v0.15.0 - 2025-08-16

Added

• doc: add SECURITY.md
• doc: Added colorscheme and youtube plugins, and shirley-template

Changed

• refactor video plugin
• github actions: update/pin all base images to ubuntu-24.04
• github actions: workaround for ondrej/php apt repository update error
• github actions: re-enable currently supported PHP versions in the test matrix
• docker: udpate base alpine image to v3.19.7

Fixed

• Fix PHP message: TypeError: get_headers(): Argument #2 ($associative) must be of type bool, int given
• doc: fix typos and inconsistencies

Security

• fix insufficient filename sanitization in bookmarks import form
• fix reflected XSS via searchtags parameter
• keep private links number private

v0.14.0 - 2024-12-08

Added

• doc: add third party plugins clickcounter and targetblank by @waschinski in #2063
• doc: add shaarli-offen plugin to Community & related software by @waschinski in #2064
• doc: add Shaanti browser extension to Community & related software by @7Ds7 in #2078
• doc: add image-upload plugin to Community & related software by @bttrx in #2097
• doc: add shaarli2bluesky plugin to Community & related software by @kalvn in #2111
• doc: server configuration: allow accessing and caching SVG assets by @nodiscc in #2074
• doc: usage: document "Sticky" mode by @nodiscc in #2055
• doc: troubleshooting: add solution for Allowed memory size of xxx bytes exhausted by @nodiscc in #2083
• doc: usage: add opensearch/browser search engine integration instructions by @nodiscc in #2096
• doc: troubleshooting: list more cases in which title retrieval fails by @nodiscc in #2060

Changed

• frontend: improve QR code CSP compliance by @thican in #2103
• docker: update base alpine linux docker image to v3.19.4 by @nodiscc in #2051, #2054, #2067, #2088
• github actions: don't attempt to push docker image from forks by @nodiscc in #2043
• doc: changelog: minor style tweaks/standardization/spacing by @nodiscc in #2106
• github actions: run daily trivy security scans on release docker image, composer/yarn dependencies by @nodiscc in #2047

Fixed

• PHP 8.x intl incompatibility: failback C locale with en_US by @ArthurHoaro in #2044
• fix description retrieval when page charset is not UTF-8 by @sokai in #1992
• fix metadata fetching for YouTube URLs by @puppe in #2069
• fix wrong date format when language is not english (Alpine icu package split) by @henschi in #2102
• doc: fix typos in special data example by @bttrx in #2098
• doc: fix broken link to 3rd party plugins by @BoboTiG in #2059
• ensure tags are unique when renaming by @kcaran in #2086
• doc: fix link to v0.13.0 release by @nodiscc in #2107
• tools: update trivy security scanner to v0.56.2 by @nodiscc in #2070, #2072, #2089, #2100

Removed

• remove updates.check_updates_branch setting by @ArthurHoaro in #1971
• doc: Remove remaining references to stable branch by @ArthurHoaro in #2042
• doc: contributing: IRC no longer available @nodiscc in #2082
• doc: community and related software: remove urlextern plugin (archived project) by @nodiscc in #2077

Security

• frontend: update vulnerable npm dependencies (npm audit fix) by @kcaran in #2087, @nodiscc in #2056, #2101

Full Changelog: v0.13.0...v0.14.0

Major changes:

• Security: Fix XSS vulnerability in tag search
• Drop support for PHP 7.1, 7.2 and 7.3

Added

• Docker build: add ARM64 platform and bump Github action version by @ArthurHoaro in #1965
• github actions: build OCI images that contain both amd64 and armv7 by @nodiscc in #1962
• Expose tags_separator config through /info API by @amadeous in #1997
• tools: github actions: build docker images on pull requests by @nodiscc in #2014
• doc: server configuration: add PHP 8.2 to PHP compatibility table by @nodiscc in #2021
• Add shaarli-stack theme to Community-and-related-software.md by @dajare in #2028
• doc: document general.download_max_size/timeout configuration settings by @nodiscc in #2036
• doc: troubleshooting: automatic title retrieval fails when it is set by javascript by @nodiscc in #2037

