Changelog

Added

• The team is told when a comment is waiting for review. A visitor's comment, or a follow-up from whoever reported, now reaches the repository's channel, so it no longer sits in the queue unseen.
• Whoever reported something and left an address is written to when the team replies, and when the issue on the forge is closed or changes state, as they already were when the team changed a status in the panel.

Added

• Docker and Monitoring: the containers and services in a widget can be arranged by hand. Each one has a grip in the widget's settings, dragged with the mouse or a finger or moved with the arrow keys. Docker keeps the order of each host apart, and a Monitoring list left fully ticked still takes the services you add later, shown after the ones you arranged.
• Docker: a Show new containers automatically switch. Turned off, a container that appears later stays hidden until you tick it, so a widget that shows only a few no longer has to hide every new one.
• The installer says which version is installed and which it is about to install, stops with "nothing to do" when you already have the latest, and takes --reinstall to install it again to repair it.

Changed

• Every widget now shows its name as a pill on the tile's border, the way a section does, and a widget with no name shows no pill. The name is the first field of each widget's settings. Docker, Monitoring, Proxmox and the API widget no longer spend a row of the tile on a heading; Proxmox keeps a slim strip with the node and its meters.
• A Docker, Monitoring or Proxmox widget that had no title of its own keeps the name it showed, written once into its title in the language of the account that owns it. After that it is an ordinary title: change it or clear it. Restoring a backup taken by an earlier version does the same for the widgets it brings back.
• The name on a widget, and on a bookmark that shows its name as a pill, now answers the pointer the way a section's does: the border takes the accent softly when the tile is hovered, and only hovering the name itself lifts it further. It used to light up fully in the accent colour.

Fixed

• Docker: a container you had hidden came back, and lost its name and address, every time it was updated. What is set on a container is now kept under its host and name instead of its ID, which changes whenever the container is recreated. Settings saved before this are read as they were until the widget's settings are saved again; a container updated before that has to be hidden once more.
• Proxmox: only starting a machine and shutting it down gracefully are relayed, as the interface and the documentation say.
• The uninstall command in the documentation did not work when the installer had been piped from curl; it now shows the form that does, and the signing guide says the installer verifies the release signature.

A security and stability release

1.9.3 is about making what is already there harder to abuse and harder to break. It adds no features. It closes weak points in sign-in, sessions, updates, backups and the connections Lastboard makes, and fixes the ways data or settings could end up half-saved. Nothing needs doing on upgrade: your sessions, boards and settings carry over.

Security

• Sign-in attempts are counted reliably: a burst of wrong passwords that arrive at the same moment used to count as one, so the lockout never came. Changing your password, deleting an account and resetting the instance now stop after too many wrong passwords too, per account, so a stolen session cookie cannot be used to guess the password.
• A session belongs to the account, not to its name. A cookie left over from a deleted account can no longer sign in to a new account that reuses the name, and a stale session no longer sends the login page into a redirect loop. Cookies issued by earlier versions keep working until their owner signs out.
• Passwords are hashed at most two at a time, so a flood of sign-in attempts can no longer exhaust the memory of a small server. Passwords can now be up to 256 characters instead of 72 bytes.
• Connections to cloud metadata services are refused when they are made, so a redirect or a hostname that resolves there cannot reach them. A container id is escaped in the Docker path, and the Gotify token travels in a header instead of the address.
• Updates are verified more strictly: each download is checked against the line of the signed checksums.txt that names it, so one platform's archive cannot stand in for another's, a download over the size limit is refused instead of cut short, and each update works in a directory of its own with only one allowed to run at a time.
• Restoring a backup ends every session without touching the signing secret, so a session opened afterwards survives a restart. After a restore, sign in again.
• Answers from a Docker host and from the release server are read up to a size limit. The dashboard background must be an image address, and an avatar or accent chosen at setup follows the same rules as one chosen later.
• The administration panel never changes the administrator's own password (that goes through the profile, which asks for the current one), and an unknown account or a taken name gets a clear answer. The browser no longer allows connections to a time-zone service it does not use.

