halo-dev/halo
Halo 是一款强大易用的开源建站工具，从个人博客、知识库，到企业官网、在线商城，Halo 都能助您轻松实现，一站式满足您的多样化建站需求。
How halo is put together
Halo is a GPLv3 open-source website-building/CMS platform ('强大易用的开源建站工具') delivered as a modular Gradle multi-project. The backend is Java 21 on Spring Boot with a fully reactive stack (WebFlux, R2DBC, Spring Security, PF4J plugin system, Lucene search), split into an 'api' library module published for plugin/theme developers and an 'application' module producing the bootable Halo jar that embeds the pre-built frontend dist. The frontend is a pnpm-managed Vue 3 + TypeScript monorepo under ui/, building two SPAs — Console (admin) and UC (user center) — from console-src/ and uc-src/, sharing packages such as api-client (OpenAPI-generated), components, editor, and ui-plugin-bundler-kit. Relational data flows through R2DBC to H2/PostgreSQL/MySQL/MariaDB, with Caffeine caching, session-based auth, and per-group OpenAPI specs (public/console/uc/extension/aggregated) generated at build time.
Languages
Frameworks
Datastores
Infrastructure
Major components
api (Java library module)
Published run.halo.app API library exposing the reactive extension/plugin SPI, Spring Boot starters, security, cache, Lucene, and PF4J dependencies consumed by external projects.
application (bootable server)
Spring Boot application producing the halo bootJar; embeds UI dist, downloads preset plugin JARs at build time, runs R2DBC migrations, and publishes container images.
Console UI (ui/console-src)
Admin single-page app (login, dashboard, content/settings management) built as Vue 3 + Pinia app mounted from console.html with modular extension points and UI-plugin runtime.
UC UI (ui/uc-src)
User-center single-page app for authenticated end users, mirroring the Console's setup pipeline (i18n, permissions, plugin runtime, theme store).
UI shared packages (ui/packages/*)
Shared frontend libraries: api-client (OpenAPI-generated client), components, editor (Tiptap-based rich text), shared utils, ui-plugin-bundler-kit, and legacy console-shared.
Plugin system (PF4J + presets)
Loads plugin JARs (backend PF4J, frontend ESM runtime per openspec specs); build downloads and auto-enables preset plugins including comment-widget, search-widget, sitemap, feed, shiki, and the closed-source appstore.jar.
platform (BOM modules)
platform/application and platform/plugin provide dependency-platform/BOM coordination for the api/application modules and third-party plugin builds.
API documentation & specs
Generates grouped OpenAPI v3.0 documents into api-docs/openapi/v3_0 via a forked Spring Boot run, complemented by openspec/ behavioral specifications.
A quiet week focused on fixing duplicate notifications and keeping dependencies up to date.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A quiet week focused on fixing duplicate notifications and keeping dependencies up to date.
Week of 2026-08-17
A small week of polishing how the editor handles cursor placement and selection around blocks.
Week of 2026-08-10
A big week of editor keyboard shortcuts, theme management upgrades, and completing the migration to the Vite+ build system.
Week of 2026-08-03
The busiest week of the month: major login and signup features landed alongside a deep rebuild of the rich text editor's table editing and selection internals.
Week of 2026-07-27
The editor was shifted onto official Tiptap extensions while plugin lifecycle bugs were fixed and login gained email verification codes.
Over the past month, the Halo team has been steadily modernizing its developer tooling—moving builds to Vite+, upgrading core frameworks like Spring Boot, Vue Router, and Pinia, and rebuilding large parts of the rich text editor on Tiptap's newer building blocks. Alongside that, they shipped user-facing improvements like OAuth2 registration, email verification code login, theme search and batch uninstall, and a wave of editor fixes for cursor behavior, selection, and scrolling. The pace peaked in early August with 27 commits, then settled into smaller maintenance and polish weeks.
Week by week
2026-08-24A quiet week focused on fixing duplicate notifications and keeping dependencies up to date.latest5 changes
Fix
No more duplicate in-app notifications
Fixed an issue where users could receive the same notification multiple times when several notifiers were active.
Chore
Spring Boot upgraded
The backend framework was upgraded to version 4.1.1 to stay current on security and bug fixes.
Fix
Cleaner comment reply listings
Removed warnings that appeared when loading pages of comment replies.
Chore
Vite+ tooling bumped
The new Vite+ build tooling was upgraded to version 0.3.0.
Chore
README Docker version refreshed
Updated the documentation to point to the latest Docker image version.
2026-08-17A small week of polishing how the editor handles cursor placement and selection around blocks.4 changes
Fix
Smoother gap cursor interaction
Improved how the text cursor behaves in the gaps between block elements like images or tables.
Fix
Better selection feedback
Complex embedded items like tables now show clearer visual feedback when selected.
Fix
Cursor preserved during replacements
The cursor no longer jumps unexpectedly when one block is swapped out for another.
Fix
Quieter cleanup logs
The background garbage-collection process now logs only essential info about extensions instead of noisy details.
2026-08-10A big week of editor keyboard shortcuts, theme management upgrades, and completing the migration to the Vite+ build system.6 changes
Feature
Improved editor keyboard shortcuts
Writers can now use better keyboard shortcuts while editing rich text content.
Feature
Theme search and batch uninstall
You can now search installed themes by name and uninstall several at once from the console.
Chore
Vite recommended for plugins
Plugin developers are now officially pointed to Vite as the preferred way to build their UIs.
Feature
Token usage timestamps
Personal access tokens now show when they were last used, making stale tokens easy to spot.
Refactor
Build workflows migrated to Vite+
Continuous integration pipelines for Node and pnpm were moved over to the newer Vite+ tooling.
Chore
UI dependency upgrades
A batch of front-end libraries, including FormKit and the main UI packages (now 2.26.0), were upgraded.
2026-08-03The busiest week of the month: major login and signup features landed alongside a deep rebuild of the rich text editor's table editing and selection internals.6 changes
Feature
OAuth2 sign-up support
New users signing in through providers like GitHub can now complete their registration and email automatically.
Feature
Email verification code login
Users can log in using a code sent to their email, and email is tried before username at the login screen.
Feature
Set passwords for passwordless accounts
People who signed up without a password can now add one from their personal center.
Refactor
Table editing rebuilt
Editing tables in the rich text editor was rewritten from the ground up for more reliable behavior.
Refactor
Editor selection engine rebuilt
Range selection and the 'gap cursor' between blocks were reworked on modern foundations to fix long-standing quirks.
Feature
ESM plugin and theme support
Plugins and themes built as modern ES modules are now supported, opening the door to current JavaScript tooling.
2026-07-27The editor was shifted onto official Tiptap extensions while plugin lifecycle bugs were fixed and login gained email verification codes.6 changes
Feature
Email code login groundwork
Support was added for logging in with a verification code emailed to the user.
Refactor
Tiptap extension adoption
Find-and-replace, audio embedding, trailing nodes, and range selection all moved to official Tiptap extensions instead of custom code.
Fix
Orphaned plugin files cleaned up
Uninstalling a plugin now removes leftover JAR files that previously lingered on disk.
Fix
Safer plugin restarts
Plugins are properly shut down when the application restarts, preventing stale state.
Refactor
Faster console global search
The admin console's global search loads its data more efficiently.
Chore
Tooling upgrades
Vite+, TypeScript, VueUse, and pnpm (to version 11) were all brought up to date.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 0 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required