Skip to content

fix: use relative path for logout redirect to avoid port mismatch - #2655

Merged
MohamedBassem merged 1 commit into
karakeep-app:mainfrom
howwohmm:ohm/foss-001
Apr 20, 2026
Merged

MohamedBassem merged 1 commit into
karakeep-app:mainfrom
howwohmm:ohm/foss-001

Conversation

@howwohmm

@howwohmm howwohmm commented Apr 7, 2026

Copy link
Copy Markdown
Contributor

Fixes #2642

Problem
signOut({ redirect: false }) returns an absolute URL built from NEXTAUTH_URL (e.g. http://localhost:3000/). When Docker remaps an external port to the container's internal port, the redirect sends users to the wrong port instead of the one they're actually on.

Fix
Replace router.push(d.url) with router.push("/") in apps/web/app/logout/page.tsx. The returned d.url is no longer needed — Next.js resolves relative paths against the user's current origin, so the port is always correct. The signOut call itself is unchanged; only the subsequent client redirect changes.

What this doesn't change
Session termination, the callbackUrl: "/" option, or any server-side auth behavior — this is purely a client-side redirect fix.

signOut({ redirect: false }) returns an absolute URL constructed from
NEXTAUTH_URL (e.g. http://localhost:3000/). When Docker remaps an
external port to the internal one, this sends users to the wrong port.
Using router.push('/') lets Next.js resolve against the user's origin.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@coderabbitai

coderabbitai Bot commented Apr 7, 2026 •

Copy link
Copy Markdown
Contributor

Walkthrough

The logout page control flow has been updated to navigate to a fixed root path ("/") after sign-out completes, instead of using the dynamic URL returned from the signOut callback. The clearHistory() function is invoked before the redirect.

Changes

Cohort / File(s) Summary
Logout Navigation Logic
apps/web/app/logout/page.tsx
Modified the .then callback in the sign-out flow to redirect to a fixed "/" path instead of the returned d.url value. Removed the resolved value parameter and reordered clearHistory() execution before redirect.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (2 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and specifically describes the main change: replacing an absolute URL redirect with a relative path to fix port mismatches in Docker environments.
Description check ✅ Passed The description comprehensively explains the problem (Docker port remapping causing wrong redirects), the solution (using relative paths), and what remains unchanged (session termination and server-side auth).

✏️ Tip: You can configure your own custom pre-merge checks in the settings.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@greptile-apps

greptile-apps Bot commented Apr 7, 2026

Copy link
Copy Markdown
Contributor

Greptile Summary

This PR fixes a client-side redirect bug where users in Docker environments with remapped ports were sent to the wrong port after logout. The fix replaces router.push(d.url) (where d.url is an absolute URL derived from NEXTAUTH_URL) with router.push("/"), so Next.js resolves the redirect against the user's current origin — always using the correct port.

  • Root cause: signOut({ redirect: false }) returns { url } built from NEXTAUTH_URL, which may point to the container's internal port rather than the externally-mapped port
  • Fix: Use router.push("/") so the redirect is relative and always resolves to the user's current origin
  • Note: callbackUrl: "/" passed to signOut is now effectively unused since d.url is never consumed, but it is harmless to keep in place
  • No server-side auth behavior, session termination logic, or other functionality is affected

Confidence Score: 5/5

This PR is safe to merge — it is a targeted, low-risk fix for a well-described client-side redirect bug.

The change is a single-line fix replacing an absolute URL (potentially wrong port) with a relative path (always correct). No logic, security, or data-integrity concerns are introduced.

No files require special attention.

Important Files Changed

Filename Overview
apps/web/app/logout/page.tsx Replaces absolute URL redirect from signOut return value with relative path / to fix port mismatch in Docker environments

Reviews (1): Last reviewed commit: "fix: use relative path for logout redire..." | Re-trigger Greptile

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
apps/web/app/logout/page.tsx (1)

20-23: Await clearHistory() before navigating to ensure cleanup completes

clearHistory() is async but called without await on line 21. The router.push("/") on line 22 executes immediately, creating a race where search history cleanup may finish after navigation completes.

