Changelog

Release notes, security updates, and feature milestones.

  • Service Worker blocking external scripts — SW now only caches same-origin assets, preventing hCaptcha and Cloudflare from being blocked. Version bump to v2 forces cache bust.
  • hCaptcha loading — Script loaded via Next.js Script strategy="beforeInteractive". SDK readiness check with loading spinner. key={pathname} forces remount on navigation.
  • CSP updated — Added cloudflareinsights.com to script-src and connect-src.
  • Premium effects site-wide — Avatar frames, nickname styles, and fonts now display in Navbar, PostGrid, PostDetails, Comment, UserList, UserProfile, NotificationBell.
  • Admin/moderator premium access — All admin and moderator users automatically get premium effects everywhere.
  • Premium settings persistence — Settings now save maxGifSize, keepOriginalVideoQuality to backend. Load from backend on mount.
  • Premium page avatar frames — Now use PremiumAvatar component for consistent rendering with actual effects.
  • Nickname preview — Uses inline CSS styles instead of dynamic Tailwind classes (JIT-safe).
  • Tag editing — PostTagEditor immediately saves to backend on add/remove. Tags API admin/mod role check fixed.
  • API keys — Admin/mod get enterprise tier. DELETE uses proper ObjectId validation. Key display shows only first 8 + last 4 chars.
  • Theme flash — Inline script in <head> sets dark class before first paint.
  • Homepage stats — Compact inline display instead of bulky cards.
  • Ad banner — Admin-editable via Settings page (text, URL, image).
  • User model — Added font field to Mongoose premium schema.
  • Posts API — Populate author with role field for proper premium detection.
  • Users API — premium boolean includes admin/moderator users.
  • Blog rendering — Custom image/link renderers with lazy loading.
  • Footer text — ShareX link restored to "Free ShareX & Flameshot Host", ZNC link fixed, added /f0ck/* page links.
  • Content rating filter — Removed from URL, stored in localStorage only.
  • Pool filter persistence — safe/sketchy/unsafe filter survives page refresh via URL params.
  • Manifest extended — Added shortcuts, categories, scope, apple-touch-icon.
  • Page title — Fixed to "f0ck.org".
  • Registration text — Increased font size for mobile readability.
  • Pool lightbox — Detect video/animated from URL extension.
  • Comment GIFs — Removed loading="lazy" for reliable loading.
  • Stripe prices — Created 4 live price IDs (monthly $2.99, quarterly $7.99, half-yearly $14.99, yearly $24.99).
  • Stripe webhook — Created webhook endpoint with all necessary events.
  • GitHub Actions runner — Self-hosted runner "mohican" online as systemd service.
  • Version bumped to 5.7.0
  • Premium pricing — Monthly $2.99, Quarterly $7.99, Half-Yearly $14.99, Yearly $24.99.
  • JetBrains Mono font — Replaced Google Fonts import with system monospace fallback (build reliability).
  • SafeHCaptcha removed — Restored original @hcaptcha/react-hcaptcha library.
  • Migration plan — Created projekt/MIGRATION_v6.md for old szurubooru data import.
  • Service Worker — Only caches same-origin assets, preventing external script interception.
  • CSP — Added Cloudflare Insights to allowed sources.
  • Secret scripts removed — Deleted create-stripe-prices.js with hardcoded API key from repo.
  • Tag creation on upload -- Enter, comma, and space now create new tags directly in the upload form, not just select existing ones. Works for both single and batch upload.
  • Premium font selection -- Premium users can now choose from 4 custom fonts (Space Grotesk, JetBrains Mono, System Sans, Serif) that apply site-wide to their nickname.
  • Premium billing periods -- Added quarterly ($7.99/3mo), half-yearly ($14.99/6mo), and yearly ($24.99/yr) billing options alongside monthly ($2.99/mo), with progressive discounts.
  • Premium color selection -- Added Amber and Rose solid colors, and Violet gradient to the premium nickname style options.
  • Pool lightbox -- Pool detail pages now support lightbox viewing with keyboard/touch navigation between pool items.
  • Payment info section -- Premium page now clearly shows Stripe as payment provider, billing terms, and refund policy.
  • hCaptcha preload -- hCaptcha script is now preloaded in root layout to prevent first-login failure.
  • Tailscale origins -- Added tailscale/mohican hostnames to allowed login origins for local network access.
  • Tag creation broken -- TagAutocomplete component now properly handles Enter, comma, and space to create new tags instead of only selecting from dropdown suggestions.
  • Login cookie domain -- Cookie domain now uses NEXTAUTH_COOKIE_DOMAIN env var instead of hardcoded .f0ck.org, allowing tailscale and localhost access.
  • Login origin validation -- Added tailscale hostnames to allowed origins list.
  • Stripe webhook import -- Fixed double-slash import path (@//lib/db/mongodb → @/lib/db/mongodb).
  • Demo mode checkout URL -- Fixed missing ? in success URL query parameter.
  • Dead code cleanup -- Removed unused handleTagInput and handlePaste functions from FileList.tsx.
  • Premium pricing -- Monthly: $1.99 → $2.99, Yearly: $15.00 → $24.99. Removed one-time payment option. Added quarterly and half-yearly tiers.
  • Premium preview -- Improved preview section with editable nickname input, better font preview, and real-time style switching.
  • Premium page -- Complete redesign with clearer feature comparison, payment provider info, and FAQ updates.
  • Changelog version badge -- Updated from 5.5.1 to 5.6.0.
  • Cookie domain -- Made configurable via NEXTAUTH_COOKIE_DOMAIN to prevent session issues across different access methods.
  • hCaptcha integration -- Added hCaptcha bot protection to Login, Registration, and Password Reset forms with server-side verification.
  • AD post URL rotation -- AD posts now use rotating obfuscated URLs that change every 5 minutes, preventing adblockers from permanently blocking them by post ID.
  • AD post randomization -- AD posts are now placed at random positions within the post grid instead of always being first.
  • Admin mass-delete -- Admins can now select and bulk-delete multiple spam accounts from the users page.
  • Touch swipe navigation -- Mobile users can now swipe left/right on post detail pages to navigate between posts.
  • Premium tier system -- New basic/pro/enterprise tiers with monthly/yearly billing via Stripe. Premium features include custom nickname colors, avatar frames, and ad-free experience.
  • Premium preview section -- Added nickname style preview (6 solid colors + 6 gradients) and avatar frame preview (6 glow effects with animations) to the Premium page.
  • Blog system -- /f0ck/blog/ listing and detail pages with RSS feed at /api/blog/rss.
  • API documentation page -- New /api route with developer documentation for public API integration.
