1.4.0

1.4.0 - 2026-07-26

This release focuses on responsive UI improvements, migrating all widgets to the standard widgets framework (See docs/widgets.md), plus various fixes and refinements.

Added

• Reorder items on touch devices by dragging the handle in the dashboard list; drop onto a folder to move an item into it.
• Widget settings can declare a color field, rendered with the same colour control used elsewhere in the admin interface.
• Widget settings can declare an object field, rendered as its own card of nested settings.
• Widget settings can declare the same key more than once with different labels, each shown by a showIf condition.
• A widget view can limit which sizes it offers.
• A widget can choose its card background: dark, light or translucent, set for the whole widget or per view.
• A widget can ship a demo.js supplying the body it shows in demo mode.
• Widget settings can declare a picklist field: a fixed number of dropdowns filled from a single fetch.
• Widget settings can declare a repeating section with a fixed number of rows per widget size.

Changed

• System stats now sample CPU once per refresh instead of twice, removing about a second of delay when the IO wait row is shown.
• Books, Connections (Map), Dashboard Switch and Stats (System Summary) now use a solid dark card. Backup, Connections (VPN), DNS and GitHub use a translucent one.
• Stats widget now uses the standard widget settings form. Disk bays are filled from one Fetch Drives call, and the network row is its own settings card.
• Connections widget now uses the standard widget settings form. Each service is a settings card, and the fields shown follow the service type.
• Widget settings rows in a repeating section now show and hide independently, and a dropdown in one can load its options from the service that row points at.
• Weather widget now uses the standard widget settings form. Location is set by typing a city, pressing Fetch and picking a match; "feels like" is a toggle.
• Backup widget now uses the standard widget settings form. Each slot carries its own URL and password. A slot that previously reused another slot's connection keeps working, but a new slot for an instance already configured elsewhere needs its URL and password entered again.
• GitHub widget opts into GitHub's advanced issue search, now the default for the pull-request search API.
• Jellyfin and Emby now-playing authenticate with a request header instead of the api_key query parameter, which Jellyfin has deprecated.
• TrueNAS disk health reports a clear message on TrueNAS 26, which removed the REST API the widget uses; TrueNAS 25.x and earlier are unaffected.
• Settings app icon uses a blue background.

Removed

• GET /api/scrutiny-proxy and POST /api/truenas-proxy. Drive and pool lists now come from the widget's own data function.
• GET /api/backup-data, POST /api/duplicati-jobs and POST /api/kopia-sources. Backup status and job lists now come from the widget's own data function.
• The customEditor manifest key, now that every widget uses the standard settings form.
• GET /api/geocode-proxy. City search now runs through the widget's own data function.

Security

• TrueNAS API key is no longer sent in a URL query string when fetching pools.
• Reject cross-origin POSTs to /api/auth/login, /api/auth/logout, /api/ping and /api/badge-proxy, matching the other write routes.

Fixed

• Folder rows now show the drop highlight while an app is dragged onto them.
• The System Summary, Disk Health and Connections (Map) widgets now show a loading and error state when their data source is unavailable, instead of appearing empty.
• Widgets no longer render outside their card in the top-left of the dashboard.
• Widget settings fields no longer appear when the field that controls them is itself hidden.
• Saving a widget with a required password or key left blank is now refused instead of saving an unusable widget.
• Fetching options in a widget's settings on the public demo no longer returns the demo's sample data instead of a real result.
• Widgets no longer show a stale cached version after an update; each widget's frontend files are cache-busted automatically from their content.
• Dashboard grid no longer overflows and clips to the left on landscape phone and portrait tablet.
• Admin dashboard list no longer truncates item names to a single character on phones; status tags wrap below the name.
• Admin dashboard uses the sidebar layout on landscape phone instead of a stretched mobile column.
• Dashboard grid is no longer vertically compressed in Safari on iPhone; it now fills the screen the same as the installed app.
• Dashboard grid no longer runs behind the dock on short viewports such as iPad landscape; pages fit the available height.
• Admin dashboard drag handle is narrower on phones, leaving more room for item names.
• Folder preview icons are uniform squares on phones and tablets regardless of icon shape.
• Kavita reading-list picker works again; its list endpoint requires POST.

