Andreas Reinhold / reiniandClaude Opus 5
21bea9646d
Indigo (the default), Blue, Teal, Green, Amber, Rose and Violet in the Vibrant style and Graphite in the Neutral style are generated from config into the stylesheet. Admin settings opens with a colour profile card: a swatch previews the profile on the page, and Save Settings stores it as color_profile, which AppServiceProvider hands to the package's resolver, so every page, mail and error page wears it. An unknown profile is refused, and a saved one that disappears falls back to indigo. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V9NnLxnPp8vaaurb3Z1MFy
112 lines
8.1 KiB
Markdown
112 lines
8.1 KiB
Markdown
# Changelog
|
|
|
|
All notable changes to this project are documented in this file.
|
|
|
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
|
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
|
|
## [Unreleased]
|
|
|
|
## [2.0.0] - 2026-09-13
|
|
|
|
### Added
|
|
|
|
- Eight colour profiles — Indigo (the default), Blue, Teal, Green, Amber, Rose, Violet and Graphite. An admin picks one in Admin settings, previews it on the page, and after saving every page, mail and error page uses it; light and dark stay each visitor's own choice.
|
|
- The share created page offers the link as a QR code: "Show QR code" opens it in a dialog (full screen on a phone) and "Download" saves it as a PNG. For a password-protected share the dialog reminds that recipients also need the password; the code holds only the link.
|
|
- A "Share…" button on the same page opens the device's share sheet with the link, where the browser has one (mostly phones and Safari).
|
|
|
|
### Changed
|
|
|
|
- SealShare moved from GitHub to Gitea: the source is at https://gitea.nonameweb.ch/noNameWEB/SealShare, and the Docker image is published as `gitea.nonameweb.ch/nonameweb/sealshare`. Images at `ghcr.io/surtic86/sealshare` are no longer updated — change `image:` in your `docker-compose.yml` to the new name to keep receiving releases.
|
|
- The interface is rebuilt on [Livewire Material](https://gitea.nonameweb.ch/noNameWEB/livewire-material), a Material 3 Expressive component library, replacing Mary UI and DaisyUI. Every page — upload, share created, download, sign-in, settings, admin and the setup wizard — uses its components, in a colour scheme generated from SealShare's indigo.
|
|
- The theme follows the system's light or dark setting until a user picks Light, Dark or System in Settings → Appearance, or from the account menu. A theme chosen in 1.x is kept.
|
|
- A floating toolbar centred at the bottom of every page replaces the sidebar and header layouts. Signed-in users reach Upload and the admin pages from it, and Settings, the theme and Log out from its account menu. The site's name and logo head the upload and download pages.
|
|
- Confirmations for deleting a share, removing the logo, clearing the system password and deleting the account are dialogs instead of browser prompts, and "Saved." messages are snackbars.
|
|
- The two-factor setup opens full screen on a phone.
|
|
- HTTP error pages and Markdown mail (password reset, email verification) use the same Material design and colours. Set `MAIL_MARKDOWN_THEME=default` to get Laravel's mail theme back.
|
|
- Signing in now lands on the admin dashboard. The starter kit's placeholder `/dashboard` page is gone.
|
|
- The Docker build installs Composer packages before building the frontend, because the stylesheet imports Livewire Material from `vendor/`.
|
|
- Removed the dependencies `robsontenorio/mary`, `daisyui` and `alpinejs` (Livewire bundles Alpine). The Bunny Fonts request is gone.
|
|
|
|
### Fixed
|
|
|
|
- The README called SealShare's encryption end-to-end. Files are encrypted at rest on the server; the README now says so, and that a share password's key is never stored.
|
|
- The admin dashboard passed its sort column and direction straight to the query, so a crafted Livewire request could order shares by any column or cause a server error. It now sorts only by the columns it shows and otherwise falls back to newest first.
|
|
|
|
## [1.2.0] - 2026-09-10
|
|
|
|
### Added
|
|
|
|
- `LIVEWIRE_MAX_UPLOAD_TIME` (minutes, default 30) sets how long a single upload may take before its signed upload URL expires. Raise it when large files arrive over slow connections.
|
|
- A "Large files" section in the README listing every limit that has to be raised together for big uploads: PHP, admin settings, upload time, execution time and the reverse proxy.
|
|
|
|
### Changed
|
|
|
|
- Upgraded to Pest 5.1 (`pestphp/pest` ^5.1, `pestphp/pest-plugin-laravel` ^5.0), which brings PHPUnit 13.3. The test suite needed no changes.
|
|
- Updated PHP dependencies within their existing constraints: Laravel 13.31, Livewire 4.4.4, Octane 2.19.1, Fortify 1.39, Mary 2.9.10, Boost 2.8 and Pint 1.32. Guzzle moves to 8.2 as a transitive dependency of Laravel.