  • Design overhaul -- Unified design system across all pages with consistent rounded-2xl cards, backdrop-blur effects, and purple accent colors.
  • Font consistency -- All headings and interactive elements now use font-[family-name:var(--font-space-grotesk)].
  • Footer links -- Added "Free ShareX & Flameshot host" (https://sx.f0ck.org), "f0ck TeamSpeak" (teamspeak://ts.f0ck.org), and "Mod View" link to /moderation/public.
  • SEO metadata -- Added JSON-LD structured data, canonical URLs, keywords meta tag, Twitter Card enhancements, and OG image with dimensions.
  • Skip-to-content link -- Accessibility-focused skip link in root layout, visible only on focus.
  • Content Security Policy -- Added comprehensive CSP header in next.config.mjs covering Stripe, Discord, Giphy, and WebSocket connections.
  • Permissions-Policy header -- Disabled camera, microphone, geolocation, and interest-cohort; restricted payment to Stripe frames only.
  • API rate limiting -- Pre-configured limiters for auth (5/min), API (30/min), read (60/min), and upload (10/min) endpoints with 429 + Retry-After responses.
  • Pre-commit secret scanning -- Added .pre-commit-config.yaml with detect-secrets, gitleaks, and pre-commit-hooks for automated secret detection.
  • Comment line breaks -- Comments now properly preserve line breaks (newlines converted to <br> tags).
  • Admin comments on AD posts -- Admins and moderators can now comment on posts marked as AD (for setting referral links).
  • Comments visible when disabled -- Comments on disabled/AD posts are now shown in read-only mode instead of being hidden entirely.
  • Tags not saving on upload -- Fixed tag persistence during media uploads ensuring tags are reliably saved and displayed.
  • Post detail navigation -- Restored two-step post lookup: prefers id field (URL convention), falls back to numericId.
  • Post navigation skipping unsafe/sketchy posts -- getAdjacentPosts no longer filters by content rating -- navigation always finds the truly adjacent post.
  • Posts page pagination crash -- Fixed circular dependency between URL sync and page state that caused infinite offset loop.
  • Tag filter double-click -- Changed from value-based to index-based tag removal using ref to avoid stale closure.
  • Comment z-index layering -- Emoji picker and report modal now properly layer above comments via portal rendering and z-index fixes.
  • Account bio character limit -- Enforced 250 character limit with visual feedback (yellow at 200+, red at 250).
  • Privacy settings not saving -- Privacy toggles now auto-save to backend via PUT /api/user with 500ms debounce.
  • Meta tags duplication -- Fixed title duplication (f0ck.org | f0ck.org) by using { absolute: title } in generateMetadata().
  • robots.txt blocking public pages -- Consolidated robots.txt into Next.js robots.ts Metadata API; /moderation/public now allowed for crawling.
  • Sitemap not updating -- Added missing revalidatePath() calls to moderation post deletion, tag deletion, comment deletion, and ban/unban actions.
  • Comment post linking -- Fixed ObjectId query to prevent NaN branches when resolving ObjectId URLs.
  • Banned users can no longer log in -- Added explicit role === "banned" check in auth flow and refresh-session callback.
  • ESLint critical fixes -- Reduced 56 to 26 warnings, fixed let to const, HTML-entity escapes, require() to ESM imports.
  • Theme provider crash -- Removed mounted guard that caused flash of light theme; now defaults to dark mode immediately.
  • User profile stats aggregation -- Fixed duplicate $lookup for pools and added missing $lookup for posts.
  • Version bumped to 5.5.1
  • Dark mode default -- Theme context now defaults to dark mode immediately on first load.
  • Tag validation -- Unified client/server tag validation regex to allow German umlauts, uppercase letters, and 30-character limit.
  • Footer cleaned up -- Removed Discord and Mastodon links; consolidated external links.
  • Stripe keys removed from source -- Hardcoded test keys removed; environment variables now required.
  • EXIF metadata stripping -- Uploaded images now have all EXIF metadata stripped via Sharp for privacy.
  • TypeScript build errors -- Changed ignoreBuildErrors: true to conditional process.env.NODE_ENV !== 'production'.
  • CSP -- Content Security Policy prevents XSS via inline scripts/styles restrictions and limits resource loading to trusted domains.
  • Permissions-Policy -- Disables unnecessary browser features (camera, mic, geolocation) site-wide.
  • Rate limiting -- All API mutation routes now have per-user/IP rate limiting to prevent abuse.
  • Pre-commit hooks -- Automated secret scanning prevents accidental credential commits.
  • EXIF stripping -- Uploaded images no longer contain GPS, camera, or personal metadata.
  • SVG disabled -- Prevents potential XSS attacks via malicious SVG files.
  • CORS policy -- Restricts cross-origin requests to trusted domains only.
  • Hardcoded secrets removed -- Stripe test API keys removed from source code; environment variables now required.
  • Content Security Policy (CSP) -- Added comprehensive CSP header in next.config.mjs covering Stripe, Discord, Giphy, and WebSocket connections. Includes object-src 'none', base-uri 'self', and frame-ancestors 'self'.
  • Permissions-Policy header -- Disabled camera, microphone, geolocation, and interest-cohort; restricted payment to Stripe frames only.
  • Security headers utility (src/lib/security-headers.ts) -- Reusable helpers for X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy, and CORS configuration.
  • API rate limiting middleware (src/lib/api-rate-limit.ts) -- Pre-configured limiters for auth (5/min), API (30/min), read (60/min), and upload (10/min) endpoints with 429 + Retry-After responses.
  • Rate limiting on all mutation routes -- Added rateLimitLegacy to POST /api/comments (10/min), POST /api/posts (5/min), PUT /api/user (10/min), POST /api/user/avatar (5/min), DELETE /api/user/avatar (3/min), PUT/POST/DELETE /api/pools/[id] (10/20/5 per min).
  • Pre-commit secret scanning -- Added .pre-commit-config.yaml with detect-secrets, gitleaks, and pre-commit-hooks for automated secret detection.
  • Local secret scanning script (scripts/scan-secrets.sh) -- Regex-based scanner for common secrets (Stripe keys, MongoDB URIs, JWT tokens, AWS keys, GitHub tokens).
  • npm scripts -- Added secret-scan and prepare scripts to package.json for easy hook setup.
  • JSON-LD structured data -- WebSite schema with SearchAction in root layout for rich search results.
  • Skip-to-content link -- Accessibility-focused skip link in root layout, visible only on focus.
  • Canonical URL -- Added alternates.canonical to root metadata.
  • Keywords meta tag -- Added global keywords for search engines.
  • Twitter Card enhancement -- Added site and creator handles to Twitter Card metadata.
