Releases

Release notes for tagged versions of Artist Alley, newest first. Entries are ported from the upstream CHANGELOG.md; see Installing for how to run each release.

Versioning follows the milestone model: v0.1.0 is the first tagged release, v1.0.0 marks out-of-beta. See ADR 0057 for the v0.1 baseline.

Version	Released	Tag
v0.6.0	Jul 23, 2026	GitHub
v0.5.2	Jul 21, 2026	GitHub
v0.5.1	Jul 21, 2026	GitHub
v0.5.0	Jul 21, 2026	GitHub
v0.4.0	Jul 18, 2026	GitHub
v0.3.1	Jul 18, 2026	GitHub
v0.3.0	Jul 17, 2026	GitHub
v0.2.0	Jul 16, 2026	GitHub
v0.1.2	Jul 15, 2026	GitHub
v0.1.1	Jul 13, 2026	GitHub
v0.1.0	Jul 12, 2026	GitHub

Generated from the GitHub releases API, refreshed every six hours. Notes for each version follow below.

v0.6.0

Public profiles, one viewing experience everywhere assets are shown, and a faster 3D preview pipeline.

• Public profile pages. Every user now has a profile page — reachable by username or by a stable ref — showing their display name, avatar, and the assets, posts and collections a viewer is allowed to see. It reuses the same visibility rules as the rest of the site: anonymous visitors see only public work, and only when public mode is on, and an owner can opt out of anonymous exposure. This also cleared the last of the dead author and similar-asset links (#478).
• Shared view controls everywhere. The browse view switcher (grid, masonry, thumbnail, list) and sort direction now appear on the profile and post-by-asset pages too, not just the main browse — one consistent control bar wherever assets are shown (#511).
• Faster 3D previews, and multi-file models fixed. Open-format 3D previews (glTF/GLB, FBX, OBJ) now render through a headless three.js worker instead of Blender — much faster, and arm64 deployments get 3D previews for the first time (the Blender path was amd64-only). A multi-file glTF model — the model file plus its external data and textures — now renders correctly where it used to fail silently. Blender stays as an automatic fallback (#497, #498, #507, #508, #486).

Under the hood: a large CI-reliability and test-isolation hardening pass. Not user-facing, but it is why these shipped green.

v0.5.2

Read-only viewers see the whole catalogue. The public demo login used to hit blank “Preview unavailable” tiles on anything above the lowest tier; now it sees every tier of content.

• A read-only content capability (#474). A new content.read.all grant lets a role read asset content at every sensitivity tier — and nothing else. It opens no admin surfaces and permits no writes, so the public demo viewer can browse the full catalogue without being an administrator. Granting it to a role is a deploy-side step (ADR 0060).

v0.5.1

Promoted all of dev since v0.5.0 — a patch version number, a substantial release. Two demo-surfaced fixes, a visibility-consolidation batch, and the accumulated foundation work.

• Shareable, reloadable asset pages. Assets now have a real /assets/[id] page, so a link to an asset opens, reloads and shares correctly. Before this, clicking an asset inside a collection dead-ended on a “Not found” page — the tile linked to a route that never existed (#475). A build-time link-integrity check now guards against dead internal links (ADR 0068).
• 3D previews work on published builds again. Turntable thumbnails for 3D models (glTF / OBJ / FBX and more) had silently stopped generating on released images — the published image shipped without the renderer, so every 3D asset showed no preview (#470). Fixed for amd64, with a build-and-render smoke so it can’t regress unnoticed.
• Audit-log retention and export. The audit log now has a retention policy — configurable per event category (a 7-year default, with shorter or longer holds per category), a legal-hold flag that exempts individual events from purge, and a nightly enforcement pass. A GDPR erasure request anonymises a user across the log — the events are kept, the person is replaced by a deleted-user placeholder — so the trail survives without the personal data. The whole log can be exported as CSV or NDJSON over a date range, streamed so exports of millions of rows don’t exhaust memory; IP addresses are withheld from the export for callers who can’t see them in the live view.
• Scheduled actions. Operators can now schedule a change to run at a future time — change an asset’s sensitivity, soft-delete, change state, or notify — and cancel it before it fires. Each action executes atomically with its audit entry, so it either fully happens and is logged or fully does not; a failure is recorded rather than half-applied. This is the generic engine (ADR 0020); the asset-gating features that use it — blur, reveal, timed embargo lift — land in later sprints.

