Changelog

Every change to the site from 1.0.0 to now, newest first. One site made from five: Home, Links, Info, Cards and Tools, with one login, one Settings panel, one backup and one look.

Versions match HUB in web/core-data/lib/boot.php and the ?v= value each page loads. Your data in site-data carries over through every update. Each update is one zip, named with dots in the version (for example site-update-1.28.1.zip), and it contains this file as web/core-data/docs/CHANGELOG.md.

How to Update

1. Extract site-update-X.zip over your site folder.

2. Press Ctrl+F5 on any page.

3. Never delete site-data. It holds all your data, and updates don't touch it.

4. Open gear › Health. Leftover files from older versions are deleted automatically; only what could not be deleted is listed.

Nothing to migrate by hand unless an entry says so.

Version Map

Version	What it brought
1.43.1	Tools loads its code once (the React error in the console is gone); pages pre-load when you hover over their link in the bar
1.43.0	Newer, safer PDF reader in Tools (pdf.js 6.4.299); Excel export without an outside library; easier to read in light and dark mode
1.42.0	Tools > Favicon: a 512 × 512 size, and downloads save right there instead of opening a new tab; the website uses clean addresses
1.41.0	New padlock pictures: gold for private tabs, green for encrypted tabs, in Info and Links
1.40.0	Needs PHP 8.3 or newer; the site tells you when your PHP stops getting security fixes; the bundled libraries were reviewed
1.39.0	Homebase Hub's own logo is the default logo and tab icon; the docs and readable source moved to web/docs
1.38.0	Updates from GitHub (Check Now, an optional daily check that is off by default, one-click download with a checksum, then your password); the project is public on GitHub under GPL-3.0; new installs are named Homebase Hub
1.37.0	Info: any number of boxes in each tab (up to 12), each in its own width and height; Classic layout removed, Notebook Cards is the default
1.36.0	Home loads faster (phone-sized background photos, Settings styles split out); Info tabs can be Classic, Notebook Cards or Document; Settings: Guided Setup, jump chips and a status pill on every menu item
1.35.0	Info's four Export buttons work again; Info's broken leftover backup timer removed; dead code and styles removed; every page's scripts and styles minified
1.34.1	Smaller scripts and styles (about 19 KB less to download per browser); the readable source is kept in docs/src
1.34.0	Login history and a list of logged-in devices; Settings search; Export Data (CSV or JSON); your own presets; page accents; button text that follows the accent; update preview; What's New; Server Check for memory and photos; newer PDF library
1.33.0	Fix: Home ran out of memory while saving big photos; Changelog in Settings; modern Security and Telegram tabs; 94 more presets; Title Case labels everywhere
1.32.1	Nothing in site-data can run as code any more; Settings menu: Protection & Data; start page menu: just Settings
1.32.0	The engine moves into web/core-data; gear opens the Settings page; redesigned Encryption, Telegram Setup and Back Up tabs; Updates renamed
1.31.1	Fix: the Settings page was white in dark theme
1.31.0	Settings is a page of its own, with tabs, an Overview and a menu; update the site by uploading a zip; check and delete files that do not belong
1.30.2	Fix: the start page's Settings sheet was laid out wrongly
1.30.1	Links' own Site Icon setting removed: one logo everywhere
1.30.0	Start Over button; backups include Telegram and the domain watch list; clearer Telegram and Security screens; one logo everywhere (in web/core-data/media/brand)
1.29.4	Security hardening (strict page policy, one set of headers, guarded include files); dead endpoints removed; smaller Cards and Info pages; cross-reference checks
1.29.3	Your pictures and icons live in web/core-data/media/; web/core is gone (old cron and Telegram addresses stop working)
1.29.2	Tools files in plain assets/ (no version in the folder name); docs/ moved into core/
1.29.1	Cards is back to the original table; the 1.29.0 tile redesign is removed
1.29.0	New folder layout (core/ beside web/ and site-data/); Cards tiles; change passphrase and recovery key; Health speed, log and backup checks
1.28.4	Links draws at once; encrypted tabs unlock in the background
1.28.3	Links opens faster and no longer shows "Loading bookmarks…"
1.28.2	Links' encrypted tabs match Info's lock screen and unlock box
1.28.1	This changelog in every update zip, compiled into one history
1.28.0	One encryption passphrase; Telegram settings reordered
1.27.0	Encrypted tabs in Links
1.26.3	Security hardening, faster Tools downloads, Links save fix
1.26.0 – 1.26.2	18 new Tools; Tasks week and Analytics reworked
1.25.0 – 1.25.2	Tasks calendar and side panel; Tools layout; Health in one place
1.24.0	Tasks rebuilt; Presets tab; Tools section colors
1.23.0	Safer Telegram and domain-watch saves; security and speed
1.18.0 – 1.22.0	One password for everything; Security and Settings reorganized
1.17.0	Encrypted backups, Telegram approval and bot, domain watch, Year in Review, Health
1.10.0 – 1.16.0	Tasks, Telegram reminders, time zone, themes and presets, Colors and Backup redesign
1.9.3	Security fixes
1.7.0 – 1.9.2	Text sizes, page backgrounds, Tools tabs, typed colors
1.1.0 – 1.6.x	Earlier work (summarized)
1.0.0 – 1.0.1	First combined release (2026-10-12)

