External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

docs: add release notes for v1.17.2

Browse Source
This commit is contained in:
SnapOtter
2026-06-08 15:55:55 +08:00
parent 9f26f0d733
commit 6dcbb9f122
1 changed files with 49 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.release-notes.md
+49 -23
View File
@@ -1,37 +1,57 @@
## Highlights
Live demo, per-tool landing pages, and a batch of polish fixes.
This release adds a new **HTML to Image** tool (tool #53), full **WCAG 2.2 AA accessibility** compliance, and a comprehensive **security hardening** pass based on external penetration testing. The Docker image also received 5 critical fixes that resolve container startup failures, broken HEIC decoding on ARM, and missing AI tool dependencies.
## New features
## New Features
- **Live demo** -- [demo.snapotter.com](https://demo.snapotter.com) lets people try SnapOtter without installing anything.
- **Tools index page** -- Browse all 50+ tools at `/tools` with search and category filters. Navbar links fixed on subpages.
- **50+ SEO landing pages** -- Every tool now has a dedicated landing page with FAQs, use cases, and comparison tables for search visibility.
- **Background preview** -- Before-after slider shows a checkered background behind transparent images so you can actually see what changed.
- **Strong password generator** -- One-click button in the Add Members form generates a secure password.
- **Easter eggs** -- Hello from the otter side.
- **HTML to Image** -- Capture screenshots of URLs or raw HTML as PNG/JPEG/WebP. Supports full-page captures, custom viewports, and dark mode. Built on Playwright Chromium with SSRF protection.
- **Docker _FILE secret convention** -- Mount sensitive environment variables (passwords, API keys, OIDC secrets) as files instead of plain-text env vars. Supported for `DEFAULT_PASSWORD_FILE`, `S3_ACCESS_KEY_ID_FILE`, `S3_SECRET_ACCESS_KEY_FILE`, `OIDC_CLIENT_SECRET_FILE`, `COOKIE_SECRET_FILE`, and `SNAPOTTER_LICENSE_KEY_FILE`. (#205)
- **Enterprise licensing and S3 storage** -- Optional commercial license key and S3-compatible object storage backend for enterprise deployments.
- **Shape editor improvements** -- Fill/stroke transparency, RGBA color picker, and dash line styles in the image editor.
- **Pre-built release archives** -- Download `snapotter-vX.Y.Z-linux-amd64.tar.gz` and `snapotter-vX.Y.Z-linux-arm64.tar.gz` from GitHub Releases for non-Docker installs (Proxmox, bare metal, LXC). (#202)
- **Community roadmap** -- Feature requests and prioritization now tracked via GitHub Discussions with `now`/`next`/`later` labels.
## Bug fixes
## Improvements
- **HEIC/HEIF info** -- Image info tool no longer fails on HEIC/HEIF files (pre-decode added).
- **AI install errors** -- Better error messages and resource limits when installing AI model bundles.
- **Library thumbnails** -- Image previews in the file library now load correctly (auth headers were missing).
- **Dropdown clipping** -- People and Teams tables in settings no longer clip dropdown menus.
- **Size comparison** -- Percentage badge hidden on non-compression tools where it was misleading.
- **Privacy link** -- Removed duplicate privacy policy link from the main content area.
- **Italian translation** -- AI features settings section translated.
- **Lucide icons** -- Updated renamed icons (Wand2, Columns) to current names.
- **WCAG 2.2 AA accessibility** -- Skip navigation, route announcer, focus trapping on all modals, `aria-live` regions for processing status, `prefers-reduced-motion` support, correct contrast ratios, and 44px minimum touch targets. All 49 hardcoded `aria-label` strings replaced with i18n keys across 25 components. (#209)
- **Mobile responsiveness** -- Responsive settings dialog, homepage, navigation, and toast notifications. SSE connections now automatically reconnect when returning from a backgrounded mobile tab. (#203, #204)
- **Background removal quality** -- Edge smoothing, color decontamination, and output format selection added to the remove-background tool.
- **Italian translation** -- ~145 newly translated strings contributed by @albanobattistella. (#206)
- **Per-tool API documentation** -- 53 individual VitePress doc pages with accurate parameters, example requests, and response formats. Root `llms.txt` added for LLM-friendly repo browsing.
- **AI model downloads** -- Retry logic with exponential backoff for HuggingFace model downloads, preventing transient failures from blocking bundle installation. (#201)
## Infrastructure
## Bug Fixes
- OpenSSF Scorecard hardened from 4.3 to ~7.0.