Fixes: content-visibility hardening — soft-deleted collections no longer appear to signed-in non-owners, and the IIIF image path enforces the same visibility rule as the browse grid (#451, #460), plus audit and admin-gating cleanups (#458, #431).

v0.5.0

Public mode: content is now reachable without an account, on an operator’s terms. The visibility model gained a single enforcement point, sensitivity moved to the content plane, and opening the surface surfaced and closed three pre-existing access holes in the foundation beneath it.

• Public browsing is an operator choice, off by default. Anonymous access had no switch — any instance served its public content to the internet whether the operator wanted it or not. There is now a setting, enforced at the API rather than by hiding pages: turning it off means anonymous requests are refused, not merely unlinked. A fresh install starts private, and first-boot, login and SSO all keep working with it off.
• One place decides visibility. A public tier for collections and posts, and a single visibility predicate every read path splices in (ADR 0063). Anonymous callers see published, public, ready content only. Browsing without an account now works — GET /assets, /assets/{id}, /collections, /collections/{id} and public image bytes all serve anonymous requests; every write path still requires authentication.
• Sensitivity moved to the content plane. Byte-streaming previously checked only that a caller was signed in, so any authenticated account could download draft or restricted material. Sensitivity now gates content: team needs membership, restricted/embargo are owner-and-admin only, across originals, derivatives, HLS segments and archive entries. Listing is deliberately unchanged — restricted assets stay visible as locked items rather than vanishing (ADR 0064, following ADR 0020). Denials return 404, not 403, so a response cannot confirm a hidden asset exists.
• A logged-out visitor has something to look at. Curated content can be featured for a public audience and the front page renders it. Featuring is now a placement, not a flag — the same collection can be featured publicly and internally at once, each with its own order, and an asset can be featured without wrapping it in a collection. It never widens access: a featured item renders only if the viewer could already see it.
• Audit-log IP addresses are gated behind their own capability. Seeing what happened and seeing from where are now separate grants: system.audit.read returns the log without IPs, and a dedicated system.audit.pii.read is required to see them. The address is withheld at the API, not merely hidden in the UI.

Three pre-existing holes closed while opening the surface: the two asset and collection detail endpoints checked only that some caller was signed in, so any account could read another user’s private item by id; the collection list applied no visibility rule at all; and collection-contents enumeration was unchecked. All now run the same visibility decision.

v0.4.0

Operator visibility: the async pipeline and the storage layer are now observable and manageable from the admin surface.

• Jobs admin. The whole async pipeline (derivatives, previews, AI tagging, federation outbox) previously could only be inspected with psql. New surfaces — queue (by status/type with age and priority), workers (lease state, stale-lease flag), live, failed (with last_error), kinds (per-type concurrency) and schedules — read-gated on system.jobs.read so a read-only operator can watch without holding system.admin. Requeue, cancel and concurrency edits require system.admin; a currently-running job is never touched by either.
• Storage admin. Usage (deduplicated bytes on disk, originals vs derivatives, broken down by content type and backend) and variants (per-family inventory), read-gated on the new system.storage.read.
• Storage integrity sweeps. orphan_scan reconciles the object store against the database in both directions; checksum_verify re-hashes stored bytes against the content-addressed key. Both run as batched, resumable job kinds and report into an admin surface. Findings are advisory — no destructive cleanup ships in this release.
• About reports the real version, read from a new anonymous GET /build-info endpoint instead of a hard-coded placeholder; the displayed licence was corrected to AGPL-3.0-only.
• Help is visible to read-only operators — documentation, shortcuts, about, release notes and support are explicit public admin tiles, identical on desktop and mobile (ADR 0061).