Proposed fix
 useEffect(() => {
-  signOut({
-    redirect: false,
-    callbackUrl: "/",
-  }).then(() => {
-    clearHistory();
-    router.push("/");
-  });
+  const runLogout = async () => {
+    await signOut({
+      redirect: false,
+      callbackUrl: "/",
+    });
+    await clearHistory();
+    router.push("/");
+  };
+  void runLogout();
 }, []);
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@apps/web/app/logout/page.tsx` around lines 20 - 23, The promise chain calls
clearHistory() without awaiting it, causing router.push("/") to run before
cleanup completes; update the .then callback (or make the surrounding handler
async) to await clearHistory() before calling router.push("/") so history
cleanup finishes prior to navigation (use await clearHistory(); router.push("/")
or return clearHistory().then(() => router.push("/")) in the promise chain).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@apps/web/app/logout/page.tsx`:
- Around line 20-23: The promise chain calls clearHistory() without awaiting it,
causing router.push("/") to run before cleanup completes; update the .then
callback (or make the surrounding handler async) to await clearHistory() before
calling router.push("/") so history cleanup finishes prior to navigation (use
await clearHistory(); router.push("/") or return clearHistory().then(() =>
router.push("/")) in the promise chain).

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a16e9439-4fa1-477e-91dd-44552bb6b56e

📥 Commits

Reviewing files that changed from the base of the PR and between bc14214 and 9c89253.

📒 Files selected for processing (1)
  • apps/web/app/logout/page.tsx

@MohamedBassem
MohamedBassem merged commit 4dbcc41 into karakeep-app:main Apr 20, 2026
8 checks passed
@MohamedBassem

Copy link
Copy Markdown
Member

Thank you

johnford2002 added a commit to johnford2002/karakeep that referenced this pull request May 19, 2026
* fix: add support for instapaper archived status and folders

* fix(mobile): truncate bookmark title with tailwind shrink (karakeep-app#2699)

* fix(mobile): remove react-native-keyboard-controller patch (karakeep-app#2697)

The upstream fix for the status bar inset issue was merged and released
in v1.21.5, so our local patch is no longer needed.

Closes karakeep-app#2581

* docs(mobile): add SENTRY_DISABLE_AUTO_UPLOAD=true to build apk without sentry dsn (karakeep-app#2700)

* docs(mobile): add SENTRY_DISABLE_AUTO_UPLOAD=true to build apk without sentry dsn

* include pr suggestion

* put SENTRY_DISABLE_AUTO_UPLOAD=true in package.json scripts instead

* deps: upgrade to zod 4 (karakeep-app#2689)

* deps: upgrade to zod 4

* fix: preserve zod 4 schema compatibility

Use safeExtend where refined signup schemas are extended so the affected modules can initialize safely under Zod 4. Keep the generated OpenAPI output aligned with runtime validation and centralize the zod-to-openapi initialization.

* chore: freshen up docker-compose.yml for local dev purposes (karakeep-app#2149)

* feat(mobile): add keep screen on toggle for bookmark viewing (karakeep-app#2691)

* feat(mobile): add keep screen on toggle for bookmark viewing

Adds a Reading-section toggle that activates expo-keep-awake while a
bookmark is open, covering all in-app views (reader, browser, screenshot,
archive, pdf, text, asset). Defaults off; releases the wake lock as soon
as the user navigates away from the bookmark detail screen.

Closes karakeep-app#2650

* fix(mobile): disable keep-screen-on toggle while settings are hydrating

Prevents writing stale default settings to SecureStore if the user
toggles before hydration completes.

