Releases

1. ▸▾v0.2.1-0.20260921074813-c51c3e23686821 Sept 2026pre-release

   Nothing published for this version

2. ▸▾v0.2.09 Sept 2026Security

   Updated Go and quic-go to address known security vulnerabilities. ( #797 , @scydas )

   v0.2.0

   Changes

   Feature

   • Added SSH Git access for model repositories with public-key authentication, automatic model registration during clone and push, and configurable SSH port exposure for Docker Compose and Helm deployments. (#697, @setsunakute)

   • The registry management UI now supports creating and managing MatrixHub-type registries. (#710, @lsq645599166)

   • Prepare config.yaml in the same folder with docker-compose.yml to make docker compose setup steps easier (#814, @yitingdc)

   • Refactor(chart): use StatefulSet for MySQL with volumeClaimTemplates (#890, @wzshiming)

   • Guide users to create a registry when the target registry selector is empty during project creation. (#957, @linghaoSu)

   • Added SQLite support for single-node deployments. Docker Compose now uses SQLite by default, while MySQL remains available through an explicit Compose configuration. Helm/Kubernetes deployments do not support SQLite. (#962, @setsunakute)

   • Improve guidance for the Registry Base URL field when creating a registry: provider-specific hints and defaults, a confirmation before overwriting a customized URL on provider switch, and a warning for addresses that look like a specific repository. (#995, @linghaoSu)

   Bug Fixes

   • Copy buttons now work when MatrixHub is served over HTTP. (#678, @lsq645599166)

   • Robot accounts now enforce disabled and expired states and all-project permissions, while model commits made with robot credentials show the correct uploader. (#688, @setsunakute)

   • Long registry names now wrap correctly in the delete confirmation dialog. (#718, @lsq645599166)

   • Project settings now display a success notification after changes are saved. (#719, @lsq645599166)

   • Creating a model now rejects names longer than 251 characters. (#729, @scydas)

   • Model parameter counts are now displayed correctly for single-file safetensors models and sharded models without total-size metadata. (#739, @scydas)

   • Fixed model size display to use repository tree content size instead of Git repository disk usage. (#759, @scydas)

   • Fix Markdown previews to consistently use the light color scheme. (#761, @vivian-xu)

   • Creating a model now rejects invalid names and normalizes model identifiers to avoid detail-page 404s caused by leading or trailing whitespace. (#781, @scydas)

   • Updated Go and quic-go to address known security vulnerabilities. (#797, @scydas)

   • Fixed duplicate-resource error handling and addressed a database dependency vulnerability. (#803, @scydas)

   • Hardened repository listing and authentication against malformed namespace and token inputs. (#822, @setsunakute)

   • Hardened model repository listing to prevent author filters from accessing content outside the configured storage directory. (#830, @setsunakute)

   • Fix the homepage Quick Start link so it opens the Getting Started guide. (#880, @yitingdc)

   • Project member dialogs now explain role permissions and default new members to the Viewer role. (#887, @linghaoSu)

   • Project viewers no longer see the Create Model action, which is now limited to project administrators and editors. (#900, @linghaoSu)

   • Create and edit sync rule dialogs now adapt their layout to the selected language so field labels remain readable. (#904, @linghaoSu)

   • Enlarged the create access token button on the profile page to match other create buttons. (#907, @linghaoSu)

   • Hugging Face registry discovery now uses the configured mirror or proxy URL, and the sync job API now exposes the PENDING status correctly. (#915, @Phil-OSophy-42)

   • Manually triggered replication runs are now recorded and displayed with the Manual trigger type, even when the policy is scheduled. (#918, @Phil-OSophy-42)

   • Fixed model creation after a failed upload leaves an existing repository without a database record. (#930, @scydas)

   • Manually specified robot account tokens must now be 8–20 characters and include at least one uppercase letter, one lowercase letter, and one number. (#937, @setsunakute)

   • SSH key registration now returns clear errors when a key is already registered or has expired. (#939, @setsunakute)

   • Made project selection dropdowns scrollable and searchable, with a clear selected-project indicator. (#945, @linghaoSu)

   • Improved empty model repository guidance and allowed projects to be created directly from the model creation form. (#947, @linghaoSu)

   • Large per-file commit diffs now show an inline raw diff link while the existing 50-file limit remains unchanged. (#948, @linghaoSu)

   • Fixed remote sync reporting success while leaving the model/dataset description, size and labels empty in the database. Dataset sync no longer creates model records instead of dataset records. (#950, @Phil-OSophy-42)

   • Remove misleading resource name placeholder in replication form- #954 (#954, @linghaoSu)

   • Adds an explanation of the public / private project types, so users understand what each visibility level means before picking one. (#956, @linghaoSu)

   • make table columns fit and keep row actions reachable. (#958, @linghaoSu)

   • Delete/Remove actions across admin pages, project members, projects list, access tokens, and SSH keys now consistently display in red. (#986, @linghaoSu)

   • Fixed the project name link font size in the Projects table to match the rest of the table text. (#987, @linghaoSu)

   • Fixed an issue where updating a robot account could unintentionally disable it. The robot’s enabled status is now preserved unless explicitly changed. (#993, @setsunakute)

   Full Changelog

   Supply-chain verification

   The release container image is keylessly signed with Cosign and has an attached SPDX SBOM.

   Verify the image signature and download the SBOM:

   cosign verify \
     --certificate-identity-regexp 'https://github.com/matrixhub-ai/matrixhub/.*' \
     --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
     ghcr.io/matrixhub-ai/matrixhub:v0.2.0
   
   cosign download sbom ghcr.io/matrixhub-ai/matrixhub:v0.2.0

   The SBOM includes the github.com/matrixhub-ai/hfd dependency. See the Security Policy for additional supply-chain and vulnerability-handling details.

   ---