• Welcome to the Chevereto User Community!

    Here, users from all over the world come together to learn, share, and collaborate on everything related to Chevereto. It's a place to exchange ideas, ask questions, and help improve the software.

    Please keep in mind:

    • This community is user-driven. Always be polite and respectful to others.
    • Support development by purchasing a Chevereto license, which also gives you priority support.
    • Go further by joining the Community Subscription for even faster response times and to help sustain this space

Chevereto v4.4.0 announcement

Status
Not open for further replies.
Rodolfo

Rodolfo

👑 Chevereto Godlike
Chevereto Staff
Administrator
Hey there,

I’m confirming the ongoing development of Chevereto v4.4.0 (Vivaracho)
This version introduces multi-tenancy, a major feature that allows a single Chevereto installation to host and manage multiple independent sites under one shared core.

Each tenant keeps its own data, configuration, and identity, while benefiting from a common codebase and shared infrastructure. That means less duplication, easier scaling, and more consistent updates across every site. In other words, distributing Chevereto installations will be much cheaper, with better resource use, simpler deployment, and lower maintenance costs.

For service providers, multi-tenancy opens the door to offering hosted Chevereto services or managing multiple client sites from a single instance.

This release lays the foundation for Chevereto Cloud and sets the stage for a more scalable, sustainable, and accessible media hosting ecosystem.


Code: 
- Added support for multitenancy
- Added Tenants API
- Added Tenants CLI
- Added multi-user support as a core (now free) feature
- Added AWS S3 and S3-Compatible Storage APIs as a core (now free) feature
- Added last seen tracking for login cookies
- Added HMAC signature to tokens, uploads and API keys
- Added cipher support for system variables (encryption)
- Added disabled web installation for service context
- Added "stats-rebuild" CLI command
- Added /powered-by route
- Added base64 encoded token URLs
- Fixed bug with albums created by guests
- Fixed invalid file checksum upload bug
- Fixed missing email-change warning message
- Merged images_hash table into images table
- Renamed "metrics" CLI command to "stats"
- Renamed "update" CLI command to "database-migrate"
- Removed ACL option for AWS S3
- Updated license terms with more grants, fewer restrictions
- Updated password hashing to use Argon2id algorithm
 
Added last seen tracking for login cookies

This release adds tracking for "last seen at" datetime which will enable to display all sorts of related information like how many users are online. Thanks for the RFC.
 
Removed images_hash table (merged into images table)

The images_hash table is no longer needed as the delete_hash will be now stored under images table.
 
Added HMAC signature to tokens, uploads and API keys

We've introduced HMAC signatures to enhance security across our system. Now, login tokens, confirmation tokens, chunked uploads, and API keys are all signed. This ensures that requests with invalid signatures are immediately rejected, avoiding unnecessary database lookups.

To further strengthen security, each subject has its own separate HMAC key. 🔐
 
Added "stat-rebuild" CLI command to recalculate stats

With Chevereto v4.4.0 you will be able to also re-build the application stats via CLI with the new stat-rebuild command. You can also do it via /dashboard as usual.

Code: 
app/bin/cli -C stat-rebuild
 
Renamed "metrics" CLI command to "stat"

To keep things sane, the metrics command has been renamed to stat.

Code: 
app/bin/cli -C stat
 
Added support for multitenancy

Multitenancy is the grand new addition on Chevereto v4.4. It introduces a completely new servicing layer that enables anyone to easily scale Chevereto to support multiple tenants. Whether you're offering Chevereto-based hosting or managing multiple websites for any purpose, this feature opens a new market where you can build, automate, and monetize Chevereto installations.

Check the Multitenancy documentation for a complete overview of this new feature.
 
Added /powered-by route

To support software self-preservation and transparency, a new /powered-by route has been introduced. This endpoint publicly indicates that the service operates using Chevereto software. It includes a disclaimer clarifying the runtime context and explicitly stating that Chevereto Software has no affiliation or responsibility for the content hosted by the instance.

In recent months, we've received a growing number of complaints and misuse reports directed toward Chevereto Software, even though the issues originated from third-party services using the software. This confusion arises because end users often can’t distinguish between Chevereto Software (the developer) and the independent operators running their own instances.

The /powered-by route provides a clear, verifiable way to identify the software behind a service while making it explicit that Chevereto has no operational or content-related involvement with these third-party instances.
 
Added multi-user support as a core (now free) feature

Multi-user support is now available on all editions, including chevereto/chevereto. This extends to roles, and guest (API, upload, etc), and it will suit more use cases.
 
Added cipher support for system variables (encryption)

We are now storing HMAC secret keys in the database, so we extended the cipher support for the system variables. These secrets are now encrypted.
 
Added Tenants CLI

Chevereto v4.4 introduces the Tenants CLI, available at app/bin/tenants, which allows you to manually manage your multi-tenant Chevereto infrastructure. With this tool you can:
  • Add, retrieve, edit, and delete tenants
  • Manage tenant cache
  • Handle plans and plan assignments
  • Run and supervise background job workers
  • Carry out updates across your tenant ecosystem
1763223244365.png
 
Added Tenants API

Chevereto v4.4 introduces the Tenants API, available at /_/api/4/, which allows you to remote control and manage your multi-tenant Chevereto infrastructure. With this tool, you can perform the same operations as the Tenants CLI but over HTTP, using an API key plus a private/public key pair for additional security.

Thanks to this, you can now shape any business on top of Chevereto multitenancy. The system is entirely config driven, allowing you to tailor it precisely for your audience, market, and needs. Whether you're launching a massive SaaS, a niche community platform, or a fully automated hosting product, the Tenants API empowers you to build it with precision, speed, and virtually unlimited scalability.
 
Updated password hashing to use Argon2id algorithm

Before Chevereto v4.4, password and API key hashing relied on the bcrypt algorithm. While solid, bcrypt has a significant limitation: it only processes the first 72 characters, silently ignoring the rest. For long, high-entropy secrets, this reduces the effective entropy of the stored hash.

Starting with Chevereto v4.4, all new hashes now use the Argon2id algorithm. Argon2id is a modern, memory-hard hashing function designed to resist GPU/ASIC cracking and avoid the issues inherent to bcrypt. It provides stronger security, better performance tuning, and is a far more suitable choice for Chevereto's use cases.
 
Added disabled web installation for service context

Added support for disabling the web installer when running in a service (SaaS) context. When the system is operating as SaaS or when tenant support is enabled, the web-based installation process is automatically blocked.
 
Renamed "update" CLI command to "database-migrate"

The update command is often interpreted as "application update" so in this new version the command is now database-migrate. The old update command is now alias for database-migrate.
 
Added base64 encoded token URLs

The ?token= parameter will be now base64 encoded, this will prevent formatting issues due to email clients and whatnot.
 
Updated license terms with more grants, fewer restrictions

The Chevereto License has been updated to clarify subscription rights, software access, and to grant commercial activity use (SaaS). By the way, we just removed all domain name restrictions.
 
Fixed missing email-change warning message

During first-time installation, the system automatically assigns the default email @chevereto.internal. A persistent warning is now correctly displayed whenever this placeholder email is detected, prompting the user to update it to a valid address.
 
Status
Not open for further replies.
Back
Top