* fix: add clawhub metadata to karakeep skill

* fix: fix clawhub skill yaml

* docs: add skills to docs

* docs: Update worker list in the environment variable reference (karakeep-app#2710)

* deps: upgrade oxlint and oxfmt

* fix: add missing source to createBookmarks from import

* feat: Add Readwise Reader import (karakeep-app#2690)

Co-authored-by: Luis Zuniga <wichogzf@gmail.com>

* fix: deduplicate crawl jobs using idempotency key (karakeep-app#2678)

* feat: add OneTab import support (karakeep-app#2495)

* feat(import): add OneTab import support

Adds a OneTab import card to the ImportExport settings page.
Implements a parser for OneTab's "URL | Title" line format with
deduplication, and registers "onetab" as an import source.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: add tests for the inference worker

* fix: add ability to manually finalize/delete staged import sessions (karakeep-app#2713)

* fix(docker): add `ffmpeg` as required by `yt-dlp` (karakeep-app#2721)

* fix: invalidate existing password reset tokens before issuing a new one (karakeep-app#2722)

- Wrap reset token replacement in a transaction
- Delete any prior tokens for the user before inserting the new token

* fix: add ratelimiting for the changePassword endpoint (karakeep-app#2723)

* fix: sanitize user names before storing them (karakeep-app#2724)

* Sanitize user names before storing them

- Strip HTML from signup and OAuth display names
- Enforce non-empty plain-text names in validation
- Add tests for sanitized and HTML-only name inputs

* more changes

* Harden user name validation

* more changes

* fix: add data: to style-src and font-src CSP directives in serveAsset (karakeep-app#2657)

Monolith-generated full-page archives inline stylesheets and fonts as
data: URIs. The previous CSP blocked these, causing broken rendering.
Adding data: to style-src and a new font-src directive unblocks them,
matching the precedent set by img-src which already includes data:.

Fixes: karakeep-app#2621

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: fix pnpm symlink conflict (karakeep-app#2725)

* fix: include userId in ratelimit key if the user is authed (karakeep-app#2726)

* feat(mcp): add update-bookmark tool (karakeep-app#2717)

Wraps PATCH /bookmarks/{bookmarkId} so MCP clients can modify an
existing bookmark instead of only creating/reading one. Exposes the
commonly useful patchable fields (title, note, summary, archived,
favourited, url, description, author, publisher, createdAt); less
common/destructive ones (text, assetContent, datePublished,
dateModified) are intentionally omitted to reduce accidental clobbering
of crawler-populated data.

The PATCH response schema does not include tags/content/assets, so the
tool follows up with a GET to return a full compactBookmark view of the
updated record.

* fix: use relative path for logout redirect to avoid port mismatch (karakeep-app#2655)

signOut({ redirect: false }) returns an absolute URL constructed from
NEXTAUTH_URL (e.g. http://localhost:3000/). When Docker remaps an
external port to the internal one, this sends users to the wrong port.
Using router.push('/') lets Next.js resolve against the user's origin.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat(web): auto-add bookmark to list on selection (karakeep-app#2629)

* feat(web): auto-add bookmark to list on selection

Remove the 'Add' button from Manage Lists modal. When a user selects
a list from the dropdown, the bookmark is now automatically added to
that list, simplifying the user experience.

Users can still remove a bookmark from a list by clicking the X button
next to the list name.

Fixes karakeep-app#2604

* fix: add loading state and prevent duplicate submission in ManageListsModal

- Added isPending state from useAddBookmarkToList hook
- Added duplicate submission prevention in onChange handler
- Added disabled prop to BookmarkListSelector component

* style: fix indentation in useAddBookmarkToList callback

- Fix incorrect indentation of onSuccess and onError callbacks
- Add trailing newline at end of file

* fix: address review comments for PR karakeep-app#2629

- Add trailing newline at end of file
- Remove redundant in-flight guard check (disabled prop handles it)
- Add guard for getPathById to prevent crash on stale cache
- Disable interactions while list membership data is loading

* fix: use translation for DialogTitle in ManageListsModal

* fix: add isLoading guard to onChange callback in BookmarkListSelector

* fix(web): improve ManageListsModal accessibility and rendering

- Add aria-label to remove button for accessibility (CodeRabbit comment 3006737430)
- Remove allLists gating to allow list.name fallback to render (CodeRabbit comment 3006737429)
- Use optional chaining for path lookup

* feat(extension): add manual save toggle for browser extension (karakeep-app#2693)

* feat: add manual save toggle for browser extension

* fix: add check for appending ellipses

* chore: add PR template inspired from immich

* chore: fix PR template path

* feat: Add native single-file support to browser extension (karakeep-app#2197)

* feat: Add native SingleFile support to browser extension

This commit integrates single-file-core into the browser
extension, allowing users to capture complete web page archives when
saving bookmarks.

