# Backend changelog Current version 2.16.1. The server and everything behind it: data and APIs, the feed worker, the database, AI, settings storage, and deployment. Versions are major.minor.bugfix: major for changes that break existing setups or links, minor for new or changed features, bugfix for fixes and speed-ups. Newest first. Also at https://helixnews.one/changelog. > HelixNews · Web page: https://helixnews.one/changelog/backend · All pages for agents: https://helixnews.one/llms.txt ## 2.16.1 (2026-11-12) ### Changed - The build records the frontend and backend versions from the changelogs, for the page footers. ## 2.16.0 (2026-11-12) ### Added - Separate changelogs and version numbers for the frontend and backend (`changelog/frontend.md`, `changelog/backend.md`), with every change since the first commit. - `/api/health` reports the running frontend and backend versions. - Markdown versions of the changelog pages, and the changelog in `llms.txt` and the sitemap. - A check (`pnpm changelog:check`, also in CI) that every frontend, backend or shared change comes with a new version in the right changelog. ## 2.15.0 (2026-11-12) ### Changed - `/settings` redirects (301) to `/account`, keeping any `#anchor`; the Markdown version of `/account` covers settings. ## 2.14.0 (2026-11-12) ### Added - Each section's most widely covered story is stored with the front page; a story belongs to the section most of its outlets put it in and tops one section at most. - The top story's section is saved on the account. ## 2.13.0 (2026-11-11) ### Added - ZIP code and postcode lookup: about 77,000 codes in 11 countries (from GeoNames), not stored or logged. ### Changed - Nearby places are ranked from a city's edge, so a point inside a big city finds the city first. ## 2.12.0 (2026-11-11) ### Added - Local news: Google News's local feed for each place, topped up with a name search when thin, fetched on demand, cached 10 minutes, with a site-wide fetch cap. - About 5,600 places in 12 countries (from GeoNames), served to the place picker from `/places.json`. - Readers' places in the `nh_places` cookie and on the account; local pages in the Markdown versions, `llms.txt` and the sitemap. ### Security - Browsers may use location for this site only. ## 2.11.0 (2026-11-10) ### Added - Markdown versions of every public page (`Accept: text/markdown`, or `.md` addresses). - `/llms.txt` describing the site for AI agents; `robots.txt` points to it. ### Changed - Page data moved into loaders shared by the pages and the Markdown versions. ### Fixed - Requests for Markdown got a 406 error. ## 2.10.0 (2026-11-10) ### Added - Alert switch and rules in the site settings, and daily alert totals. - AI drafts of outlet facts; odd values are dropped. - Coverage mix by outlet type and country for story pages. ## 2.9.0 (2026-11-10) ### Added - Web Push alerts: every 5 minutes the worker matches followed topics against widely covered stories (at most one alert per topic every 6 hours, 5 a day). Push keys are stored encrypted; only browser push services are accepted. ## 2.8.0 (2026-11-10) ### Added - Outlet facts (type, country, owner, year founded, description), with type and country filled in for the current outlets. ## 2.7.0 (2026-11-10) ### Added - Muted outlets are left out of Latest, search, Following and the week in review; kept in a cookie and on the account. ## 2.6.0 (2026-11-10) ### Added - Most read this week, from anonymous click totals. ## 2.5.0 (2026-11-10) ### Changed - The site moved to helixnews.one: a migration updates the Site URL, and page requests on other public domains redirect there (301). ## 2.4.3 (2026-11-10) ### Fixed - Opening a server-function address as a page showed raw data; it now goes to the front page, and those addresses are kept out of search engines. ## 2.4.2 (2026-11-10) ### Changed - The front page rebuilds about 13 times faster (9 s → 0.7 s), and dashboard saves no longer stall. ## 2.4.1 (2026-11-10) ### Fixed - Accounts only worked when credits, AI and Ask were all turned on. ## 2.4.0 (2026-11-10) ### Added - Followed topics saved on the account. - Outlet page data, search filters, and the week in review (rebuilt every 3 hours; past weeks kept). - Change log for feeds and ad campaigns. ### Fixed - Development: database connections piled up across code reloads. ## 2.3.0 (2026-11-10) ### Added - Live reader count: open tabs send an anonymous heartbeat every 30 seconds, counted in memory only. ## 2.2.0 (2026-11-10) ### Added - Feed import and export (JSON, OPML); imports never delete feeds. ### Fixed - Feed addresses other than http(s) were accepted. ## 2.1.0 (2026-11-10) ### Added - Ad campaigns: