CHANGELOG.org

  1#+title: gitbay changelog
  2
  3Versioning follows semver from v0.1.0. Database migrations run
  4automatically on daemon start; upgrade notes appear per release when
  5anything beyond "replace the binary and restart" is needed.
  6
  7* v1.13.0 — 2026-09-04
  8
  9Collaboration. A review is composed and submitted as one thing, a merge
 10request can say it is not asking yet and can show what changed since you
 11last looked, issues are searched by their text, and the events half the
 12mutations never recorded now exist.
 13
 14- A review is composed as a unit. =mr diff-comment --pending= holds a
 15  comment back; =mr review= publishes the batch with the verdict and says
 16  how many went with it; =mr review --discard= throws away what was never
 17  submitted. A pending comment notifies nobody when written — the review
 18  is the announcement, and it names its own size — and does not gate a
 19  merge, since a thread only its author can see is one nobody else could
 20  resolve. #111
 21- =mr create --draft=, =mr draft=, =mr ready=. A draft does not merge and
 22  does not appear in anyone's review queue; marking it ready is the
 23  request for review. Draft is a flag rather than a fifth state, so every
 24  =state = 'open'= rule still means what it did, and the merge refusal is
 25  unconditional: every other gate is a setting an admin turns on, and
 26  this one is the author's own statement about their own work. #111
 27- =mr range-diff= shows what changed between two revisions of a merge
 28  request, and =mr revisions= lists them. A push stales every review and
 29  nothing said what had moved; a diff of the two heads cannot answer it,
 30  and the previous head was overwritten in place. Each side of the
 31  comparison carries the merge base it had at the time, since measuring
 32  both against today's would attribute every commit that landed on the
 33  target in between to this merge request's author. #111
 34- Issues and merge requests are searched by their title and body, over
 35  FTS5. =issue list --search= and =mr list --search= narrow one
 36  repository; the instance-wide =search= reaches bodies now, and both
 37  list pages carry a search box. What someone types is quoted term by
 38  term, so an FTS5 operator — =c++=, =AND=, a lone quote — is a word to
 39  match rather than a syntax error. #114
 40- Ten mutations that changed a repository silently now record an event:
 41  =mr.closed=, =mr.reviewed=, =mr.edited=, =mr.retargeted=, =mr.draft=,
 42  =issue.edited=, =issue.labeled=, =issue.assigned=, =issue.milestoned=,
 43  =mr.milestoned=, =release.deleted=. =mr close= and =issue edit= also
 44  notify participants, which they did not. The full list is on the API
 45  wiki page and =webhook add --events= refuses a name that is not on it,
 46  since a subscription to a typo would never fire and nothing would say
 47  so. #112
 48- =gitbay-runner -jobs N= runs N builds at once. Claiming was always a
 49  single transaction that selects and updates, and each build already
 50  worked in its own directory, so several workers were safe the whole
 51  time; the runner never used more than one. #115
 52- A merge request replayed from a migration bundle has a diff. The bundle
 53  carried no head at all, and =mr diff= resolves through the head ref, so
 54  a merged merge request — which has no source branch left — could only
 55  fail. Re-running an import after the git push sets the head it could
 56  not set the first time. The GitHub import fetches =refs/pull/*/head=,
 57  which a mirror made with the default refspecs does not carry. #128
 58- The review loop is driven end to end by three accounts in the test
 59  suite: draft, ready, thread, approval, resolve, merge, with approvals,
 60  CODEOWNERS and require-resolved all on at once. Every one of those had
 61  its own test and none of them met. #139
 62- A bare =go test ./...= says the timeout is too short instead of
 63  panicking eleven minutes in and blaming whichever test was running.
 64  =make test= is what CONTRIBUTING asks for now. #143
 65
 66Migrations 0036 through 0039 add the search index, the draft flag,
 67pending review comments and merge request head history; 0036 and 0039
 68backfill from what is already there. They run on daemon start.
 69
 70Two things this does not do. There is still no way to ask a particular
 71person for a review — the queue is computed from involvement, so a
 72collaborator with write access who has not touched a thread hears nothing
 73(krz/gitbay#145). And a CI build still runs as the runner's own user with
 74no container; the runner on this instance is scoped to one repository,
 75which is what keeps that narrow (krz/gitbay#144). Both are v1.14.0.
 76
 77* v1.12.0 — 2026-09-04
 78
 79The store and the push path. Dashboard queries walk an index instead of
 80sorting the table, concurrent writers wait instead of failing, expired
 81rows are swept, and a large first push no longer forks a process per
 82commit.
 83
 84- Every dashboard list scanned its table and sorted the result to take
 85  fifty rows. Reachability is correlated subqueries and cannot be
 86  indexed; the index supplies the =ORDER BY= instead, so the walk stops
 87  at =LIMIT=. On 20k issues and 20k merge requests: open issues 11.8ms
 88  to 0.8ms, open merge requests 12.1ms to 0.8ms, the review queue 15.5ms
 89  to 0.3ms, assigned issues 10.6ms to 0.04ms. The last of those also
 90  drives from =issue_assignees= rather than testing =EXISTS= against
 91  every issue. #137
 92- Concurrent writers serialise rather than failing. Every transaction in
 93  the store writes, and a deferred one takes the write lock at its first
 94  write, by which point another may hold it; SQLite answers
 95  =SQLITE_BUSY= and does not run the busy handler for that case, so
 96  =busy_timeout= could not help. Measured with eight concurrent
 97  read-then-write transactions, 44% of them failed. Beginning immediate
 98  takes the lock up front, where the timeout applies. #121
 99- =repo settings= updates no longer overwrite each other.
