Changelog

Unreleased

New

Added

• Notifications pipeline (P10a): stdlib `Mailer` (log/sendmail/SMTP with
• Event webhooks (P10b): `WebhookService` (docs/API.md catalogue, static SSRF
• Threshold alerts (P10c): `AlertService` — traffic spike/drop vs the 24 h
• Link comments (P10d): one-level threading with flatten, resolve/reopen,
• Teams (P10e): auto-provisioned owner team, role ladder
• Abuse reporting & spam intake (P8.6, ADR-013): outbound AbuseIPDB reports for
• Spam intake `POST /api/v1/intel/spam-report` (shared secret via
• Admin → Settings card "Abuse reporting & spam intake": report_attacks /
• `docs/ABUSE-REPORTING.md` (operator guide: endpoint contract, curl/rspamd
• Visit capture pipeline (P5 core): `VisitService::capture()` on the response
• `ThreatDetection`: the legacy 54 KB `HackDetectionService` reorganised into a
• Consent-gated JS tracker (`tracker.js`) + `/tracker/collect` (pixel & beacon)
• First-party identifier cookies (`iya_consent`, `iya_vid`, `iya_sid`),
• Anonymous privacy mode keeps honest aggregate counters in `rollups` while

Fixed

• `Db::upsert()` on tables without an `id` column (`rate_limits`) no longer
• `serve` accepts `--host=`/`--port=` (documented form); pixel `Content-Length`

I18n

• Locales completed this cycle: he (RTL), fa (RTL), hi, bn (🏁 milestone 40),

Changed

• `ip_internal` no longer requires consent when observed server-side (trusted
• Maintenance worker enriches queued visits with real GeoIP/UA/threat

2.0.0

�� 2026-10-17 — "Swarm"

Added

• Personal subdomains (`organization.iya.ru`) with nested link paths
• Visit analytics with 127 captured fields per visit, rollup tables, realtime
• Agent swarm: GET-first API with 60+ endpoints — registration, profiles,
• Machine discovery: `/llms.txt`, `/agents.json`, `/api/v1/openapi.json`
• Identity: registration, login, email verification, password reset, TOTP
• Teams with owner/admin/editor/viewer roles, invitations and shared statistics
• Privacy: four collection modes (minimal, standard, extended, anonymous),
• Security: Argon2id hashing, CSRF, rate limiting per IP/token/endpoint,
• Platform: 77-table schema with checksummed migrations for SQLite and MySQL,
• Design system: tokens, shadcn-style components, utilities, RTL support,
• i18n: 66 locale catalogs generated from the original 43-language service
• Tooling: dependency-free test runner, `bin/iya` console (doctor, migrate,

Changed

• **The visitor IP is now the external, publicly routable address.** The
• A LAN address observed for the same client is kept in a **separate**
• Visits are stored as one row per visit instead of one row per IP; the old
• Removed every third-party dependency from the page: no cdnjs Font Awesome,
• Public statistics became owner-controlled: the visit list, IPs, internal
• Legacy compatibility kept: `/1.2.3.4/`, `/123/`, `<ip>.iya.ru`,

Fixed

• `info.php` (a public `phpinfo()`) removed; `display_errors` is off in
• `ip-info-widget.php` (dead WordPress code) removed
• RFC1918 prefixes are no longer reported as "VPN likely"
• Route patterns with quantified constraints (`{ip:\d{1,3}\.…}`) compile
• `X-Frame-Options`, CSP `frame-ancestors` and `Referrer-Policy` are set on
• Language catalogs no longer emit a UTF-8 BOM into the response

Security

• Passwords: Argon2id (64 MiB, t=4) with a transparent rehash path
• Tokens: only SHA-256 hashes stored; agent tokens are long-lived, rotatable
• Cookies: `Secure`, `HttpOnly`, `SameSite=Lax`, host-scoped
• Sessions: database-backed, regenerated on privilege change, garbage
• Outbound requests: SSRF guard validates scheme, host, port and *every*
• Threat detection retained and reorganised from the legacy

Removed

• Yandex.Metrika counter and informer image
• cdnjs Font Awesome stylesheet (replaced by inline SVG icons)
• `info.php`, `ip-info-widget.php`, `elements.html`, `generic.html`
• The `UNIQUE(ip)` constraint on the visitor table