Fixed

• A backup fails with an error instead of silently leaving out a row it cannot read. It keeps the order a phone shows bookmarks in, and restore errors are translated.
• Deleting a board is a single change that also sweeps its unused icons. A new board always goes after the last one, reordering with a partial list keeps every position distinct, and the first board of an account is created once even when several requests arrive together.
• Saving the monitoring settings is all or nothing, and a failure is reported instead of answering "saved". A preference that fails to save is rolled back everywhere, so the next save does not carry it. The dashboard background is kept when a request does not mention it.
• Deleting a bookmark no longer deletes the icons chosen for Proxmox machines, and storing icons locally no longer undoes an edit made while they were downloading. Credentials typed into a widget before a page reload are moved to the secret store when it is saved.
• Renaming yourself works with the default avatar. Saving a clock keeps its time zone. Board names (50) and project names (64) are counted in characters, so non-Latin names get the full length.
• With the server unreachable and nothing cached, the board is empty instead of showing a tile that is not yours.
• The "Check for updates" button asks the release server again instead of repeating the last answer, the release lookup gives up after fifteen seconds, and only the administrator asks for updates, once per page load.
• The background status check no longer reads every bookmark every fifteen seconds.

Changed

• Several Proxmox hosts are read at the same time instead of one after another, and Docker and Proxmox connections are reused instead of piling up.
• Widgets and pages that poll the server stop while the browser tab is hidden and resume when it is shown.
• The interface holds one HTML escaper and one place that reads API answers and errors, and styles and code nothing used were removed.

A clearer third point on the front page

Changed

• The third point of the front page says what a visitor gets: every report shows where it stands, from new to shipped, in the twenty languages. It used to say that reports can become forge issues, which an installation without a forge never has.

A picture beside every name, and a safer text for the forge

Added

• Replies and comments no longer draw initials. Everybody gets a picture beside their name: one figure in a light grey for whoever reported or commented, and the same figure with its colours turned round and a stronger grey for the team.
• A team member's own picture shows beside their replies on public pages, and in the panel's lists and menu. It is public, like their name already was; somebody who has chosen none keeps the default.

Fixed

• What a stranger wrote is made inert before it reaches the forge. An issue body is read there as Markdown, so a mention notified people, an image loaded from a host the writer chose, a link hid its destination and, on one forge, a line starting with a slash could run a command. The report text and every answer now have those characters escaped, with code left exactly as written.

A new logo

Changed

• A new logo: a viewfinder around the board, with a red dot as the signal. It is the one in the browser tab, the installed app icon, the login and setup pages, the top bar and About.

Docker installs are told about new releases

Fixed

• A Docker install is told about a newer release, and every administrator's load checks

Replies follow renamed accounts, History with open and closed, and the house colours

Added

• The archive tab, now called History, splits the published reports into All, Open and Closed, each with the number it shows. Under Closed, Done and Not done tell a delivery from a report the team turned down.
• In History, a repository's heading folds its reports away and opens them again, and the choice is kept in your browser.

Changed

• The panel is laid on the page's own ground, with its menu and cards one step above it, in both themes, and the light background, the two text greys, the light border and the dark text are the values the rest of the family uses.
• Go 1.27.2 and x/net 0.60.0, which fix the standard-library and HTTP/2 advisories the vulnerability scan reports. The scan now runs before a release is tagged, so a release that reaches an advisory cannot be cut.
• The toolchain and dependencies are up to date: Bun 1.4.3, Docker CLI 29.9.0, buildx 0.38.0, and the Go modules crypto, image, net and SQLite.

Fixed

• A team reply is signed with the name the account has now: renaming an account used to leave its earlier replies under the old name. Replies written before this version are matched to the account that holds their name today, and a rename claims the ones still signed with the name it leaves.