100  =settings_json= is one blob, and every caller read it off a repository
101  loaded earlier, changed a field and wrote it all back; two admins at
102  once and the later write put back what it had read for the other's
103  field. The read and the write happen together now, under one
104  immediate transaction. #123
105- Expired sessions and tokens are swept, and =[retention]= caps how long
106  the audit log, the activity feed, webhook deliveries and the mail
107  queue keep a row. Unset means forever, which is what every existing
108  instance gets. #122
109- The audit entry records flag names without their values. Secrets never
110  reached argv — they travel on stdin — but prose did: =--body <the
111  whole issue>= was stored verbatim, in a table nothing pruned, for a
112  repository that may be private. Identifiers are positional and
113  survive. #122
114- pre-receive on a require-signed repository forked a =cat-file= per
115  incoming commit and built one JSON message holding the whole push. A
116  50k-commit first push forked 50k processes and held the history in
117  memory twice. One =cat-file --batch= serves the push now, and the
118  daemon verifies each commit as it arrives. #100
119- The payloads other surfaces decode are named types in =control=. httpd
120  had its own copies of what the build, profile and dashboard commands
121  emit, so a field added to a command was silently absent on the page.
122  #126
123
124Migration 0035 adds three indexes; it runs on daemon start.
125
126Two changes in behaviour rather than configuration. A heavily contended
127write now blocks for up to =busy_timeout= (five seconds) instead of
128returning an error immediately — waiting is the point, but a caller that
129treated the error as normal will see a pause instead. And anything
130parsing =audit --json= for command arguments will find flag values gone;
131the flag names and the positional arguments are still there.
132
133* v1.11.0 — 2026-09-04
134
135The web catches up with the rest of the forge: search across the
136instance, a notification inbox, a compare view, linkable diff lines,
137and a pass over contrast, heading structure and the stylesheet.
138
139- Notifications are no longer mail or nothing. An =inbox= table holds a
140  row per recipient whether or not the instance has SMTP;
141  =notifications list= reads it, unread by default, and =notifications
142  read <id>... | --all= clears it. =repo watch= adds you to a
143  repository's notifications and =repo unwatch= mutes it, with a mute
144  beating every other reason to be told, including owning the
145  repository or having written the thread. The unread count rides on
146  =dashboard= and in the web rail. #113
147- =search= matches repository paths, descriptions and topics, and issue
148  and merge request titles, across everything the caller can read;
149  =/search= renders it with a field in the rail on every page, and an
150  anonymous visitor gets the public rows from the same query. Titles
151  only — body search is #114. #118
152- =/{owner}/{repo}/compare/{a}...{b}= shows what one ref adds on top of
153  another. Diff rows, files and review threads carry ids, so a line can
154  be linked to. The issue and merge request lists page at fifty with
155  the cursors the commands already emit. #118
156- CODEOWNERS gating is a setting rather than a file that happens to
157  exist: =repo settings require-codeowners <owner/name> on|off=, off by
158  default, still independent of =require-approvals=. A repository can
159  carry the file as documentation of who to ask without it gating
160  merges. #142
161- A failed form action's reason rides a one-shot cookie instead of
162  =?e=<message>=, so it no longer survives a reload or lands in
163  history. #119
164- A diff cut at 4 MiB cuts on a line boundary and says so, the
165  diffstat says its counts are partial, and a merge request's commit
166  list says "first 100 of N". #117
167- Page templates parse once with the layout at start-up, so a template
168  that does not parse fails the process rather than the first visit to
169  its page. #116
170- Markdown headings carry ids, matching org pages, and the stylesheet
171  serves a hash ETag with a day's lifetime and answers a matching
172  =If-None-Match= with 304. #132
173- Dark-mode buttons carry a visible edge (a 1 px border was 1.3:1
174  against the 3:1 non-text contrast floor), and a stored label colour
175  is held between 0.12 and 0.28 relative luminance so it clears 3:1 on
176  both grounds while keeping its hue. #120
177- Accessibility: the pin star is decoration and the word carries the
178  meaning, the refs and release asset tables have scoped column
179  headers, state filters carry =aria-current= rather than marking the
180  active one by colour alone, and a rendered README or wiki page's
181  headings move down one level so they sit under the page's own. #133
182- The stylesheet drops rules no template reaches, folds two off-scale
183  values onto the type scale, and resolves the classes templates asked
184  for and it never defined. #131
185- On a phone the tab bar wraps to a second row instead of scrolling
186  sideways with its scrollbar hidden, and the landing page says in
187  three sections what a reader, a writer and a reviewer can do. #134
188
189Migration 0034 adds =inbox= and =repo_watchers=; it runs on daemon
190start. Reinstall the CLI for =search=, =notifications= and =repo
191watch/unwatch=.
192
193Two upgrade notes beyond replacing the binary. A repository that
194relied on a CODEOWNERS file gating merges by its presence alone loses
195that gate until =require-codeowners= is set: nothing back-fills it,
196since the database cannot say which branches carry the file. And
197=search= and =notifications= are now reserved top-level routes, so a
198user or organization already holding either name keeps it but its
199profile page is shadowed by the route.
200
201* v1.10.0 — 2026-09-04
202
203Every command parses its arguments the same way, the web answers by
204exit code, and a restart no longer waits on idle connections.