* fix: truncate urls in crawler logs

* feat: change the default new list emoji to folder

* feat: add support for configuring OpenAI reasoning effort (karakeep-app#2718)

* Add support for configuring OpenAI reasoning effort

* Update docs' formatting

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

* minor fixes

* minor fixes

---------

Co-authored-by: Luis Zuniga <wichogzf@gmail.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

* fix: skip url getContentType fetch if precrawledArchiveAssetId exists (karakeep-app#2580)

* deps: upgrade astro to 6.1.6. fixes karakeep-app#2728

* fix: fix broken cache invalidation requiring refresh after adding a bookmark to a tag or a list

* feat: add granular API key scopes (karakeep-app#2731)

* fix: fix promise race leaks in the worker (karakeep-app#2737)

* fix: change the archive button in the manage lists dialog to be a secondary button

* chore: add portless pnpm scripts

* feat(mobile): customizable reader toolbar (karakeep-app#2527)

* feat(mobile): add auto-hiding reader toolbar with customizable actions and overflow menu

Redesign the bookmark reader bottom bar with configurable toolbar actions,
an overflow ellipsis menu using native MenuView, and auto-hide on scroll.
Add toolbar settings page for reordering visible/overflow actions. Support
iOS 26 glass pill styling and transparent headers with edge-to-edge content.

* Update apps/mobile/components/bookmarks/BottomActions.tsx

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

* fix comment

* fix(mobile): address PR review findings for reader toolbar

- Fix silent fall-through when sharing non-image/non-pdf assets
- Pass contentInsetTop to browser/archive WebViews for iOS 26
- Auto-inject missing action IDs into overflow on settings load
- Extract NAV_BAR_HEIGHT constant to replace magic number 44
- Remove unused ownerOnly/linkOnly from ToolbarActionMeta
- Extract triggerHaptic() helper to handle async catch
- Deduplicate image/PDF share logic with finally cleanup
- Add console.warn for unknown menu action events
- Simplify headerPlatformOptions to plain isIOS26 ternary
- Fix inaccurate comment about top/bottom padding

* remove margin around text view

* fix bottom inset

* fix reading progress bar regression, add small gap

* Add redesigned reading progress pill, blur effect for iOS 18 and lower

* small review fixes

* fix icon colors in dark mode

* Add missing @/lib/ios module for isIOS26 platform detection

* downgrade expo-blur to match expo

* Update to stable expo-glass-effect version

* fix(mobile): close reader view after archiving bookmark

* chore(mobile): remove auto-hiding header/footer and pill redesign from toolbar PR

Split these concerns out so this branch lands only the customizable toolbar.
Auto-hiding native header, auto-hiding bottom toolbar, and the redesigned
continue-reading pill will return together in a follow-up reader-chrome PR,
where they belong architecturally as a single feature.

* fix footer padding on iOS 26

* unify handling of archive and fav in bottom actions

* abstract share logic

* dynamic labels depending on bookmark state

* fix overflow submenu in android

* review comments

* feat: add metrics for sub status

* chore: add infra for the event logger

* feat: add exhaustive event logging

* fix: fix nodejs bundling for the eventLogger

* fix: upgrade zod resolver to fix form validations (karakeep-app#2744)

* fix: bump up zod resolver

* fix: follow greptile review

* fix: reject user deletion with active subscription

* chore: add event logging for bookmark summarization

* fix: fix subscription tranisiton event logging

* feat(mobile): revamp search and navigation chrome (karakeep-app#2685)