Servers beyond this one, secrets kept apart, and accounts of their own

Added

• A host's agent token is kept in the widget's secret store
• A widget can wear a title on its border, the way a section does
• Monitoring and Proxmox belong to each account, not to the server
• Read another server's health from Glances, Netdata or a JSON endpoint
• Rename and delete live in the manager, beside the drag handle
• The API widget keeps its credentials in the secret store
• The Server Health widget can show another server through Glances, Netdata or JSON
• The Server Health widget refreshes every 5, 10, 30 or 60 seconds
• What a widget keeps secret is stored apart from its content

Fixed

• Editing an imported bookmark keeps its icon

Changed

• Go 1.27.2 and x/net 0.60.0, and the vulnerability scan stops a release before it is tagged
• Update the toolchain and dependencies

A declined idea reads as the rest do

Fixed

• In Spanish, the status of a declined idea is "Descartado", agreeing with "Nuevo", "Planificado", "En curso" and "Entregado" instead of standing out as the only feminine one on the Closed tab.

Closed reports say what the team decided

Added

• On the Closed tab, two switches — Done and Not done — narrow the list to what was shipped or fixed, or to what the team declined or could not reproduce, each with its count. Pressing the one that is on shows both again, and the choice is kept in the address.
• The similar reports offered while somebody types a title now show what the team decided about a closed one, with a line saying a closed report takes no more votes, so it can be read before asking for the same thing again.

Changed

• An idea the team does not take on is Declined and a bug it could not reproduce is Couldn't reproduce, translated by hand in all 20 languages. They were "Not planned" and "Can't reproduce".
• A closed "no" no longer looks like a delivery: a shipped or fixed report is green and solid, a declined one has a dashed edge and a hollow dot. A fixed bug used to be the same grey as a declined idea.

Fixed

• The Lastboard page said its API widget has seventeen guided presets and listed Proxmox among them: there are sixteen, because Proxmox now has its own pages and widgets in Lastboard instead of a preset
• The Lastboard documentation says the same, so the count and the list agree everywhere on the site

Secrets you can tell are saved but never see

Fixed

• The alert token shows as dots and is never sent back
• The Proxmox token secret is shown as dots, with nothing to reveal
• The side panel's close button sits on the header's centre line

Stored secrets show as dots

Changed

• A saved token or secret — a notification channel's token, an organisation's forge token and its webhook secret — is shown as dots: it is there, and which one it is cannot be seen, and there is no eye to reveal it. Write over the dots to replace it, empty the field to remove it, or leave the dots to keep it. The checkbox that removed a channel's token is gone.
• An organisation's forge token and webhook secret are changed one at a time: replacing one leaves the other, and an empty field keeps what is stored. Removing the token disconnects the organisation from its forge.

Fixed

• Saving only the forge token, as the setup wizard does, no longer empties a webhook secret that was already stored.

Anti-abuse, notifications and a grace window

Added

• An Anti-abuse screen under This server: the word list as a form and a list, with edit and remove in each row, a search and pages of ten, how many reports each word has refused, and how many submissions each check turned away, by repository.
• When an administrator rejects a report from the queue, the word that gave it away can be added to the list in the same step.
• A notification channel for the whole server, set once under Notifications and chosen by each repository in its own list. A repository that does not choose it is not affected.
• A Send a test button on notification channels, which says why a message did not arrive: a refused token, an address that does not exist, a service that cannot be reached, no mail relay, or an installation working offline.
• Ctrl+K (⌘K on a Mac) goes to the search box on every screen.