205
206- One flag parser for every command: an unknown flag, a missing value or
207  too many arguments is exit 2 with the command's usage, everywhere.
208  =mr review --approve --bogus= used to report repository =--bogus= as
209  not found. #96
210- =--json= is honoured by the dispatcher's own refusals, so a script told
211  no gets the envelope. #109
212- A store failure is exit 1 and not-found is exit 3; both used to be
213  usage errors. #107
214- Web form actions answer by exit code: the 404 page for a thing that
215  does not exist, the page with the message for anything else. #106
216- Inside a clone, =gitbay mr create= takes the checked-out branch as
217  =--source=; =gitbay <noun> --help= is the server's reference for the
218  noun, flags included. #101 #130
219- Shutdown closes idle SSH connections at once and drains only sessions
220  mid-command; a store failure during key lookup no longer counts as a
221  bad key against the auth limiter; the CLI says on ssh's exit 255 that
222  a burst may have tripped it. #141
223- A merge request head the target already contains is recorded as
224  merged instead of refused; a fork is created with its parent in one
225  insert; a failed transfer revert is reported; the repository quota is
226  checked under a lock. #108
227- Issues and merge requests share their comment, reference and
228  author-or-write code. #110
229- The payloads the web and clients decode are named types: =Created=,
230  =MRCreated=, =IssueShow=, =MRShow=. JSON unchanged. #126
231- Tests: parse failures per command, non-ASCII paths (which found
232  =ls-tree= returning octal escapes, fixed with =core.quotepath=off= for
233  every git the server runs), concurrent pushes. #129
234
235Replace the binary and restart, and reinstall the CLI. No migration.
236
237* v1.9.0 — 2026-09-03
238
239The runner is no longer an admin, the web no longer reaches around the
240registry, and the CLI stops paying a handshake per command.
241
242- =keys add --scope runner= confines a key to =runner next/log/done= and
243  read-only git; the runner commands accept that scope or an admin. The
244  systemd drop-in sandboxes the runner process. gitbay.org's runner now
245  polls as a non-admin =ci= account scoped to one repository. #92
246- The web's repo create, issue create and edit, MR edit and both comment
247  forms dispatch the command the CLI runs, so the repository quota, the
248  archived-repository refusal, notifications, the body format and the
249  audit entry hold from a browser. #93
250- The CLI shares one SSH connection per instance (=ControlMaster=, five
251  minutes idle): a command costs a round trip instead of a handshake,
252  0.4 s instead of 4 s from a distant laptop. =no_multiplex = true= on
253  an instance opts out. #94
254- A disabled account is refused on every surface, and disabling revokes
255  its API tokens along with its sessions. #95
256- CODEOWNERS gates whenever the file exists on the target branch, not
257  only under =require-approvals=. #99
258- The HTTP listeners have header and idle timeouts, and SIGTERM drains
259  in-flight requests and SSH sessions before exit. #104 #105
260- =git archive= runs under a two-minute deadline and a 512 MiB cap. #124
261- Every git invocation ends option parsing before the ref, so a ref
262  shaped like an option is a bad revision and never a flag. #135
263- The admin noun is gated in the dispatcher as well as in each handler;
264  registry tests cover that and =ReadsStdin=. #127
265- An e2e test runs every =ReadOnly= command against a populated instance
266  and fails on any row it changes. #97
267- =http.trusted_proxies= attributes proxied API requests to the last
268  untrusted =X-Forwarded-For= hop for rate limiting; =email add= is
269  capped at five codes an hour per account. #136
270- A merge request head is built in the target repository, at
271  =refs/merge-requests/<n>/head=, so a fork's merge request has
272  =ci/<job>= statuses for =require-checks= to gate on. A head from
273  another repository is built without the target's secrets. #98
274- Triggers refuse deleting a user or organization that still owns
275  repositories, whatever path the delete takes. #136
276- The stylesheet's fonts are served again, and directory crumbs on blob
277  and blame pages link to the tree. #102 #103
278- The Threat-Model wiki page covers the runner. #138
279
280Replace the binary and restart, reinstall the CLI, and =make
281deploy-runner=: the runner fetches merge request refs before checkout.
282Migrations 0032 and 0033 run on start. The daemon host needs git 2.24
283or newer for =--end-of-options=.
284Operators running =gitbay-runner=: give it a non-admin account with a
285key added by =keys add --scope runner=, remove the admin key it held,
286and =make deploy-runner= to install the sandboxed unit drop-in; an
287admin key keeps working meanwhile.
288
289* v1.8.1 — 2026-09-03
290
291Markdown and org files render when opened.
292
293- A =.md=, =.markdown= or =.org= file renders on its page the way a
294  README does on the directory page, through the same renderer with
295  relative links resolved against the file's directory. =source= in the
296  action bar, or =?view=source=, shows the text as before. Every other
297  file is unchanged. #88
298- The e2e harness waits for the HTTP and git listeners as well as SSH
299  before a test starts; a test whose first act was an HTTP request could
300  be refused, which failed two otherwise green runs. #91
301
302Replace the binary and restart. No migration.
303
304* v1.8.0 — 2026-09-03
305
306The tracker's lists narrow, labels have colours you set, and the CLI's
307help is the server's.
308
309- =issue list= takes =--label=, =--assignee=, =--author= and
310  =--milestone= (a title, or =none= for issues with no milestone);
311  =mr list= takes =--author= and =--milestone=. The store narrows in
312  SQL, and the web lists take the same names as query parameters and
313  show each active filter with a link that drops it and keeps the rest.