|
|
- Updated frontend dependencies: Alpine.js 3.17.2, DaisyUI 5.7.32, Vite 8.2.2 and `laravel-vite-plugin` 3.2.
|
|
|
|
### Fixed
|
|
|
|
- Files larger than 4 GB were always rejected with "Upload failed: file exceeds the maximum size of N MB", even when the admin's maximum file size N was bigger than the file. Livewire's temporary upload rule had a hard-coded 4 GB cap; it is gone, so `PHP_UPLOAD_MAX_FILESIZE` is the hard limit and the admin setting is the enforced one.
|
|
- An upload the server rejects no longer blames the admin's maximum file size. The user is told the server could not accept the file, and the actual reason is logged as a warning.
|
|
|
|
## [1.1.0] - 2026-07-23
|
|
|
|
### Changed
|
|
|
|
- Upgraded to Laravel 13 (`laravel/framework` ^13.0, `laravel/tinker` ^3.0). PHP 8.5 is now the minimum.
|
|
- Set `serializable_classes` to `false` in `config/cache.php`, so a leaked `APP_KEY` cannot drive an object gadget chain through the cache.
|
|
- Upgraded the frontend toolchain to match the Laravel 13 skeleton: Vite 8, `laravel-vite-plugin` 3, Tailwind CSS 4.3.3, DaisyUI 5.7, Alpine.js 3.15.12 and concurrently 10.
|
|
|
|
### Fixed
|
|
|
|
- Adding a second batch of files to a share left the uploader stuck on "Processing files…" forever, with the drop zone and the "Create Share Link" button permanently disabled. The uploading state is now cleared by a `files-processed` event dispatched on every batch, instead of a one-off `x-init` that only ran the first time the file list appeared.
|
|
- Dropping files on the drop zone showed no upload progress at all, because `uploadMultiple()` was called without progress callbacks.
|
|
- Dropping a second folder onto an existing selection replaced the collected relative paths instead of appending them, which shifted every earlier file's path onto the wrong file.
|
|
|
|
### Removed
|
|
|
|
- Dropped the unused `axios` dependency and the stale `@rollup/rollup-linux-x64-gnu` optional pin (Vite 8 builds with rolldown).
|
|
|
|
### Security
|
|
|
|
- Forced `shell-quote` to a patched release via an npm override, clearing GHSA-395f-4hp3-45gv (quadratic complexity DoS). `npm audit` reports 0 vulnerabilities, down from 3.
|
|
|
|
## [1.0.1] - 2026-02-25
|
|
|
|
### Fixed
|
|
|
|
- ZIP downloads returned 0-byte archives under FrankenPHP. ZipStream writes through `fwrite(php://output)`, which FrankenPHP silently drops; downloads are now built with native `ZipArchive` and served as a file response.
|
|
- Docker image was missing the PHP `zip` extension required by `ZipArchive`.
|
|
- Stale `bootstrap/cache/*.php` from the build context could load dev-only service providers in the production image.
|
|
- `DB_DATABASE` now defaults to `/app/database/database.sqlite` in `docker-compose.yml`, so the `env()` fallback resolves correctly.
|
|
- The unlock button on the password-protected share page rendered outside the form and did nothing. Share page action buttons are now consistently full width.
|
|
|
|
### Removed
|
|
|
|
- `maennchen/zipstream-php` dependency.
|
|
|
|
## [1.0.0] - 2026-02-13
|
|
|
|
### Added
|
|
|
|
- Initial release.
|
|
- File uploading via drag & drop or browse, supporting multiple files and folders with real-time progress.
|
|
- Shareable links, one unique link per upload.
|
|
- AES-256-GCM encryption at rest, chunked and streaming, with PBKDF2-SHA256 key derivation.
|
|
- Optional password protection per share.
|
|
- Configurable expiration from 1 hour to 30 days, and per-share download limits.
|
|
- ZIP download of all files in a share.
|
|
- Hourly auto-cleanup of expired shares and their files.
|
|
- Admin dashboard and settings for upload limits, storage quotas and branding.
|
|
- Site branding: custom logo, title and description.
|
|
- Optional system password gate restricting upload access.
|
|
- User authentication (login, registration, password reset, email verification) and TOTP two-factor authentication via Laravel Fortify.
|
|
- First-run setup wizard for creating the initial admin account.
|
|
- Dark themed UI built with Livewire, Alpine.js, Tailwind CSS and DaisyUI.
|
|
- Docker images published to `ghcr.io/surtic86/sealshare`, served by FrankenPHP via Laravel Octane.
|
|
|
|
[Unreleased]: https://gitea.nonameweb.ch/noNameWEB/SealShare/compare/v2.0.0...main
|
|
[2.0.0]: https://gitea.nonameweb.ch/noNameWEB/SealShare/releases/tag/v2.0.0
|