* FAB styling looks good, still working on search

* Finish pr

* use latest expo-glass-effect version

* feat(mobile): auto-focus search bar when iOS search tab gains focus

* fix(mobile): address PR review feedback

- Fix search history: save new terms on blur via useEffect in
  BookmarkSearchResults and index.ios.tsx onBlur handler
- Fix keepPreviousData: use isPending instead of isFetching for spinner
  guards so stale results stay visible during refetches
- Add enabled guard on search queries to avoid firing on empty input
- Increase debounce from 10ms to 300ms on iOS search tab
- Add accessibility labels/roles to close buttons in search and
  InlineSearch
- Increase ProfileAvatarButton tap target to 44px minimum, add a11y
  props, convert static styles to Tailwind
- Fix tags empty state to show "No tags match your search" when
  filtering
- Fix stale comment in Android search stub

* feat(mobile): prevent iOS tab bar from shrinking and resize FAB

Disable tab bar minimize behavior on iOS so it stays at full height
when scrolling. Enlarge the FAB to better match the native search
button size and adjust its positioning.

* fix broken ProfileAvatarButton on iOS due to bad CodeRabbit suggestion

* fix(mobile): lock FAB glass effect to app color scheme

Pin GlassView and BlurView to the app's current color scheme instead
of adapting to background content, preventing the FAB from switching
to light appearance over white content in dark mode.

* fix(mobile): add tintColor to FAB glass effect for consistent appearance

Use GlassView tintColor to prevent the FAB from adapting to background
content, keeping it dark in dark mode and light in light mode regardless
of what's behind it.

* fix(mobile): use PlatformColor for FAB icon vibrancy on iOS

Replace hardcoded foreground color with PlatformColor("label") so the
FAB icon participates in UIKit vibrancy and stays legible against the
adaptive liquid glass effect. Revert FAB GlassView to its clean default
with no colorScheme or tintColor overrides.

* fix(mobile): trim search term in onBlur before persisting

The onBlur handler checked trim().length but passed the untrimmed value
to addTerm(), allowing whitespace-padded terms into search history.

* revert bad change in lists

* revert tag spacing change

Co-authored-by: Copilot <copilot@github.com>

* remove unused search component

* fix broken view switching in ios search results

* drop the search screen stack from root layout

* remove global search

* search on type

* remove duplicate expo-blur from package.json

* restore header for ios

---------

Co-authored-by: Copilot <copilot@github.com>

* fix: debounce bulk query invalidations (karakeep-app#2745)

* Debounce bulk query invalidations

* Avoid scheduling predicate invalidations

* Document predicate invalidation bypass

* feat: Allow multiple lists for Rule Engine karakeep-app#2490 (karakeep-app#2620)

* feat: Allow multiple lists for Rule Engine karakeep-app#2490

feat: Allow multiple lists for Rule Engine karakeep-app#2490

feat: Allow multiple lists for Rule Engine karakeep-app#2490

* re-add db migration

* codex review comments

* chore: use .gitignore as source of truth for oxfmt and oxlint (karakeep-app#2740)

* chore: use .gitignore as source of truth for oxfmt and oxlint

Wire `--ignore-path=../../.gitignore` into every per-package format/lint
script and prune the duplicated `ignorePatterns` arrays from each
oxfmt/oxlint config. For oxfmt in packages with a local `.gitignore`
(mobile, browser-extension, cli, mcp, sdk, benchmarks, e2e_tests), pass
the local file as a second `--ignore-path` too. oxlint only accepts one
`--ignore-path`, so mobile retains `ios/`, `android/` etc. in its
`ignorePatterns`.

Observed issue: files in the `.astro/` directory in apps/landing were
getting flagged by the format check in the precommit hook, because
oxfmt running from the package cwd does not auto-discover the root
`.gitignore` (it only reads a `.gitignore` in cwd). The explicit
`--ignore-path` makes the gitignore policy consistent regardless of the
invocation directory.