Changed

• doc: update release procedure (merge the latest release to the release branch) + use the release branch for latest release version detection by @nodiscc in #1960
• Update german translation by @bschwede in #1969
• Update Server-configuration.md by @reinboldg in #1973
• Update Community-and-related-software.md by @nlegaillart in #1984
• doc: improve docs on usage of OR operator in tags search by @nodiscc in #1987
• docker: nginx: listen on IPv6 in addition to IPv4 by @cerebrate in #1983
• Doc update, WebSub (formerly PubSubHubbub) plugin by @clach04 in #2008
• doc: community/related software/integration with other platforms: add link to shaarli debian package by @nodiscc in #2018
• replace mkdocs with sphinx/myst-parser for HTML documentation generation, documentation improvements by @nodiscc in #2025

Fixed

• Makefile: Use GNU tar if available by @ArthurHoaro in #1957
• Support: ignore disk_free_space if the function is unavailable by @ArthurHoaro in #1970
• Documentation: fix broken link to 3rd party plugins by @ArthurHoaro in #1975
• Fix autofocus: load bulk action input on linklist only by @ArthurHoaro in #1976
• doc: fix mkdocs build warnings/relative links by @nodiscc in #2015
• correct usage of hyphens in all occurences of 'super fast, database-free' by @nodiscc in #2003

Removed

• Drop support for PHP 7.1, 7.2 and 7.3 by @ArthurHoaro in #1958
• doc: themes: remove unmaintained themes by @nodiscc in #2030
• doc: remove bountysource badge by @nodiscc in #2035

Security

• Fix XSS vulnerability in tag search by @ArthurHoaro in #2039
• tools: run trivy vulnerability scanner on the 'latest' docker image by @nodiscc in #1980
• github actions: fix value of TRIVY_TARGET_DOCKER_IMAGE by @nodiscc in #1989
• tools/CI: scan repository with trivy security scanner (yarn.lock, composer.lock) by @nodiscc in #1998
• tools/tests: update trivy to v0.44.0 by @nodiscc in #2012
• docker: update base alpine docker image to 3.16.7 by @nodiscc in #2024

Full Changelog: v0.12.2...v0.12.3

Docker Changes

Docker: use ghcr.io/shaarli/shaarli as Docker image instead of shaarli/shaarli.
The :master Docker image has been removed, please use :latest instead.
The :stable Docker image has been removed, please use :release instead.

Added

• Bulk action: add or delete tag to multiple bookmarks
• New Core Plugin: ReadItLater
• Plugin system: allow plugins to provide custom routes
• Support search highlights when matching URL content
• Support for OR (~) and optional AND (+) operators for tag search
• Russian translation
• Chinese translation
• Export:
  • Export: set a bookmark's LAST_MODIFIED attribute to its update timestamp
  • Export: set a bookmark's PRIVATE attribute using an integer value
• Add an additional free disk space check before saving the datastore
• curl: support HTTP/2 response code header
• CI:
  • Build and push Docker images through Github Actions
  • push container images to github registry in addition to dockerhub
• Documentation:
  • Add '206 not acceptable' to the Troubleshooting section
  • Add mention to Shaarli Archiver
  • doc: add note to adjust proxy timeouts or PHP max execution time
  • doc: shaarli configuration: mention file:/// URIs
  • add "formatter" key to example config.json.php

Changed

• docker latest: replace dev in shaarli_version.php with the latest commit
• Daily RSS Cache: invalidate cache base on the date
• Update Japanese translations
• Update German translations
• Templates: Inject current template name
• format_date: include timezone in IntlDateFormatter object
• Handle pagination through BookmarkService
• autocapitalize off for username input
• More intuitive label for plugin checkboxes
• Simple and uniform localized website title
• Use rewrited version of Netscape Bookmark Parser
• tests/makefile: rewrite translate target to be compatible with busybox
• PubSubHub Plugin: make 1 external call per request
• Docker:
  • newer alpine (for newer PHP) and apk upgrade
  • Dockerfile.armhf: upgrade python2 -> python3
  • Dockerfile: add php8-gettext package
  • update s6 service definition to use php-fpm8
  • install php8-ldap in Docker images
• CI:
  • use Github Action instead of Travis CI
  • use the yarnpkg command instead of yarn
  • tools: github actions: fix PHP 8.0 tests
  • github actions: add tests for PHP 8.2
• Documentation:
  • apache: explicitely ste index.php as DirectoryIndex
  • bookmarklet is now working on github.com
  • LDAP login support, update php requirements list
  • installation/tests: clarify build tools installation procedure
  • doc: PHP extensions are also required for development
  • doc: move OCI images hosting to ghcr.io

