v2.10.0 (2026-07-24)

Features

• add 'ugc' to link rel attributes (#1120)
• api/vote: add get vote status endpoint (#998)
• auth: add SSO token exchange endpoint (#1134)
• config: enhance config file and data dir retrieval (#992)
• db: add TLS support for MySQL with Google Cloud SQL (#1104)
• go: upgrade golang to v1.26.2 and some deps
• go: upgrade golang to v1.26.5
• plugins: add plugin registry fetch script
• ui: add dependency injection container (#1006)
• ui: add npm published version check script
• ui/conf: add preferRemoteConf option (#1000) (#1011)
• ui/eslint: add eslint plugin for artalk ui development (#995)
• ui/eslint: update eslint-plugin-artalk to v1.0.2 (#1010)
• ui/page_vote: add page voting feature (#983)

Bug Fixes

• api: validate vote status targets
• api: make vote updates transactional
• api/stats: exclude pending comments
• api/vote: return not found for deleted targets
• auth: require verified email for SSO exchange
• build: propagate image version metadata
• build: bind Docker metadata to release commit
• cache: return database results on store failure
• ci: preserve nightly tag during release refresh
• ci: create release tags under tag ruleset
• ci: pin release retries to reviewed commits
• ci: satisfy workflow shell checks
• ci: harden release supply chain
• ci: harden release tag handling
• cmd: preserve config lookup before data chdir
• config: preserve keyword file separators
• core: initialize process timezone once
• db: enforce Cloud SQL TLS verification
• docs: support React 19 useRef types
• email: add Message-ID header
• scripts: harden npm publish check
• scripts: import Buffer explicitly
• ui: accept scoped comment lists without page data
• ui: restore deprecated context services
• ui: reject direct context replacement
• ui: align plugin lifecycle with final config
• ui: preserve generated list response contract
• ui: replace vulnerable HTML sanitizer
• ui/editor: restore deprecated aliases
• ui/sidebar: handle null array preferences
• ui/types: restore deprecated public aliases
• ui/types: preserve atomic config values
• ui/ua: support OpenHarmony and more browsers (#1087)

Code Refactoring

• api/vote: refactor vote http endpoint and logic (#997)
• auth: migrate JWT handling to v5
• ci: accelerate nightly publishing
• ci: optimize multi-architecture releases
• ui: improve modularity, lifecycle, and types (#1007)
• ui/auth: ensure compatibility with new client types (#1009)
• ui/comment: update reply button to use component
• ui/conf: introduce DeepPartial type for ui config (#996)
• ui/sidebar: ensure compatibility with new client types (#1008)

Testing

• remove races from async tests
• ci: expand release validation
• server: verify plugin URL trust filtering
• ui: update comment e2e flow
• ui: isolate Playwright end-to-end specs
• ui: cover Marked 18 integration
• ui: cover sanitizer attribute allowlist
• ui: isolate browser storage from Node

Documentation

• document dependency and security updates
• add v2.10.0 release notes
• add Japanese README (#1145)
• integrate git changelog plugin
• i18n: add Turkish (tr-TR) language support (#1119)
• i18n: add zh-TW translation for config template
• landing: redesign landing page (#1020)
• landing: add more translations
• landing: optimize responsive font size

BREAKING CHANGE

Beyond #997, #1007, and #1011, v2.10.0 changes default config/data discovery and relative-path semantics; raises source builds to Go 1.26.5; replaces the CGO-backed SQLite driver with a pure-Go implementation; fixes application timezone at process initialization, requiring a full restart to change it; removes the useBackendConf opt-out and remoteConfModifier; changes DI registration, Context mutation, update() return value, and created timing; and requires marked 18 with modern package resolution. Migration guide: https://artalk.js.org/en/guide/releases/v2.10.0.html

UI client now prioritizes local config in the latest version, whereas previously, the remote config would override it. (See #1011)

This update changes the UI client's export Types. Although we aim to maintain backward compatibility, it may still affect downstream UI programs. Please refer to the TypeDoc.

Vote HTTP API endpoint have been updated. (See #997)

nightly (2026-07-24)

Bug Fixes

• ci: publish npm package with trusted OIDC
• docker: push release images by digest
• plugins: prepare unpublished packages for release
• scripts: detect unpublished npm versions

v2.9.1 (2024-09-18)

Features

• go: upgrade golang to v1.22.7 and some deps

Bug Fixes

• db: sql error with custom table prefix (#970)
• test: separate test db to isolate concurrent test instances (#975)
• transfer: ensure consistent time format in artrans export
• ui/plugin: prevent exceptions from blocking other plugins loading

Performance Improvements

• plugin_katex: add error message for missing katex deps

Code Refactoring

• dao: improve concurrent testing for FindCreateAction function
• go: hardcode version and get commit_hash via runtime/debug
• go: bump the module version and support go install (#979)

Testing

• mutex: add tests for keyed mutex

Documentation

• refine deployment documentation
• i18n: add English translations for docs (#978)
• landing: add multi-language and dark-mode for landing
• landing: add demo video in landing page