314  Both lists had taken =--state= and nothing else, so the web's
315  filtering could never match the CLI's. #84
316- =label list= shows a repository's labels with their colour and how
317  many issues carry each; =label set <label> [--color rrggbb|'']=
318  creates a label or sets its colour; =label remove= takes it off every
319  issue. The colour column had existed since labels did and nothing
320  wrote it. The hash is optional because over bare ssh a bare =#= starts
321  a comment for the tokenizer. =issue label --add= still creates a
322  colourless label on the fly. #85
323- =gitbay help= with a prefix or =--json= runs the server's help, the
324  only place flags are written down and whose JSON is the contract;
325  bare =gitbay help= is still the local tree. Cobra's built-in help had
326  owned the word, so =gitbay help --json= failed on an unknown flag. #86
327
328Replace the binary and restart, and reinstall the CLI for the help
329change. No migration.
330
331* v1.7.0 — 2026-09-02
332
333What an open instance needs before it is open: a cap on what one
334account can take, a way out of a browser session you no longer hold,
335and accounts that never verified do not stay forever.
336
337- =limits.max_repos_per_user= caps the repositories an account owns
338  directly; =repo create=, =fork= and =import= refuse past it with the
339  numbers. =limits.max_bytes_per_user= caps their disk: a push may be no
340  larger than what the owner has left, riding the same
341  =receive.maxInputSize= as the pack cap, and is refused outright when
342  nothing is left. Organizations are not capped. Migration 0031 adds
343  per-account overrides, set with =admin user limits <name> [--repos
344  n|default] [--bytes n|default]= and shown by =admin user show=. Both
345  default to 0, unlimited, so nothing changes until set. #82
346- =registration.pending_expiry=, a duration, removes self-registered
347  accounts still unverified after that long, hourly and once at start,
348  audited as =pending.expired=. Empty keeps them, as before. #82
349- =web sessions list= shows each unexpired browser session by a short id
350  with its creation and expiry; =web sessions revoke <id>= ends one and
351  =--all= ends every one. SSH-only, matching the token commands, and
352  scoped to the caller. #83
353- A step runs in its own process group and a cancel or timeout kills the
354  group. On a host whose =/bin/sh= is dash, killing the shell alone left
355  its child holding the log pipe, so a cancelled build held the runner
356  until the child finished on its own, minutes for a test suite. The
357  wait after a kill is capped at ten seconds besides.
358- A commit with a build still queued or running is not queued again
359  when a fast-forward lands it; the v1.6.0 skip counted only a finished
360  success. #90
361
362- =golang.org/x/crypto= v0.56.0: GO-2026-6354 and GO-2026-6355 in its
363  =ssh= package, both reached through =ssh.NewServerConn= in the
364  embedded SSH server; one is a denial of service on a deadlocked
365  undecided channel.
366
367Replace both binaries and restart: =make deploy= for the daemon
368(migration 0031 adds two columns to =users= on start), then
369=make deploy-runner= for the process-group kill.
370
371* v1.6.1 — 2026-09-02
372
373A cancel reaches a build in its clone.
374
375- The runner honoured a cancel only in its step loop; a build cancelled
376  during its clone or checkout ran git to completion first, which on a
377  loaded host was long enough for the v1.6.0 test to fail on the CI
378  host while passing locally. One =runStep= now drives the clone, the
379  checkout and each step with the cancel signal and the deadline, and
380  checks the signal before starting at all. The runner logs how its log
381  session ended when that was not a cancel.
382
383Replace the runner: =make deploy-runner=. The daemon is unchanged from
384v1.6.0.
385
386* v1.6.0 — 2026-09-02
387
388The v1.4.0 admin surface answered questions about accounts. This one
389answers questions about the machinery: which runner is alive, what is
390stuck, whether last night's backup exists, and it lets an operator stop
391a build instead of waiting it out.
392
393- A build a runner claimed and never reported is failed by the
394  scheduler's minute tick, with no runner involved. It used to happen
395  only when some runner polled again, so a dead sole runner left its
396  builds running forever. =GITBAY_STALE_BUILD_DEADLINE= shortens the
397  deadline for tests. #75
398- Runners are visible. Migration 0030 adds =runner_seen=: one row per
399  runner account with its last poll, the =-repos= scope it asked for,
400  and the build it holds. =admin runners= lists them, over SSH and on
401  the host. #76
402- =GET /healthz=: whether the database answers and which commit serves,
403  no auth, no repository data, 503 when the database does not answer.
404  =healthz= joins the reserved names. #77
405- The host monitor's hourly reading carries the age of the newest full
406  backup and database snapshot, alerting at 25 and 2 hours, and the
407  daemon's own =/healthz= answer read through =site_url=. Both ride the
408  journald line and the webhook body. #78
409- =admin stats= reports =lfs_bytes=. =admin gc --lfs= scans every
410  repository's objects for LFS pointers and removes stored objects none
411  names, keeping anything younger than a day since git lfs uploads
412  before it pushes. #79
413- =admin backup --verify <archive>= reads an archive back: SQLite's
414  integrity check on the snapshot, and the repositories it names against
415  the archive's. A database-only archive says so. Damage or a missing
416  repository exits non-zero. #80
417- A commit that already passed a job on another branch is not built
418  again when a fast-forward lands it. Merging the six-layer v1.6.0 stack
419  had queued eighteen jobs for commits that had each just gone green.
