right-click the binary and choose Open.
• ffmpeg is only required for server-side video export; everything else works without it.

What's Changed

• F28: slide layouts and deck themes in the editor (FR-3, FR-4) by @devadattas in #1
• F28: accessibility foundation (FR-29) - alt text, decorative, reading order by @devadattas in #2

Full Changelog: v0.2.8...v0.3.0

v0.2.8

What's changed

• Add the CLA, commercial licensing terms, and HyScaler ownership notices

Platform notes

• Each archive contains just the self-contained hycanvas binary with the frontend embedded; see the README for setup (.env, PostgreSQL). The first-run wizard generates the configuration for you, and .env.example in the repository documents every setting.
• First run: ./hycanvas service start daemonizes the server (pidfile + logfile next to the binary; Linux, macOS, and Windows) and asks whether to set up in the browser or in the terminal. The browser wizard at /installation/step-1 is unlocked by the one-time access secret it prints; the CLI wizard asks the same questions right there. Other verbs: stop, restart, status, log -f. ./hycanvas start runs in the foreground.
• The macOS binaries are not signed or notarized. If macOS quarantines the download, run xattr -d com.apple.quarantine hycanvas or right-click the binary and choose Open.
• ffmpeg is only required for server-side video export; everything else works without it.

Full Changelog: v0.2.7...v0.2.8

v0.2.7

What's changed

• Generate a what's-changed section in release notes
• Expand the docs with exhaustive guides and a full wizard walkthrough
• Fix anonymous share links and make their URLs canonical

Platform notes

• Each archive contains just the self-contained hycanvas binary with the frontend embedded; see the README for setup (.env, PostgreSQL). The first-run wizard generates the configuration for you, and .env.example in the repository documents every setting.
• First run: ./hycanvas service start daemonizes the server (pidfile + logfile next to the binary; Linux, macOS, and Windows) and asks whether to set up in the browser or in the terminal. The browser wizard at /installation/step-1 is unlocked by the one-time access secret it prints; the CLI wizard asks the same questions right there. Other verbs: stop, restart, status, log -f. ./hycanvas start runs in the foreground.
• The macOS binaries are not signed or notarized. If macOS quarantines the download, run xattr -d com.apple.quarantine hycanvas or right-click the binary and choose Open.
• ffmpeg is only required for server-side video export; everything else works without it.

Full Changelog: v0.2.6...v0.2.7