- CI tests parallelized into 4 shards with downsized fixtures.
- 41 dependency updates across dev, production, and GitHub Actions.
- **Docker: fresh containers were completely unusable** -- `RATE_LIMIT_PER_MIN=0` in the Dockerfile caused `@fastify/rate-limit` to block all API requests (including health checks) with HTTP 429. Fixed by treating 0 as unlimited (50,000/min).
- **Docker: face detection AI tools failed on all platforms** -- blur-faces, red-eye-removal, enhance-faces, and passport-photo failed with "libGLESv2.so.2 not found". Fixed by adding `libgles2` to the Docker image.
- **Docker: HEIC files broken on ARM** -- `heif-convert` crashed with "undefined symbol: heif_get_plugin_directories" on arm64 due to library version mismatch. Fixed with `LD_LIBRARY_PATH=/usr/local/lib` to prioritize the custom libheif 1.21.2 build.
- **Docker: upscale and restore-photo AI bundles failed on ARM** -- `basicsr` could not build from source on arm64 because `wheel` and `setuptools` were missing from the Python venv. Fixed by pre-installing both packages.
- **Docker: OCR used wrong CUDA version on GPU** -- PaddlePaddle resolved from PyPI (CUDA 11) instead of the CUDA 12.6 index, causing symbol errors on GPU containers. Fixed by changing `--extra-index-url` to `--index-url` for the cu126 package source.
- **SSRF guard bypass via hex IPv4-mapped IPv6** -- The URL-fetch SSRF guard only handled the dotted form of `::ffff:` addresses. Hex-compressed forms like `[::ffff:7f00:1]` (127.0.0.1) bypassed the private IP check, allowing access to internal services and cloud metadata endpoints. (Reported by **tonghuaroot** via coordinated disclosure)
- **iPhone HEIC support** -- Built libheif 1.21.2 from source to fix decoding of iPhone HEIC files with auxiliary images (depth maps, HDR gain maps). (#183, #199)
- **Real-ESRGAN CUDA OOM on 8GB GPUs** -- Enabled tiling to prevent out-of-memory crashes when upscaling on GPUs with limited VRAM. (#200)
- **6 production Sentry errors resolved** -- Fixed crashes from malformed inputs, edge cases in metadata handling, and error response formatting.
- **7 bugs from QA sweep** -- Selective metadata stripping, meme font mapping, content type detection, and missing i18n keys. (#208)
- **Cryptographic password generation** -- Replaced `Math.random()` with `crypto.getRandomValues()` for password generation.
- **Docker Compose image name** -- Corrected the image name in `docker-compose.yml`. (#198)
## Security
- **Penetration test hardening** -- 10 findings from external security testing addressed: XFF rate-limit bypass (PT-01), malformed JSON 500 errors (PT-03), unbounded pipeline steps DoS (PT-04), clientJobId validation (PT-06), missing security headers on SSE streams (PT-07), audit log XSS (PT-08), TRACE method enabled (PT-10), missing 429 in OpenAPI spec (PT-12), unbounded SVGZ decompression (PT-13). (#207)
- **SSRF hex IPv6 bypass** -- Blocked hex-compressed IPv4-mapped IPv6 addresses in the URL-fetch guard. (Credit: **tonghuaroot**)
- **SVG XXE protection** -- Added test fixtures and validation for SVG XML external entity attacks.
- **Dockerfile base images pinned by digest** -- Prevents supply chain attacks from mutable tags.
## Acknowledgements
- **tonghuaroot** -- For responsibly disclosing the SSRF guard bypass via hex IPv4-mapped IPv6 addresses. The detailed proof-of-concept and suggested fix made for a quick turnaround.
- **@rudedog7106** -- For reporting HEIC decoding failures on TrueNAS/Docker. (#183)
- **@albanobattistella** -- For contributing ~145 Italian translation strings. (#206)
## Upgrade
```bash
docker pull snapotter/snapotter:1.17.1
docker pull snapotter/snapotter:1.17.2
```
Or with Docker Compose:
@@ -40,4 +60,10 @@ Or with Docker Compose:
docker compose pull && docker compose up -d
```
**Full Changelog**: https://github.com/snapotter-hq/SnapOtter/compare/v1.17.0...v1.17.1
Also available from GitHub Container Registry:
```bash
docker pull ghcr.io/snapotter-hq/snapotter:1.17.2
```
**Full Changelog**: https://github.com/snapotter-hq/SnapOtter/compare/v1.17.1...v1.17.2