Changed

• The word list matches whole words, so "ass" no longer refuses "class", and finds a word anywhere in a sentence in Chinese, Japanese, Korean and Thai, which have no spaces. Capitals and accents do not matter. A list written for the old matching may need a word or two added.
• A repository's notification form shows the saved address and recipient after saving. The token is never shown; leave it empty to keep the stored one, or tick the box to remove it.
• An answered report stays open to its reporter and to the team for 48 hours after the answer, and the page says until when. Visitors still cannot comment as soon as it is answered.
• A board's card on the front page counts every report it has had, answered or not, instead of only the open ones.
• The reports screen's search shortcut is Ctrl+K instead of "/", and the board page's search uses the same box as the rest of the product.

Fixed

• Usernames can no longer contain <, >, ", ', & or control characters. Accounts that already have them keep their names.
• The address a reporter leaves must be one plain mailbox.
• In a narrow reports pane, the sentence beside the approve, reject and spam buttons was squeezed into a column of a few letters.

Added

• A page for Lastboard Agent, with its own picture, what it does and how to run it
• The website appears in the projects index and on the organization page, with a picture of its own
• A security policy and a contributing note for the repository

Changed

• Lastboard Agent and CodigoSH Web are called by those names everywhere, in the release history too, not by their repository names
• Every project shows its mockup in the project lists and panels
• The social cards carry the CodigoSH mark instead of a typed </>
• The projects subtitle covers every project, the website included: open-source software, public from day one
• The README follows the same sections as the other projects, with a logo and a mockup of several pages

Fixed

• The Lastboard security answer said passwords are hashed with bcrypt; it is Argon2id
• A project that ships only as a container no longer promises a Linux installer
• The privacy answer for Lastboard Agent says what its log holds

A steadier checklist, a working side panel and Ctrl+K everywhere

Added

• Ctrl+K and Cmd+K reach the search box on the status and Proxmox pages
• The note and the markdown tile wear a thicker accent border while open for writing

Fixed

• A checklist box keeps the caret behind it, and every row sits the same distance apart
• The side panel's chart fits its card and its tooltips show

Pictures on a report

A screenshot is often the quickest way to show a bug, so reports can now carry them. Installations update in place — from the panel, the installer or a new image — and keep everything they hold; the update adds the table the pictures live in.

Added

• Pictures on reports. The person reporting can attach up to five screenshots to a report and three to each follow-up, and the team can add three to each reply. Nothing is shown until the team has looked, and it can take out a single picture and approve the rest. The server draws every picture again, so the place and the camera a photo carries are not kept.
• A picture opens large over the page, with the arrows to move between them and Escape to go back.
• A switch per repository for pictures, in its settings.
• Each repository card on the front page shows how many bugs and ideas are open, and the two kinds wear their colours wherever they appear.

Changed

• An answered idea or bug takes no more votes, comments or replies. The thread stays, and reopening the report opens it again.
• Pictures are erased 30 days after their report closes, and at once when a report or a message is rejected, marked as spam or deleted.
• The limits on the words of a report count characters, not bytes: a report in Japanese or Chinese was refused at about a third of what English was allowed.
• After updating, every repository takes pictures. Turn them off in its settings if you prefer.

Fixed

• Pictures can be added to the front page from Safari on a Mac or an iPhone.
• Long words with no spaces, like a pasted address or a log, stay inside the report's card instead of running off it, most of all on a phone.
• A vote or a comment on a report that was folded into another or turned down is refused instead of being accepted and lost.
• A build made between two releases is no longer offered the release before it as an update.

Notes that stay current, a Ctrl+K search shortcut and steadier status dots

Added

• Ctrl+K and Cmd+K put the cursor in the search box
• Icons become real logos on import, travel inside the export, and the format is detected
• The settings show which release each agent host runs

Fixed

• A dot that is already green stays green while it is checked again
• Attribute gopkg.in/yaml.v3 and drop x/exp, with a test that asks the linker
• Container names stay visible when the widget is narrow
• Importing a file builds the dashboard instead of failing on an empty one
• Nothing under /api/ may be kept by a cache
• Reach an agent behind HTTPS, and say so when it refuses the token
• Read Homepage nested groups and real-world files, and say what is left out
• Speedtest Tracker, Prowlarr and Nextcloud presets are no longer beta
• The agent token no longer travels in the request URL
• The native export keeps the groups of a board
• The note follows the board, and saving over someone else's edit asks first