1.43.1

Tools loads its code once

• The Tools page loaded its main file under two addresses, so the browser ran two copies of React. Every tool hit an error on its first try and then recovered, leaving "Minified React error #321" in the browser console. An import map on the page now tells the browser both addresses are the same file. Tools works as before, without the error.

Pages open faster from the bar

• Hover over a page in the bar, or start to tap it, and the browser prepares that page in the background, so it opens almost at once. Your site already asked for this, but every page's security policy blocked it, so it never worked. The pages now name a small rules file instead (web/core-data/assets/speculation-rules.json), which the security policy allows.
• Browsers that do not support it ignore it, and a browser can skip it, for example to save data or battery.

Checked on a real Apache server

• The site's .htaccess files (security policies, private folders) were tested on Apache for the first time: every page answers with its policy, and site-data, web/docs, config.php and the file list are refused. This test now runs on every change.
• A page's own security policy no longer includes frame-ancestors, which browsers ignore there (the server's policy still sends it).

1.43.0

Tools: a newer, safer PDF reader

• The PDF tools now use pdf.js 6.4.299, the newest version, instead of 3.11.174. Older versions have known problems where a specially made PDF could run script; this version has no known problem. PDFs are opened with scripting turned off.
• Every PDF tool was checked with real files: PDF to Images, Compress, Merge, PDF to Text, and the page previews in Organize, Split, Sign, Annotate, Watermark and Protect.
• pdf.js 6 needs separate decoders for JPEG 2000 and JBIG2 pictures and for colour profiles; they are included and load only when a PDF needs them.

Cards: Excel export without an outside library

• Export Excel now writes the spreadsheet itself instead of loading an 880 KB library (SheetJS) whose last free version has known problems. The file has the same columns, widths, ₹ amounts and totals, a bold header, and the Information sheet when you have notes. It is the standard .xlsx format; it was checked in LibreOffice.

Easier to read

• Every page was checked with an accessibility tester (WCAG 2.1 AA), in dark and light mode, and every problem it found is fixed:
• In light mode, gold and the Tools section colours used as text are now a darker shade of the same colour, so they are easy to read on a light background. Buttons and highlights keep the bright colour.
• Small grey text (notes, the group names in the Settings menu) is a little brighter in dark mode and a little darker in light mode.
• The Settings menu is announced as a list of sections, the Tasks calendar days read what they show, and a hover box in Links no longer confuses screen readers.

Behind the scenes

• Every change is now tested automatically: the update tests, every page and every tool in a real browser, the accessibility check and the library check. The tools these checks use are pinned to exact versions.
• AGENTS.md explains the rules and the release steps for anyone changing the code.

