v1.1.3

Fixed

• Hidden modpacks (not marked private) were returning 404 on direct API access, causing the Technic Launcher to show them as "Offline". Restored the documented behavior: hidden packs are omitted from /api/modpack listing but remain fetchable by slug via /api/modpack/{slug} and /api/modpack/{slug}/{version} without a cid. Regression introduced in the API refactor that consolidated access checks behind Modpack::isAccessibleBy().

v1.1.2

Fixed

• Pagination buttons corrupted on middle pages due to duplicate Alpine.js x-for key when two ellipsis entries existed

v1.1.1

Added

• Notes exposed in read API for authenticated users with mods_manage or solder_full permission
• PUT /api/mod/{slug}/{version} endpoint for updating mod version fields
• Notes editing UI in expanded version rows on the mod view page

Fixed

• Sort persistence: storageKey computed as property instead of getter (getter wasn't available during Alpine init())
• Version notes save using correct JSON content type instead of form-encoded data

v1.1.0

Added

• Clone entire modpack with all builds and mod assignments (web UI + API)
• Clone builds across modpacks (grouped dropdown showing all accessible modpacks)
• Save All button for batch mod version updates in builds
• Private notes field on mods and mod versions (excluded from read API)
• Rehash All button for mod versions (sequential with progress and cancel)
• Unused mod versions section on dashboard
• CSV export for build mod lists
• Data table sort direction persisted in localStorage
• grantModpackAccess() method on UserPermission model
• Database indexes on modversions.mod_id, builds.modpack_id, user_permissions.user_id, client_modpack.client_id, client_modpack.modpack_id, clients.uuid, keys.api_key

Fixed

• MD5 file download skipped when user provides hash manually (no more timeouts on large files)
• MD5 hash format validated (must be 32-character hex string)
• Remote MD5 error messages now show actionable hints instead of raw cURL errors
• Cross-modpack clone authorization check (was missing, allowed unauthorized cloning)
• Clone validation runs before build creation in API (no orphaned builds on failure)
• Slug uniqueness validated after Str::slug() normalization (prevents bypass)
• findOrFail used consistently in anyModify batch-version case
• PHP 8.4 deprecation warning in getModpacksAttribute() null handling
• Clone build dropdown sorted by modpack name (current modpack first) with newest builds first

Changed

• Modpack permission assignment extracted from duplicated controller blocks into UserPermission::grantModpackAccess()
• clone_from_modpack API parameter added for cross-pack build cloning (backward compatible)

v1.0.3

Fixed

• Non-standard placeholder domains replaced with example.com
• Guest redirect broken by Laravel framework v13.4.0 middleware bug (laravel/framework#59600)

v1.0.2

Fixed

• Build clone allowing cross-modpack data leak (IDOR)
• Null dereference in modpack modify handler on invalid IDs
• CORS middleware now validates request origin against allowed origins list
• Redundant prefix in release title

Changed

• Replaced Dependabot with Renovate for all dependencies
• Added PHP 8.5 to CI test matrix
• Bumped nick-fields/retry to v4 for Node.js 24 compatibility

v1.0.1

Fixed

• Sidebar modpack icons using filesystem paths instead of icon_url, causing broken images for modpacks with custom art
• Tests requiring Vite manifest to pass — added withoutVite() to base TestCase

Changed

• Release workflow now extracts notes from CHANGELOG.md instead of auto-generating

v1.0.0

The first major release of Technic Solder. This is a ground-up modernization — new auth system, new API capabilities, modern frontend, and serious security hardening. Solder is ready for the next era of modpack distribution.

Highlights

Two-Factor Authentication — Protect admin accounts with TOTP-based 2FA, complete with QR code setup and recovery codes.

Write API — Full programmatic CRUD for modpacks, builds, mods, and clients. Automate your modpack management with personal API tokens (sldr_-prefixed for easy secret scanning).

Modern Frontend — Rebuilt with Tailwind CSS v4, Alpine.js, and Vite 8. Dark mode, searchable dropdowns, responsive layouts, and a polished UI throughout.

Policy-Based Authorization — Fine-grained permissions enforced through Laravel Policies, replacing the legacy middleware system. Users with solder_full bypass all checks via a global gate.

Security Hardening — Timing-safe key verification, security headers on every response, rate limiting on login/2FA/API, explicit mass-assignment protection on all models, and passwords checked against breached databases.

Laravel 13 & PHP 8.4 — Built on the latest Laravel with modern PHP features.

Breaking Changes

• PHP 8.4+ required (was 8.2)
• Node.js 20+ and npm now required for frontend builds
• Password policy now enforces minimum 8 characters and checks against breached databases — existing users with weak passwords will need to update them

Upgrading

See the upgrade guide for step-by-step instructions.

Full Changelog

See CHANGELOG.md for the complete list of additions, changes, removals, and fixes.

v0.12.9

• Rephrase dashboard footer text (1009f24)
• Bump dependencies (83cf5b3)

Full Changelog: v0.12.8...v0.12.9

v0.12.8

• Bump dependencies (55505e8)
• Improve CI tests workflow (d7d3380, ee7c81b, a44369d)
• Set up Dependabot (030f8e4)

Full Changelog: v0.12.7...v0.12.8