* tests: add a test for browser rendering

* fix(ui): resolve text clipping in bookmark cards (karakeep-app#2748)

* fix: prevent text overflow

* Update apps/web/components/dashboard/bookmarks/NotePreview.tsx

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

* refactor: correct formatting

---------

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

* feat: redesign list and tag page headers (karakeep-app#2749)

* feat: redesign list and tag page headers

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(landing): add safari links to landing

* deps: upgrade protobufjs

* fix: fix allow the adblocker to run after request interception

* feat: Add agentic skills links to the landing page (karakeep-app#2761)

* fix: fix SSRF handling with redirects in crawler worker (karakeep-app#2759)

* feat(mobile): open links and images in in-app browser (karakeep-app#2696)

* feat(mobile): open links and images in in-app browser instead of navigating away

Links and media clicked within bookmark reader, browser, and archive
views now open in an in-app browser overlay (expo-web-browser) or
fullscreen image viewer instead of navigating the current view away
from the bookmark content.

* fix(mobile): address PR review comments for link handling

Use origin-based comparison instead of one-shot hasLoaded flag in
BookmarkLinkBrowserPreview to correctly handle HTTP redirects on iOS.
Remove dead href.startsWith("#") branch in BookmarkHtmlHighlighterDom.
Combine duplicate imports from react-native-webview/lib/WebViewTypes.

* fix: format BookmarkLinkPreview import

* fix: extract bookmarkUrl to preserve type narrowing in useCallback

* fix(mobile): allow text selection on links for highlighting

Strip href from links and store in data-href so the browser treats them
as regular selectable text instead of activating native link gestures
(iOS preview sheet, Android drag-and-drop). A MutationObserver re-strips
hrefs after DOM changes from highlight effects.

* feat: Add CLI auth config support (karakeep-app#2751)

* fix: typo in docker docs (karakeep-app#2762)

* fix: fix timezone handling in date displays across the app (karakeep-app#2682)

* fix: use safe favicon resolution in metascraper (karakeep-app#2763)

* fix: use correct env variable syntax for perplexity (karakeep-app#2765)

* fix: use correct env variable syntax

* fix: env syntax for perplexity base url

* fix: harden video worker redirect validation against SSRF (karakeep-app#2760)

* refactor: refactor bulk actions to store bookmark ids (karakeep-app#2767)

* fix(mobile): fix scrolling in manage tags page in ios

* docs: add a comment to security docs about SSRF mitigations

* feat: add keyboard shortcuts (karakeep-app#2750)

* i18n: Sync weblate translations

Co-authored-by: CircleCrop <guhengting@gmail.com>
Co-authored-by: Hosted Weblate <hosted@weblate.org>
Co-authored-by: OpenAI <noreply-mt-openai@weblate.org>
Translate-URL: https://hosted.weblate.org/projects/karakeep/karakeep/ar/
Translate-URL: https://hosted.weblate.org/projects/karakeep/karakeep/cs/
Translate-URL: https://hosted.weblate.org/projects/karakeep/karakeep/da/
Translate-URL: https://hosted.weblate.org/projects/karakeep/karakeep/de/
Translate-URL: https://hosted.weblate.org/projects/karakeep/karakeep/el/
Translate-URL: https://hosted.weblate.org/projects/karakeep/karakeep/en_US/
Translate-URL: https://hosted.weblate.org/projects/karakeep/karakeep/es/
Translate-URL: https://hosted.weblate.org/projects/karakeep/karakeep/fa/
Translate-URL: https://hosted.weblate.org/projects/karakeep/karakeep/fi/
Translate-URL: https://hosted.weblate.org/projects/karakeep/karakeep/fr/
Translate-URL: https://hosted.weblate.org/projects/karakeep/karakeep/ga/
Translate-URL: https://hosted.weblate.org/projects/karakeep/karakeep/gl/
Translate-URL: https://hosted.weblate.org/projects/karakeep/karakeep/hr/
Translate-URL: https://hosted.weblate.org/projects/karakeep/karakeep/hu/
Translate-URL: https://hosted.weblate.org/projects/karakeep/karakeep/it/
Translate-URL: https://hosted.weblate.org/projects/karakeep/karakeep/ja/
Translate-URL: https://hosted.weblate.org/projects/karakeep/karakeep/ko/
Translate-URL: https://hosted.weblate.org/projects/karakeep/karakeep/nb_NO/
Translate-URL: https://hosted.weblate.org/projects/karakeep/karakeep/nl/
Translate-URL: https://hosted.weblate.org/projects/karakeep/karakeep/pl/
Translate-URL: https://hosted.weblate.org/projects/karakeep/karakeep/pt/
Translate-URL: https://hosted.weblate.org/projects/karakeep/karakeep/pt_BR/
Translate-URL: https://hosted.weblate.org/projects/karakeep/karakeep/ru/
Translate-URL: https://hosted.weblate.org/projects/karakeep/karakeep/sk/
Translate-URL: https://hosted.weblate.org/projects/karakeep/karakeep/sl/
Translate-URL: https://hosted.weblate.org/projects/karakeep/karakeep/sv/
Translate-URL: https://hosted.weblate.org/projects/karakeep/karakeep/tr/
Translate-URL: https://hosted.weblate.org/projects/karakeep/karakeep/uk/
Translate-URL: https://hosted.weblate.org/projects/karakeep/karakeep/vi/
Translate-URL: https://hosted.weblate.org/projects/karakeep/karakeep/zh_Hans/
Translate-URL: https://hosted.weblate.org/projects/karakeep/karakeep/zh_Hant/
Translation: Karakeep/Karakeep