420  Failed or abandoned builds still re-queue. #90
421- =build cancel <owner/name> <n>= withdraws a queued build or ends a
422  running one. For a running build the server closes the runner's log
423  session, the runner kills the step within seconds, and its late report
424  changes nothing. The commit status goes back to the passed result from
425  another build of the same commit when one exists, else reads
426  =cancelled=. Needs write access.
427- Deploys copy with =rsync --partial=, so a transfer the host's load
428  stalled resumes, and =make deploy-runner= installs a systemd drop-in
429  (=Nice=10=, =CPUWeight=30=, =IOWeight=30=) so a build never starves the
430  host's sshd again.
431
432Replace both binaries and restart: =make deploy= for the daemon, then
433=make deploy-runner= for the runner, which carries its half of running-
434build cancellation and installs the drop-in. Migration 0030 adds the
435=runner_seen= table on start. The monitor change ships in
436=deploy/cloud-init.yaml=; an existing host takes it by hand.
437
438* v1.5.0 — 2026-09-02
439
440Merge requests stack.
441
442- A merge request whose target is the source branch of another open
443  merge request in the same repository is stacked on it. Nothing is
444  stored and no flag exists; the forge reads the stack from the
445  branches. =mr create= says =stacked on !A= when it applies, =mr show=
446  carries =stacked_on= and =stacked=, =mr list= rows carry =stacked_on=,
447  and the page says both directions in the header. #87
448- When the lower merge request merges, everything stacked on it is
449  retargeted onto what it merged into, with a system comment naming the
450  merge and its reviews kept: after a fast-forward or merge commit the
451  diff against the new target is the diff they were of. A squash or
452  rebase merge under a stack is refused, naming the stack, since it
453  would rewrite the commits the stack builds on.
454- The first stack merged on gitbay.org was the six merge requests of
455  v1.6.0, bottom-up, with no =mr retarget= typed. The wiki's
456  Stacked-MRs page walks through it.
457
458Replace the binary and restart. No migration.
459
460* v1.4.0 — 2026-09-01
461
462Until now the instance had one operator surface: root on the host. Every
463question about the instance itself — who is on it, what is stuck, what a
464spam repository is doing — needed a shell on port 2222. This release
465gives an instance admin the same answers over SSH, and one page on the
466web.
467
468- =admin user list= pages accounts by username with
469  =--state active|pending|disabled|admin=, each row carrying its state
470  and =last_seen=, the newest use of any of its SSH keys or API tokens.
471  =admin user show <name>= adds the keys with their last use, each
472  address with how it was verified, PGP keys, org roles, owned
473  repository count, API token names and live browser sessions. Both are
474  SSH-only and refused to non-admins, like =audit=. #69
475- =admin user promote|demote=. The only way to admin was
476  =admin user create --admin=; an existing account could not be raised
477  and an admin could not step down. Demoting the last admin is refused
478  inside the transaction that counts them. The host-local twin is the
479  recovery path when no admin key is reachable. #70
480- Repository overrides for moderation: =admin repo list= with size and
481  last push, and =admin repo archive|unarchive|visibility|delete=. Policy
482  still knows nothing about instance admin — a private repository
483  answers not-found to an admin as before — so each override skips the
484  access check explicitly and writes its own =admin repo.<action>= audit
485  row. #71
486- =gitbayd admin= dispatches into the registry. User create, disable,
487  enable and delete, email verify, invite and stats were reimplemented on
488  the host; they now live in the registry, SSH-only and admin-gated, and
489  the host binary runs them as the host — an admin context with no
490  account behind it, so its audit rows say =source: host= where a
491  session says the key fingerprint. Invite and stats gain an SSH twin by
492  the same move. =backup=, =gc= and the backfills stay host-local. #72
493- =audit= filters: =--actor <user>= or =--actor -= for actorless rows,
494  =--action <prefix>=, and =--since= as a duration (=30m=, =24h=, =7d=)
495  or a date. =gitbayd admin audit= takes the same flags and =--json=. #73
496- =dashboard= carries a =queues= block for admins: per worker —
497  webhooks, mail, mirrors, builds, dependency checks — the pending,
498  retrying and dead-lettered counts, the oldest pending age, and the
499  retrying or failed rows themselves, capped at twenty each. The mail
500  queue was readable nowhere before. =/admin= renders the block by
501  dispatching =dashboard=; non-admins get a 404 and no rail link. #74
502- =gitbayd admin config show= prints the configuration in effect as
503  TOML, defaults filled in and =smtp_pass= redacted, so a support
504  question starts from what runs rather than what was written. #81
505- Build badges are served as PNG at =badge/build.png= as well as SVG,
506  for places that will not render SVG.
507- Host monitoring writes its reading to journald on every run and exits
508  non-zero on an alert, so an unset webhook no longer looks like a
509  healthy host; it reads the ACME cache where it actually lives and
510  reports the soonest expiry. govulncheck runs as its own CI job. The
511  database is snapshotted hourly by =gitbay-db-backup.timer=, keeping 48,
512  alongside the nightly full archive; archives inherit the database's
513  mode rather than the umask default. #28
514- A runner whose log stream drops no longer fails the build it was
515  recording. #67
516- =go.yaml.in/yaml/v3= and =golang.org/x/net= bumped. #60
517
518Replace the binary and restart. No migration. The =gitbay-db-backup=
519timer and the monitor changes ship in =deploy/cloud-init.yaml= for new
520hosts; an existing host takes them from there by hand.
