ClearFlask
FeedbackRoadmapChangelog

Changes we made

Similar

2.6.4

Security release, self-hosters should upgrade.
Fixes:
  • Connect: a rejected promise ended the worker
  • Connect: a dead worker took the whole site down instead of being replaced
  • Connect: client resets restarted the site
  • Connect: www.clearflask.com returned a 500 on every page
  • Connect: SSR redirects answered with the Location alone
  • Connect: hardened SSR against subdomain-enumeration floods
  • Connect: banlist strikes counted by unique 404 target, not raw hits
  • Server: 404 instead of 500 for a project that does not exist
  • Server: handled API errors kept out of the SEVERE log
  • Server: quiet noisy WARN on malformed client-supplied auth tokens
  • Build: try Maven Central before jitpack
  • Deploy: target the singlehost by a dedicated tag, fail when nothing matches
  • Deploy: connect-only and server-only targets ran the full deploy
  • Comment search returned comments on Private posts to anonymous callers
  • ideaCommentSearch now returns 404 for a Private post unless the caller is an admin or moderator
  • commentSearch excludes comments on Private posts for everyone else
Changes:
  • Per-competitor alternative landing pages

2.6.3

Changes:
  • Single-tenant mode for PRODUCTION_PLATFORM, serves one project directly instead of the multi-tenant subdomain layout

2.6.2

Fixes:
  • Image upload broken in the editor, uploaded images were re-fetched as external URLs
  • Platform hosting: mariadb bind-address=:: for IPv6-only private networks (Railway)
  • Platform hosting: dummy AWS creds to avoid EC2 metadata hang on non-AWS clouds
  • Platform hosting: connect creates its config dir, server JVM heap capped to fit 1GB hosts
  • Documented the CI deploy and release process

2.6.1

Fixes:
  • Platform hosting: bundle sqlite4java native lib in the WAR, embedded storage failed to start
  • Platform hosting: require a connect token instead of allowing an unauthenticated connect channel

2.6.0

Changes:
  • New platform-hosting deployment type with embedded storage, runs as a single container for one-click platforms and small hosts
  • Billing resolves to the self-host no-op path under platform hosting

2.5.0

Changes:
  • Self-host generates install secrets on first boot instead of shipping fixed defaults
  • Self-host configurable through environment variables
  • Running the company in the open, strategy and board log checked in under ceo/
Fixes:
  • Self-host quick start docs, email setup step and telemetry opt-out key were wrong
  • BouncyCastle moved to the Tomcat shared classloader, out of the WAR
  • Deleted project left behind in teammates' external project ids
  • Inviting a teammate failed on accounts with a dangling admin id

2.4.0

2.3.1

2.3.0

Changes:

  • Kubernetes Helm Chart deployment
  • Add copy-to-clipboard button for post external link

Fixes:

  • Correct GIF frame reading in image normalization
  • Respect newCommentsAllowed prop in CommentList
  • Re-index parent idea after post merge
  • Update mod status in sessions instead of revoking

Security fixes:

  • Sanitize fontFamily to prevent CSS injection
  • Validate session ID format in cookie values
  • Use sessionStorage for OAuth CSRF tokens

We are also introducing a new team member: Claude Code

2.2.0

Changes:
  • Self-hosting now uses mariadb:10.5 instead of mysql:5.7 (Only applies to new installations)
Fixes:
  • Page footer missing when using embed
  • Fix href not available in connect test
  • Don't bcc if no bcc addresses exist
  • Make it clearer whether search indexing is enabled or not
  • Improve handling of ApiException logging
  • Suppress 'Event Subject was not initialized' durint tomcat war reload
  • Fix do not unload externalized method beans as it conflicts during tomcat war reload
  • Free Trial Ending email text change
Anti-spam changes:
  • Bulk delete accounts API
  • Do not index projects with account in trial/blocked status
  • Use Castle anti-spam
Powered by 
ClearFlask