SealShare/CHANGELOG.md

Changelog

All notable changes to this project are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

2.0.0 - 2026-09-13

Changed

• The interface is rebuilt on Livewire Material, a Material 3 Expressive component library, replacing Mary UI and DaisyUI. Every page — upload, share created, download, sign-in, settings, admin and the setup wizard — uses its components, in a colour scheme generated from SealShare's indigo.
• The theme follows the system's light or dark setting until a user picks Light, Dark or System in Settings → Appearance, or from the account menu. A theme chosen in 1.x is kept.
• A single top app bar replaces the sidebar and header layouts. Signed-in users reach Upload, the admin pages, Settings and Log out from the account menu.
• Confirmations for deleting a share, removing the logo, clearing the system password and deleting the account are dialogs instead of browser prompts, and "Saved." messages are snackbars.
• The two-factor setup opens full screen on a phone.
• HTTP error pages and Markdown mail (password reset, email verification) use the same Material design and colours. Set MAIL_MARKDOWN_THEME=default to get Laravel's mail theme back.
• Signing in now lands on the admin dashboard. The starter kit's placeholder /dashboard page is gone.
• The Docker build installs Composer packages before building the frontend, because the stylesheet imports Livewire Material from vendor/.
• Removed the dependencies robsontenorio/mary, daisyui and alpinejs (Livewire bundles Alpine). The Bunny Fonts request is gone.

Fixed

• The admin dashboard passed its sort column and direction straight to the query, so a crafted Livewire request could order shares by any column or cause a server error. It now sorts only by the columns it shows and otherwise falls back to newest first.

1.2.0 - 2026-09-10

Added

• LIVEWIRE_MAX_UPLOAD_TIME (minutes, default 30) sets how long a single upload may take before its signed upload URL expires. Raise it when large files arrive over slow connections.
• A "Large files" section in the README listing every limit that has to be raised together for big uploads: PHP, admin settings, upload time, execution time and the reverse proxy.

Changed

• Upgraded to Pest 5.1 (pestphp/pest ^5.1, pestphp/pest-plugin-laravel ^5.0), which brings PHPUnit 13.3. The test suite needed no changes.
• Updated PHP dependencies within their existing constraints: Laravel 13.31, Livewire 4.4.4, Octane 2.19.1, Fortify 1.39, Mary 2.9.10, Boost 2.8 and Pint 1.32. Guzzle moves to 8.2 as a transitive dependency of Laravel.
• Updated frontend dependencies: Alpine.js 3.17.2, DaisyUI 5.7.32, Vite 8.2.2 and laravel-vite-plugin 3.2.

Fixed

• Files larger than 4 GB were always rejected with "Upload failed: file exceeds the maximum size of N MB", even when the admin's maximum file size N was bigger than the file. Livewire's temporary upload rule had a hard-coded 4 GB cap; it is gone, so PHP_UPLOAD_MAX_FILESIZE is the hard limit and the admin setting is the enforced one.
• An upload the server rejects no longer blames the admin's maximum file size. The user is told the server could not accept the file, and the actual reason is logged as a warning.

1.1.0 - 2026-07-23

Changed

• Upgraded to Laravel 13 (laravel/framework ^13.0, laravel/tinker ^3.0). PHP 8.5 is now the minimum.
• Set serializable_classes to false in config/cache.php, so a leaked APP_KEY cannot drive an object gadget chain through the cache.
• Upgraded the frontend toolchain to match the Laravel 13 skeleton: Vite 8, laravel-vite-plugin 3, Tailwind CSS 4.3.3, DaisyUI 5.7, Alpine.js 3.15.12 and concurrently 10.

Fixed

• Adding a second batch of files to a share left the uploader stuck on "Processing files…" forever, with the drop zone and the "Create Share Link" button permanently disabled. The uploading state is now cleared by a files-processed event dispatched on every batch, instead of a one-off x-init that only ran the first time the file list appeared.
• Dropping files on the drop zone showed no upload progress at all, because uploadMultiple() was called without progress callbacks.
• Dropping a second folder onto an existing selection replaced the collected relative paths instead of appending them, which shifted every earlier file's path onto the wrong file.

Removed

• Dropped the unused axios dependency and the stale @rollup/rollup-linux-x64-gnu optional pin (Vite 8 builds with rolldown).

Security

• Forced shell-quote to a patched release via an npm override, clearing GHSA-395f-4hp3-45gv (quadratic complexity DoS). npm audit reports 0 vulnerabilities, down from 3.

1.0.1 - 2026-02-25

Fixed

• ZIP downloads returned 0-byte archives under FrankenPHP. ZipStream writes through fwrite(php://output), which FrankenPHP silently drops; downloads are now built with native ZipArchive and served as a file response.
• Docker image was missing the PHP zip extension required by ZipArchive.
• Stale bootstrap/cache/*.php from the build context could load dev-only service providers in the production image.
• DB_DATABASE now defaults to /app/database/database.sqlite in docker-compose.yml, so the env() fallback resolves correctly.
• The unlock button on the password-protected share page rendered outside the form and did nothing. Share page action buttons are now consistently full width.

Removed

• maennchen/zipstream-php dependency.

1.0.0 - 2026-02-13

Added

• Initial release.
• File uploading via drag & drop or browse, supporting multiple files and folders with real-time progress.
• Shareable links, one unique link per upload.
• AES-256-GCM encryption at rest, chunked and streaming, with PBKDF2-SHA256 key derivation.
• Optional password protection per share.
• Configurable expiration from 1 hour to 30 days, and per-share download limits.
• ZIP download of all files in a share.
• Hourly auto-cleanup of expired shares and their files.
• Admin dashboard and settings for upload limits, storage quotas and branding.
• Site branding: custom logo, title and description.
• Optional system password gate restricting upload access.
• User authentication (login, registration, password reset, email verification) and TOTP two-factor authentication via Laravel Fortify.
• First-run setup wizard for creating the initial admin account.
• Dark themed UI built with Livewire, Alpine.js, Tailwind CSS and DaisyUI.
• Docker images published to ghcr.io/surtic86/sealshare, served by FrankenPHP via Laravel Octane.