# Changelog: ipx-web

The page, and the container that serves it (Caddy). ipx's changelog is
[crates/ipx/CHANGELOG.md](../crates/ipx/CHANGELOG.md), which was the page's too until 0.12.0, and the
directory's [crates/directory/CHANGELOG.md](../crates/directory/CHANGELOG.md).

Its version is in `package.json`, and a release is tagged `web-vX.Y.Z`.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]

### Security

- The ipx-web image no longer carries curl, which Caddy's base image shipped and nothing used: 8.22.0 there is affected by CVE-2026-92392 (#237).

### Fixed

- The refresh buttons turn from the moment they are pressed until the scan they asked for has finished, smoothly, instead of jerking back upright between one feed and the next (#231, #233).
- A feed's unread count stays put while a scan checks it quickly; the spinner takes its place only when a check takes a moment (#232).

## [1.0.1] - 2026-10-13

### Fixed

- A live update or a list refresh that fails because the network is gone (a laptop asleep) is no longer reported as an error, an error page from Cloudflare no longer becomes a request's message, and requests a minute or more after a tap start a trace of their own instead of joining that tap's (#219).

## [1.0.0] - 2026-10-12

### Added

- With a directory token that may administer it, an admin has Check now and Remove from the directory on a Directory feed's page, and Servers and Blocked lists in Admin, Directory (#206).
- The page has a version of its own, which the logo's tooltip shows beside ipx's (#207).
- The page is served by its own container, ipx-web (Caddy), which passes the API to ipx on the same address, so a change to the page deploys without rebuilding ipx (#203).
- Admin, Directory sets the directory's address and this server's token, and whether to share, and says how the last share went (#205).
- A feed's settings have a Private switch, which keeps it out of the directory; on and locked for a feed whose address or login shows it is private (#205).
- ipx-web logs one line a request, without the request's headers or a sign-in token in the address (#210).
- ipx-web sends a trace span for each request when `WEB_TRACING=on`, continuing the page's trace into ipx (#213).

### Changed

- The Directory says when no directory is set up, and its counts are of everyone on every sharing server (#205).
- Add a feed no longer asks for a folder; a feed's folder is its title (#201).

### Fixed

- On a phone, the Subscribe button on a Directory feed's page is full size again, not squashed to a sliver (#212).

[unreleased]: https://git.sdf1.net/rays/ipx/compare/web-v1.0.1...main
[1.0.1]: https://git.sdf1.net/rays/ipx/compare/web-v1.0.0...web-v1.0.1
[1.0.0]: https://git.sdf1.net/rays/ipx/releases/tag/web-v1.0.0