The agent comes as a container image

Changed

• The README's installation is Docker alone: the compose file, and the same thing as a single docker run
• A page for the agent on codigosh.com, and a mark and a showcase image of its own

Removed

• The release binaries, checksums.txt and its Ed25519 signature. None of the releases carries them any more, this one or the earlier ones: the agent is the image at git.codigosh.com/codigosh/lastboard-agent, and anyone running a binary can switch to the image or build from source with Go

Releases you can verify

Added

• checksums.txt is signed with Ed25519, and the README shows how to check the signature with OpenSSL before running a downloaded binary

A new codigosh.com. We rebuilt the site from the ground up to look and feel like the tools it presents: quiet, readable and made with care, in light and dark.

It is still a static site with no cookies, no tracking and nothing loaded from outside, but now everything lives under one roof. Every project has its own page, the releases of all of them share one history, and the documentation of each project is part of the site instead of a separate place: same header, same search, same pages. Below is what changed.

Added

• A new look for the whole site: Bricolage Grotesque for headings, Geist for text and a calmer palette, in light and dark, with the Appearance panel to choose
• A release history graph on the home page and the changelog, where every release is a knob on its project's line, with a year picker and an all-time view
• A page of releases at a time in the changelog, a project dropdown and a timeline whose line swells into a knob for each release
• The documentation of every project is now part of the site itself: the same header, the same pages, search across all of it with Ctrl K, and a menu that keeps one project open at a time
• "On this page" in the documentation, with a line and a knob that follow your reading from the top of the page to its last section
• Project pages with the facts of the project in a card beside the title, in-page navigation, screenshots you can enlarge, install commands for Docker and Linux, and the latest release
• An organization page with our promises, how a release gets to you, the history and the ways to reach us
• Dropdowns, buttons and the footer drawn in the same style across the site

Changed

• The documentation no longer depends on a documentation framework: the same pages, at the same addresses, with search built when the site is
• The header says "Source code" for the link to the repositories, here and in the footer
• The footer is smaller: where to ask, the terms, and the name along the bottom
• The gooey lines are smoother, with no stepped edges

Fixed

• The primary button and the active link in the documentation menu now have enough contrast to be read
• Pages no longer shift while images load
• Headings keep their order on every page, and LastHelp has a documentation index

Only what Lastboard asks for reaches Docker

Added

• The agent says which version it is, on /health and when it starts
• The image reports its own health, so docker ps shows the agent as healthy once it is serving
• A warning at startup when the token is too short, or is the example from the documentation
• Instructions for the release binaries: download, check against checksums.txt, and run without a container

Changed

• Only the parameters Lastboard sends reach Docker, so a leaked token can no longer hold a stats stream open, make the daemon measure every container on disk, or stop one with a timeout of days
• The token stops at the agent and is no longer passed on to Docker
• Built with Go 1.27.1 on Alpine 3.24

A backup only you can open

Added

• Protect a backup with a password: set it when you download, and it is asked for when you restore
• The backup now carries the Proxmox hosts with their tokens, and the monitoring settings with the notification token, so a restore no longer leaves them to be typed again
• Passwords are hashed with Argon2id; an account from an earlier version moves over the next time it signs in, with nothing to reset

Fixed

• A click in the empty space inside a dialog no longer closes it and throws away what was typed
• Shrinking a section moves out the items that no longer fit, instead of squeezing them below its edge
• Under Podman, the in-place update is no longer offered inside the container

Latest projects first on the home page, and support links

Added

• LastHelp joins the projects, with its own page
• Each project shows when it last shipped, in place of stars and forks
• The home page shows the three projects that shipped most recently
• The footer and every project page link to that project's page on the support desk