Fixed

• Error handling if the datastore mutex is not working
• Synchronous metadata retrieval is failing in strict mode
• Improve metadata extraction
• Typo: 'Authentication' ->
• default_colors plugin: update CSS file on color change
• API: POST/PUT Link - properly parse tags string
• Error when using bulk shaare with a single URL
• Bulk Shaare:
  • use unique HTML ID
  • error with a single URL
  • redirection with ending slash
• Bug when trying to access ATOM feed without bookmarks
• Documentation build
• pubsubhubbub hub link in RSS / Atom.
• Monthly views previous/next month links during month
• Resolve PHP 8.1 deprecation warnings
• Fix PHP 8 incompatibility with debug mode enabled
• Fixed Roboto-Regular and Roboto-Bold font declarations
• template/vintage: fix typo in visibility selection link
• Do not display deprecated warnings by default
• Fix a bug when using '/' as a tag separator
• Fix Logger exception: gracefully handle permission issue
• Documentation:
  • plugins.md: fix link casing

Removed

• Daily RSS: Remove relative description (today, yesterday)
• Documentation:
  • remove the markdown plugin from the plugins list
  • remove duplicate "general" key in example config.php.json

nginx (#1628) and Apache (#1630) configurations have been reviewed. It is recommended that you
update yours using the documentation.
Users using official Docker image will receive updated configuration automatically.

Added

• Bulk creation of bookmarks
• Server administration tool page (and install page requirements)
• Support any tag separator, not just whitespaces
• Share a private bookmark using a URL with a token
• Add a setting to retrieve bookmark metadata asynchronously (enabled by default)
• Highlight fulltext search results
• Weekly and monthly view/RSS feed for daily page
• MarkdownExtra formatter
• Default formatter: add a setting to disable auto-linkification
• Add mutex on datastore I/O operations to prevent data loss
• PHP 8.0 support
• REST API: allow override of creation and update dates
• Add strict types for bookmarks management

Changed

• Improve regex and performances to extract HTML metadata (title, description, etc.)
• Support using Shaarli without URL rewriting (prefix URL with /index.php/)
• Improve the "Manage tags" tools page
• Use PSR-3 logger for login attempts
• Move utils classes to Shaarli\Helper namespace and folder
• Include php-simplexml in Docker image
• Raise 404 error instead of 500 if permalink access is denied
• Display error details even with dev.debug set to false
• Reviewed nginx configuration
• Reviewed Apache configuration
• Replace vimeo link in demo bookmarks due to IP ban on the demo instance
• Apply PSR-12 on code base, and add CI check using PHPCS

Fixed

• Compatiliby issue on login with PHP 7.1
• Japanese translations update
• Redirect to referrer after bookmark deletion
• Inject ROOT_PATH in plugin instead of regenerating it everywhere
• Wallabag plugin: minor improvements
• REST API postLink: change relative path to absolute path
• Webpack: fix vintage theme images include
• Docker-compose: fix SSL certificate + add parameter for Docker tag

Removed

• config.json.php new lines in prefix/suffix to prevent issues with Windows PHP

Save you data/ folder before updating!

