v2.6.0

✨ Highlights

• 🧭 Easier to find your way around. The start screen now puts the search box first. Below it are a few labelled examples and a Search syntax button that explains #tag, type: and >actions. A feature's sub-pages are now tabs across the top of the page instead of a second sidebar. Every page has a clear title, and the top bar shows the app name.
• 🔄 See what's running. A spinning indicator in the top bar appears while scans are running or waiting for a free slot. Click it to see each scan, whether it's Running or Queued, and jump straight to its live results. Recent activity on the start screen now updates on its own until those scans finish.
• ⚙️ Settings → General. Language, theme and what the app opens to are now in one place. The RU/EN switch moved here from the top bar, since the Russian translation is still incomplete.
• 🤖 Local AI with Ollama, no API key needed. A local Ollama model now unlocks every AI feature. Models you start or pull while the app is open show up without reloading the page. AI Templates can now run on Ollama models too.
• 🌍 Sharper photo geolocation. The model also reads any text in the photo, such as signs, plates, prices and phone numbers. Corvid then turns that text into hints (alphabet, language-specific letters, currency, phone prefixes, domains) using its own reference tables, so the hints don't depend on the model guessing. When a country looks likely, a second pass checks the photo against what's typical there, like which side of the road people drive on, plate style and road markings.

🔧 Fixes

• 🔕 A fresh install no longer opens with a false "Failed access-token attempts" security alert.
• 🖼️ Newsfeed source icons load again; they were blocked by the access-token check.
• ⌨️ Side panels can be resized with the keyboard and touch, not just the mouse. Shortcut hints show ⌘ or Ctrl to match your system.
• 📦 The unused Google AI SDK has been removed from the backend image. The docs used to list Google/Gemini as a provider, but it never actually worked; that has been corrected.
• 📄 Photo-geolocation reference data now ships with its upstream license notices.

⬆️ Upgrading

Run ./update.sh (or ./update.sh v2.6.0). No configuration changes are needed.

v2.5.0

✨ Highlights

• 🔔 Alerts bell — an in-app inbox for finished and failed scans, plus a recent-activity feed on the start screen.
• 🚦 Scan queue — heavy scans (Amass, social-analyzer, maigret, git clones…) now wait for a free slot (SCAN_MAX_CONCURRENT_HEAVY, default 3) instead of exhausting memory. Optional BACKEND_MEM_LIMIT.
• 📜 Better history — paging, filtering, sorting, delete confirmation, live refresh of running scans, and JSON/CSV export.
• 🌐 Open it from anywhere — works by server IP or hostname out of the box; new guide for putting HTTPS in front. /docs and /redoc now open in the browser.
• 🧹 News retention that really deletes — default is now 30 days (was "forever"); articles with a note or AI analysis are always kept.

🚀 Deploy & updates

• ⚡ Much faster image builds (pinned release binaries for subfinder/httpx/amass) and near-instant up --wait.
• 🔖 ./update.sh <version> updates or rolls back to a specific release; images are pinned via CORVID_VERSION.
• 💾 Pre-migration backups are taken only when a migration is actually pending.
• 🛡️ New guide: route all outbound traffic through a VPN sidecar.

🔧 Fixes

Weekly live checks now cover the keyless sources, and found five broken ones:

• OpenPhish feed moved, address-blacklist (OpenSanctions) redirect, DuckDuckGo ads leaking into dork results — fixed.
• Dark Reading has a new feed URL (existing installs migrate automatically); SecurityWeek blocks all clients and was removed from the defaults.
• 🔑 MalwareBazaar now needs an abuse.ch key — add it under Settings → API Keys (same key as ThreatFox and URLhaus).

⬆️ Upgrading

Re-download docker-compose.prod.yaml and update.sh (or re-run the installer), then ./update.sh. Non-SQLite DB_URL values now fail at startup — SQLite was the only supported database already.