  • OG image -- Added Open Graph image with dimensions and alt text.
  • CODE_OF_CONDUCT.md -- Contributor Covenant Code of Conduct v2.0.
  • CONTRIBUTING.md -- Comprehensive contribution guidelines with coding standards, commit conventions, and PR process.
  • SECURITY_ROTATION.md -- Documents secrets found in Git history requiring rotation.
  • DEPENDENCY_STATUS.md -- Full dependency audit with update recommendations.
  • SECURITY_AUDIT.md -- Comprehensive security findings and recommendations.
  • SEO_CONFIGURATION.md -- SEO setup documentation.
  • Stripe keys removed -- Hardcoded test keys removed from src/lib/stripe.ts; now throws error if STRIPE_SECRET_KEY or STRIPE_PUBLIC_KEY are not set in environment.
  • Dependabot enhanced -- Added GitHub Actions ecosystem, security-critical dependency group, and ignore rules for breaking major versions.
  • TypeScript build errors -- Changed ignoreBuildErrors: true to conditional process.env.NODE_ENV !== 'production' to catch type errors in development.
  • Root layout -- Wrapped children in <main id="main-content"> for skip-link target.
  • EXIF metadata stripping -- Uploaded images now have all EXIF metadata stripped via Sharp for privacy.
  • dangerouslyAllowSVG disabled -- SVG processing disabled in Next.js config to prevent XSS via SVG.
  • CORS policy -- API-wide CORS policy implemented for cross-origin request safety.
  • Hardcoded secrets -- Removed Stripe test API keys from source code; environment variables now required.
  • CSP -- Content Security Policy prevents XSS via inline scripts/styles restrictions and limits resource loading to trusted domains.
  • Permissions-Policy -- Disables unnecessary browser features (camera, mic, geolocation) site-wide.
  • Rate limiting -- All API mutation routes now have per-user/IP rate limiting to prevent abuse.
  • Security headers -- Utility provides consistent security headers across API responses.
  • Pre-commit hooks -- Automated secret scanning prevents accidental credential commits.
  • EXIF stripping -- Uploaded images no longer contain GPS, camera, or personal metadata.
  • SVG disabled -- Prevents potential XSS attacks via malicious SVG files.
  • CORS policy -- Restricts cross-origin requests to trusted domains only.
  • Public API endpoint -- New /api/public/status endpoint provides public access to system statistics (active users, posts, comments, tags) without authentication. Returns recent posts and trending tags.
  • API access control -- Added /api/public endpoint as entry point for public API status checking, returning success status and timestamp for any non-admin/moderation endpoint.
  • Premium preview section -- Added nickname style preview (6 solid colors + 6 gradients) and avatar frame preview (6 glow effects with animations) to the Premium page, showing live visual effects before purchase.
  • Tag type system -- Added tag types (General, Character, Series, Artist, Meta) with distinct color coding across tag pages, post pages, and moderation panels. New /tags page filter allows filtering by tag type.
  • Tag type badges -- Visual type indicators (CHAR, COPY, ART, META, GEN) on tag cards and post tag lists for better organization.
  • Video upload improvements -- Graceful handling when FFmpeg is unavailable: videos now upload without transcoding instead of failing completely. Metadata extraction failures no longer block uploads (uses sensible defaults).
  • Security hardening -- Fixed 12 npm vulnerabilities via npm audit fix --force (updated sharp, postcss, and transitive dependencies).
  • Dark mode default -- Theme context now defaults to dark mode immediately on first load, removing the "mounted" guard that caused flash of light theme. No more system preference check for initial render.
  • Version bump -- Updated changelog version badge from 5.3.3 to 5.4.0.
  • Tag validation -- Unified client/server tag validation regex to allow German umlauts (äöüß), uppercase letters, and 30-character limit.
  • Tag API -- Added tagType filter parameter to /api/tags for filtering by tag type.
  • Mastodon link -- Removed Mastodon link (mast.f0ck.org/@f0ck_org) from the site footer to declutter external links.
  • Post not found regression -- Restored two-step post lookup: prefers id field (URL convention), falls back to numericId. The 5.3.3 commit incorrectly removed these, causing posts to not be found when navigating via URL. Adjacent post navigation uses id for deterministic ordering.
  • ThemeProvider crash on settings page -- Removed the if (!mounted) return <>{children}</> guard from ThemeContext that rendered children outside the provider during SSR/initial render, causing useTheme() to throw. The provider now always wraps children with the default "dark" theme until client hydration.
  • Post navigation bug -- Fixed ambiguous query in getAdjacentPosts() that matched across both id and numericId fields (which can diverge). Now performs a two-step lookup (prefer id, fallback to numericId) and sorts exclusively by id for deterministic post resolution. Pressing A/D keys no longer jumps to unrelated posts.
  • Tags not displaying -- Added tags: 1 to the post listing API .select() projection and added tag rendering to the PostGrid component. Tags saved during upload now appear as purple pills on post cards (up to 3, with "+N" overflow indicator).
  • Comment formatting broken -- Implemented parseCommentFormatting() utility that converts markdown syntax (**bold**, *italic*, __underline__, ~~strikethrough~~) to React elements. Added Underline and Strikethrough buttons to both Comment.tsx and CommentList.tsx formatting toolbars. Updated DOMPurify allowed tags to include <u> and <s>. Fixed CommentList preview to render formatted text instead of raw string.
  • Sitemap not updating -- Added missing revalidatePath() calls to moderation post deletion (/sitemap_uploads.xml), tag deletion (/sitemap_tags.xml), comment deletion by author/mod (/sitemap_comments.xml), and ban/unban actions (/sitemap_users.xml). Reduced sitemap cache headers from 3600s to 300s. Removed /moderation/public from sitemap index (it's a page, not a sub-sitemap).
  • Meta tags duplication -- Fixed title duplication (f0ck.org | f0ck.org) by using { absolute: title } in generateMetadata() and all page-level metadata exports. The layout template "%s | f0ck.org" now only applies to pages without explicit metadata.
  • robots.txt blocking public pages -- Consolidated robots.txt into Next.js robots.ts Metadata API. /moderation/public is now allowed for crawling; only private routes (/api/, /account/, /admin/, /settings/, auth routes, /upload) are blocked. Removed static public/robots.txt which was ignored by Next.js App Router.
  • Footer links -- Added "Free ShareX & Flameshot host" (https://sx.f0ck.org) and "f0ck TeamSpeak" (teamspeak://ts.f0ck.org) to the site footer.