Infrastructure: storage backends gained an ordered, cursor-resumable List (ADR 0062); Dependabot grouped per ecosystem so routine bumps stay auto-mergeable; a pre-checkout stale-.git-lock sweep fixed intermittent self-hosted checkout failures.

v0.3.1

Admin read-cap UI + foundation cleanup.

• Admin UI for read-cap holders. The frontend half of v0.3.0’s read capabilities: the admin menu and route guard now gate per tile on the capability each surface actually enforces, so a read-only role (without system.admin) sees and can browse the sections its capabilities permit. The backend still enforces every write.

Infrastructure: repo-wide gofmt normalisation behind a gofmt -l CI gate; a make release target codifying release prep (version bump, OpenAPI regen, drift check, promotion PR) without tagging; Dependabot github-actions group split; the steel secondary token wired into the Alert info tone.

v0.3.0

Derivatives, read-only admin, responsive UI.

• Media derivatives generated on seed/upload. aa seed and the upload path now produce col / hires / screen thumbnails plus sprites.jpg video hover-scrub sheets — the browse grid renders real thumbnails instead of 404ing, and videos get a slideshow preview.
• Read-only admin access. A role can hold *.read admin capabilities and browse the admin surface without the system.admin superuser cap — six previously superuser-only surfaces (activities, featured, license, metadata-extraction, federation, requests) now render read-only.
• Responsive + accessible UI. Browse and navbar are fluid from a 390px phone to a 3840px / 32:9 ultrawide — an auto-fill grid where size is the lever and column count is the outcome (no breakpoint cliffs), an Instagram-style single-column feed view, hide-on-scroll chrome, and WCAG 2.2 AA target sizing on coarse pointers. Desktop layout unchanged.
• Featured content curation is seeded, so the admin Featured rail and the public collections featured tab both show content on a fresh seed.
• Operator-bug fixes. PATCH /admin/system/site now merges instead of blanking omitted fields (updating base_url used to wipe the site name); unroutable file extensions no longer mint guaranteed-terminal preview jobs.

Infrastructure: a CI/nightly stability arc (per-run compose isolation + resource caps, five stacked shared-daemon/host causes fixed) left the federation nightly green for the first time since 2026-06-21.

v0.2.0

Admin surface unlock + public demo.

• Admin tiles unlocked (Tier 1–2). The admin surface is now fully navigable: audit-log viewer (/admin/audit), per-user active sessions plus capability grants/revokes, resource requests, trash with soft-delete restore across assets/posts/collections, system log, and an API explorer served from the Go binary (/api/v1/openapi.json, replacing the external-spec fetch).
• AA_DEMO_MODE. Env-gated demo mode — a demo/demo credential hint and fill button on the sign-in screen, plus a read-only banner when signed in as the demo user. Off by default; zero footprint on real installs.
• Public read-only demo at demo.artist-alley.org — runs the release image behind a write-blocking nginx edge, seeded from the Layer-A dataset, and auto-redeploys on each release.

v0.1.2

Patch release: brand palette, job/queue fixes, dependency majors.

Note

This tag has no upstream CHANGELOG.md section; the summary below is drawn from the commits in the v0.1.1..v0.1.2 range.

• Burnt/Steel repalette (AA-verified) with the finalised chevron brand mark, the configured site name honoured throughout, and a favicon viewBox fix so the tab icon renders.
• Per-type job concurrency caps are now applied in the single-process worker pool (#278).
• Saved-search hot loop fixed — the notify coordinator now grid-aligns reschedules instead of spinning (#292).
• Dependency majors — pdfjs-dist v6, three.js r185, dead model-viewer removed, pins moved off latest; supply-chain forks retargeted from mscrnt/* to Artist-Alley-Org (#286).
• API docs gained a usable getting-started and clean error documentation, and dropped internal phase codes.

v0.1.1

Patch release. Fixes the background-job processing outage from v0.1.0 plus release-pipeline and dependency hygiene. Docker-only, multi-arch (amd64 + arm64), Sigstore-signed.