v2.4.0

What's Changed

• chore(deps): bump python from ce40764 to cae66f2 in /backend by @dependabot[bot] in #57
• chore(deps): bump astral-sh/uv from 0.12.5 to 0.12.7 in /backend by @dependabot[bot] in #58
• chore(deps): bump i18next from 26.3.6 to 26.4.0 in /frontend by @dependabot[bot] in #59
• chore(deps): bump @mdxeditor/editor from 4.2.0 to 4.2.3 in /frontend by @dependabot[bot] in #60
• chore(deps-dev): bump @vitejs/plugin-react from 6.0.5 to 6.1.0 in /frontend by @dependabot[bot] in #61
• chore(deps): bump anchore/sbom-action from 0.24.0 to 0.24.2 by @dependabot[bot] in #65
• chore(deps): bump github/codeql-action/upload-sarif from 4.37.8 to 4.37.9 by @dependabot[bot] in #66
• chore(deps-dev): bump @vitest/coverage-v8 from 4.1.10 to 4.1.11 in /frontend by @dependabot[bot] in #62
• Update dependabot.yml by @z0rats in #67
• chore(deps): bump the react group in /frontend with 2 updates by @dependabot[bot] in #76
• chore(deps): bump react-i18next from 17.0.10 to 17.0.12 in /frontend by @dependabot[bot] in #71
• chore(deps): bump jotai from 2.20.2 to 2.20.3 in /frontend by @dependabot[bot] in #70
• chore(deps): bump nginx from db35bfc to 72ba65e in /frontend by @dependabot[bot] in #73
• chore(deps): bump astral-sh/uv from 0.12.7 to 0.12.10 in /backend by @dependabot[bot] in #74
• chore(deps): bump python from cae66f2 to cad9a2c in /backend by @dependabot[bot] in #75
• chore(deps): bump greenlet from 3.5.3 to 3.5.5 in /backend by @dependabot[bot] in #77
• chore(deps-dev): bump eslint from 10.9.0 to 10.9.1 in /frontend by @dependabot[bot] in #78
• chore(deps): bump @mui/material from 9.3.1 to 9.4.0 in /frontend by @dependabot[bot] in #88
• chore(deps): bump the actions-minor-patch group with 3 updates by @dependabot[bot] in #89
• chore(deps): bump the npm-minor-patch group in /frontend with 10 updates by @dependabot[bot] in #90
• chore(deps): bump the pip-minor-patch group in /backend with 12 updates by @dependabot[bot] in #92
• chore(deps): bump astral-sh/uv from 0.12.10 to 0.12.19 in /backend by @dependabot[bot] in #103
• chore(deps): bump the actions-minor-patch group across 1 directory with 7 updates by @dependabot[bot] in #102
• chore(deps): bump the pip-minor-patch group across 1 directory with 8 updates by @dependabot[bot] in #104
• chore(deps): bump react-dropzone from 15.0.0 to 20.1.1 in /frontend by @dependabot[bot] in #91
• chore(deps): bump @mui/lab from 9.0.0-beta.6 to 9.0.0-beta.9 in /frontend by @dependabot[bot] in #82
• chore(deps): fix vulnerable deps, bump vitest 5, pin jsdom 30.0.1 by @z0rats in #107

New Contributors

• @z0rats made their first contribution in #67

Full Changelog: v2.3.0...v2.4.0

v2.3.0

A few weeks of new tools and one long-requested safety net. 🕵️

• 💾 Backup & restore — export your whole app state (DB + encryption key) from Settings and restore it later. No more starting an investigation from zero after a redeploy.
• 🎣 Four new free IOC providers — OpenPhish (phishing feed), CISA KEV (actively-exploited CVEs), FIRST.org EPSS (exploit-probability score), and LeakIX (IPv4 leaks/services). All keyless.
• 🌐 Domain Finder leveled up — subdomain enumeration via HackerTarget/RapidDNS, Wayback Machine history, and a new Web Check panel (TLS, security headers, DNSSEC, blocklists).
• 🖼️ Image Tools — ChronoVerify provenance/C2PA check, richer EXIF via exiftool, and a live Street View embed for geolocated photos.
• 🔎 IOC Extractor now flags secret-shaped strings and sensitive API paths hiding in pasted text.
• 📊 Plus: a Reddit posting-activity chart, new LinkedIn dork templates, and the usual dependency bumps.

v2.2.0

✨ Highlights

• 🖼️ Image analysis suite — EXIF/metadata, hashing, and reverse image search links.
• 🎬 YouTube — video metadata lookup.
• 🕵️ Hudson Rock — infostealer exposure checks.
• 👤 Threat-actor username matching in Username Search.
• 🌐 Domain Finder — DNSDumpster integration; repeat URLScan.io scans of the same page are deduplicated.
• 🤖 Local Ollama models supported for AI features.
• 🧩 Browser extension — selection popup, right-click context menu, and side panel.

🔧 Fixes

• Layout fixes: content overflowing the viewport, MUI 9 Stack alignment/wrapping.
• URLScan.io screenshots are no longer blocked by the Content Security Policy.
• Resolved open code-scanning alerts and a docs 404.

⬆️ Upgrading

Pull the new images and restart; no configuration changes required. Optional: set LLM_OLLAMA_BASE_URL to use a local Ollama server.

Full Changelog: v2.1.1...v2.2.0

v2.1.1

Includes the changes from v2.1.0 (which had no separate GitHub release).

✨ Highlights

• 🔍 FFraud — new keyless IOC lookup provider.
• 🖱️ Drag-and-drop file hashing on the start screen.
• 📜 Shared history table and detail views across scan features.
• 📚 Auto-generated database schema docs and architecture decision records.

🔧 Fixes

• Concurrent database inserts no longer fail (removed SQLite static connection pools).
• Scans left "running" after a restart are reconciled consistently; three latent bugs fixed during the scan-code refactor.
• SQLite foreign-key cascades are now enforced.
• API version is configurable; the app version is derived dynamically.

⬆️ Upgrading

Migration history was squashed into a single initial revision. Pull the new images and restart — migrations run automatically on startup.

Full Changelog: v2.0.4...v2.1.1

v2.0.4

✨ Improvements

• The app version is shown in Settings → About.
• The installer prints the access token after installation.
• The frontend port is configurable.

Upgrade by re-running the installer or pulling the new images; no breaking changes.

Full Changelog: v2.0.3...v2.0.4

v2.0.3

🔧 Fixes

• Smaller backend image — reduced build size.

Upgrade by pulling the new images; no configuration changes.

Full Changelog: v2.0.2...v2.0.3

v2.0.2

🚀 Release process

• Releases are now published automatically as GitHub releases by the release workflow.

No application changes — no action needed when upgrading.

Full Changelog: v2.0.1...v2.0.2

v2.0.1

📝 Docs

• Updated deployment documentation.

No code changes — no action needed when upgrading from v2.0.0.

Full Changelog: v2.0.0...v2.0.1