  • Ko-fi / Support Us links -- Removed all Ko-fi donation links from Footer, Help page, and Terms page. Crypto donation addresses on Help page preserved.
  • Post detail "Post not found" error -- Fixed undefined variable id in src/app/api/posts/[id]/route.ts:92 -- changed to rawId. Posts without tags previously caused a ReferenceError resulting in a 500 response, displayed as "Post not found" in the client.
  • Comment links pointing to wrong posts -- Fixed numericId/id drift in comments API normalization. The canonicalId pattern (p.numericId || p.id) was overwriting p.id with numericId when they differed, causing comment links to go to wrong posts. Now only sets numericId from id if missing -- original id is preserved.
  • Comment link ID priority -- Changed all post link construction across Comment.tsx, CommentList.tsx, notificationService.ts, UserProfile.tsx, and RecentActivity.tsx to prefer id over numericId, matching the user-facing URL convention.
  • Comment link Object Object -- Fixed ObjectId-to-string conversion in notificationService, reported-comments API, Comment.tsx post links, and CommentList.tsx comment ID mapping. Comment fragment links now correctly resolve to the intended comment instead of showing [object Object].
  • Comment POST response ID -- Added explicit id = _id.toString() in the comments POST handler to ensure consistent string IDs in API responses.
  • Upload tag assignment -- Tag inputs are now disabled during upload to prevent stale tag state. Replaced shared currentTag state with per-item state to avoid cross-item input pollution.
  • Video upload temp file cleanup -- Fixed potential temp file leak in getVideoMetadata() by adding a settled flag and proper cleanup in both resolve and reject paths.
  • Video upload MIME type whitelist -- Added video/x-mov to the upload route whitelist for consistency with the upload library.
  • Dependabot security -- Updated nodemailer from 8.0.11 to 9.0.1 to fix GHSA-p6gq-j5cr-w38f (arbitrary file read / SSRF via raw option). All 23 open Dependabot alerts addressed -- 0 vulnerabilities remaining.
  • Version -- Bumped to 5.3.1 in package.json.
  • npm dependencies -- nodemailer 9.0.1 (security fix).
  • Admin user management -- New /api/admin/users endpoint for administrators to list, search, and modify user roles (user, premium, moderator, admin, banned) and grant/revoke premium status.
  • Footer link -- Added "ZNC bouncer" link to https://znc.f0ck.org in the site footer.
  • Comment post linking -- Fixed ObjectId query in /api/posts/[id] to prevent NaN branches when resolving ObjectId URLs (kilo-code-bot review).
  • Comment fragment preview -- Consolidated try-block in checkForCommentFragment, added status filter to only load approved comments for SEO metadata.
  • Adjacent post navigation -- Query now includes { id: numericId } for legacy numeric route compatibility.
  • Sitemap safety -- Both comment sitemap and main sitemap now filter out unsafe-rated posts when indexing comment URLs.
  • npm dependencies -- Updated packages to latest stable versions.
  • Version -- Bumped to 5.3.0 in package.json and README.
  • CHANGELOG -- Fixed typo "Keep a Keep a Changelog" to "Keep a Changelog".
  • Comment post linking -- Fixed critical bug where comments linked to wrong post IDs (e.g. comment on post/300 linked to post/25). Root cause was id vs numericId field divergence in Post model. All comment API routes now consistently resolve and return numericId as canonical post identifier.
  • Comment API post lookup -- GET and POST /api/comments now search by { $or: [{ numericId }, { id }] } instead of only { id }, ensuring correct post resolution regardless of which field matches.
  • Comment POST response -- Fixed postObjectId?.id (which returned ObjectId hex string) to use the actual numeric post ID.
  • CommentList data mapping -- Post ID mapping now prioritizes numericId over _id for consistent URL generation.
  • Tag upload limit -- Increased max tags from 15 to 30 across all upload paths (normalizeInputTags, validateUploadParams, client-side validation in FileList, BatchTagging, upload page).
  • Sitemap comment URLs -- Comments sitemap now resolves numeric post IDs via batch lookup instead of using raw ObjectId strings in URLs.
  • Sitemap post filtering -- Unsafe-rated posts excluded from sitemap for better SEO quality.
  • User profile Recent Activity overflow -- Added min-w-0, break-words, truncate classes to prevent long titles/content from breaking layout.
  • Post page adjacent post navigation -- Fixed to use numericId for navigation and _id for fallback lookup.
  • Post page metadata -- Removed noindex for unsafe content -- all posts are now indexable.
  • Root layout title -- Changed from "Free ShareX Host" to "f0ck.org - Anonymous Imageboard".
  • Site metadata name -- Changed from "Free ShareX Host" to "f0ck.org" across all pages.
  • Moderation public page -- Redesigned from card-based list to structured table layout with consistent columns (Action, Time, Details, Reason).
  • Filter hover effects -- Removed hover:-translate-y lift animations from filter containers and buttons on /posts/, /tags/, and /users/ pages for a cleaner, more static appearance.
  • Tags page -- Added missing <Footer /> component to /tags/ page.
  • Dynamic version display on homepage pulled from package.json environment variable.
  • Public moderation log page at /moderation/public with read-only activity wall.
  • API endpoint /api/moderation/public-activity for anonymous access to moderation actions.
  • video/x-mov MIME type support for .mov video uploads.
  • Footer: Removed sx.f0ck.org link, Teamspeak entry moved to Ko-fi Support link (already in place).
  • Rules page: Removed Discord integration section, added "Reporting Content" guidelines.
  • Navigation: Desktop "Home" link now uses gradient styling matching footer.
  • Tag validation: Now allows underscores in tag names for better compatibility.
  • Validation error messages: Improved specificity for unsupported file types.
  • Upload rejects fewer-than-3 tags and normalizes/dedupes/lowercases tag input before persistence.
  • Post tag editor now creates tags via /api/tags and persists additions with PUT /api/posts/[id]/tags; spacebar no longer triggers tag creation.
  • Post page tag enrichment uses one $in query instead of N+1 findOne calls and matches case-insensitively.
  • Moderation delete path decrements author uploads for posts and invokes comment stats cleanup for comment deletions.
  • Sitemap revalidation added for /api/user profile updates and pool membership changes.
  • Comment timestamps now link to the matching comments view for the post instead of fragment-only anchors.
  • Post page exposes a Mod Log shortcut for moderators/admins.
  • Account statistics tiles for likes, favorites and tags are now clickable filters.
  • Updated dependency versions to address Dependabot advisories.

