v1.5.8-stable v2.0.10-beta
VectifyAI/PageIndexOct 4, 2026 → Oct 4, 20260 days between releases
What's New
Restricts API token upgrades and adds environment variable expansion to config YAML.
Breaking Changes
- Custom API tokens (minimal=false) can no longer upgrade to full-permission sessions via the renewal endpoint.
- Config YAML now expands $VAR strings, potentially breaking configurations with literal dollar signs.
New Features
- New 'requirePasswordChange' user setting forces password updates for new users.
- Config YAML now supports environment variable expansion ($VAR).
- Sidebar navigation tree rows are now real hyperlinks.
- Sidebar source view toggle added for filesystem-only usage.
Improvements
- Bootstrap passwords now use a 'word-xxxxx-xx' format for better readability.
- Public share media routes now honor viewer and download settings.
- Public share download limits are enforced on media routes.
Bug Fixes
- Fixed slow file listings when http.baseURL is configured as a subpath.
- Fixed inflated disk usage reporting on ZFS datasets and btrfs subvolumes.
- Fixed TOTP re-enrollment bypass vulnerability.
Upgrade Notes
Users with custom API tokens may encounter renewal failures; ensure tokens are web session tokens. Check config files for literal $ characters that will now be expanded as environment variables. New users will be forced to change their password upon first login if the setting is enabled.
The Two Releases
v1.5.8-stable
Oct 4, 2026· 17 days ago
A stable release superseding v1.5.7 that focuses on fixing a TOTP re-enrollment security bypass and restoring TOTP login functionality that was broken in the previous version.
Full release notesv2.0.10-beta
Oct 4, 2026· 17 days ago
This beta release addresses critical security vulnerabilities regarding API token renewal and TOTP re-enrollment, introduces new password management settings, and fixes bugs related to file listing and disk usage.
Full release notes