Skip to content
cloudzilla
Star us
v0.6.0 · alpha

Changelog

Every shipped change to Cloudzilla, newest first. No roadmap promises here — only what's actually in the binary you can pull today.

v0.6.0
OCT 8, 2026

Operate it for real — mirrors, admin tools, metrics, and rate limits.

Latest
Added
  • Pull mirrors — scheduled sync from another Git host, a read-only guard, and credentials sealed with security.secret_key.
  • Edit, rename, and delete files straight from the code browser, plus a file tree that stays on blob pages.
  • Syntax highlighting with per-user code themes, and a create-a-fork page with owner, name, and default-branch options.
  • Password reset by email with a CLI fallback, a reset-2fa command for locked-out operators, and reset links issued from the admin user page.
  • Admin user management — suspend accounts everywhere they sign in.
  • Avatar uploads on local disk or any S3-compatible storage.
  • Close issues from closing keywords in commits and pull requests.
  • Prometheus metrics on a separate listener, plus /healthz and /readyz probes and a Docker HEALTHCHECK.
  • API rate limits per user and per IP, configurable per resource.
  • A Checks tab of commit statuses replaces the Actions mockup.
Fixed
  • Private repositories now answer pages, code search, and Git requests exactly like a missing repo.
  • Webhooks refuse private addresses at dial time; SSH refuses a key already registered as a deploy key (and vice versa).
  • Required status checks are evaluated against, and merge, the head commit that passed.
  • Code browser: annotated tags, nested file-tree filter, escaped refs and paths, and branch switching for refs like feature/x.
  • Settings forms show save errors instead of a stale success toast; the footer shows the real build version.
v0.5.0
OCT 4, 2026

Import, seed, and faster pull requests — on PostgreSQL 18.

alpha
Added
  • Import a repository from another Git host.
  • cloudzilla-cli seed fills a dev instance with test data.
  • Show/hide password toggle on sign-in and sign-up; admin pages linked from the user menu; command-palette items replace the home shortcuts panel.
Improved
  • Breaking: Docker Compose now runs PostgreSQL 18. Dump the database, remove the postgres_data volume, and restore — see the upgrade notes in the docs.
  • Pull requests diff from their merge base, skip the unused diff on the Conversation tab, and stop writing merged trees on page views.
  • Pushes walk only the commits they add; embedded assets are cached and gzipped, and mermaid loads on demand.
Fixed
  • Web commits keep existing entries intact and cap path and upload sizes; .git paths are refused.
  • Merged trees keep submodules and mode changes; tree entries sort in Git order.
  • Toasts show after HX-Redirect and HX-Refresh responses; left-side PR line comments land on the right line.
v0.4.0
OCT 1, 2026

Security hardening — accounts, auth, and Git pushes.

alpha
Added
  • Email verification at sign-up, with Google sign-in linked to verified addresses and connect / disconnect from account settings.
  • Organizations own their repositories; repository transfers must be accepted by the recipient.
  • Deleted accounts hand their content to a ghost user; commit author email is private by default.
  • New UI for gists, the dashboard, profiles, and organizations (overhaul phases 7–9).
Fixed
  • PAT and OAuth-app token scopes are enforced; TOTP is required on API, LDAP, SAML, and Google sign-in.
  • Branch protection is enforced before receive-pack writes the ref; unreachable, missing, or stale pushes are refused.
  • Thin packs and delete-only pushes are accepted over HTTP and SSH.
  • Private issues and repositories no longer leak through search, notifications, pinned lists, or the API.
v0.3.0
MAY 20, 2026

UI overhaul — flagship pages, insights, and a new design system.

alpha
Added
  • Full UI overhaul — flagship repository, issue, and pull-request pages rebuilt, with PR sub-views, account navigation, and a redesigned milestone view.
  • Repository Insights — commits, contributors, pulse, and a dependency graph.
  • Code browser & project boards redesigned, alongside refreshed tracker, Actions, and review-request views.
  • Profile, organizations, wiki, releases, discussions, and settings pages polished.
  • Publish step to promote draft releases to published.
Improved
  • New design-system foundation — every page ported and the shared component library expanded.
  • Hardened the GitHub Actions CI workflows.
v0.2.0
MAY 12, 2026

First public alpha — the core forge.

alpha
Added
  • Git hosting over smart HTTP + SSH — pure Go via go-git, with no git executable on the box.
  • Code browser — tree, blob, blame, commit history, and syntax-highlighted diffs.
  • Pull requests — fast-forward, three-way, and squash merges, draft PRs, and auto-merge.
  • Code review — inline line comments, one-click suggestions, and CODEOWNERS auto-assign.
  • Issues — labels, assignees, milestones, reactions, pinning, locking, templates, and private issues.
  • Organizations — orgs, collaborators, three-tier permissions, and protected branches.
  • Authentication — Google OAuth, TOTP 2FA, LDAP / SAML SSO, personal access tokens, and deploy keys.
  • Notifications — in-app feed plus SMTP email digests, per-repo watch levels, and an activity feed.
  • Webhooks with HMAC signing, retry / backoff, and redelivery.
  • Full-text search, explore / trending, project boards, wikis, gists, profile READMEs, topics, stars, and forks.
  • Single static binary, shipped as a Docker image; PostgreSQL is the only runtime dependency.
Improved
  • Migrated rendering to templ type-safe components across every page.
  • Standardized on PostgreSQL — removed SQLite, consolidated migrations, and moved stores to sqlx.
Fixed
  • Implemented the full git pack protocol for HTTP and SSH transport.
  • Hardened project-board data isolation and reaction ownership checks.
  • CSRF tokens now included in hand-rolled fetch() calls, plus numerous security-review fixes across phases.

Older internal builds aren't listed. Full history lives on GitHub Releases.