[Unreleased]

  • Comment formatting toolbar with Bold, Italic, Link, and Preview actions in comment forms.
  • Anonymous-user hint in comment forms indicating no account is required.
  • Post thumbnails in comment listings next to "Comment on:" references.
  • Changelog page now uses collapsible version sections with search/filter and section item counts.
  • Settings page redesigned with SettingRow/SectionHeader layout and animated Switch component.
  • Privacy settings moved to the bottom of the account page and now auto-save via PUT /api/user.
  • EmojiPicker renders through a React Portal to prevent z-index stacking issues.
  • Account bio enforces a 250-character limit with visual feedback at thresholds.
  • Post navigation (getAdjacentPosts) now respects content rating filter from query parameter when navigating between posts.
  • Posts page pagination crash from circular URL/state sync when infinite scroll is disabled.
  • Tag filter removal now uses index-based deletion to avoid stale-closure failures.
  • Comment and report modal layering corrected with portal rendering and elevated z-index values.
  • PostFilter "More" button now uses flex-shrink-0 to avoid compression on small screens.
  • Comment timestamp links now correctly point to /post/{id}#comment-{id} instead of /comments?postId=..., restoring the expected navigation behavior.
  • Comment "Comment on:" section now shows a clickable thumbnail of the linked post, enabling quick navigation and visual context.
  • User profile stats aggregation (/api/users/[username]) -- Fixed duplicate $lookup for pools (was counting pools twice) and added missing $lookup for posts (reported 0 uploads for all users). Stats are now computed correctly in a single aggregation pipeline.
  • Banned users can no longer log in -- Added explicit role === "banned" check in auth.ts credentials flow and refresh-session callback, blocking both new sessions and existing JWT renewal.
  • Changelog page now shows a more informative error with searched file paths when CHANGELOG.md cannot be read from the filesystem.
  • Footer now includes a "Mod View" link to /moderation/public for transparent moderation access by all users and visitors.
  • Explicit empty catch blocks replaced with console.warn() logging for improved debuggability.
  • Previously banned users with valid sessions could still refresh their JWT; the refresh callback now invalidates the token and forces logout.
  • PNG upload error -- Resolved a.pipeThrough is not a function crash by aligning processUpload to the existing Readable.toWeb(Readable.from(...)) pattern already used in /api/upload and assemble-chunks routes, restoring PNG/Web Stream compatibility with file-type v22.
  • Chunked image upload rejection -- The assemble-chunks route no longer rejects all non-video uploads; PNG, JPEG, and other image formats are now accepted after chunk reassembly.
  • Chunk metadata safety -- Malformed or undefined chunk meta.json values (tags, contentRating) no longer crash chunk assembly; tags are validated as arrays and content ratings are coerced to the supported set before being persisted.
  • Legacy PNG MIME support -- image/x-png is now whitelisted across upload entry points, preventing false rejections on older browser-reported PNG types.
  • Client paste path validation -- Clipboard-paste uploads in the dropzone now apply the same type/size filter as drag-and-drop, removing a bypass for oversized or unsupported pasted PNGs.
  • Comment formatting toolbar -- Bold, Italic, Link, and Preview buttons in comment creation/reply/edit forms.
  • Comment anonymous hint -- Shows "No account needed" text for unauthenticated users in comment form.
  • Comment post thumbnails -- Comment listings now show post thumbnails next to "Comment on:" links.
  • Blog system -- /f0ck/blog/ listing and detail pages with RSS feed at /api/blog/rss.
  • Dynamic sitemap -- Sitemap now includes public user profiles and individual comment pages alongside posts, tags, and pools.
  • Changelog page redesign -- Collapsible version sections, search/filter, collapsible subsections with item counts, back-to-top button, compact summary badges per version.
  • Settings page redesign -- Polished animated Switch component with checkmark/X icons, improved setting row layout with descriptions, better section grouping.
  • Comment mobile responsiveness -- Action buttons wrap on mobile, responsive mention dropdown, scrollable formatting toolbar.
  • EmojiPicker portal rendering -- Now renders via React Portal to document.body to prevent z-index stacking issues.
  • Privacy settings placement -- Moved to bottom of account page, after security integrations section.
  • Post navigation skipping unsafe/sketchy posts -- getAdjacentPosts no longer filters by content rating -- navigation always finds the truly adjacent post regardless of rating.
  • Posts page pagination crash -- Fixed circular dependency between URL sync and page state that caused infinite offset loop when infinite scroll was disabled.
  • Tag filter double-click -- Changed from value-based to index-based tag removal using ref to avoid stale closure.
  • Comment z-index layering -- Emoji picker and report modal now properly layer above comments via portal rendering and z-index fixes.
  • PostFilter "More" button overflow -- Added flex-shrink-0 to prevent button compression on smaller screens.
  • Comment report modal z-index -- Bumped to z-[10000] to render above emoji picker.
  • Account bio character limit -- Enforced 250 character limit with visual feedback (yellow at 200+, red at 250).
  • Privacy settings not saving -- Privacy toggles now auto-save to backend via PUT /api/user with 500ms debounce and status feedback.