* i18n: fix automated i18n strings

* feat(web): add more details to the all lists page

* fix(crawler): proper handling for proxy auth with CDP interceptions

* release(docs): release the 0.32 docs

* release: release cli, sdk, mobile and extension

* release(cli): release CLI 0.32.0

* docs: minor docs update to mention the skills and the new singlefile integration

* feat(browser-extension): request host permission at runtime for client side crawling (karakeep-app#2784)

Move `<all_urls>` from `host_permissions` to `optional_host_permissions` so it
isn't requested at install time. The permission is now requested via
`chrome.permissions.request()` when the user enables client-side crawling in the
extension settings, and removed when they disable it. The settings toggle and
the capture path both gate on whether the permission is actually granted.

https://claude.ai/code/session_01NnQnr1B9KSRriTaQkZM6AP

Co-authored-by: Claude <noreply@anthropic.com>

* release(extension): Release version 1.2.11

* docs: update screenshots in the docs

* fix(mobile): fix insets on new iOS settings formSheet modal (karakeep-app#2793)

The settings screen is presented as an iOS formSheet with an opaque,
non-large header (since 649efb8). iOS sizes the formSheet's inner
content view ~headerHeight pixels taller than the visible sheet area,
so the bottom of the settings list was clipped behind the sheet's
bottom edge.

contentInsetAdjustmentBehavior="automatic" correctly handles the top
(adding the right top inset to clear the opaque header), but does not
add a corresponding bottom inset for the formSheet's invisible bottom
region. Adding useHeaderHeight() to paddingBottom pushes the trailing
content up to a visible position.

* fix(mobile): stack Upload Image Quality slider on two lines (karakeep-app#2794)

The MEDIA → Upload Image Quality row in mobile settings crammed the
label, percentage, and slider onto one horizontal line, leaving the
slider only a few dozen pixels wide on phone widths. Switch the row
to a vertical layout: label + percentage on top, full-width slider
beneath.

* feat(mobile): tablet/iPad UI polish for toolbar and FAB (karakeep-app#2788)

* Set max width for reader toolbar on tablets

* fix(mobile): remove FAB bottom inset on iPad

iPad's tab bar geometry doesn't need the extra 57–60pt lift the iPhone FAB uses.

* fix(mobile): give reader toolbar icons proper spacing on iPad

Replace the inner row's width/maxWidth + space-between approach with an
intrinsic gap. The earlier cap caused the row to collapse to its natural
icon width inside the hug-fit GlassView, leaving icons cramped against
each other. Using `gap: 28` gives each icon real breathing room and lets
the pill size to its contents naturally.

* fix(mobile): fix formsheet padding in manage_lists, manage_tags and info sheets

* fix(mobile): fix color of list separator in recent searches list

* fix(mobile): improve perf of manage_tags page

* release(mobile): release mobile v1.9.4

* fix: serve unoptimized nextjs images

This is a temporary fix to be able to patch the recent NextJS security
update until a proper fix is available.