1.42.0

Tools: Favicon

• Get from a Website now offers 512 × 512 next to 16, 32, 64, 128 and 256. Google's icon service gives at most 256 × 256, so the 512 picture is enlarged from that, and the page says so.
• Downloads save right there. Before, a download opened the icon in a new tab and asked you to right-click and save it, because Google's service does not let a web page save its pictures. Now your own site fetches the icon and the browser saves it as a file, like example.com-favicon-512.png.
• Only the website name is sent to Google, as before, now through your site. The icon address is open to visitors but limited to 60 icons per visitor per 10 minutes, accepts only real website names and the sizes listed, and only ever returns a PNG.
• If your hosting cannot reach other websites, the tool says so instead of opening a new tab. Settings > Health > Server Check shows whether it can.

Tools files are now checked on every build

• A short fingerprint of the Tools files decides when your browser throws away its saved copy of them. A new script, tools/tools-rev.py, makes it, and the build refuses to run when it is out of date, so a changed Tools file can never be served from an old saved copy.

1.41.0

Padlocks you can tell apart

• A gold padlock now marks a private tab (only shown when you are logged in), and a green padlock with a tick marks an encrypted tab. Before, both looked alike in Links, and both were thin outlines.
• The same pictures are used on the "Encrypted Tab" unlock card and on the bar that says "Encrypted tab, unlocked on this device until you log out or lock it", in Info and in Links.
• The tab's tooltip says which kind it is.

1.40.0

PHP 8.3 or newer

• Homebase Hub now needs PHP 8.3 or newer. PHP 8.1 stopped getting security fixes on 31 December 2025, and 8.2 stops on 31 December 2026.
• An update that needs a newer PHP than your server has is refused with a clear message, and nothing changes. This covers updates from GitHub and uploaded zips. If your host runs an older PHP, choose 8.3 or newer in your hosting panel (in cPanel: MultiPHP Manager) and try again.
• Settings > Overview now tells you when the PHP your site runs on has stopped getting security fixes, or will within about six months, and what to ask your host for.
• Settings > Health > Server Check shows the same notice next to the PHP version.
• The site does not stop working on an older PHP; it only warns, and refuses updates it cannot support.

Checked the bundled libraries

• The PDF reader in Tools (pdf.js 3.11.174) and the Excel writer in Cards (SheetJS 0.18.5) have known problems that need a crafted file to be opened or read. Tools already opens PDFs the safe way, and the site never reads Excel files, so neither can be reached. Both facts are now checked automatically before every release. The details are in THIRD-PARTY.md.
• Nothing else bundled has a known advisory.

1.39.0

The logo

• Homebase Hub now has its own logo: a gold house. It is the logo in the bar and the tab icon on every page until you choose your own in Settings > General. Your own logo still replaces it everywhere.

The docs moved

• README.txt, CHANGELOG.md and the readable source of every minified script and style moved from web/core-data/docs to web/docs. They are still closed to browsers.
• For this one version a copy of the changelog also stays at the old place, so a site on an older version can show "What Is in This Update" before it updates. It will be removed in a later version.

1.38.0

Homebase Hub is now a public project

• The site is published as Homebase Hub on GitHub (https://github.com/Jackpison/Homebase-Hub) under the GPL-3.0 licence. Every file the project wrote carries a short licence notice; bundled libraries keep their own licences (see THIRD-PARTY.md in the repository).
• New installs are named Homebase Hub instead of "My Site". An existing site keeps the name it has.

