7 releases 11 tags

RSS feed

• 2026.10.6.1 99b59ec10e

  Compare

  2026.10.6.1 Stable

  marvin8 released this 2026-10-06 04:29:24 +00:00 | 57 commits to main since this release

  Signed by marvin8

  SSH key fingerprint: SHA256:B4Q+9pbWSIqGYTl3Ub/FPrBSqAVd2OkCR13hYRG5wek

  [2026.10.6.1] - 2026-10-06

  • Sign-in is here — yunjin now has real accounts: a first-run setup page, username/password login with configurable session lifetime, logout, and CSRF protection on every state-changing request. No more implicit single-user access.

  • Everything is per-account — each account gets its own feeds, topic aggregates, read state, display settings, ignore rules, and OPML import/export. Shared feeds are still fetched only once no matter how many accounts subscribe to them.

  • Passkeys (optional) — sign in with a fingerprint, device PIN, or security key instead of a password; enroll and manage passkeys from Settings → Account, with shorter 12-hour passkey sessions. Passwords always remain the fallback. Requires serving yunjin over HTTPS on a stable domain and setting two new environment variables (YUNJIN_RP_ID, YUNJIN_ORIGIN).

  • Account self-service and simple administration — users can change their own password and delete their own account (with full data cleanup); there's no sign-up page and no admin role — accounts are managed from the server with the new yunjin create-user and delete-user commands.

  • Documentation expanded — new pages for passkeys, account management, and the CLI, including the HTTPS prerequisite and configuration for passkey support.

  Commits

  • 🔀 Merge branch 'feat/multiuser' 89f26f7
  • 🔀 Merge branch 'feat/issue-67-account-management' into feat/multiuser cea51eb
  • ✅ Restore session lifetime config via monkeypatch d631863
  • 📝 Qualify passkey gating, operator wording, and seeded default in docs f7fba96
  • 📝 Move account docs to a dedicated page ab3edcd
  • 📝 Anchor the gitleaks vector regex and round out account docs e1a8fb2
  • 📝 Say aggregates, not groups, in the passkey deletion docs f94e6ca
  • ✅ Expect IntegrityError in credential-id uniqueness test f05ef6a
  • 🔒 Scope gitleaks allowlist to the public fixture vector bbc03b6
  • 🐛 Close setup-gate bypass and harden registration errors 5ee6dc5
  • 📝 Document account management and passkeys 0ff72cf
  • ✨ Add create-user and delete-user CLI commands 45bfb5d
  • ✨ Add self-service account deletion with data cleanup e08d218
  • ✨ Add password change with session handling 366c86a
  • ✨ Add passkey enrollment and credential management 0bb3e56
  • ✨ Add username-less passkey login c4c3f0c
  • 🔒 Enforce per-login session lifetimes fcbfd15
  • ✨ Add webauthn ceremony service d0b3730
  • ➕ Add webauthn dependency 5c4d189
  • 🗃️ Add webauthn credential schema and data access layer dc90ee9
  • 🔀 Merge branch 'feat/issue-65-data-ownership' into feat/multiuser f80a44a
  • ✅ Cover get_articles_for_feeds and clarify unsubscribe docs 7d3b6c2
  • 📝 Mark reuse-ignored add-feed options in the CLI table f74f9f2
  • 📝 Reword the waitress licence-ignore rationale a49c786
  • ⏪ Run the nox pytest session with plain pytest bcbf9e8
  • ✅ Assert the subscription UNIQUE constraint by indexed columns 5439ead
  • 🔒 Scope aggregate article links to the aggregating user c851e8a
  • ✅ Pin unsubscribe effect and document feed-reuse metadata 819cb98
  • 📝 Fix refresh docstring and generics annotation in aggregator 821d00a
  • 📝 Add per-user CLI flags and document data ownership 1de8592
  • ✨ Replace feed deletion with per-user unsubscribe 97524d3
  • ✨ Scope feed management and OPML to the session user b0140b3
  • 🐛 Make subscription cleanup atomic 01551c3
  • ✨ Add subscription service with orphan-feed GC bfdd67d
  • 🗃️ Add subscription model and data access layer 3bcd54e
  • ✨ Cluster and read aggregates per user 69a8b44
  • 🗃️ Add feed subscriptions and per-user aggregates migration e489054
  • 🔧 Switch WuMing agents to DeepSeek flash and raise diff cap to 5000 4a2457d
  • 🔧 Bump dependencies and align pre-commit revisions a78fe97
  • 🙈 Ignore local .pi and media directories 0255325
  • 🔀 Merge branch 'feat/effort1-auth' into feat/multiuser 5326063
  • 🔁 Re-trigger CI after PR #63 push non-dispatch ff1ee47
  • 🐛 Container smoke test fetches the login page bdd5fab
  • 🐛 Equalize failed-login work to prevent username enumeration b7c618a
  • 🐛 Initialize database in set-password command 4411eda
  • 📝 Add set-password CLI and document session configuration 8782486
  • ✨ Derive acting user from session on all routes 91eabdc
  • 🔒 Enforce authentication and CSRF across all routes ae6619a
  • ✨ Add setup, login, and logout routes with session config 7dfc606
  • ♻️ Extract safe_next_path redirect helper 459bea7
  • ✨ Add auth service with password hashing and session validity 485edf3
  • ✨ Add password hash and session validity to user model b7b3d7a
  • ✨ Add user credential columns migration 6dcd63f
  • 🔀 Merge branch 'feat/favicon-raster-fallbacks' e47d317
  • 🐛 Smoke test fetches apple-touch-icon from its /static path b471631
  • ✅ Smoke test checks icon content types and serves both icons 8abb4bd
  • 🐛 Fetch smoke-test ICO to file to avoid SIGPIPE under pipefail 72b64a0
  • ✅ Route test compares favicon.ico bytes to static file ae6f4ee
  • 🐛 Update container smoke test for direct ICO favicon serving 08c6125
  • ✅ Strengthen favicon fallback assertions per review 18b8e78
  • 🔧 Retrigger CI after upstream Forgejo hosting outage 7530060
  • 🔧 Retrigger CI after transient zhuiri runner failure 1fefeb4
  • 👽 Add ICO and apple-touch-icon raster fallbacks 56c08cb
  • 🎨 Draw cloud favicon as explicit vector art in primary blue 446794c

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    2 downloads