Kept 1.14.5

Highlights

• Caddy or Ollama: one step before you upgrade. compose.yaml now runs Kept alone. If you use either, download compose.full.yaml and set COMPOSE_FILE=compose.full.yaml in .env, or the next download of compose.yaml leaves Kept on plain http. Behind your own proxy, KEPT_TRUSTED_PROXIES in .env now takes effect. New settings need the new compose.yaml: bumping only KEPT_IMAGE keeps the old file (#414).
• One Kept on more than one address, and longer sign-ins over http. KEPT_EXTRA_ADDRESSES adds a tailnet or LAN address beside your main one, and KEPT_HTTP_SIGN_IN_DAYS keeps you signed in longer over plain http. Admin, Status shows both (#405, #404).
• Connectors stay signed in. MCP connectors now use refresh tokens. Each existing one sees the consent page once, then stays connected (#411).
• Ukrainian, Hide Personal, and a place tree you can size. Kept now comes in Ukrainian. Personal can leave your menu, Home, lists and search. Drag the place tree's edge to change its width, or collapse it (#444, #392, #427).

What's changed

Fixes

• server: issue refresh tokens to MCP connectors (#413, closes #411) (23d8e4d)

Translations

• add Ukrainian (uk) translation (#444) (5583f68)

Other

• Fixes from the final review before the release (#456) (1260551)
• Homebox import: Paperless links take their title from Paperless (#454, closes #422) (655b054)
• Places: trashing and restoring write a history line for the places they move (#455, closes #441) (8310758)
• One Kept on more than one address (#440, closes #405) (f0653d2)
• Longer sign-ins over plain http, set by the admin (#434, closes #404) (4671fde)
• Hide the Personal location (#438, closes #392) (6f99e0e)
• Consent page: say the app stays signed in after you sign out here (#430, closes #423) (a0cd12c)
• Small fixes left from the last two reviews (#439, closes #425) (3d67712)
• Nightly cleanup: remove expired refresh tokens (#442, closes #424) (65b27d4)
• Place tree: drag its edge to change its width, and collapse it like the main navigation (#433, closes #427, reported by @strausmann) (587209c)
• Place tree: a box's name stays readable, its count goes under it when the row is narrow (#431, closes #426, reported by @strausmann) (ee9775a)
• Paperless: the start of a word finds it in Link from Paperless (#429, closes #420, reported by @jpbaril) (c8218a7)
• Dates: a date with no time shows the right day west of UTC (#428, closes #417, reported by @jpbaril) (491177b)
• Compose: a reverse proxy named in .env is trusted; the settings check catches fixed values (#416) (624e8f4)
• Install: compose.yaml runs Kept alone; Caddy and Ollama move to compose.full.yaml (#415, closes #414) (4b70a79)

Documentation and behind the scenes

Documentation

• release: the 1.14.4 record, and the Home Assistant app at 1.14.4 (#410) (624a4b5)

Upgrade

• Image: ghcr.io/keptinventory/kept:1.14.5 or docker.io/keptinventory/kept:1.14.5
• Docker Compose: set KEPT_IMAGE in .env to the image, then docker compose pull && docker compose up -d
• Helm: the chart oci://ghcr.io/keptinventory/charts/kept, version 1.14.5
• Database changes: yes (migrations run on start; with a backup target set, a snapshot is taken first).

Contributors

@BrunIF · @ibrahimroshdy · @strausmann

Full changelog: v1.14.4...v1.14.5

Image, chart and how to verify

Built 2026-11-05 from commit 09eb214488f10f5c4b6607c8bf5c9ebbeee7371b by scripts/release.sh on GitHub Actions (https://github.com/keptinventory/kept/actions/runs/42108958253).

The image

ghcr.io/keptinventory/kept@sha256:cb851b647e1d01de9a7968eed26bc0bdd4914911039bf0e050f9bef3304acab2, for linux/amd64 and linux/arm64, each smoked by digest before any tag
(each natively, by the workflow's build job on a runner of its own architecture) with /version answering 1.14.5 at this commit.

Platform	Manifest
linux/amd64	sha256:76bdeded98a8da53773b30329f47e9eb7fcbabf01978ea477b66aa02dfaceed0
linux/arm64	sha256:3d2e923330efbd6ae0bcf7221ea58379d02e3c77f82958f1f2b1fb75718ab0d5

Tags, all pointing at that digest (there is never a latest):

• ghcr.io/keptinventory/kept:1.14.5
• ghcr.io/keptinventory/kept:1.14
• ghcr.io/keptinventory/kept:1

The Home Assistant app's image

ghcr.io/keptinventory/kept-ha@sha256:cd9f1f14b676491a51938715879ae211c37d71a19ee6cdc7ac10b6f69c923858, tagged ghcr.io/keptinventory/kept-ha:1.14.5 only (the app's config.yaml
names that version), each platform smoked by digest (scripts/smoke-ha-image.sh).

Platform	Manifest
linux/amd64	sha256:1da48e1798d544da397a80760541df92f8bd575926f11758ac5981be41169b00
linux/arm64	sha256:3967798c93e64db35089f4426f55ec305e133b36b58c1d24fcb758ae9d7712d1

The chart

oci://ghcr.io/keptinventory/charts/kept:1.14.5 (sha256:4705136f94941bb2884f44487355ca37a732e8d34e1c2fb339fedb3c2d5dbd4d), appVersion 1.14.5, its image pinned by the digest above.

Verify

cosign verify --key cosign.pub ghcr.io/keptinventory/kept:1.14.5
cosign verify --key cosign.pub ghcr.io/keptinventory/kept-ha:1.14.5
cosign verify --key cosign.pub ghcr.io/keptinventory/charts/kept@sha256:4705136f94941bb2884f44487355ca37a732e8d34e1c2fb339fedb3c2d5dbd4d
docker buildx imagetools inspect ghcr.io/keptinventory/kept:1.14.5 --format '{{ json .SBOM }}'   # the SPDX SBOM per platform