• Media processing restored — the in-process worker pool never claimed jobs on a fresh install, so thumbnails, previews, transcripts, and search embeddings never generated. Fixed. (#279)
• Release image publishing fixed — the org rename left the container-image owner with capitals, which is an invalid lowercase-only OCI tag; edge and release image builds failed. Corrected. (#280)
• Dependency security cleanup — bumped every open advisory in the shipped artifact (golang.org/x/net, DOMPurify) and the optional CLIP sidecar (torch, Pillow, python-multipart), clearing all open Dependabot alerts. (#281, #283, #284)

Astuce

v0.1.0 users should upgrade — the worker fix is required for any media processing (thumbnails, previews, search) to work.

v0.1.0

The first-ever public release — the transition from pre-tag development to a versioned baseline (RS-derived code removed, AGPL-3.0 relicense, core feature set in place).

Distribution

v0.1.0 ships as a multi-arch Docker image (amd64 + arm64), published to GHCR and Docker Hub and signed with Sigstore. Native packages and binaries (.deb / .rpm / static / Homebrew) are a v1.0.0 target (#242). See Installing.

Highlights

Pulled from the roadmap’s Shipped foundation set:

• Single-binary deploy. One Go server with the SvelteKit SPA embedded via go:embed; Postgres + a storage volume (filesystem or any S3-compatible bucket — AWS / R2 / B2 / MinIO). Goose migrations run on boot.
• Identity & auth. Sessions, scoped API tokens, roles & capabilities, password policy, and an SSO provider-config UI (LDAP / SAML / OAuth enforcement lands with Phase 1.18).
• Upload → posts → collections. Drag-anywhere upload with a background queue, per-row tags + per-asset metadata, three post-composition modes, and separate cover thumbnails. Posts wrap assets; collections wrap posts; full-text search spans all of it.
• Admin-extensible metadata (Phase 1.9). Operators define typed custom fields per asset-type and per collection, with per-field capability gates and audit history (ADR 0012).
• Browse & review. Grid / masonry / thumbnail / list feeds with a sortable spreadsheet view; a post detail modal with multi-asset scroller, comments, likes, and a dedicated review canvas (zoom / pan / tile).
• Universal asset viewer (Phase 1.18). One Svelte shell hosts per-kind bodies — image, video, audio, PDF, font, 3D — over a shared anchor model, with universal pan/zoom, fullscreen, and jump-to-frame.
• Format coverage. Images (PNG / JPEG / WebP + HDR / EXR / Radiance), HLS video with frame-accurate scrubbing, audio waveforms, multi-page PDF, font specimens, and native 3D viewers (glTF / GLB / OBJ / FBX / .mview) with Blender-rendered turntables for heavy formats.
• Federation v1 — ArchivePub (Phase 1.22). The reference implementation of ArchivePub, the walled-garden federation protocol built on the ActivityPub data model: per-actor inbox/outbox, Ed25519 signed envelopes, share-list access control, a delivery worker, and an admin queue. Encrypted-federation arc complete; spec at v1.0-rc1. The first federated DAM, open-source or commercial (ADR 0043).
• Admin & account shells. A 13-section capability-gated admin menu with a Scalar-embedded API explorer and real config surfaces (site, SMTP, auth, AI providers, appearance); an account shell with profile, theme + language preferences, and API-token management.
• Theme & i18n. M3-shaped light + dark palettes with admin-configurable font slots; per-user language preference with English shipped and Spanish + French stubs in the picker.

License

AGPL-3.0-only, dual-licensed with a separate commercial license — the relicense from BSD-3 shipped ahead of the tag (ADR 0016).