521
522* v1.3.0 — 2026-08-31
523
524A runner took every repository's work, which decided where you could run
525one.
526
527- =runner next= takes optional =owner/name= arguments and =gitbay-runner=
528  takes =-repos=, so a runner claims builds only for the repositories it
529  names. Naming none is the old behaviour, so an existing runner is
530  unaffected. This is what makes a runner outside the server practical: one
531  on a machine that should build a single project no longer picks up a
532  build belonging to someone else, which with open registration need not be
533  anyone the operator knows. The scoping is what the runner asks for rather
534  than an ACL the server holds over it — a runner account is admin by
535  necessity, so the boundary is the operator choosing how to start it. #66
536
537Replace the binary and restart. Runners want the new binary too, though an
538old one keeps working unscoped.
539
540* v1.2.1 — 2026-08-31
541
542Merging landed commits without running anything.
543
544- A merge moves the target ref with a direct ref update, so it never
545  reached post-receive and none of the ref-update work fired: no =push=
546  event for webhooks to subscribe to, and no builds. Pushing a commit to a
547  branch ran the whole =.gitbay/ci.yml=; merging the identical commit ran
548  nothing. Both now happen in the merge path, with the build queueing
549  shared between it and post-receive rather than living in one of them.
550  #65
551
552Replace the binary and restart.
553
554* v1.2.0 — 2026-08-31
555
556A merge request said what its state was and almost nothing about when it
557got there. It now keeps time.
558
559- Reviews and checks carry the moment they last said something, on the
560  merge request page and in =mr show=. A =ci/<job>= check also reports how
561  long its build ran, so the timing of a run is readable without opening
562  it. Checks posted through =status set= have no build and report only the
563  time. !137
564- A merged or closed merge request names who resolved it and when. The
565  header stated "X wants to merge" whatever the state; it now says "X
566  merged A into main on <date>", or "closed this without merging", and
567  drops the claim entirely for a row that carries no stamp rather than
568  inventing a time.
569- =mr show= gains =merged_at=/=merged_by= and =closed_at=/=closed_by=, a
570  =created_at= per review, and =updated_at= plus =duration= per check, in
571  both JSON and text. Additive: nothing existing changed shape.
572- The iOS client renders all of it as of krz/gitbay-ios!37.
573
574Replace the binary and restart. Migration 0029 adds four columns to
575=merge_requests= and backfills the merge stamp for merge requests already
576merged, reading the =mr.merged= events. A merge with no such event to read
577— an import, or a row older than its events — keeps no stamp, and every
578surface says nothing about when it happened rather than guessing.
579
580* v1.1.0 — 2026-08-31
581
582Every release until now answered questions. This one notices something
583on its own: that a repository's dependencies have moved, and says so
584without being asked.
585
586- Dependency update checks, opt-in per repository. A daemon worker reads
587  the manifests on the default branch, asks the ecosystem's registry what
588  the current release is, and maintains one issue per repository — opened
589  when something falls behind, rewritten when the set changes, closed once
590  nothing is behind. No package manager runs, so it needs no CI runner and
591  no configuration beyond turning it on. #58
592  - =go.mod= against proxy.golang.org, =package.json= with
593    =package-lock.json= against npm, =Cargo.toml= with =Cargo.lock=
594    against crates.io, =requirements.txt= and =pyproject.toml= against
595    PyPI. A lockfile wins where both exist. A requirement naming a set
596    rather than a release — a range, a wildcard, a git or path source — is
597    skipped, since a range that already admits the newest release is not
598    news.
599  - =repo deps enable|disable|status=, a toggle on the repository settings
600    page, and the same three over the JSON API.
601  - Off by default, because checking a private repository tells a public
602    registry what it depends on. That is the owner's disclosure to make.
603    =[deps] check_interval_hours= sets the cadence, default 24.
604  - The issue is authored by a =gitbay-bot= account, so the existing
605    notification mail reaches the repository's owner rather than excluding
606    them as the actor. Its table is padded to its columns, which a
607    renderer ignores and a mail client needs. #61
608- =help= takes a prefix — =help mr= narrows the registry to one noun — and
609  every command now documents its arguments, so the server answers "what
610  are the flags" instead of being guessed at. #57
611- Web: settings rows end in one column of controls, checkboxes drawn at
612  the height of the inputs and buttons they sit beside #59; an added line
613  keeps its leading dash in the diff; a contributor's several verified
614  addresses collapse to one row #56.
615
616Replace the binary and restart. Migration 0028 adds two tables and, when
617the name is free, the =gitbay-bot= account. An instance already using that
618name for a user or an org keeps what it has: the account is not created,
619and dependency checks report that as the reason they cannot open an issue
620rather than the migration failing and the daemon not starting. #64
621
622* v1.0.1 — 2026-08-30
623
624Two CI fixes found by running orgo's release pipeline on this instance.
625
626- A runner killed between claiming a build and reporting it left the build
627  =running= forever, and the commit's =ci/<job>= status pending with it.
628  =runner next= now fails builds past a 90-minute deadline — longer than the
629  runner's own =-timeout= — and resolves their commit status. #53
630- =gitbay keys add= and =gitbay repo deploy-key add= take stdin as a bare
631  =< key.pub=, but only forwarded it when =--file -= appeared in the
632  arguments, so both sent an empty body and rejected input the SSH API
633  accepts. #55
634
635Replace the binary and restart.