API -- /api/user

  • MongoDB password projection error corrected -- GET /api/user now returns 500 because the aggregation pipeline mixed inclusion (password: 1) with exclusion (password: 0) in the same $project stage. Fixed by removing the inclusion; only password: 0 is used, preventing MongoServerError: Invalid $project. Ref: src/app/api/user/route.ts.

EmojiPicker & GifSelector -- runtime crash

  • onClose is not a function crash fixed in both EmojiPicker (src/components/EmojiPicker.tsx) and GifSelector (src/components/GifSelector.tsx): onClose is now an optional prop with a default no-op, so components render safely even when the prop is omitted.
  • CommentList comment creation form (src/app/comments/components/CommentList.tsx): EmojiPicker and GifSelector instances in the comment creation box now receive the correct onClose callback and no longer depend on a non-existent wrapper onClick handler.
  • PostDetails comment composition box (src/app/posts/components/PostDetails.tsx): EmojiPicker and GifSelector both receive onClose callbacks, matching the implementation already present in the inline Comment reply box.

Navigation labels swapped

  • Posts list pagination (src/app/posts/components/PostsPage.tsx): Left arrow button was labelled "Next" but navigated to the previous page; right arrow button was labelled "Previous" but navigated forward. Both labels swapped to read Previous / Next, matching the Math.max(1, p-1) and Math.min(totalPages, p+1) action handlers.

Post-level navigation labels swapped

  • Single-post post navigator (src/app/posts/components/PostNavigation.tsx): Previous button was wired to nextPostId (higher-ID / newer post, not the older one) and Next button was wired to previousPostId. JSX conditionals swapped so that Previous is shown only when previousPostId exists and navigates to the older post, while Next is shown only when nextPostId exists and navigates to the newer post.

Footer

  • Discord server link removed from footer (src/components/Footer.tsx); TeamSpeak 3 ts3server://ts.f0ck.org link retained as the sole external chat link.

Next.js Image config

  • images.qualities: [75, 95] added to next.config.mjs so that quality={95} used in PostDetails.tsx is an allowed value and the Next.js build/DevTools warning disappears.

Account page -- session fallback for avatar

  • AccountCard initial avatarUrl state (src/app/account/components/AccountCard.tsx) falls back to session?.user?.avatar (the value already known to NextAuth at login), preventing a flash of the default avatar before the /api/user profile API completes.

