Changelog
What's new.
Every public Klott release, newest first. Grouped by Added, Changed, Fixed, Removed. Missing something? Send a feature request.
Roadmap
What’s next.
Where Klott is headed: what’s already shipped, what’s in progress right now, and what’s planned.
Shipped
- Shipped · v1.0.0 · 2026-06-01The idea
A blank page you can just write on.
- Shipped · v1.2.0 · 2026-06-04Klott on klott.cc
Renamed, moved to klott.cc, email sign-in.
- Shipped · v1.3.0 · 2026-06-09Moods
Typography-and-color themes that change how writing feels.
- Shipped · v1.5.0 · 2026-06-13Private by default
Your notes stay yours; share only when you choose.
- Shipped · v1.11.0 · 2026-07-05Guest writing
Open it cold and type, no account needed.
- Shipped · v1.15.0 · 2026-07-09Native app groundwork
The desktop wrapper begins.
In progress
- In progressNative macOS app
A real downloadable Klott for the Mac.
- In progressBeta waitlist
Public launch is coming, join the list.
Planned
- PlannedNative app v1
Ship the macOS app.
- PlannedSelf-hosting, one command
Run Klott on your own server.
- Planned · 17 November 2026Public launch
Out of beta, open to everyone.
- PlannedCollaboration
Write together, live.
- Security
- A pre-HAG-439 row in the auth token store was an immortal credential.
- Seven advisories in the dev dependency tree are gone (HAG-1824).
- The webroot default-denies files that are never part of the served bundle (HAG-2351).
- `@xmldom/xmldom` is pinned to ^0.8.15 and three advisories are gone (HAG-2809).
- The two open `@tiptap/core` advisories are gone (GHSA-cp6q-959q-f8rh, where `mergeAttributes()` turned an own `__proto__` key into inherited executable DOM attributes; GHSA-j95f-988m-3j2f, quadratic ReDoS in block…
Added- A carousel step on /discover is a MORPH now rather than a cut.
- The waitlist confirmation now opens on a picture: a 520x240 masthead band with the Klott mark as ascii art, carved out of a still frame of the homepage backdrop, in the site's own cyan-to-magenta ramp, standing in a…
- Share analytics can count the links people follow out of a klott, not just the views (HAG-2295).
- A Discover card can show the klott's OWN first picture (HAG-1986).
- `scripts/reassign-seeded-owner.php` can move seeded Discover demo content off a personal account (HAG-1939).
- The mail-capture contract has a test that was shown to fail before it passed (HAG-2574).
- The test suite runs on vitest's threads pool, so a test file cannot be dropped without anybody noticing.
Changed- `scripts/deploy.sh` cannot ship to production by accident either.
- Staging is numbered 1.43.0. It sat at 1.41.1 while production served 1.42.0, so the release manifest staging generates announced itself as older than the thing it exists to replace (HAG-2803).
- The waitlist confirmation's background is neutral rather than warm.
- `scripts/deploy-app.sh` cannot ship to production by accident.
- The Discover seed spreads its demo klotts across the demo authors (HAG-1895).
Fixed- `scripts/release.sh --deploy` reaches production again.
- `scripts/worktree.md` no longer documents a production deploy that quietly goes to staging.
- Fixed: privacy page now describes view counting as it actually works, including the transient IP bucketing behind the approximate unique estimate (HAG-2807)
- PDF export did nothing in the native macOS app (HAG-1841).
- The marketing copy said Klott has eight moods.
- Home and Discover no longer collide with the left panel on a phone.
- The closing Klott mark is visible again at the foot of the page, on a phone above all.
- The editor stops painting a mood's typeface over the font the author chose, so what you write is what you publish.
- A vanity address can no longer shadow a real route.
- An unknown address gets the real not-found page.
- A mail capture directory named `0` no longer mails real people.
- A document saved while Oi was on offer renders in the face that replaced it, everywhere.
- An install served under a subpath finds its own assets and links.
- The calm field stopped breathing next to the countdown (HAG-2575).
- Staging stops linking people at production, in its pages and in its mail (HAG-2801).
- The MCP authorisation page works under a subdirectory self-host (HAG-2802).
- A published page is the same shape as the document you wrote (HAG-2811, the same class of bug as HAG-2285).
- The last hardcoded root-relative hrefs in the app go through `withBase()` (HAG-2576).
- The calm-walk guard also covers the root it was handed (HAG-2575).
- A document's title survives an HTML round-trip, and `h1.klottle-title` parses as a title at all.