636
637* v1.0.0 — 2026-08-26
638
639The web finishes the job #35 set it: reading, reviewing and responding,
640with the CLI still the complete interface. Every capability exists over
641SSH, every web write dispatches the same control command, and anything
642whose input is a credential stays on the command line. The [[https://gitbay.org/krz/gitbay/wiki/Parity][Parity]] page in
643the wiki is the maintained matrix and says which rows are deliberately
644CLI-only.
645
646- Diff view: one foldable section per file with line-number gutters,
647  per-file stats, rename and binary handling, and syntax highlighting
648  run per hunk per side so multi-line constructs lex as real code.
649  Commit and merge request pages share it; review threads anchor
650  inline.
651- Repository facts on the code page: commit, branch and tag counts,
652  detected license, latest release, build status, a language census by
653  tracked bytes, and contributors resolved to accounts by verified
654  email. All derived from git at render time.
655- Account settings on the web: SSH keys with scope, OpenPGP keys, and
656  email addresses. Public keys are the only credential-shaped input the
657  web accepts — they are not secret, and a new user needs one
658  registered before the CLI is reachable to them. Token minting and
659  account export stay SSH-only.
660- Organizations are run from their page: membership and roles, teams,
661  team members, and team repository grants, for org admins.
662- Commit log shows each commit's combined check status and gains a path
663  filter, so per-file history is reachable without editing the URL.
664- Issue references from commit messages read "referenced in commit
665  <sha> by <author>", linking the author when their email is verified
666  here.
667- The rail's focus ring uses the shell's own mark: the light scheme's
668  accent was a dark blue ring on a black rail.
669
670No migrations. No new config.
671
672Upgrading from v0.5.0 is replace-the-binary-and-restart.
673
674* v0.5.0 — 2026-08-26
675
676A design pass and a parity pass. The web stops being a read-only
677mirror of the CLI without becoming the place you are expected to work.
678
679- New design: a black shell with a persistent left rail carrying
680  cross-repo state (pinned repos, review queue), the repo header
681  rendered identically on every tab so navigation never moves, sharp
682  lines, self-hosted IBM Plex, and code blocks that read against both
683  color schemes. Tree listings sort directories first and carry each
684  file's last commit; diffs, inputs and controls were reworked to
685  match.
686- Web parity with the CLI, dispatched through the same command
687  registry the CLI and JSON API use — every web write is the
688  equivalent =gitbay= command with =--source web=:
689  - merge requests: review, resolve threads, merge, close, and open a
690    new MR from the browser
691  - issues: state, labels, assignees, milestones
692  - repositories: settings, branch protection, visibility
693  - releases: create and edit; builds: trigger a job
694  Commands marked SSH-only still refuse over the web: build secrets,
695  mirror tokens, domain claims, token minting, deletion and transfer.
696- A dashboard that answers "what needs me": review queue, assigned
697  issues, pinned repos, and an activity feed. Author names resolve to
698  accounts and link to profiles wherever commits appear.
699- Build status badges at =/{owner}/{repo}/badge/build.svg= for public
700  repos.
701- =[web] title= sets the instance's display name, separate from the
702  hostname commands are pasted with.
703- =make build/test/deploy= targets.
704- Fixes: the mobile tab strip scrolls sideways only, long commit
705  subjects no longer overflow on narrow screens, the shell fills the
706  viewport with the line-length cap moved onto prose, and the account
707  cell lines up with the page footer.
708
709No migrations. New config: =[web] title=.
710
711* v0.4.0 — 2026-08-25
712
713- Git LFS: standard clients work over both transports.
714  =git-lfs-authenticate= joins the SSH dispatcher (deploy keys
715  included; download needs read, upload write), minting stateless
716  repo- and operation-scoped tokens for the batch API and basic
717  transfers. Anonymous HTTPS downloads for public repos; uploads
718  verified against size and sha256 before landing. Storage is
719  content-addressed under =[lfs] root= behind a small interface an
720  S3-compatible backend can drop into; =[lfs] max_object_bytes= caps
721  objects (512MB default).
722- Build failures mail the repo's notify targets with the log tail and
723  build link — failed scheduled jobs reach an inbox.
724- =release edit= updates a release's title and notes (absent flags
725  keep their field); omaha-style CI note rebuilds work again.
726- Syntax highlighting follows the color scheme: class-based chroma
727  with light and dark palettes, the light-pinned code background is
728  gone, and markdown fences and org src blocks highlight too. The UGC
729  sanitizer admits only chroma's token-code classes.
730
731No migrations. New config: =[lfs] root=, =[lfs] max_object_bytes=.
732
733* v0.3.0 — 2026-08-25
734
735- CI: =.gitbay/ci.yml= jobs run as builds claimed by =gitbay-runner=
736  over SSH (admin-only runner protocol; statuses feed =require-checks=).
737  Per-repo secrets set over stdin and injected into build environments;
738  cron schedules (server-local time) and tag-glob triggers, mutually
739  exclusive per job; =build list/show/log/trigger= and a builds tab.
740- Pages: public repos' =pages= branches served on =<owner>.<domain>=
741  (=[pages] domain=), custom domains with DNS TXT ownership challenges
742  and 7-day expiry for pending claims, per-subdomain on-demand ACME.
743- Wikis (=.wiki= companion repos, access mirrors the parent) and teams
744  within orgs (members-role scoping, per-repo team grants).
745- Activity graphs on user and org pages, backfillable
746  (=admin backfill-activity=); commits attributed by verified author
747  email, deduped by sha.