Updates: from GitHub, and still by uploading a zip

• Settings > Updates > Update From GitHub. Check Now looks for a newer version. When there is one, Download and Check Version X downloads the release zip, compares its size and SHA-256 with the list GitHub publishes, and then runs exactly the same checks an uploaded zip gets. Nothing on your site changes until you read the changes and type your website password; applying is the same as before (snapshot, swap, self-check, automatic rollback).
• Check GitHub Once a Day is off by default. While it is off the site makes no request to GitHub unless you press Check Now. When it is on, the check runs with the Telegram schedule (the cron job), and Overview shows "Version X is available on GitHub".
• The check reads a small latest.json on the project's GitHub Pages address first; GitHub's own API is only a fallback, asked at most once a day. If GitHub cannot be reached the site says "Couldn't check" and keeps working.
• Only github.com, api.github.com, the project's Pages address and githubusercontent.com are ever contacted, over HTTPS, and every redirect is checked again. The zip must be this project's own release file for that very version; a zip whose version differs from what GitHub lists is refused.
• The checksum catches damaged or partial downloads. It comes from the same GitHub account as the zip, so it does not prove a release is genuine; that is why nothing installs by itself and you see the changelog and file list first.
• Server Check also tests that your host can reach GitHub.
• Uploading a zip works exactly as before.
• The project website and a PDF guide (every page and every setting, with screenshots) are built from the repository and published on GitHub Pages; they are not part of the update zip.

1.37.0

Info: as many boxes as you need, in any size and shape

• Add Box: in edit mode every tab ends with a dashed + Add Box tile. A tab can hold up to 12 boxes, and a new box opens ready to type in. Tabs still start with two boxes.
• Box Settings (the small sliders button next to Edit on each box):
• Width: Auto, One Third, Half, Two Thirds or Full. Boxes sit in a 12-column grid, so a third and two thirds share a row, three thirds make a row of three, and so on.
• Height: Auto, Short, Tall or Extra Tall.
• Move Earlier / Move Later to change the order, and Delete Box (a box with text asks a second time; the last box in a tab cannot be deleted).
• Auto width is half the page in Notebook Cards and the full page in Document. In Document the sizes make the page: for example a full-width section, then two half-width sections side by side.
• On a phone every box is full width, whatever its size.
• Safe with other devices: every box now has its own id, so a page that has not been refreshed still saves into the box it is showing, even after you reordered the boxes on another device. A page that is out of date cannot add, remove or reorder boxes: it says so and shows the latest version.
• Boxes work in encrypted tabs too: a new box is stored encrypted, resizing and moving keep the encrypted text as it is, and Remove Encryption in Settings now decrypts every box in a tab, in order, with its size (it used to expect exactly two). Backups and restores keep the boxes, their order and sizes, and earlier versions restore them too. Export (text and PDF), search and the outline all handle any number of boxes.

Layouts: Classic is gone

• Notebook Cards is the default and the only card look; Document is the other choice. The Classic layout is removed, and a tab that was Classic now shows as Notebook Cards (nothing is lost; the boxes are the same two, now as cards you can resize).
• In Edit Tab the choices are Notebook Cards (now described as "Cards you can size and arrange. The default.") and Document. New tabs are Notebook Cards.
• Old styles that only the Classic layout used were removed.

1.36.0

Faster: Home (the design is unchanged)

Measured on real Apache with the minified files, throttled to a mid-range phone on slow 4G, with a background photo: 329 KB became 197 KB (40% less), the page finishes loading about a third sooner (2.2 s to 1.4 s), and the first paint is a little earlier.

• Phone-shaped background photos. A phone held upright shows only the middle slice of a landscape photo, but used to download all of it. Each new background photo now also gets a center-cropped 3:4 copy (name-p.jpg). Portrait screens load that copy (86 KB instead of 221 KB in the test) and look the same as before: compared pixel for pixel, the difference was invisible. Landscape screens and desktops still get the full photo, and turning the phone swaps the file. The copy is deleted with its photo. Photos saved before this version have no copy and rotate out after a few views.
• The Settings styles are a file of their own. 68% of shell.css only styled the Settings page, yet every page downloaded and parsed it. It is now shell-settings.css, loaded by the Settings page, and by other pages only when a Settings part opens. The stylesheet every page needs went from 81 KB to 31 KB (readable), and rules that only belonged to the old Settings popup were removed. About 110 screens (every page, every Settings tab, the login and Text Sizes dialogs, in dark, light and phone widths) were compared before and after: the same.
• The background photo no longer competes with the scripts and styles the page needs to appear: it loads at low priority and fades in as before.
• On data saver or a 2G connection, the idle download of the Settings files is skipped, and the next background photo is not fetched ahead of time.