Full changelog: v1.3.1...v1.4.0

1.4.0-rc.4

Fixed

• Dashboard grid no longer runs behind the dock on short viewports such as iPad landscape; pages fit the available height.
• Admin dashboard drag handle is narrower on phones, leaving more room for item names.
• Folder preview icons are uniform squares on phones and tablets regardless of icon shape.

Full changelog: v1.4.0-rc.3...v1.4.0-rc.4

1.4.0-rc.3

Fixed

• Dashboard grid no longer overflows and clips to the left on landscape phone and portrait tablet.
• Admin dashboard list no longer truncates item names to a single character on phones; status tags wrap below the name.
• Admin dashboard uses the sidebar layout on landscape phone instead of a stretched mobile column.
• Dashboard grid is no longer vertically compressed in Safari on iPhone; it now fills the screen the same as the installed app.

Full changelog: v1.4.0-rc.2...v1.4.0-rc.3

1.4.0-rc.2

1.4.0-rc.2 - 2026-07-25

Release candidate for 1.4.0, on top of rc.1. Adds touch reordering on the mobile dashboard list, with a batch of fixes and one security tightening. No breaking changes. Please run it and report anything off before it is promoted to stable.

Added

• Reorder items on touch devices by dragging the handle in the dashboard list; drop onto a folder to move an item into it.

Changed

• System stats now sample CPU once per refresh instead of twice, removing about a second of delay when the IO wait row is shown.

Security

• Reject cross-origin POSTs to /api/auth/login, /api/auth/logout, /api/ping and /api/badge-proxy, matching the other write routes.

Fixed

• Folder rows now show the drop highlight while an app is dragged onto them.
• The System Summary, Disk Health and Connections (Map) widgets now show a loading and error state when their data source is unavailable, instead of appearing empty.
• Widgets no longer render outside their card in the top-left of the dashboard.
• Widget settings fields no longer appear when the field that controls them is itself hidden. Turning off the Stats network row now hides its provider and URL fields, and the disk-source fields no longer show under System Summary.

Changes since rc.1: v1.4.0-rc.1...v1.4.0-rc.2

1.4.0-rc.1

1.4.0-rc.1 - 2026-07-24

Release candidate. New widget authoring surface, and every built-in widget now uses the standard settings form. No breaking changes. Please run it and report anything off before it is promoted to stable.

Added

• Widget settings can declare color, object and picklist fields.
• Widget settings can declare a repeating section with a fixed number of rows per widget size.
• Widget settings can declare the same key more than once with different labels, each shown by a showIf condition.
• A widget view can limit which sizes it offers.
• A widget can choose its card background: dark, light or translucent, set for the whole widget or per view.
• A widget can ship a demo.js supplying the body it shows in demo mode.

Changed

• Every built-in widget now uses the standard settings form.
• Backup slots each carry their own URL and password. A new slot for an instance configured elsewhere needs its URL and password entered again.
• Several widgets changed card background: Books, Connections (Map), Dashboard Switch and Stats (System Summary) are solid dark; Backup, Connections (VPN), DNS and GitHub are translucent.

Removed

• GET /api/scrutiny-proxy, POST /api/truenas-proxy, GET /api/backup-data, POST /api/duplicati-jobs, POST /api/kopia-sources and GET /api/geocode-proxy. Each widget now fetches through its own data function.
• The customEditor manifest key.

Security

• TrueNAS API key is no longer sent in a URL query string when fetching pools.

Fixed

• Saving a widget with a required password or key left blank is now refused.
• Fetching options in a widget's settings on the public demo no longer returns the demo's sample data.
• Widgets no longer show a stale cached version after an update.
  Full changelog: v1.3.1...main

1.3.1

1.3.1 - 2026-07-20

Security and reliability fixes since 1.3.0. No breaking changes.

Security

• Backup job and source discovery now routes the entered URL through the SSRF guard. If your backup server is on a private IP, set ALLOW_PRIVATE_IPS=true.
• Widget config preview now routes the entered URL through the SSRF guard.
• SSRF guard now blocks http://localhost by name.
• Parallel login attempts are now rate-limited correctly.

Fixed

• A config file that parses but has the wrong shape no longer crashes the server.
• An error in a request handler now returns a 500 instead of stopping the server.
• Speed test view now works with a MySpeed or Speedtest Tracker server on a private IP.
• Corrected the Docker socket hint to point to a socket proxy URL.