Fixed

• The changelog no longer widens the page on a phone
• Project pictures are stamped with the version they show, so an updated screenshot reaches people who have seen the page
• Project pages no longer claim "0 issues": the count is gone

Changed

• The Lastboard page describes the whole product, with its picture sizes corrected
• Every dependency is on its latest release, pinned exactly
• The brand files the forge uses are versioned alongside the site

The machines behind your services

Added

• A chip and a memory stick beside the figures
• A duration says both units, so nothing needs dividing
• A hypervisor behind the demo board's bookmarks
• A node says how much memory, and how many cores
• A page that says which service went down with the machine
• A settings screen for the connection
• A summary across every hypervisor, and a way into each
• A summary that says what every hypervisor adds up to
• A tile for the hypervisor, beside what it runs
• A way back to the board, and a band that admits it has more
• Back leaves a full-screen page, not Lastboard
• Fold a node away when you are not looking at it
• Hypervisors first, and a list that opens without moving the page
• Info links to support instead of the forge's issues
• Let a bookmark say which machine serves it
• Let an operator choose the face of a machine
• Match machines to bookmarks by name, with no setting up
• Read a hypervisor without storing anything about it
• The disk and the machines say how much, too
• The header counts what is stopped, the tile says what it costs
• The interface follows the machines to their own hypervisor
• The logo and the project name link home
• The server reads a list of hypervisors, not one
• The settings screen takes a list of hypervisors
• The sheets say what each figure is, and the charts answer the pointer
• The summary becomes a board, one tile per hypervisor
• The summary names what is wrong instead of counting it
• Three figures you can open, and a tile you can click

Fixed

• A check that could not reach the release server no longer says you're up to date
• A checkbox you can see, and a toolbar toggle that stays put
• A hypervisor card says its shape on its own line
• A node card shows percentages only, the sheet shows the figures
• A node's footer says what its numbers are
• A stopped machine stays where it is, and is seen anyway
• A sweep that only counted items was deleting the machines' icons
• A tile shows its memory figure instead of an ellipsis
• All three lists open the same, and none of them moves the page
• An outage keeps its own start whatever range you pick
• Ask the hypervisors when the list is opened, not only when saved
• Dress the widget in the styles the app actually has
• Drop the helper the host list left without callers
• Durations are spelled out, in one place
• Every dialog on the one recipe, checked rather than assumed
• Every open list gets the same height, not just the first
• Every stopped machine in a soft red
• Fetch the icon catalogues when the picker opens
• Find a machine's bookmark on every board, not the open one
• Fit the three theme options where two used to go
• Four things the approved design had and the page did not
• Give a phone its way back to the settings
• Give the search the whole bar on a phone
• Give the widget a width of its own, or it has none
• Keep the logout where it was, and only one settings icon
• Lock the bar behind the page, as the status page does
• Make room for the longest labels on a desktop too
• Meters read green, amber, red - never the brand accent
• Notice when the dictionary is not from this build, and heal it
• One bar at the top, not two
• One colour rule for every bar on the page
• One magnifier that opens the search and closes it again
• One name per section, not two
• Reorder all the boards or none of them
• The beta setting is a channel, and it says what that costs
• The bookmark mark moves to the corner, beside the status dot
• The Data panel counts bookmarks, so it says bookmarks
• The labels of a chart follow the chart, not the language
• The lists just open, and open on a phone at all
• The machine field wears the app's dropdown, not the system's
• The magnifier leads the expanded search
• The modal stops moving while the steps run
• The panels that float take the surface meant for floating
• The summary's figures stop pretending to be buttons
• The timeline stops re-popping every step at the last one
• The trend lines take the meter's colours too
• The update card on the dark theme, without rings or a brown wash
• The update card's glow no longer ends in a straight line
• The update card's shadow no longer draws rings in the dark theme
• The updater's success line existed in no language at all
• The widget's dot says on or off, like the page's