BREAKING CHANGE

The original Go module name was github.com/ArtalkJS/Artalk, which has now been modified to github.com/artalkjs/artalk/v2 (all lowercase). This change may affect the CI pipeline or other areas if you are compiling the Artalk server and have specified the fixed Go module name. Regarding the original -ldflags -X github.com/ArtalkJS/Artalk/internal/config.Version and CommitHash definitions, please remove them, as they are now obsolete. The Version has been hardcoded into the Go code, and the CommitHash is now read from the Go build info via runtime/debug’s vcs.revision value. This change only affects the server developers and does not impact the frontend UI client.

v2.9.0 (2024-09-03)

Features

• auth: add user profile and password changing (#966)
• config: add site_url config option (#967)
• go: upgrade golang to v1.22.6 and some deps
• ui/dashboard: new dashboard ui refresh for desktop devices (#957)
• ui/date: add dateFormatter config option (#940)
• ui/plugin: make ui plugin configurable
• ui/sidebar: add dark mode toggle for dashboard (#790)
• ui/sidebar: add page search by keywords in sidebar (#603)
• ui/sidebar: add user search by keywords in sidebar (#710)

Bug Fixes

• anti_spam: handle empty referer variable in anti-spam check (#853)
• api/auth: fix missing Microsoft oauth provider configuration (#929)
• api/auth: migrate auth_identities when account merging (#920)
• api/auth: register issue due to unremoved auth records after user deletion (#919)
• api/comment_add: improve the security of comment add api (#964)
• auth: correct email verification code send button
• plugin/lightbox: fix import for non-browser env (#931)
• plugin_kit: fix typescript lib path retrieval on win
• plugin_kit: import source path case error on linux
• sidebar: correct total item count for pagination in sidebar
• ui/dark_mode: apply dark mode config option before mounting ui (#890)
• ui/plugin-kit: fix typescript lib folder for api-extractor in monorepo
• ui/sidebar: disable admin password check dialog in sidebar
• ui/sidebar: show env variables in sidebar settings ui (#946) (#956)
• ui/stat: fix invalid backward compatible strategy (#880)
• validator: restrict to allow only HTTP protocol

Performance Improvements

• api/auth: add more specific error messages for login failures
• app/init: generate translated config file by env variable ATK_LOCALE
• auth: add loading skeleton for login methods list
• auth: enhance visibility of skip button (#863)
• auth: perform optical adjustment for consistent icon sizing
• auth: correct verify button position in register form
• i18n: auto-load frontend i18n locale js sources
• notify: improve error messages for notify (#943)
• plugin_kit: improve typescript diagnostics output
• style/sidebar: modify font-family for sidebar
• ui/sidebar: enhance i18n translations for sidebar
• ui/sidebar: mask sensitive input values in sidebar settings (#494)
• ui/sidebar: optimize setup process and i18n lazy load (#962)

Code Refactoring

• plugin_katex: use tokenizer extension of marked (#955)
• ui/deps: remove abortcontroller-polyfill (#923)
• ui/marked: replace pkg-level marked with new class instance (#954)
• ui/types: add Layer interface
• ui/user: rename nick to name in LocalUser data structure (#961)

Documentation

• auth: set auth.anonymous to false as default
• ui/i18n: add more locale support for sidebar
• ui/i18n: add translations for French, Korean, and Russian

v2.8.7 (2024-06-09)

Features

• go: upgrade golang to v1.22.3 and some deps
• plugin_kit: add vite plugin for developing artalk plugins (#904)
• sync: add keyed rw-mutex

Bug Fixes

• api/auth: include render mustache params for verification email subject (#910)
• api/stats: fix site_pv response body and add unit tests (#896)
• api/transfer_upload: close temp file in transfer upload endpoint (#877)
• auth: failed to register by social account on mysql database (#902)
• conf_env: enhance environment variable loading for config (#892)
• plugin_katex: fix event issue causing katex integration failure (#897)
• ui/height_limit: height limit issue for collapsed comments (#865)
• ui/sidebar: unable to logout if user is not admin in control center
• ui/types: remove marked dependency in dts (#868)

Performance Improvements

• conf: add cache for config metadata to boost startup speed (#892)
• dao: add singleflight for no-cache db find func
• gravatar: support both sha256 and md5 hash for gravatar (#912)
• gravatar: convert email to lowercase before hashing for gravatar
• gravatar: use sha256 hashing algorithm for gravatar (#874)
• ui/conf: exclude conf pvEl, countEl and statPageKeyAttr from remove server (#905)
• ui/dev: bump eslint to v9 (#915)

Code Refactoring

• dao: add date field to the page json entity
• dao: improve QueryDBWithCache func and concurrent unit tests (#884)
• transfer: improve the reliability of the transfer (#883)
• transfer: strip domain from page key by default (#873)
• ui: fix linter issues for ui and docs (#917)
• ui/stat: use class selector for pageview elements by default (#880)

Documentation

• refine documentation
• dev: refine contributing.md and translate to chinese
• i18n: revise French translation (#913)
• ip_region: add instructions for obtaining accurate IP under proxy

v2.8.6 (2024-05-09)

