CHANGELOG.md

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[1.7.5] - 2026-07-19

Added

• Gist Deletion Choice: Added the ability to permanently delete the corresponding GitHub Gist when permanently deleting a mapped snippet.
• Unlink with Deletion: When unlinking a Gist from the Gist Sync settings, users are now presented with a custom modal that provides the option to also delete the remote Gist.
• Dedicated Sync Delete API: Introduced DELETE /api/v1/gist/sync/snippet/{id} to cleanly handle the atomic deletion of both remote Gists and local mappings.

Changed

• Soft-Delete (Trash) Lifecycle: Moving a synced snippet to the Trash no longer severs its GitHub Gist sync mapping. The sync worker simply pauses syncing for trashed snippets, allowing syncing to seamlessly resume upon restoration without duplicating Gists.
• Dynamic Delete Modal: The delete confirmation modal now dynamically changes its title, text, and button (e.g., "Move to Trash" vs. "Permanently Delete") based on whether the action is a soft or hard delete.

[1.7.4] - 2026-07-18

Fixed

• Prevent aggressive caching of static JS and CSS files by setting Cache-Control headers - - Support auto theme selection and fix a UI bug that wiped checkboxes and prevented saving settings

Changed

• Restrict API key creation/deletion and Gist sync in demo mode
• Debounce settings updates with a 500ms timeout to reduce API request frequency and prevent race conditions

[1.7.3] - 2026-07-14

Fixed

• Fix bug in token generation process because of the previous change to HMAC keys

[1.7.2] - 2026-07-13

Added

• Footer version label now links to the CHANGELOG section on click (#298)

Security

• Sanitize FTS5 query input to prevent SQL injection attacks (#302)
• Redact sensitive query parameters from logs and reject passwords in URLs (#304)
• Clear user-controlled data from log entries (#311)
• Remove X-API-Key from session token extraction (#305)
• Sanitize Host header in pagination links to prevent injection (#307)
• Sanitize user input in log entries to prevent log injection (#300)
• Enforce Content-Type: application/json in DecodeJSON (#301)

Fixed

• Derive HMAC keys from session secret instead of hardcoding a static value (#308)
• Move S3 delete key from query parameter to URL path for proper signing (#303)
• Require TrustProxy setting for X-Forwarded-Proto in scheme() (#310)
• Resolve OpenAPI spec path relative to executable (#309)
• Fix logging for snippet tag setting errors by truncating overly long messages (#312)

Changed

• Update GitHub Actions using sanad policy (#299)
• Upgrade Go depedencies

[1.7.1] - 2026-07-11

Fixed

• Resolve mobile editor layout overlap and toolbar row stacking

[1.7.0] - 2026-07-04

Removed

• Removed decryption with the pre-1.5 Gist credential key. Existing Gist credentials encrypted with that key must be saved again.
• Removed the deprecated tag_id and folder_id list filters. Use the comma-separated tag_ids and folder_ids parameters.
• Removed support for non-enveloped API responses in the web client and browser extension.
• Removed the retired Gist metadata-file exception, frontend compatibility globals, the no-op schema migration 6, and migration-specific repair paths.

Fixed

• Editing items does appear crammed on mobile phones

Development

• Updated actions version to the latest accepted by sanad policy
• Removed the non-functional migrate-down Make target; schema downgrades are not supported.
• Removed the unused top-level migrations directory. Runtime migrations are defined only in internal/database/migrations.go.

[1.6.1] - 2026-06-16

• Update Frontend vendor dependencies to latest versions, including Ace editor and Alpine.js.

[1.6.0] - 2026-06-06

Added

• Added Ctrl+S / Cmd+S save support in edit mode, including Ace editor command handling and duplicate-save protection.

Changed

• Reworked edit mode so the code editor remains primary while language, folder, sharing, expiration, and tags live in a right-side details sidebar.
• Moved edit-mode description under the title and kept toolbar actions aligned with the title row.
• Updated edit-mode tags to render as wrapping chips, including quick-add suggestions.
• Expanded the edit-mode language dropdown to full width with clearer language labels.
• Made edit-mode file tabs more distinct with stronger borders.
• Removed tag rendering from snippet cards and moved copy controls plus single-file/multi-file indicators directly under the description or preview.
• Hydrated snippet files, tags, and folders in list responses so browse metadata and file indicators are available without opening each snippet.
• Updated Go dependencies: golang.org/x/crypto, modernc.org/sqlite, github.com/go-chi/chi/v5, and AWS SDK config/credentials packages.

Fixed

• Fixed edit-mode file tab management for legacy single-file snippets, including Add File, switching between files, empty-editor states, and stale file-operation locks.
• Fixed edit-mode single-file snippets showing + Add file instead of a filename when the snippet had not recently been edited.
• Improved Escape key handling so delete modals and search help close before the editor.

Development

• Added Dependabot coverage for GitHub Actions updates.
• Updated GitHub Actions versions for Node setup, artifact upload/download, Docker login/build, Codecov, and golangci-lint workflows.
• Pinned GitHub Actions to full commit SHAs and added the action lock file.

[1.5.0] - 2026-05-10

Added

• Added POST endpoint for exporting encrypted backups with an optional password.
• Updated OpenAPI documentation to reflect new backup export options.

Changed

• Improved backup export functionality adding encryption support.
• Refactored middleware to support anonymous access with admin password verification.

Fixed

• Fixed API allowed origins (SNIPO_ALLOWED_ORIGINS) configuration parsing to resolve linting issues.
• Improved validation and error handling for backup operations.

Security

• Improved security by sanitizing HTML in markdown rendering.

Removed

• Removed legacy SHA256 weak cryptographic hashing algorithm fallback for backup code.