Changed

• Teach the stored data which Proxmox it means
• The hypervisors become a list with a dialog behind it
• The status page wears the same clothes as the Proxmox one
• Staticcheck runs before a tag, not after one
• Update every toolchain and dependency to its latest release
• Update what was behind, and guard the pins that can drift

Removed

• The Proxmox preset of the API widget, now that Lastboard speaks Proxmox itself

The first stable release

The first stable release of LastHelp, a self-hosted feedback portal that speaks to your forge. There is no earlier stable to compare it with, so these notes describe what LastHelp is rather than what changed. Installations that followed the betas update in place — from the panel, the installer or a new image — and keep everything they hold. Two things are not there yet: a bridge to Bitbucket, and a screen in the panel for the anti-abuse word list and the refusal counts, which work and are set and read as the documentation describes.

Added

• Reporting without an account. Anybody can send a bug or an idea from one form. What they get back is a secret link to their own report, which is why no sign-up is needed.
• Bugs and ideas as two journeys. A bug is asked which version and how to see it happen, and is not voted. An idea is one sentence, gathers votes and ranks by them.
• Similar reports while typing, so the same problem gathers votes and comments instead of duplicates.
• A public board per repository, with open and closed reports apart, filters and search kept in the address, and a page at a time.
• A roadmap nobody maintains. Three columns built from the state of each report, so it cannot go out of date.
• Reports, the team's one screen. Every repository you work on in one list, with the report beside it: publish, reject or spam with a key each, edit its words, change its status, reply, edit or delete any comment, merge a duplicate, or open or link a forge issue. The same screen is the archive of every report ever sent.
• An overview of the last thirty days, the most wanted ideas, the newest reports and the work per repository, each number leading to the list it counts.
• Organisations and repositories with two levels of trust. A lead runs an organisation, its forge token and its repositories. A collaborator triages the repositories they are given and never sees the token. Both can carry an icon.
• A front page you compose from bands of modules — the repositories, the most voted ideas, what was resolved, statistics, links, and your own words and images — arranged on a grid in the page itself.
• A bridge to GitHub, GitLab, Gitea and Forgejo, including forges on your own network. A report becomes an issue or is attached to an existing one, and follows it when it closes or reopens. Work goes through a queue with backoff, so a forge that is down delays an issue instead of losing a report. Running without a forge is supported.
• Notifications for the team through ntfy, Gotify, a webhook or mail, per repository. Reporters can follow an Atom feed that needs no account, or leave an email when a mail relay is configured; the address is deleted when the report closes.
• Anti-abuse without a third party. A signed single-use form token, a timing window, a honeypot, rate limits by address and network block, duplicate and link heuristics, an operator word list, and a breaker that closes a repository for a while. Nothing is published without a person, and every refusal is counted by layer.
• Signed releases and a verified updater. Checksums are signed with Ed25519. The updater in the panel checks the signature and the checksum, makes the new binary prove it runs, refuses one older than the database and takes a backup before it swaps, showing each step.
• One binary, one SQLite file. A one-line installer with a hardened systemd service, --uninstall and --purge, and Docker images for linux/amd64 and linux/arm64.
• Twenty languages, translated by hand, with right-to-left layout for Arabic, Persian and Urdu.
• Installable as an app from the browser when served over HTTPS.

