0.34.0

Welcome to the 0.34.0 release of Karakeep (and sorry for the long wait)! The mobile app gets most of the attention this time: Automatic offline downloads for recent bookmarks and particular lists, tablet layouts, tag management, public lists, collaborators and attachments, all of which used to need the web app. The crawler got a big anti-bot overhaul: it now drives real Google Chrome through patchright, so far fewer sites will hand you a "Just a moment..." page instead of the article. There are also a lot of memory and performance improvements, along with tons of bug fixes.

Thanks to everyone who contributed to this release: @justadityaraj, @InventorB, @ryanchou1994, @NoiceHax, @0-0mfuji, @eriktews, @qwist1233-cpu, @lightsabit, @BrownieCoder, @itz-puneet, @jreiml, @deepcfr, @mislav, @pradeepb28, @Kyzcreig, @gowinder, @samuel-sarmah, and everyone who triaged bugs or shared feedback.

Note: the changes mentioned here for the extension and mobile releases will need to go through the different store (apple, google, mozilla) reviews. So it might take a couple of days until all of them are released.

If you enjoy using Karakeep, consider supporting the project here ☕️ or via GitHub here. Also share Karakeep's managed offering (☁️ link) with your friends who're not into selfhosting.

New Features 🚀

• Karakeep's auth moved from next-auth to better-auth:
  • This is an infrastructure change, but it's a big one. Karakeep moved its auth library to better-auth (away from next-auth). This will unlock a lot of new features in the future (e.g. 2fac, oauth login in the mobile app, hosted MCP auth, etc).
  • This migration is going to happen automatically after the upgrade BUT there are some caveats, please read the "Upgrading" section.
• Automatic Offline Downloads: 0.33 let you save single bookmarks for offline reading on the mobile app. In this release, you can let karakeep automatically download recent bookmarks for you while the app is open, and also mark specific lists to be always fully available offline.
• Mobile app catching up with the web:
  • Tablet layout showing multiple columns on wide screens.
  • Tag management: rename and delete tags from the app (fc401d0).
  • Manage public lists and list collaborators (292c13a).
  • View and download bookmark attachments (27774f9).
  • A new usage statistics screen (6563ee1).
  • Pick a parent list, choose a list icon, and create lists straight from the "Manage Lists" page (7ca5ee2, 428d1f2, f977712).
• A crawler that gets blocked less:
  • The crawler now drives the browser with patchright, a Playwright fork that doesn't leak the automation signals that bot-protection scripts look for (af8b0eb).
  • The karakeep-chrome image now ships Google Chrome stable instead of Chrome Headless Shell, as protected sites block the headless shell far more often (ea57af1). This comes at the cost of the chrome image getting bigger unfortunatly.
  • The user agent now comes from the actual browser instead of a hardcoded Chrome 124 one (254174a).
  • Cloudflare's "Just a moment..." and DataDome's device check clear on their own after a few seconds. The crawler now waits for them (up to CRAWLER_CHALLENGE_WAIT_SEC, default 15s) instead of saving the challenge page (1800346).
  • New CRAWLER_BROWSER_TIMEZONE to make the browser's timezone match your proxy's location, as a UTC browser behind a non-UTC proxy is a strong bot signal (ba8c188).
• On-demand video preservation (#3183): A new "Preserve Video" bookmark action downloads a single bookmark's video with yt-dlp. You can now keep automatic video downloads off and still preserve the ones you care about.
• Broken links management revamp (#3105): The broken links settings page now groups issues by category and supports search, sorting, retrying and bulk deletion.
• Search: New has:notes and has:highlights qualifiers by @BrownieCoder (#3053).
• Others:
  • New CRAWLER_FULL_PAGE_ARCHIVE_MAX_SIZE_MB to discard full-page archives above a certain size (media-heavy pages can produce 1GB+ archives that never render) by @NoiceHax (#3054).
  • Pages uploaded as precrawled archives (e.g. SingleFile uploads, and client-side crawling) now get a screenshot too (#3161).
  • Banner images are now resized and converted to WebP to save storage (#3165).
  • The default tagging model is now gpt-6-luna which costs half as much as gpt-5.6-luna used to cost (thanks OpenAI?).

UX Improvements ✨

• A visual refresh of various web app components. More modern looking dialogs, buttons, dropdown menus, tooltips, etc.
• Added a "System" theme option that follows your OS by @deepcfr (#3159).
• The bookmark preview page now has the full bookmark options menu in its action bar (24fb655).
• The "delete unused tags" button is now a bit more grown up (acbac6a).
• Home/End now move the cursor in the search bar by @eriktews (#3110).
• The browser's theme color now follows dark mode by @itz-puneet (#3051).
• Mobile:
  • Lists are sorted by name, like on the web, by @justadityaraj (#3040).
  • Bigger toolbar tap targets by @jreiml (#2813).
  • Better looking bookmark cards when there's no metadata (2b2771a).

