karakeep
v0.34.1A self-hostable bookmark-everything app (links, notes and images) with AI-based automatic tagging and full text search
- Maintenance
- ActiveBased on the last push: commit history is not collected yet
- License
- AGPL-3.0Copyleft · OSI-approved
- Security
- 12 advisories5 high, 5 medium, 2 low
- Supported versions
- No scheduleendoflife.date does not track this project
30.5k stars · 1.6k forks · 721 open issues · last release 24 days ago · data checked 4 hours ago
Breaking changes
What to check before upgrading, taken from the notes of the last 30 releases.
- v0.33.1Aug 1, 2026
- ⚠️ Semantic search requires embeddings to be enabled, read the upgrade notes for details about how to enable them.
Upgrading 📦
To upgrade:
- If you're using
KARAKEEP_VERSION=release, rundocker compose pull && docker compose up -d. - If you're pinning it to a specific version, upgrade the version and then run
docker compose pull && docker compose up -d.
Enabling Embeddings
- Karakeep's embedding uses your existing meilisearch installation as the default vector store. If you're an OG, and running an old meilisearch version, you'll need to ensure you're on meilisearch version (1.13 or higher). Check this guide for info on how to update.
- If you're using the default OpenAI based configuration, auto embeddings of new bookmarks will be enabled automatically and will use the
text-embedding-3-smallmodel. - If you're using a custom provider, you'll need to pass in the
EMBEDDING_TEXT_MODEL=, the size of the dimension of the model viaEMBEDDING_DIMENSIONSand then passEMBEDDING_ENABLE_AUTO_INDEXING=trueto enable embeddings. Check out our docs for example models and configurations.
Once you've enabled embeddings, you'll need to regenerate embeddings for all existing bookmarks. Head to the admin panel's Background Jobs page (new "Embeddings" card) and regenerate embeddings for all/pending bookmarks. This might take a while depending on how many bookmarks you have, and will cost you money (though embeddings are usually pretty cheap).
NOTE: Changing the model or its dimension after embedding even a single bookmark will require you to regenerate embeddings for *all* bookmarks.
- v0.30.0Jan 1, 2026
Upgrading 📦
To upgrade:
- If you're using
KARAKEEP_VERSION=release, rundocker compose pull && docker compose up -d. - If you're pinning it to a specific version, bump the version and then run
docker compose pull && docker compose up -d.
- fix!: changing default for includeContent to be false in the API - @MohamedBassem in 1369ad01
- If you're using
- v0.28.0Nov 8, 2025
- ⚠️ (Potentially breaking change) ⚠️ Stricter URL valdaition to protect against SSRF attacks (#2082)
Upgrading 📦
To upgrade:
- If you're using
KARAKEEP_VERSION=release, rundocker compose pull && docker compose up -d. - If you're pinning it to a specific version, bump the version and then run
docker compose pull && docker compose up -d.
- v0.24.0Apr 27, 2025
- ### ⚠️ The firefox extension is back under a new name (Action Required) ⚠️
- ⚠️ For backward compatibility, this defaults to
true, but starting from the next release, this will default tofalse. So if your tool relies on the content of the bookmarks, start passing this totruenow.
Upgrading 📦
If you’re using
KARAKEEP_VERSION=release:docker compose pull && docker compose up -dIf you pin to a specific version, update
KARAKEEP_VERSION, then:docker compose pull && docker compose up -d
Release history
All releases on GitHubThis is a security release on top of 0.34.0. The docker images move from the pinned node:24.18.1-slim back to node:24-slim (currently Node 24.22.1) to pick up the October 2026 Node.js security releases. Among other fixes, these patch a Brotli decoder out-of-bounds write (CVE-2026-111497) and several TLS certificate hostname validation bypasses (CVE-2026-105483, CVE-2026-106069, CVE-2026-106072). Thanks @eriktews for the fix (#3217)!
The node version was pinned in 0.33.2 because of the better-sqlite3 crash loop (#2989). The upstream fix for that shipped in Node 24.22, so the pin is no longer needed.