v1.0.4

What's Changed

• Chore/dependencies and eslint by @sphildreth in #81
• Perf/next image media by @sphildreth in #82

Full Changelog: v1.0.3...v1.0.4

v1.0.3

What's Changed

• v1.0.3 PR by @sphildreth in #80

Full Changelog: v1.0.2...v1.0.3

v1.0.2

What's Changed

• Chore(deps): Bump dompurify from 3.4.8 to 3.4.9 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #75
• Chore(deps): Bump dompurify from 3.4.9 to 3.4.11 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #76
• v1.0.2 PR by @sphildreth in #78

Full Changelog: v1.0.1...v1.0.2

v1.0.1

[1.0.1] - 2026-06-06

Added

• Added a repo-managed deploy/deploy-tag.sh helper for non-Docker hosts that
  deploy from a Git tag or origin/main.
• Added .node-version and package engines metadata to document and enforce
  the Node.js 22.13+ and pnpm 11.5.2 runtime requirements.

Changed

• Bumped the application version from 1.0.0 to 1.0.1.
• Updated LXC deployment documentation from Node.js 20/pnpm 10 to Node.js
  22/pnpm 11 and replaced production schema push guidance with migration-based
  deployment.
• Updated the deploy helper to enable only the pnpm Corepack shim so stale Yarn
  shims on older hosts do not block deployment.

Fixed

• Fixed direct LXC deployments after 1.0.0 by adding explicit runtime
  preflight checks before dependency installation and build steps.
• Fixed deployment docs and helper flow so database migrations run during
  non-Docker deploys.
• Fixed page/post analytics trackers to avoid avoidable client-side requests
  when the browser advertises Do Not Track or Global Privacy Control.
• Fixed public page/post tracking to honor existing tracking configuration
  flags before rendering client analytics trackers.

v1.0.0

Changelog

This file records notable project changes. It follows the
Keep a Changelog format and uses
Semantic Versioning.

[1.0.0] - 2026-06-06

Added

• Added the first root changelog for release tracking, starting with the
  1.0.0 release.
• Added a pnpm 11 workspace configuration with dependency overrides,
  peer-dependency rules, and build-script approval settings.
• Added a Docker ignore file to keep local dependencies, build outputs,
  private environment files, backups, and uploaded media out of image build
  context.
• Added database indexes for published post feed lookups, post category
  lookups, comment tree/moderation queries, comment parent lookups, and
  comment attachment joins.
• Added a generated migration for the new index set.
• Added CI typechecking as an explicit required step.
• Added stricter CI runtime environment defaults for Auth.js, admin access,
  analytics salt, telemetry, and the test database.

Changed

• Bumped the application version from 0.7.4 to 1.0.0.
• Updated dependencies to current resolved package versions, including Next.js
  16.2, React 19.2, TypeScript 6.0, Vite 8, Vitest 4, Tailwind 4, Drizzle ORM
  0.45.2, DOMPurify 3.4, Mermaid 11.15, and related tooling.
• Updated the package manager declaration to pnpm 11.5.2.
• Updated CI from Node.js 20/global pnpm installation to Node.js 22 with
  Corepack-managed pnpm.
• Updated TypeScript configuration for TypeScript 6 compatibility.
• Updated Vitest configuration to use Vite's native TypeScript path support.
• Updated Docker builds and runtime images to Node.js 22.
• Updated the Docker runtime image to copy the actual Next config,
  pnpm-workspace.yaml, drizzle.config.ts, migrations, scripts, and source
  files needed by runtime migration and app startup paths.
• Updated the production entrypoint to run migrations with pnpm and stop
  logging DATABASE_URL.
• Rewrote the README to match the current 1.0.0 stack, setup flow,
  configuration, database commands, data operations, WXR import options,
  security posture, deployment notes, and quality gates.
• Updated admin server actions and admin mutation APIs to require verified 2FA
  through requireAdmin2FA.
• Updated import job listing to use the shared admin 2FA guard.
• Updated local upload handling to require an authenticated session rather than
  admin access, matching comment-upload usage while preserving upload
  tracking.
• Updated comment upload handling to support both direct PUT presigned S3/R2
  uploads and local multipart uploads.
• Updated production CSP generation to avoid development-only unsafe-eval,
  narrow connect-src, and include configured S3/R2 hosts.

Fixed

• Fixed the GitHub Actions CI workflow so dependency installation, migrations,
  typechecking, build, and tests run under the versions and environment the
  project now expects.
• Fixed Docker image build/runtime issues caused by stale file copies and
  missing runtime configuration files.
• Fixed presigned upload signing to reject missing, non-finite, zero, and
  oversized content lengths.
• Fixed presigned S3/R2 upload commands to include validated content length.
• Fixed /api/r2/sign so unauthenticated requests receive auth-specific
  responses instead of a generic internal error.
• Fixed local upload auth error mapping so unauthorized and forbidden cases
  return appropriate status codes and error codes.
• Fixed test mocks and expectations for admin 2FA guarded routes/actions.
• Fixed local upload tests so authenticated upload tracking does not violate
  user foreign-key constraints.
• Fixed admin allowlist unit-test isolation when CI provides ADMIN_EMAILS.
• Fixed README drift, duplicate sections, corrupted heading characters, stale
  badge versions, npm command examples, and outdated test-count claims.
• Fixed the Performance GitHub Actions workflow to use Node.js 22 and
  Corepack-managed pnpm, matching the main CI runtime.

Security

• Hardened admin mutation surfaces by requiring recent 2FA verification for
  post management, user management, moderation, data operations, configuration,
  purge/restore/export, banner uploads, and import job access.
• Hardened /api/r2/sign by requiring an authenticated session before issuing
  upload credentials.
• Hardened upload validation by binding presigned uploads to the validated
  client-reported content length.
• Hardened production CSP by removing development-only script evaluation and
  limiting connection targets to configured storage endpoints.
• Updated vulnerable direct and transitive dependency ranges where current
  package updates could resolve them.
• Resolved the remaining pnpm audit advisories for transitive yaml,
  postcss, and uuid usage with package overrides and dev-only placement for
  performance tooling.

Noted

• GitHub Dependabot alerts may lag behind local dependency changes until the
  branch is pushed and GitHub refreshes the dependency graph.
• Current backup archives include database JSON exports and media-reference
  manifests, but not full remote media payloads.
• Current restore support focuses on posts, users, and configuration, with
  dry-run, slug/date filters, and skip options.

Pre-1.0.0

Earlier releases were tracked through Git tags and pull requests before this
changelog was introduced.

v0.7.7

What's Changed

• Add puppeteer dependency and suppress hydration warnings in various c… by @sphildreth in #70

Full Changelog: v0.7.6...v0.7.7

v0.7.6

What's Changed

• Refactor code structure for improved readability and maintainability by @sphildreth in #69

Full Changelog: v0.7.5...v0.7.6

v0.7.5

What's Changed

• Sph 2026 03 21.01 by @sphildreth in #68

Full Changelog: v0.7.4...v0.7.5

v0.7.4

Full Changelog: v0.7.3...v0.7.4

v0.7.3

Full Changelog: v0.7.2...v0.7.3