Fixes 🐛

• Performance and memory:
  • Fix a server memory leak caused by the query cache (#3138).
  • Workers and web only load the dependencies of features that are enabled cutting memory usage for most setups. You should expect a 40MB drop in RSS with this release.
  • Prometheus default metrics are no longer collected when Prometheus isn't configured (#2397). This fixes a regerssion introduced in 0.29 and should result into a lower baseline CPU usage.
  • Faster tag searches by @0-0mfuji (#3089).
  • Search indexing now defaults to 50 workers (instead of 1) for better batching. Should result in faster indexing for large imports.
  • SQLite now runs PRAGMA optimize on open and daily (355a0b0).
  • Faster lists page and list stats queries and a smaller main web bundle (2d7cc4b, 44ea028, b640f15).
• Hardening:
  • Upload body size is now enforced before parsing the multipart body (3e22b65).
  • Asset downloads now respect client backpressure instead of buffering in memory (b5cab5b).
  • Pagination limits are now validated on all tRPC endpoints (94e1ea2).
  • Content length is capped before tokenizing AI prompts (ef07e91).
  • Upgraded Next.js to 16.4.1 for its October security release (#3196).
• Collaborators' bookmarks now show up in public lists by @NoiceHax (#3019).
• Moving a list under one of its own sublists is now rejected, as the resulting cycle could send list deletion into an infinite loop. Reported by @Vertextheonesolution (GHSA-892w-x93w-2fqp, #3199).
• Fix bookmark pagination tie breakers that could skip or duplicate bookmarks (135f116).
• Fix the headers timeout for AI inference jobs with slow providers by @eriktews (#2888).
• Fix embedding generation with providers that don't default to float embeddings (#3009).
• Bookmarks deleted while being indexed no longer dangle in meilisearch (bca289d).
• The RSS fetcher now identifies itself with a karakeep specific user agent (adf399b).
• If one of the workers fails, the whole worker process now crashes instead of silently running without it, so your container's restart policy can kick in (ae9e23b).
• Fix .jpg uploads being rejected in the attachment box (2434e65).
• Fix the header shrinking in Safari (3c44114).
• Fix duplicate "sort by" in the all tags page (f5e56b4).
• Fix the sidebar's "+" (new list) button messing up the bookmark preview modal when clicked while a bookmark is open by @samuel-sarmah (#3192).
• Make /run owned by node in the docker image so non-root setups work by @lightsabit (#3114).
• Mobile:
  • Fix lost and duplicated Android shares after the app gets killed (e7fbaab). This has been a long standing problem, and should signficantly improve share reliability for android.
  • Ignore Android's unreliable internet reachability checks that marked the app offline (#3127).
  • Fix the server save button getting hidden by the keyboard by @InventorB (#3010).
  • Markdown list bullets and numbers now use the foreground color by @ryanchou1994 (#3046).
  • Fix lists not getting auto refreshed when a bookmark is added to it (f4efff9) and vertical images in bookmark info (482369b).
  • Fix a bug that was causing mobile API keys to not be revoked on mobile app logout (1820693).
• Added missing Turkish translations by @qwist1233-cpu (#3111).

For Developers 🛠️

• The MCP server has been upgraded to the MCP v2 SDK (39df6c6).
• The CLI now bundles the official Karakeep skill (baf0b1b).
• Karakeep now serves /.well-known/api-catalog, /.well-known/change-password and /.well-known/security.txt (2620d9e).
• The docs now have an llms.txt for agents (a8450b3).
• Translations have moved away from Weblate and to an LLM driven workflow.
• Clarified LOG_LEVEL options in the docs by @mislav (#3149).

Community Projects 💡

Checkout our community projects page here.

• Alfred Karakeep: An Alfred workflow for inline bookmark search using Karakeep's query language by @Kyzcreig (#2974).
• Supasend: A quick capture iOS app for sending photos and links to Karakeep by @pradeepb28 (#3077).
• KaraClone: A reimplementation of the Karakeep server API that runs on the Cloudflare Workers free tier by @gowinder (#3124).

Screenshots 📸

Automatic Offline Download

Broken Links Page

Upgrading 📦

Things to know before upgrading:

• Everyone gets signed out once. The move to better-auth (#3140) switches web sessions from JWTs to database sessions, so all web users will need to sign in again. Mobile apps and API keys are not affected.
• Auth env changes:
  • This release will automatically lowercase all email stored in the database (in prep for making email case insensitive), except accounts that will cause a conflict (two accounts that differ only in email case). You Must fix those conflicts before upgrading (by deleting the unused one). You'll get locked out if you have two conflicting accounts (neither of which are lowercase). If you get locked out, change the email address in the sqlite database to be lowercase to gain access back.
  • New AUTH_TRUSTED_ORIGINS (default *) to restrict which origins can sign in and be redirected to on top of NEXTAUTH_URL.
  • NEXTAUTH_URL and NEXTAUTH_SECRET keep their names and are still required.
• Migrate to the karakeep-chrome image if you haven't already. Check the migration guide here. Browserless (mostly unraid users) will continue to work but will miss out on the stealth improvements. It's advised to migrate to karakeep-chrome's unraid template maintained by @Collectathon.

To upgrade:

• If you're using KARAKEEP_VERSION=release, run docker compose pull && docker compose up -d.
• If you're pinning it to a specific version, upgrade the version and then run docker compose pull && docker compose up -d.