Changelog

This log records changes to the public API, newest entry first. Each entry gives the service version, the date and the kind of change: Added, Changed, Deprecated. Breaking changes only ship with a new API version; see Versions and stability.

v1 — services 1.0.0, contract frozen on 2026-09-21#

Added#

• DocBuilder, 11 endpoints: GET /v1/status, GET /v1/formats, GET /v1/limits, POST /v1/convert, POST /v1/build, POST /v1/template/render, POST /v1/extract/text, POST /v1/extract/meta, POST /v1/extract/thumbnail, GET /v1/jobs/{id}, GET /v1/files/{id}.
• o3oscript v1 scripts for text documents, spreadsheets and presentations; {{field}} templates with table row loops.
• Gate: GET /o3o/status, GET /o3o/limits, GET /o3o/healthz; connection counting, 5-minute sliding peak, 120-second reconnect grace, Vietnamese limit page, fail-open, CSV usage log.
• Embedding: api.js, O3O.Editor with 7 events and 5 methods, embed sessions, an internal WOPI host.
• Callbacks document.saved, document.closed, job.done, job.failed, signed with HMAC SHA-256.
• API key and HS256 JWT authentication; unified error format; rate limit headers.
• Offline-verified Ed25519 license tokens; a 50-connection community edition and a token-based enterprise edition, at least 50 connections per order.
• Docker bundle: proxy, editing server (DEV image), gate, DocBuilder, nextcloud profile.
• SSRF protection in the gate and DocBuilder for every externally supplied URL, with IP pinning against DNS rebinding: the host name is resolved once, every address is checked, then the connection goes straight to the checked address (file downloads, every redirect hop, callbacks). Name entries in O3O_FETCH_ALLOW_HOSTS are resolved at connect time; CIDR entries stay pinned. See Production security.
• Inner proxy and safe start-up: every WebSocket upgrade to the editing server must pass the gate, and WebSocket requests the gate cannot parse are refused; the editing server's admin console and metrics are blocked at the proxy, trailing-slash forms included; compose refuses to start until the editing server's admin password is set, and the gate in production mode refuses to start while that password is empty or CHANGE_ME. See Reverse proxy.

Not in this release#