* deps: upgrade nextjs to 15.5.18

* docs: update SECURITY.md

* feat(db): add PostgreSQL migration for upstream schema sync

Adds PG equivalent of the SQLite migrations 0083 (apiKey scopes) and
0084 (rule engine multi-list refactor) brought in by the upstream merge.

The auto-generated migration was missing two things needed for parity
with the SQLite version:

1. A SQL DEFAULT for apiKey.scopes to backfill existing rows (matches
   SQLite's `DEFAULT '["fullaccess"]'`).
2. Data migration for the event JSON in ruleEngineRules: delete rules
   with empty listId in addedToList/removedFromList events, then
   transform single listId to a listIds array.

Both data-migration steps mirror what upstream's SQLite migration does
using SQLite's json_extract/json_set, translated to PG's jsonb operators.

Verified with `drizzle-kit check` (schema/migration consistent) and the
schema-sync test (column lists match across dialects).

* fix(docker): pin postgres overlay to v18 and fix volume mount

Bumps the PostgreSQL overlay from postgres:16-alpine to postgres:18-alpine
to match the production deployment, and fixes the volume mount that PG18
rejects.

PG18+ stores data in a version-specific subdirectory under
/var/lib/postgresql (e.g. /var/lib/postgresql/18/docker). The image
refuses to start if the volume is mounted at the legacy
/var/lib/postgresql/data path, even on a fresh install. Mounting one
level up lets PG18 manage its own subdirectory layout.

Also documents the migration-smoke-test command pattern in the overlay
header: pair the overlay with a base compose file and `up postgres -d`
to bring up just postgres, then run `pnpm --filter=@karakeep/db migrate`
from the host. Verified end-to-end against postgres:18-alpine (PG 18.4).

Upgrading an existing PG16 fork deployment to this overlay is a breaking
change — the volume layout is incompatible and requires pg_upgrade or
a dump/restore.

---------

Co-authored-by: Mohamed Bassem <me@mbassem.com>
Co-authored-by: xuatz <xzlow10@gmail.com>
Co-authored-by: Evan Simkowitz <esimkowitz@users.noreply.github.com>
Co-authored-by: Max <43565398+maxim-mityutko@users.noreply.github.com>
Co-authored-by: Luis G. Zúñiga <github@nuevenueves.com>
Co-authored-by: Luis Zuniga <wichogzf@gmail.com>
Co-authored-by: Nikhil Chowdhury <54472147+NikhilChowdhury27@users.noreply.github.com>
Co-authored-by: apo-mak <apo-mak@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Maxime Pinot <contact@maximepinot.com>
Co-authored-by: Om Mishra <152969928+howwohmm@users.noreply.github.com>
Co-authored-by: Vladimir Balko <147043796+vbalko-claimate@users.noreply.github.com>
Co-authored-by: 冰水泡枸杞 <87858694+xingzihai@users.noreply.github.com>
Co-authored-by: Morgan Kesler <keslerm@aegiszero.is>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: GSAlex <GSAlex@users.noreply.github.com>
Co-authored-by: Beluga <mikhailbialouwork@gmail.com>
Co-authored-by: Copilot <copilot@github.com>
Co-authored-by: Ahmed Abdelkarim <ahmad.abdelkarim89@gmail.com>
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
Co-authored-by: Mark :) <Mxrk@users.noreply.github.com>
Co-authored-by: Hosted Weblate <hosted@weblate.org>
Co-authored-by: CircleCrop <guhengting@gmail.com>
Co-authored-by: OpenAI <noreply-mt-openai@weblate.org>
djmango referenced this pull request in djmango/karakeep Sep 19, 2026
…655)

signOut({ redirect: false }) returns an absolute URL constructed from
NEXTAUTH_URL (e.g. http://localhost:3000/). When Docker remaps an
external port to the internal one, this sends users to the wrong port.
Using router.push('/') lets Next.js resolve against the user's origin.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Logout incorrect redirect

2 participants