Features

• auth: user accounts merge tool (#854)
• auth: social login api endpoints (#854)
• ci: include frontend dist files in release (#860)
• i18n: add incremental updates feature for i18n code scan tool
• multi_push/lark: add card mode for lark push (#839)
• sync: add keyed mutex
• ui/auth: plugin-auth for integrating social login (#854)
• ui/img_lazyload: add support for lazy loading images (#850)

Bug Fixes

• api/pv: add mutex for page pv record endpoint
• cache/user: user id cache from email lookup not cleared
• comments_get: include site_name for isolation in associated query for comment's page
• dao: ensure find and create functions thread safe (#845)
• db/migrate: fix root_id migrate for database lacking recursive CTE support (#848) (#846)
• db_migrate: drop fk_comments_user foreign key constraint of the users table
• sidebar/site: unable to edit the new site urls
• ui/dark_mode: add support for configuring dark mode in backend (#790)
• ui/dark_mode: unable to toggle dark mode for sidebar in auto mode
• ui/height_limit: height limit not working while loading images (#849)
• ui/marked: optimize same origin link judgment logic

Documentation

• update introduction document
• auth: add social login feature (#854)
• i18n: add translation for Korean and Russian

v2.8.5 (2024-04-24)

Features

• ci/build: add nightly build workflow
• conf/http: add http.proxy_header config option
• go: upgrade golang to v1.22.2 and some deps

Bug Fixes

• cmd/gen: ensure directory before saving in gen cmd (#612)
• dao: prevent potential infinite loop in FindCommentRootID
• db/migrate: issue with root id generation
• db/migrator: remove foreign key constraints and better root_id generation (#835)
• log: improve log system and fix memory leaks (#843)
• transfer: retrieve root_id for imported comment data
• ui/comment: missing reply comment data when inserting (#838)
• ui/comment: incorrect reply comment data in nested mode (#771) (#837)
• ui/lifecycle: keep root element during destroy (#810)
• ui/sidebar: user list not refresh when data is modified
• ui/upload: unable to upload image when file extension is uppercase
• upload: add config option to solve request entity too large issue (#834)

Performance Improvements

• conf/upgit: disallow custom executable path of upgit for security (#817)
• db: optimize N+1 query in comment list (#799)
• i18n: add translation for 'parameter is required'
• ui/pkg: add shorter export names (#821)
• ui/version_check: beautify version upgrade notice

Code Refactoring

• comments_get: reduce api complexity by introducing LiteDB (#800)
• ui/prettier: add prettier code formatter

Documentation

• extras: add deploy guide for Valaxy (#836)
• i18n: add French translation (#797)

BREAKING CHANGE

For UpGit users: Due to security reasons, Artalk no longer allows configuring the executable file path (img_upload.upgit.exec) for upgit. Please add it to system environment variables instead.

v2.8.3 (2024-03-04)

Features

• api/auth: invalidate old auth tokens after changing password
• api/domain: add GET /conf/domain endpoint
• app: add onConfUpdated hook
• comment: add is_verified field for comment entity
• ui/api: add ctx.getApiHandlers() to handle error responses and expose hooks
• ui/editor: add beforeSubmit hook for editor submitting
• ui/plugins: support dynamic loading of ui plug-in scripts (#774)

Bug Fixes

• captcha/image: unable to display image captcha on initial load
• conf: skip patching IP region conf if disabled
• exception: missing message field after refactoring exception data structure
• sidebar/login: cannot select a name with the same email upon login (#781)
• ui/layer: ensure immediate operation when calling show() after hide()

Performance Improvements

• ui/editor: improve the icon details for editor

Code Refactoring

• dao: validate the args of the FindCreateUser function
• entity/user: extract CheckPassword function
• origin: extract CheckURLTrusted function

v2.8.2 (2024-02-05)

Bug Fixes

• api/comments: ua field is optional and not required (#767)
• style: replace style break-all with break-word in content el (#644)

Performance Improvements

• ui/editor: optimize editor styles for narrow-width screens
• ui/editor: modify editor plug-in text buttons to icons for brevity
• ui/editor: place Cancel Reply at the bottom of editor area (#644)
• ui/lite: disable ArtalkLite preview config option by default

v2.8.1 (2024-02-04)

Features

• api: add GET /comments/:id endpoint (#764)
• config: add db.prepare_stmt config option (#760) (#762)
• ui/goto: improved solution of navigating to comment via link hash (#693) (#765)

Bug Fixes

• api/comments: counting comments issue in PostgreSQL db (#760) (#761)
• cmd/admin: update user role to admin if already exists
• ip_region: unable to output the IP region correctly (#760)
• ui/list: unable to reply or delete comments after switching pagination
• ui/no_comment: always appears when creating comment
• ui/pv: missing pageTitle field in the PV request
• ui/scroll: scroll into view issue when relativeTo parameter is provided

Performance Improvements

• style/sidebar: improve some detail in sidebar

Code Refactoring

• ui/comment: loose coupling between Comment and Context
• ui/list: refactor the list layout manager

Documentation

• supplement and refine fe-api.md