Full changelog: v1.3.0...v1.3.1

1.3.0

1.3.0 - 2026-07-18

Security hardening, accessibility, and fixes. No breaking changes for normal use.

Added

• Folder app picker and widget multi-select dropdowns can now be operated from the keyboard.
• Toggles show a focus ring when reached by keyboard, and an unavailable toggle is announced with its reason.
• docs/widget-template/: a working widget to copy from.

Changed

• Inline-edit rows open from the value text, not just the pencil, and the pencil's tap target is larger.
• Dock icons show the app name on hover.
• The per-app Health Check toggle now shows as unavailable, with the reason, when Docker Container Health Checks are off.
• Host-IP portMap targets are now SSRF-checked. Mapping to a private IP now needs ALLOW_PRIVATE_IPS=true; container-name mapping is unaffected.

Fixed

• Uploading a custom app icon failed and never applied the icon.
• Saving from two admin tabs at once silently discarded one save; it now reports a conflict.
• Show in Dock stayed usable when the dock was full and then dropped the app; more than four dock apps is now rejected.
• Test Connection and health-check pings hit a different target than the widget fetch; they now follow the same port mapping.
• The badge color picker's last swatch could be clipped on narrow screens.
• The weather widget clipped the bottom of the rain and shower drops.
• IPv6 literal targets now connect correctly.

Security

• SSRF guard now blocks IPv4-in-IPv6 forms of private targets it previously missed.
• SSRF guard now runs after host rewriting, so the checked URL is the one connected to.
• Security headers are now sent on every response, including /icons/.
• Badge headers and URL parameters can be marked as credentials, stored server-side and never returned to the browser or exported.
• Badge values returned by a remote service are now escaped on render.

Full changelog: v1.2.0...v1.3.0

1.3.0-rc.4

1.3.0-rc.4 - 2026-07-18

Fourth release candidate for 1.3.0.

Added

• The folder app picker and widget multi-selects are keyboard operable.
• Toggles show a keyboard focus ring; unavailable toggles say why.
• A widget template to copy from.

Changed

• Inline-edit rows open from the value text with a larger tap target.
• Dock icons show the app name on hover.
• Host-IP portMap targets are SSRF-checked.
• Internal: widget manifests are validated in CI; completed the escape-by-default HTML rendering migration; dead code, comment, and docs cleanup.

Fixed

• Custom app icon uploads no longer fail silently.
• Saving from two admin tabs no longer discards one tab's changes.
• Test Connection and per-app health pings report on the right target.
• The weather widget no longer clips the bottom of rain and shower.
• The badge color picker no longer clips its last swatch on narrow screens.
• Configs with more than four dock apps are rejected rather than silently truncated.

Security

• Live activity badge headers and URL parameters can be marked as credentials, stored server-side and never returned to the browser or exported.
• Security headers (CSP, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy) are now sent on every response, including /icons/.
• The SSRF guard blocks IPv4-in-IPv6 forms of private targets (IPv4-mapped and NAT64); IPv6 literal targets now connect correctly.
• Icon uploads verify the bytes really are a PNG or ICO.

Full changelog: v1.3.0-rc.3...v1.3.0-rc.4

1.3.0-rc.3

1.3.0-rc.3 - 2026-07-17

Third release candidate for 1.3.0.

Added

• The folder app picker and widget multi-selects work from the keyboard.

Changed

• Dock icons show the app name on hover.
• Inline-edit rows open from the value text, with a larger tap target.
• Internal: widget manifests are validated in CI; dead code and comment cleanup; trimmed docs.

Full changelog: v1.3.0-rc.2...v1.3.0-rc.3

1.3.0-rc.2

1.3.0-rc.2 - 2026-07-16

Second release candidate for 1.3.0. Behaviour change: a host-IP port map target is now SSRF-checked. Mapping to a container name is unaffected; mapping to a private IP needs ALLOW_PRIVATE_IPS=true.

Fixed

• Test Connection and health-check pings now probe the same target the widget fetches when a host-IP port map is configured.

Security

• Hardened the outbound request path so the URL that gets checked is always the URL that gets connected to.
• Badge values from a connected service are escaped when shown.

Full changelog: v1.3.0-rc.1...v1.3.0-rc.2