LeafWiki

📝 Changelog for v0.12.0

🌟 Highlights

• Backup & Restore: full restore from backup snapshots (hot-swap, CLI, self-restart) plus restore from an uploaded ZIP in the UI
• Two-factor authentication (TOTP): setup/disable UI, recovery codes, lockout protection, plus broader auth hardening
• UX: drag & drop tree reordering, per-user favorites, collapsible TOC panel, resizable preview split, .leafwikiignore
• Observability: structured logging, Prometheus metrics for auth events, --log-format flag, build-version gauge
• Assorted bug fixes: TOC overflow, frontmatter colon parsing, duplicate ID handling, redirect URL validation, and more

💛 Thanks to our sponsors

A heartfelt thank you to everyone supporting LeafWiki via GitHub Sponsors & Ko-Fi
If you'd like to support LeafWiki too: leafwiki.com/support

✨ Features

• feat(restore): add restore-from-uploaded-ZIP and fix Windows users.db… (#1341) (@perber)
• feat(metrics): expose build version via leafwiki_build_info gauge (#1335) (@perber)
• feat(auth): structured logging + Prometheus metrics for auth events (@perber)
• feat: add --log-format flag to switch between text and json logging (#1328) (@perber)
• feat: restore from full backup snapshot (#1323) (@perber)
• feat: API key handling - behind feature flag (#1281) (@zorak1103)
• feat(snapshot): add Full Backup settings UI (@perber)
• feat(snapshot): complete full-backup snapshot scheduler, retention, and admin API (@perber)
• feat(users): add two-factor authentication UI (@perber)
• feat(auth): expose TOTP login and self-service HTTP endpoints (@perber)
• feat(auth): add two-step TOTP login handshake and self-service methods (@perber)
• feat(auth): add TOTP core service and storage layer (@perber)
• feat: .leafwikiignore (#1263) (@designermonkey)
• feat(preview): add AutoHotkey syntax highlighting (#1312) (@c436zhan)
• feat(favorites): add per-user favorite pages (#1310) (@perber)
• feat(tree): drag & drop page/section reordering in the page tree (#1307) (@arcabaa)
• feat(editor): make preview split resizable (#1279) (@ahfoysal)
• feat(sidebar): make pinned/pages sidebar sections collapsible accordion (#1308) (@perber)
• feat(cli): allow configuring initial admin username and email (#1302) (@perber)
• feat: add Prometheus workflow observability (#1304) (@perber)
• feat(auth): add configurable login URL, promote logout URL to top-level option (@perber)
• feat(viewer): add collapsible table-of-contents side panel (@perber)

🐛 Bug Fixes

• fix(toc): cap sticky side panel height so it stops overflowing the viewport (#1340) (@perber)
• fix(e2e): patch brace-expansion transitive dependency (#1339) (@perber)
• fix(tree): skip duplicate leafwiki_id during reconstruct instead of a… (#1333) (@perber)
• fix(markdown): recover unquoted colon in leafwiki_* frontmatter fields (#1332) (@perber)
• fix(ui): patch brace-expansion transitive dependency (@perber)
• fix(auth): avoid logging login identifiers (@perber)
• fix(ui): TOC side panel entries show full text as a hover tooltip (@perber)
• fix(cli): validate --user-management-url like --login-url/--logout-url (@perber)
• fix(auth): SessionManager robustness + token-type/timing findings from review (@perber)
• fix: totp button styling (#1326) (@perber)
• fix: fixes tree auth sidebar (#1325) (@perber)
• fix(snapshot): address Copilot review findings (@perber)
• fix(auth): close TOTP lockout bypass and DisableTOTP panic from code review (@perber)
• fix(auth): close recovery-code double-redemption race (@perber)
• fix(router): satisfy tsc for router.test.tsx element type narrowing (@perber)
• fix(auth): reject non-http(s) redirect URLs, fix /login route order (@perber)
• fix(tree): rename page/section without requiring link-refactor flag (@perber)
• fix(layout): slide sidebar via transform instead of animating width (@perber)
• fix: sonar issues (#1284) (@Hugo-Galley)
• fix(sidebar): allow explorer/search hotkeys while search field is focused (#1288) (@perber)

🔧 Refactoring

• refactor(auth): extract SessionManager from AuthService (@perber)
• refactor(sqliteutil): share open/corruption-recovery logic across stores (#1311) (@perber)