Info: three designs, chosen for each tab

• In Edit Tab there is a new Layout choice with a small picture of each: Classic (the original two columns, and what every existing tab keeps), Notebook Cards (each box a card with a colored edge in the tab's color) and Document (one reading-width page with an outline beside it, which lights up as you scroll and becomes a row above the page on a phone).
• Each tab has its own layout, so one page can mix all three. A new tab starts as Classic.
• Editing works in every layout. Layouts are saved with the tab, show up on your other devices, and are kept by backups and restores. A Classic tab is pixel for pixel what it was.
• Fixed on the way: "New tab", "Save tab" and "Delete tab" in that dialog are now in Title Case.

Settings: the three ideas together

• Status on every menu item. Each section's menu entry now shows where it stands (for example Security "4 of 6", Backup "just now", Updates "Up to date", Health "OK", the theme, the version).
• Overview first. The Overview opens with jump chips (each with a status dot) to the main sections, a banner for guided setup while steps are open, then the "things to look at" list and the summary cards as before.
• Guided Setup (Overview › Guided Setup): the protection steps in order, one open at a time: Website Password, Encryption Passphrase, Recovery Key, Two-Step Login, First Backup, then optional Telegram. It uses the same code as Security and Backup, so a step does exactly what its Security tab would. A passphrase you type is kept only in memory while Settings is open, so the recovery key step does not ask twice; the key is shown once and is never stored. Steps can be skipped and reopened.

1.35.0

Fixed: Info's Export buttons

• All four buttons in Info's Export dialog did nothing (All Tabs or Current Tab, as PDF or as Text): the code behind them was missing. This was already so in 1.32.1. They now work:
• Text keeps every character exactly (₹, Hindi, emoji, the formatting marks as you typed them).
• PDF is an A4 document: the page title, then each tab with its boxes. It uses a basic built-in font, so ₹ becomes "Rs", curly quotes and dashes become plain ones, formatting marks are removed, and letters outside Western European scripts become "?". Use Text for those; the dialog says so.
• Boxes of an encrypted tab that is still locked are left out, with a note in the file. Unlock the tab first to include them.
• File names follow the page or tab: my-notes-2026-10-21.pdf, home-stuff-2026-10-21.txt.

Removed: leftovers that still ran

• Info's own backup timer, its reminder dialog and its earlier-versions dialog. Their buttons were removed when backups moved to Settings, but the code stayed: the countdown still ticked every second, and when a backup was due the "BACKUP NOW" button called code that no longer existed. The site-wide backup reminder in the bar, and Settings › Backup & Restore › Earlier Versions (which lists and restores Info's versions), do this job. Info's four server actions behind it (save_timer, backup_done, list_versions, restore_version) are gone too.
• Styles nothing uses any more: 77 rules (about 6 KB) in the site's shell, Info, Cards and Home, left over from earlier Settings and Info designs. Each was checked against every page and script, including the Tools bundle, and names built in code (like k- + kind) were kept.
• A variable in Cards' server code that was set and never read.

Faster

• Every page's own scripts and styles are now minified, not just the shell: Home, Links, Info, Cards, Tasks and Settings (18 files, 821 KB to 668 KB; 240 KB to 206 KB compressed). The readable originals ship in the zip in web/core-data/docs/src/<page>/, closed to browsers.

Checked, nothing to change

• Security: every action that changes data on every page checks the login and the security token; the login cookie is HttpOnly, SameSite=Strict and Secure on https; HSTS is sent on https; every page sends a content security policy with no inline scripts.
• Dead files: none. Every file in Tools is used (the 5 MB OCR language file is loaded by name).