0.2.6

2026-09-21

Fixed

Mobile dashboard — header stats (servers, S3, backups) wrap under the title instead of overflowing.
History on phones — each run is a card with name, status, source, size, and time at a glance. Desktop still uses the table.
Menu navigation — the sheet stays open with a spinner until the new page is ready, plus a progress bar so a slow load is not a blank wait.
SSH authorize box — shorter copy; the install command stays selectable so it can be copied on HTTP/LAN when the clipboard button cannot.

Changed

GHCR publish — :latest and version tags publish only on v* releases (not every main push). amd64 and arm64 build natively in parallel, then CI stitches a multi-arch manifest (no QEMU).

0.2.5

2026-09-18

Fixed

GHCR / Alpine image — pin Bun 1.3.13 in the Docker image (same as CI). Floating oven/bun:1-alpine pulled 1.4.2, which segfaults bun test on musl.

0.2.4

2026-09-18

Security

Next.js 15.5.24 — patch the 15.5.x unauthenticated RCEs (Windows-hosted servers and Image Optimization AVIF).

0.2.3

2026-09-09

Added

Git repository sources — clone a bare mirror on this host (git clone --mirror, vault SSH key for SSH remotes), tar it, then land like a volume archive. Restore unpacks the mirror. Connections has a Git tab.
Live History — backup start and finish stream over SSE so History refreshes without a reload, and a toast reports the result.
rsync --delete — opt-in on path backups so destination files that vanished at the source are dropped.

Changed

Connections — Servers, S3, and Git live under one navbar item instead of separate top-level links.

Fixed

S3 Test connection — restore the stored-profile helper so S3 detail and Connections overflow menus can probe a saved profile.

0.2.2

2026-09-05

Added

Dashboard day filter — hover a Backup status bar for that day’s counts and success rate; click to filter the card, then open History for that day.

Fixed

Verbose failure text — Recent Activity shows a short snippet instead of dumping the full error across the dashboard. The history detail still has the complete message, in a scrollable block.
Toasts covering Save — connection-test toasts sit under the navbar (top-right) instead of on top of Add Server / Save.
Docker-exec DB host — honor a custom database host so the client inside the container can reach a VPS-internal or docker-network database.

0.2.1

2026-09-04

Added

Docker first-run — Compose pulls ghcr.io/ceneka/lazybackup:latest without a required .env (copy-paste docker compose up).
README and landing storefront — screenshots and badges on GitHub; Get started points at the Docker snippet; Open Graph card for sharing.
GitHub community files — CODE_OF_CONDUCT, PR/issue templates, Dependabot, FUNDING, and package metadata so the repo looks installable.
Dashboard first hour — backup recipes and honest empty stats so a new instance does not look like a perfect backup record.
404, PWA, and version — branded 404/error pages, web app manifest, and a visible app version in Settings.
Next cron run — the backup form shows when the schedule will fire next (app timezone).
Gotify and Slack — failure-webhook and success-ping presets.
Config export — Settings downloads a non-secret lazybackup-config.json (no passwords, SSH/S3 keys, token hashes, or age identities). Session-only; no import yet.
Update check — Settings (and Status) compare the running version to the latest GitHub release, cached about 24 hours. Offline or rate-limited checks stay quiet.

Changed

MCP read_only catalog — mutating tools are omitted from tools/list (still denied at call time). exec_command is only advertised when remote_exec (or a browser session) is allowed.

Fixed

Empty dashboard — recipes no longer stack on an empty Backups card; next-run times use a stable locale to avoid hydration mismatches.
Restore on Alpine — inspect archives without requiring GNU tar.
Landing restore copy — docs match SSH destination pull and host retarget.

Security

Fresh authentication required for age vault changes.
Safer restore archives (reject unsafe paths / contents).
Browser security headers.
Logout is caller-local; outbound connections are pinned after validation.
LazyBro control/transfer boundaries tightened; peer object streaming uses bounded memory.

0.2.0

2026-08-13

Added

Restore from History — Path, volume, and database restore when the artifact is local, on S3, on Bro, or on an SSH destination with key auth (pulled onto this host first). History can restore onto a different host (server picker). Encrypted .age archives decrypt automatically. Password-only SSH destinations cannot pull for restore. Download the artifact without restoring in place (GET /api/history/:id/download).
Bro mailbox retention — Version-count and age/min-keep cleanup use the same rules as S3. LazyBackup advertises deletes[]; LazyBro unlinks and acks. Open recalls are skipped until they finish. Restore/download while the peer still holds the blob returns HTTP 202 (waiting)—not a backup failure.
Local Docker socket — Volume packs and docker-exec dumps from this host’s Docker, not only a remote SSH server.
SQLite dumps — First-class database engine → .sqlite.gz (native file / sqlite3 .backup only).
Multi-arch GHCR — linux/amd64 and linux/arm64.
LazyBro binaries — linux-x64, linux-arm64, darwin-arm64, darwin-x64, windows-x64 (release tag lazybro).
MCP — validate_backup, get_status, and opt-in read_only API tokens (mutually exclusive with remote_exec).
Status missed schedules — warn when enabled crons are overdue. Success-ping presets for Discord, ntfy, and Telegram (plus Healthchecks-style GET).
Install catalogs — Unraid Community Applications XML and TrueNAS SCALE compose under deploy/.
Landing changelog sync — /changelog is generated from this file at landing build time (landing/scripts/sync-changelog.ts); no hand mirror.
Landing compare page (/compare) — LazyBackup vs rsync/cron, with short notes on Restic, Borg, and Duplicati. Positions LazyBackup as a From→To control plane (SSH, Docker volumes, DB dumps, MCP), not a dedup archive CLI.
Landing changelog (/changelog) — user-facing release notes on the static site.
MCP demo callout on the marketing home page — links to the manage backups with MCP guide.
Screenshot gallery entries for Status, Encryption (age vault), API/MCP settings, S3 profiles, and Bro Space (capture when a seeded UI is available).
Age vault blog — keys, export, and recovery.

Reliability (recent main)

CI — tests and build before GHCR publish; Alpine/musl regressions caught in the image pipeline.
Concurrent-run lock — the same backup config cannot overlap itself.
Failure webhooks — notify on failed runs; method, headers, and {{tag}} body templates (Settings).
Backup validate — probes without transferring data; last validation results persist on the config.
Secret redaction — server, S3, and backup API responses strip secrets before JSON leaves the process.

Product surface (context for evaluators)

Also on recent main (see README / Features for detail): age encryption vault, Bro Space peer destinations, instance meta-backup, WebAuthn passkeys, Status posture page, S3-compatible endpoints, database dumps, MCP + API tokens with optional remote_exec.

Changes

Cut GitHub Releases from CHANGELOG on v* tags, and simplify the landing page.
Unify resource cards and S3 pages; show S3 and Bro endpoints on backup details.
New Backup first-hour UX: VPS path/volume recipes, cron preset chips, and SSH key gate for path transfers.
Self-host Inter so next dev does not fetch Google Fonts.

Tagging practice

Keep bullets under Unreleased in CHANGELOG.md, then move them into a dated [X.Y.Z] section when cutting a release.
Tag vX.Y.Z and push; CI publishes the GHCR image for main and v*.
Optionally open a GitHub Release whose body matches that changelog section.

Compare vs rsync →Features →