[1.4.2] - 2026-04-26

Changed

• Regular update of snipo Go and vendor dependencies.

[1.4.1] - 2026-04-08

Fixed

• Textarea auto-resize: autoResizeTextarea now reads the element's computed max-height instead of a hardcoded cap, so the title input (120 px) and description textarea (80 px) each respect their own CSS constraint
• Cancel button invisible in light theme: Modal cancel buttons (modal-footer button:first-child) now use --snipo-text-primary instead of --pico-color, which Pico v2 overrides to white on button elements
• Modal flicker on load/navigation: Added x-cloak to the Token Password and Disable Login Password confirmation overlays, which were briefly visible before Alpine.js initialised
• Dropdown text clipping: Removed the height: 40px constraint from .editor-field inputs and selects; elements now auto-size from padding alone, eliminating the tight content area that clipped text at the bottom border. ::file-selector-button vertical padding reduced to match
• Copy button misalignment: Added display: inline-flex; align-items: center to .dropdown so the copy dropdown wrapper aligns with sibling btn-action buttons in the editor toolbar
• Gist toggle in preview mode: Replaced the interactive checkbox/switch with a read-only status indicator matching the Public/Private indicator style; Gist sync can now only be changed from edit mode

Changed

• New/Edit Folder modal: inputs and buttons use a compact size (btn-compact) for a less heavy feel

[1.4.0] - 2026-04-07

Added

• Snippet Expiration & Auto-Archive: Set optional expiration dates on snippets with automatic archiving. Supports quick presets (7d, 30d, 90d, 6mo, 1y) or custom date picker
• Copy dropdown: Adding copy as rich option to copy button that is now a dropdown. This copies the snippet with syntax highlighting and formatting preserved, ideal for pasting into rich text editors or mattermost/slack.

Changed

• Vendor workflow: Simplified package.json scripts, added verification and orphan cleanup
• Moved Public and Gist toggles in editor to symmetric compact field-inline layout
• Preview mode public toggle changed from interactive switch to read-only indicator
• Updated golangci-lint to support Go 1.26
• Updated various vendor JS dependencies
• Updated Go dependencies and sqlite

[1.3.13] - 2026-03-22

Added

• Add RTL and Arabic support with proper mixed-content handling
• Update vendor JS dependencies

Changed

• Improve snippet history tracking and restoration feature
• Improve the settings Modal CSS to make it more user friendly

[1.3.12] - 2026-03-09

fixed

• TUI Fixed n keybinding navigation not showing in the TUI interface
• Removed unecessary information from the /health endpoint response to avoid potential security implications.

[1.3.11] - 2026-02-22

Added

• Added a new public endpoint (GET /api/v1/metadata/languages) to the Snipo backend, dynamically exposing the canonical list of languages valid for syntax highlighting to any connected client.
• TUI: Added editing and writing capabilities to the TUI interface so it is no longer read-only.
• Update vendor JS dependencies including Ace editor components, Alpine, and Marked.

Fixed

• Fix SNIPO_DISABLE_AUTH=true still prompting for password when we try to delete or create a token.
• Fix Gist sync button does not work with new snippets.

[1.3.10] - 2026-02-19

Added

• Display application version in the footer

[1.3.6] - 2026-02-04

Fixed

• Corrected hardened image release workflow to include conditional debug pulls

[1.3.5] - 2026-02-02

Added

• Hardened Docker image build (#132)
• Soft delete for snippets with trash management (#135)

Fixed

• Ensure API token lists are always arrays (#134)
• Rename modal CSS classes to snipo-modal-backdrop to avoid adblocker detection (#136)
• various other fixes and improvements

[1.3.4] - 2026-01-29

Fixed

• Allow special characters in tag names (e.g., C#, C++) (#127)
• Add configurable database memory settings to resolve 'out of memory' errors (#111)

Security

• Prevent SQL injection in snippet list query (#128)
• Add URL validation and snippet ID sanitization (#112)
• Security updates and hardening (#108, #114)

[1.3.3] - 2026-01-07

Added

• Demo mode to showcase the app with sample snippets (configure via SNIPO_DEMO_MODE environment variable)
• GitHub Gists sync integration (Settings → GitHub Gists)
• Support for deploying snipo to subpaths (configure via SNIPO_BASE_PATH environment variable)
• Extension: Published Firefox extension (Install)

Fixed

• GitHub sync tokens not persisting across restarts

Note: To use GitHub Gist sync, set the SNIPO_ENCRYPTION_SALT environment variable. Without this, GitHub tokens will not persist across restarts. Generate a salt with: openssl rand -base64 32

[1.3.2] - 2026-01-03

Added

• CHANGELOG.md to track version history
• Copy button on overview page with dropdown support for multi-file snippets
• Option to exclude first line (shebang) from copy (Settings → General)
• TUI: Basic functionality for reading snippets with terminal theme support
• Extension: Initial web extension for adding snippets from any page

Fixed

• Pagination not showing in some cases
• API response formatting for consistent JSON field naming
• Sorting by title (A-Z and Z-A) returning same results
• TUI: Terminal color detection for better theme support
• TUI: Layout issues on different terminal sizes
• TUI: Responsiveness on small terminals

Security

• API Tokens: Upgraded from SHA256 to HMAC-SHA256
• Sessions: Upgraded from SHA256 to HMAC-SHA256
• Backup Encryption: Upgraded from SHA256 to PBKDF2 (100,000 iterations)

Migration: Fully backward compatible. Existing tokens and sessions continue to work and are automatically upgraded on first use.

Configuration: Added SNIPO_ENCRYPTION_SALT environment variable for production backup encryption (auto-generated if not set).

Deprecation: Legacy SHA256 fallback will be removed in v1.5.0 (Q1/2 2026).

---

Changelog started at v1.3.2