Google indexing / SEO

  • Added src/app/sitemap.ts so that Google and other search-engines can discover /posts, /comments, /account, /moderation, /f0ck/changelog, /rules, /terms, and /help -- previously only the homepage was listed in any indexable source.
  • Changelog page file-access path candidates expanded (src/app/f0ck/changelog/page.tsx) to include an absolute project-root fallback, so CHANGELOG.md reliably loads even in standalone Docker/prod contexts where process.cwd() points to the server working directory rather than the source tree root.
  • Phase 0-1-1: Critical SSRF hardened with env var fallback + DNS resolution checks; production data-leak (console.log) removed from PostDetails.tsx; ModActionsPanel action whitelist via TypeScript as const.
  • Phase 0-1-2: ESLint reduced 56 to 26 warnings (0 errors); let to const x8; 4 HTML-entity escapes; 4 require() to ESM imports; 11 react-hooks/exhaustive-deps fixes.
  • Phase 0-1-3: ErrorBoundary class component with getDerivedStateFromError + Try-Again reset; ThemeContext SSR hydration fixed; module-level side-effects removed from layout.tsx.
  • Phase 0-1-4: Tag validation fixed (max 15 tags, per-tag length/regex check inside loop); normalizeInputTags helper added; tag persistence fallback (new Tag().save() when findOrCreate fails); chunk upload tags forwarded via meta.json side-channel; N+1 tag query batched to $in; Tag model regex accepts hyphens.
  • Phase 0-1-5: LiveWall component with AbortController polling; QuickActions onTabChange wired; PostModerator 8 dead typeof toast !== 'undefined' guards removed; ModLog action types fixed (feature/unfeature to MARK_AS_AD/REMOVE_AD).
  • Phase 0-1-6: Comment creation form UI added to unified CommentList; stale closure fixed in handleLoadMore; 3 replace() to replaceAll() fixes in GIF/content rendering; /post/[id] page renders inline CommentList; 1,798 lines of dead code removed across 6 old comment files.
  • Phase 0-1-7: PostNavigation label direction corrected; content-rating filter reads ?rating= from URL; keyboard navigation fixed (A = older, D = newer); PostNavigation wrapped in Suspense boundary; getImageUrlWithCacheBuster regex fixed with g flag.
  • Phase 0-1-8: CommentsPage ingestion path quarantined (no longer imported into posts detail routes); CommentModeration uses unified component; CommentFilter and CommentList refactored to shared component shape.
  • Phase 0-1-9: Manifest page with layout/content/PDF route; Values page (8 hacker values); Community page with guidelines; History page with milestones; API documentation page; Blog system with data/listing/detail pages/API/RSS.
  • Phase 0-1-10: Vitest config with setupFiles; test env vars/hooks; 18 navigation filter tests; 30 tag E2E tests; 48 new tests all passing.
  • Phase 0-1-11: AddToPoolModal enhanced (search, loading, error); Pool API permission checks with moderator override; contributor tracking on pool actions; Pools field added to User model; Pool stats on user profiles.
  • Phase 0-1-12: Full build, lint, test pass; CHANGELOG and README updated; 66 tests (65 passing, 1 pre-existing TS check unrelated).
  • Tag model type enum now includes 'meta' alongside general/character/copyright/artist.
  • User model privacySettings now has showPools field with isProfilePrivate defaulting to false.
  • Account page: _maxAge: '0' added to profile-fetch requests to ensure uncached data.
  • Tag edit/count facade backed by service abstractions; view-layer tags delegate to orchestrator.
  • Upload edge validated; pool-edit guarded; narrative system refactored with unambiguous results.
  • Help system migrated to dynamic sub-page layout.
  • Session-update token-hardening prevents privileged-field overwrite from client-triggered updates; identity-field refresh avoids stale session during auth transitions.
  • Changelog blank-line rendering preserves intentional empty lines from Markdown; list-typo and indentation preserved.
  • Tag edit endpoint infinite-loop corrected; stale user-state after anonymous upload countered.
  • comments/filter-users route pruning; error-format contract explicitly checked.
  • Post count updated via ModLog pipeline; creative writing filter response corrected.
  • User-list deduplication.
  • Pool bug categorisation: in-place tag/pool editor page loading.
  • Watermark placement corrected on CMD+Shift+2; embed page layout removed; test-administration contract hardened.
  • file-type upgraded from v21 to v22 with migration to new stream-based API (fileTypeFromStream).
  • eslint upgraded from v9 to v10 with full Flat Config migration (languageOptions, globals, js.configs.recommended).
  • typescript upgraded from 5.9 to 6.0.3.
  • @types/react upgraded to 19.2.18, @types/react-dom to 19.2.6, @types/node to 25.7.0.
  • Dependency Stack Refresh -- All production dependencies updated to latest stable versions:
    • eslint: 9.39.2 to 10.3.0
    • file-type: 21.3.0 to 22.0.1 (breaking: stream-based API)
    • typescript: 5.9.3 to 6.0.3
    • next: 16.2.6 (unchanged, latest stable)
    • react/react-dom: 19.2.6 (unchanged, latest stable)
    • tailwindcss/@tailwindcss/postcss/@tailwindcss/forms: 4.3.0 (unchanged, latest stable)
    • @types/react: 19.2.14 to 19.2.18
    • @types/react-dom: 19.2.3 to 19.2.6
    • @types/node: 25.6.2 to 25.7.0
    • eslint-config-next: 16.2.6 (unchanged)
  • ESLint 10 Flat Config Migration (eslint.config.mjs):
    • Added js.configs.recommended as base config.
    • Consolidated env, globals, parserOptions into unified languageOptions block.
    • Imported globals from globals npm package (globals.browser, globals.node, globals.es2021).
    • Removed deprecated @eslint/eslintrc import pattern.
    • All react-hooks rules retained at warn level for backward compatibility.
  • file-type v22 Migration:
    • fileTypeFromBuffer() replaced with fileTypeFromStream(Readable.from(buffer)) in:
      • src/lib/upload.ts
      • src/app/api/upload/route.ts
      • src/app/api/upload/assemble-chunks/route.ts
      • src/app/api/user/avatar/route.ts
    • Added import { Readable } from 'stream' where needed.
  • Security Overrides Expanded in package.override:
    • Added transitive dependency pins: glob-parent, send, mime, qs, path-parse, debug, ms, lodash.merge.
    • Ensures all transitive dependencies locked to known-safe versions.
  • 7 Dependabot advisories addressed via transitive dependency overrides:
    • glob-parent >= 6.0.2 (path traversal)
    • send >= 1.2.0 (DoS)
    • mime >= 4.0.0 (content-type sniffing)
    • qs >= 6.14.0 (prototype pollution)
    • path-parse >= 1.0.7 (ReDoS)
    • debug >= 4.4.3 (ReDoS)
    • ms >= 2.1.3 (ReDoS)
    • lodash.merge >= 4.6.2 (prototype pollution)
  • npm audit passes with 0 vulnerabilities.
  • Broken fileTypeFromBuffer calls now use v22-compatible fileTypeFromStream with Readable wrapper.
  • ESLint build passes cleanly on v10 with updated Flat Config.
  • TypeScript compilation compatible with v6 strict mode.
  • Next.js 16.2.6, React 19.2.6, and TailwindCSS 4.3.0 remain the stable foundation -- no breaking changes in these packages since last release.
  • This release is fully backward-compatible for end users; all changes are internal dependency upgrades and security hardening.
  • Secure FFmpeg-based media processing pipeline for uploaded videos with H.264/AAC normalization.