dates, pausing, view caps, weights and UTM tags; existing ads became campaigns. - Ad images uploaded or imported once, checked, re-encoded to WebP and served from `/ad-image/`. - Per-campaign reports with CSV, private advertiser report links, and link checks every 6 hours. ### Changed - HTML ad frames moved to `/ad-frame/`. ## 2.0.0 (2026-11-10) ### Added - The app sends its own security headers: Content Security Policy, HSTS over HTTPS and the rest. ### Changed - The site is published on `WEB_BIND:WEB_PORT` (default `127.0.0.1:3000`). ### Removed - Caddy is no longer part of Docker Compose; put the site behind your own reverse proxy. ## 1.13.0 (2026-11-10) ### Changed - Docker Compose runs without an `.env` file; bind mounts work on SELinux hosts. ### Fixed - Fresh installs seeded only the crypto feeds. ## 1.12.0 (2026-11-10) ### Added - Paywall flag per feed (16 outlets pre-marked). - Latest headlines with cursor paging. - Saved stories on the account. - Text size and new-since-last-visit choices saved on the account. ### Fixed - The process crashed when Postgres or the network dropped an idle database connection. ## 1.11.0 (2026-11-10) ### Changed - Theme and feedback-question choices are saved on the account too. ## 1.10.0 (2026-11-09) ### Added - Streaming chat answers from `/api/ask` (server-sent events), with the checked answer and sources at the end; cached answers stay plain JSON. ## 1.9.0 (2026-11-09) ### Added - Chat searches headlines by meaning: the fast model suggests related terms, cached for an hour, with a 6-second limit and a plain-keyword fallback. ## 1.8.0 (2026-11-09) ### Added - Hidden sections are saved on the reader's account; the account's choice wins. ## 1.7.0 (2026-11-09) ### Added - Full-text search over the last 30 days of headlines (rate-limited). - Story page data, and story pages in the sitemap. - RSS feed of the top stories (`/feed.xml`). ## 1.6.0 (2026-11-09) ### Added - Nightly database backups: a compose service dumps the database to `./backups`, checks each dump, keeps 14 days and catches up after downtime; `scripts/run.sh backup` does the same locally. ## 1.5.0 (2026-11-09) ### Security - Content Security Policy and Cross-Origin-Opener-Policy headers. - HTML ads are served from their own address with a looser policy, for a sandboxed frame. ## 1.4.0 (2026-11-09) ### Security - One-time email links are used only when the reader presses the button on the page, and the page doesn't send its address (with the token) as a referrer. ## 1.3.0 (2026-11-09) ### Added - A configurable allowance for reasoning models' thinking (default 3,000 tokens), added to every AI request. ### Fixed - Summaries and sorting batches failed with "max tokens reached" on reasoning models. ## 1.2.0 (2026-11-09) ### Added - Story chat: reads the outlets' own articles once (respecting robots.txt, paywalls and "noai"), keeps them 48 hours, and cites each outlet. - Accounts without email: scrypt-hashed passwords, one-time recovery codes, passkeys (WebAuthn) and optional email. - Crypto section with 9 crypto feeds. - Hidden sections, remembered in a cookie so the page arrives without them. - `scripts/run.sh`: starts the database, applies migrations and runs the site and worker. ### Fixed - The account page crashed in production (the passkey library is now loaded by Node instead of bundled). ## 1.1.0 (2026-11-09) ### Changed - Chat with the news reads the recent conversation (up to 4 exchanges) to understand follow-up questions; follow-ups search with the previous question too and aren't cached. ## 1.0.0 (2026-11-07) ### Added - AI features through OpenAI-compatible endpoints or OpenRouter: sorting, the top-story summary, Ask the news and comment insights. - Reader accounts, credits, Stripe and PayPal payments with webhooks, and email sign-in. - Dashboard settings stored in the database, with a history of changes. - Status API (`/api/status`) with feed health history. - Image proxy for publisher photos: signed, resized and guarded against requests to private addresses. - Sitemap and `robots.txt`. - Cookieless visit counting that honors Global Privacy Control and Do Not Track. ## 0.1.0 (2026-11-06) ### Added - Feed worker: polls RSS and Atom feeds when due (ETag and If-Modified-Since, backing off on failures) and stores stories in Postgres, de-duplicated by link. - Groups headlines about the same story, sorts them into sections, and writes a new front page only when it would change. - Live updates pushed to browsers over server-sent events (`/api/stream`). - Feeds, editorial overrides and ads from config files, reloaded while running. - Health check (`/api/health`) and anonymous click counting.