748- MR pages list the commits the MR carries; =mr show= gains a commits
749  section.
750- Per-file history: =?path== on the web log, =--path= on =repo log=,
751  history link on blob pages.
752- Mirror status surfaced in =repo show= and the repo header
753  (admin-only), with sync errors visible; tag-only pushes now schedule
754  mirror syncs.
755- Rendering: GFM tables/strikethrough/autolinks/task lists, blob image
756  previews, raw serves images with real content types (README images
757  render under nosniff), 0BSD license recognition, repo website links,
758  compact dashboard pins.
759- =admin user delete= for accounts that anchor nothing, with named
760  blockers otherwise.
761- Fixes: wiki pages no longer overflow on mobile (iOS font-inflation
762  trigger), GHSA-free deps, secret values pipe correctly through the
763  CLI.
764
765Migrations 0020-0025 apply on start. New config: =[pages] domain=.
766The runner is a new binary (=gitbay-runner=); see the wiki's Admin
767guide for setup. Stress-tested against an import of git.git (82k
768commits): see the wiki's Performance page.
769
770* v0.2.0 — 2026-08-24
771
772- Deploy keys: repo-bound CI keys (=repo deploy-key=), ro/rw, rename- and
773  transfer-proof.
774- Commit statuses (=status set/list=), combined state on MR pages, and a
775  =require-checks= merge gate.
776- Email notifications for issue and MR activity (participants with
777  verified addresses; never the actor).
778- Inline review threads on MR diffs (=mr diff-comment/threads/resolve=),
779  stale on force-push, =require-resolved= merge gate.
780- Required approvals with CODEOWNERS (=require-approvals=; latest review
781  wins, author excluded) and a =require-resolved= gate; merge gate order
782  is checks → approvals → CODEOWNERS → resolved threads → signatures.
783- Web design revamp: token-based stylesheet (light+dark), wordmark and
784  favicon, aligned layout grid, card-based listings, designed 404,
785  mobile pass.
786- Cross-references and mentions: =#N=, =!N=, =owner/name#N=, =@user=
787  autolink in issue/MR text, viewer-aware for private repos.
788- Archived repositories (read-only with badge) and repo topics.
789- Blame view with signature-aware attribution and 1000-line pages.
790- Repository search (name/description/topic) and per-repo code search
791  (=repo grep=, web search tab); blob line anchors.
792- Homepage: dashboard for logged-in users (pinned repos via =repo pin=,
793  open MRs and issues involving you), landing page for visitors, full
794  public listing at =/explore=; MR diffs collapsed by default.
795- Milestones (=milestone create/list/close=, =issue/mr milestone=) with
796  web progress; issue templates from =.gitbay/issue-template*.md=
797  (CLI =$EDITOR= prefill and web form).
798- Issue actions from commit messages landing on the default branch:
799  =closes/fixes/resolves #N= closes, bare =#N= leaves a reference
800  comment; once per issue+commit.
801- Vanity Go imports: =[go_import]= config serves go-import meta tags, so
802  =go install gitbay.org/gitbay/cmd/...@latest= works.
803- Release script: =deploy/release.sh <tag>= builds reproducible
804  linux/amd64, linux/arm64, and darwin/arm64 binaries with SHA256SUMS.
805- Repository maintenance: =admin gc= (repack/prune, per-repo sizes),
806  =admin stats= (counts + disk usage), weekly =gitbay-gc.timer=.
807- Releases: tag-anchored notes and binary assets (=release= commands,
808  assets over SSH stdin/stdout, web releases tab with downloads).
809- GitHub history import: =repo import-issues= brings issues and PRs
810  (as merged/closed MRs) with comments, labels, and state, attributed
811  inline and resumable.
812- Push and pull mirroring (=repo mirror=): background sync, read-only
813  pull mirrors, per-mirror status; credentials server-side, SSRF-guarded.
814- Web signup at =/register= for open and invite instances.
815- Audit log (=audit=, =gitbayd admin audit=): every mutating command
816  with source key fingerprint, registrations, force-pushes, auth
817  failures. Hardening: per-IP auth-failure throttling
818  (=ssh_auth_rate=), =max_pack_bytes= enforced, =admin user
819  disable/enable=.
820- Account migration: =gitbay migrate --from <host>= (bundle
821  export/replay + client-side git mirror); =gitbay auth export= as a
822  user-level backup.
823- Editable issues and MRs (=issue edit=, =mr edit=, web forms).
824- Commit references appear as system messages with linked shas.
825- Design: top nav, repo listing rows (topics, license, last updated),
826  file table headers, README relative-link resolution, branch
827  dropdown, web pinning, org owner picker, label filters, linked
828  usernames and commit parents, =/privacy= page, blue accent.
829
830Upgrade notes: migrations 0006–0019 apply on start. No config changes
831required; =[go_import]=, =[mirrors]=, =web.privacy_notice=, and
832=web.mode = "accounts"= are opt-in.
833
834* v0.1.0 — 2026-08-24
835
836First tagged release: the complete CLI-first forge. SSH control plane
837(bare-OpenSSH usable), git over SSH/HTTPS/git-daemon, repos, issues,
838merge requests (ff/merge/squash/rebase with signature policy), OpenPGP
839and SSHSIG verification with retroactive re-verification, orgs, repo
840import, web UI (view-only or accounts mode), registration with invites
841and SMTP, HTTPS/JSON API with SSH-minted tokens, webhooks, backups,
842ACME TLS, systemd deployment.