  • Image optimization pipeline with automatic WebP output for storage and bandwidth efficiency.
  • Extended pools domain capabilities:
    • create/edit/delete pool lifecycle
    • visibility and content rating controls
    • moderation-safe pool management operations
  • Universal report flow for posts and comments with actionable moderation reasons.
  • Expanded moderation action center:
    • bulk target support
    • reason preset support
    • report-clearing operations
  • Dedicated in-app project namespace:
    • /f0ck as a new project-native landing route
    • /f0ck/changelog as in-app release notes
  • /changelog redirect route for consistent external entry points.
  • Dedicated metadata coverage for:
    • /changelog
    • /f0ck/changelog
    • /f0ck
  • Runtime logo-discovery API at /api/logos for dynamic .png logo selection.
  • Privacy persistence and enforcement flow across account, profile, and feed entry points.
  • Tag activity live-stat aggregation for newPostsToday and newPostsThisWeek.
  • Changelog rendering is now sourced directly from Markdown and displayed in structured release cards.
  • Changelog page visual system has been reworked:
    • wider content canvas
    • more readable vertical rhythm
    • mono-styled release title treatment
    • section badges for release categories
  • Release version headers are anchor-linkable from both sidebar and in-card title.
  • Changelog renderer normalizes display text by stripping emoji glyphs.
  • Changelog markdown typography now applies explicit spacing and list indentation rules for long-form readability.
  • Random logo selection no longer uses hardcoded paths and now discovers available logos from public/logos.
  • Moderation dashboard width and density were tuned for large-screen operational workflows.
  • Post and tag filter behavior is aligned for consistent intersection logic.
  • Notifications and tags pagination contracts are aligned between backend response and frontend consumption.
  • Legacy password route now delegates to a central password policy flow with compatibility headers.
  • Changelog blank-line rendering now preserves intentional empty lines from Markdown.
  • Changelog list rendering now keeps correct list indentation and spacing.
  • Mention autocomplete reliability and dropdown lifecycle handling in post comments.
  • GIF handling in post comments now supports independent selection/removal without clearing typed text.
  • Favorite API compatibility by returning both favoriteCount and favoritesCount.
  • Tag filter deduplication and duplicate key issues in active tag rendering flow.
  • User stats navigation query consistency for:
    • liked_by
    • favorited_by
    • disliked_by
  • Compile regression in users/[username]/activity caused by duplicate imports.
  • Notifications pagination behavior (page, limit, hasMore) and load-more UI state drift.
  • Comments and tag-detail page restoration to full component rendering paths.
  • Dependabot alert #74 resolved by upgrading nodemailer to 8.0.5 (GHSA-vvjj-xcjg-gr5g).
  • Session update hardening prevents privileged token field overwrite from client-triggered updates.
  • Identity field refresh during token/session update avoids stale user identity state.
  • Upload route hardening:
    • strict chunk metadata validation
    • safer chunk assembly filename handling
  • URL import temporary file ownership model enforced per user scope.
  • Expanded SSRF defenses:
    • protocol restrictions
    • redirect-hop validation
    • private/internal target blocking
    • payload size limits
  • Additional rate limits on sensitive upload and user-search paths.
  • Atomic report-write safeguards against duplicate report race conditions.
  • Unified path sanitization and base containment checks in image/thumbnail/file routes.
  • Regex escaping for username-query APIs to prevent pattern abuse and false-positive matches.
  • Moderator/admin authorization enforcement for tag mutation endpoints.
  • Post-release security patches (2026-04-10):
    • Fixed path traversal vulnerability in moderation thumbnail regeneration.
    • Fixed password hash exposure in user API aggregation.
    • (Reverted: anonymous uploads remain allowed with ownership validation)
    • Fixed tempFilePath ownership bypass -- now validates for both authenticated and anonymous users.
    • Added pagination to reported posts endpoint to prevent memory exhaustion.
    • Added input validation (length limits, whitelists) to moderation actions.
    • Added pagination bounds to posts API (max 100, min 1).
    • Fixed unhandled promise in user API lastSeen update.
    • Added ObjectId validation in reports API.
  • Live tag activity counters are computed from current DB state on request.
  • Privacy settings are persisted in user documents and enforced in profile, activity, and feed APIs.
  • User list responses are privacy-aware and redact hidden profile fields where required.
  • This is still part of the larger 5.0.0-beta rollout and remains under active stabilization.
  • This entry intentionally serves as the main comprehensive reference for the current beta milestone.
  • More deterministic account-registration error semantics for duplicate username/email handling.
  • Improved fallback handling paths for media previews and selector overlays.
  • Discord OAuth username handling now preserves actual provider identity instead of synthetic fallback naming.
  • Discord OAuth email ingestion now maps cleanly to account profile fields.
  • Registration race condition around duplicate username/email writes.
  • GIF/emoji selector layering and z-index issues in comment composition UI.
  • Video thumbnail fallback behavior for comments containing video posts.
  • Pool navigation assumptions around non-numeric IDs (ObjectId-safe behavior).
  • Error-message quality for registration collisions (clear username/email conflict reporting).
  • Platform-facing UI copy moved to consistent English output.
  • HTML language attribute switched to en for semantic correctness and crawler/accessibility consistency.
  • Authentication and registration messaging normalized for cleaner frontend handling.
  • 4.7.1-beta focused on high-impact correctness fixes ahead of the larger 5.0.0-beta stabilization cycle.
  • Upload progress UI improvements for multi-file flows with retry-friendly feedback.
  • Timezone utility layer for consistent day/week windows in statistics.
  • Scheduled tag-stat maintenance endpoint for periodic counter resets.
  • Additional database indexes for high-frequency query paths.
  • XSS vulnerability in the comment edit endpoint.
  • Video thumbnail behavior in comment-list rendering.
  • Mobile GIF picker positioning and viewport overlap handling.
  • Tag stats daily/weekly counter logic with timezone-aware boundaries.
  • Pool sorting behavior for most_items and related query edge cases.
  • Stats update drift in tag-removal flows.
  • Avatar caching behavior improved to reduce unnecessary reloads.
  • Discord and tag query performance improved through targeted index coverage.
  • Upload and media pipelines aligned for better operational stability during heavy usage.
  • 4.7.0-beta was the foundation release that stabilized media, stats, and moderation-adjacent workflows before 4.7.1-beta and 5.0.0-beta.

Showing 19 of 19 versions