Release v2.0.1 - Adds Shlink URL shortener support, password peek & bugfixes

[elrido]

• ADDED: Auto shorten URLs with config option shortenbydefault (Auto shorten urls #1627)
• ADDED: Added shortenviashlink endpoint with an shlink configuration section
• ADDED: Password peek (Add option to see/peek at the password #1254)
• CHANGED: CSP recommendation around bootstrap5 template resolved in Firefox 131 (update CSP recommendation around bootstrap5 template #1613)
• CHANGED: Upgrading libraries to: bootstrap 5.3.8, DOMpurify 3.2.7 & ip-lib 1.21.0
• FIXED: Allow pasting a password for decrypting a paste (fix: allow pasting a password for decrypting a paste #1620)
• FIXED: Allow copying the shortened link after using a URL shortener (Copy Link does not work on shortened URL #1624)
• FIXED: URL extraction fails when frame-ancestors is set in CSP (Short URL extraction fails when a valid URL exists in the response document from the proxy call #1644)
• FIXED: traffic limiter not working when using Filesystem storage and PHP opcache

---

This discussion was created from the release Release v2.0.1 - Adds Shlink URL shortener support, password peek & bugfixes.

[AnonymousWP]

For everyone responsible for this: thank you for your hard work again! Nice release.

I'm just wondering why it's release 2.0.1. If you use semantic versioning, this should be 2.1.0 because you added features. 🤔

[elrido]

In short, I guess this project has so far been conservative about version changes. Most releases only bump the patch version, while introducing changes either configurable and off by default or such that they avoid breaking UX flow.

We have only bumped the minor version if the features significantly change UX flow or came enabled by default, but are not (yet) breaking changes. Added features that are not enabled by default, such as the new URL shortener features would require the server admin to actively configure them after the release. Arguably the password peak is UX, but is optional and a user can just ignore it.

Examples from past minor releases:

• 1.7.0 introduced the confirmation dialog before opening a burn-after-reading paste (though old paste URLs did skip it even on 1.7.0+, as it was done as a URL-parameter and only new paste URLs have it)
• 1.6.0 required a new minimum PHP version
• 1.5 had some changes that could affect MySQL/MariaDB setups
• 1.4 removed the ini config migration and brought changes to configuration options
• 1.3 changed the minimum required PHP and JavaScript versions, introduced the v2 paste format, but still supported v1 pastes
• 1.2 changed the minimum required PHP version
• etc.