Added

• Thumbnailer: add soundcloud.com to list of common media domains
• Markdown rendering is now integrated into Shaarli core
• Add autofocus on tag cloud filter input
• Japanese translations
• Japanese translation: add language to admin configuration page
• Support for PHP 8.0
• Support for local anchor URL (starting with #)
• LDAP authentication
• Encapsulated PageCacheManager
• Docs:
  • add screenshots of all pages
  • section about mkdocs
  • Ulauncher extension
• CI: run against PHP 7.4
• Added $links_per_page variable to template and display on default
• Inject BookmarkServiceInterface in plugins data
• Add manual configuration for root URL
• Added PATCH to the allowed Apache request methods.
• REST API: compatibility with ionos Apache's headers

Changed

• Introduce Bookmark object and Service layer
  • Save bookmark as objects in the datastore
  • Handle bookmark as objects across the whole codebase (except templates and plugins)
• Process all Shaarli page through Slim controller, with proper URL rewriting (see #1516)
• Docs: the entire documentation has been reviewed, updated and improved, thanks to @nodiscc!
• ATOM feed: use instance name as author name instead of URL
• Updated French translation
• Default colors plugin: generate CSS file during initialization
• Improve default bookmarks after install
• Upgrade all front end dependencies and webpack build
• Default theme: Make tag cloud/list views buttons more obvious

Fixed

• Undefined index: thumbnail in daily page
• Undefined index: thumbnail on OpenGraph headers
• Undefined index: updated on linklist
• Make sure that bookmark sort is consistent, even with equal timestamps
• Code PHP version check as requirement bumped to PHP 7.1
• Thumbnail images lazy loading
• Markdown plugin: fix RSS feed direct link reverse
• Fix RSS permalink included in Markdown bloc
• Demo plugin: multiple typos
• Makefile target for releases
• Makefile target for html documentation
• Session cookie setting being set while session is active
• Deprecated use of implode
• Division by zero in tag cloud
• CI: deprecated linux distribution and sudo directive
• Docker build: gcc is no longer included in python alpine image
• Default template: display pin button in mobile view
• Pinned bookmarks are not longer displayed first in ATOM/RSS feeds
• Docs:
  • Outdated Docker documentation for stable branch
  • Outdated links
  • Plugin description in meta files
• docker-compose.yml: pin traefik image to 1.7-alpine

Removed

• Markdown plugin
• Docs:
  • emojione & twemoji removed
• Makefile: remove static_analysis_summary from all: target
• doc/Makefile: remove references to composer update

Fixed XSS vulnerabilities introduced in v0.12.0-beta.

Save you data/ folder before updating!

This is a beta version containing major changes, including new URLs for Shaarli and datastore format update.
Be aware that by using a beta version you might encounter bugs, and that 3rd party themes or plugins might not be compatible.

Added

• Thumbnailer: add soundcloud.com to list of common media domains
• Markdown rendering is now integrated into Shaarli core
• Add autofocus on tag cloud filter input
• Japanese translations
• Support for local anchor URL (startting with #)
• LDAP authentication
• Encapsulated PageCacheManager
• Docs:
  • add screenshots of all pages
  • section about mkdocs
  • Ulauncher extension
• CI: run against PHP 7.4

Changed

• Introduce Bookmark object and Service layer
  • Save bookmark as objects in the datastore
  • Handle bookmark as objects across the whole codebase (except templates and plugins)
• Process all Shaarli page through Slim controller, with proper URL rewriting (see #1516)
• ATOM feed: use instance name as author name instead of URL
• Updated French translation
• Docs:
  • Troubleshooting page rewritten
  • Updated unit tests page
  • Updated Server security page

Fixed

• Undefined index: thumbnail in daily page
• Undefined index: thumbnail on OpenGraph headers
• Undefined index: updated on linklist
• Make sure that bookmark sort is consistent, even with equal timestamps
• Code PHP version check as requirement bumped to PHP 7.1
• Thumbnail images lazy loading
• Markdown plugin: fix RSS feed direct link reverse
• Fix RSS permalink included in Markdown bloc
• Demo plugin: multiple typos
• Makefile target for releases
• Makefile target for html documentation
• Session cookie setting being set while session is active
• Deprecated use of implode
• Division by zero in tag cloud
• CI: deprecated linux distribution and sudo directive
• Docker build: gcc is no longer included in python alpine image
• Docs:
  • Outdated Docker documentation for stable branch
  • Outdated links
  • Plugin description in meta files

Removed

• Markdown plugin
• Docs:
  • emojione & twemoji removed

Release to fix broken Docker build on the latest version.

Fixed

• Fixed Docker build
• Fixed a few documentation broken links
• Fixed broken label

Added

• More accessibility improvements