A mark of its own, and a theme that follows yours

Added

• A mark of Lastboard's own, drawn as vectors
• Follow the device, for whoever asks it to
• Let people remove Lastboard without doing it by hand
• Tell a blip apart from an outage in the activity bar

Fixed

• Give the login and setup pages a theme colour of their own
• Label the latency axis for the span it covers
• Let the status bar follow the theme the user picked
• Make the activity bar follow the range you pick
• Open the device's own colour picker
• Paint the splash screen in the theme the app actually opens in
• Say "30 days" where the scale said "720h"
• Shrink the avatar the wizard sends, like the settings panel does
• Stop painting the Android status bar in the accent colour
• Stop the installer from taking down what it did not install
• Verify the signature, which the installer never did

Added

• Give doc pages a social card and the site's font preloads
• Give the documentation the same craft as the rest of the site
• The docs header carries the same sections as the rest of the site
• The documentation ends and looks like the rest of the site
• The new CodigoSH isotype, and a source big enough for it

Fixed

• An updated screenshot actually reaches people who have seen the page
• Bind global listeners once instead of on every navigation
• Don't abort the script on an empty cleanup commit
• Drop the docs link on projects that ship none
• Fail when Forgejo is unreachable instead of publishing mock data
• Link internal pages at their canonical URL
• Nest autogenerate inside a group's items
• Point the hero image at its current path
• Resolve doc cross-references to their published route

Changed

• Remove dead code and clear the remaining check warnings

Installs as an app, and speaks your language

Fixed

• Ship the icons and the manifest link that installing needs
• Tell the login and setup pages what language they are in

The demo page renders again

Fixed

• Restore the demo page, blank since 1.7.1

Settings reachable on tablets in landscape

Fixed

• Restore access to settings on tablets in landscape

Security and correctness fixes

A maintenance release. Everything below applies to an existing installation the moment it updates — no configuration changes, no migration steps.

Fixed

Security:

• The login lockout could be evaded behind a reverse proxy. A proxy appends to X-Forwarded-For rather than replacing it, so the leftmost entry is written by whoever is calling. Lastboard read that one, which let an attacker hand themselves a fresh address on every attempt and never trip the five-try lockout. It now reads the entry your own proxy added. If requests reach Lastboard through more than one proxy, set TRUST_PROXY_HOPS.
• A request for a missing file under /dist/ or /styles/ returned the application shell without a session. Authentication no longer exempts anything by path prefix.
• The monitoring notification URL and token were readable by any account. They are the administrator's credentials for their own alert channel; only an administrator receives them now.
• The instance metadata service is refused on every URL the server fetches for you, including the background monitor. Pointing widgets and bookmarks at your own network is unchanged — that is what Lastboard is for.
• The API widget no longer forwards headers that impersonate the caller (Cookie, the X-Forwarded-* family). API keys and every preset still work.
• Logging in and first-run setup now refuse writes the browser reports as coming from another site, and the WebSocket honours a forwarded host only when TRUST_PROXY says there is a proxy in front.
• Request bodies are capped everywhere, the address table behind rate limiting can no longer grow without bound, and the release key is now a list so it can be rotated without stranding installations that are behind.

Reliability:

• Shutting down no longer cuts background work off mid-write. A restart could previously interrupt the icon migration or the monitor while it was writing.
• A handler that panics now answers with an error instead of dropping the connection with no status.
• Lastboard refuses to open a database written by a newer version, rather than migrating it downwards.
• Settings that cannot be read are reported at startup: TRUST_PROXY=True, with a capital letter, silently meant the opposite of what it looked like.

Languages:

• Right-to-left languages are laid out right to left. Arabic, Persian and Urdu were translated but rendered left to right.
• The page now declares the language it is actually in, which is what a screen reader announces and what the browser hyphenates by. It always said English.
• Dates and numbers are formatted in the language you chose, not the browser's, and values inserted into a sentence keep their punctuation in place.

Changed

• Releases are reproducible. Two builds of the same source now produce identical binaries, so anyone can rebuild a release and compare it against the published checksums. The recipe is in the security documentation.
• The Docker and monitoring widgets refresh their list instead of rebuilding themselves on every tick, so an open popup stays open and a scrolled list stays where you left it.
• Bookmark health checks are probed in bounded batches rather than all at once.

Your board stands on its own

Added

• Add a widget for the services you monitor
• Bring in the icons a board was already using
• Keep demo instances out of search results
• Keep picked icons on your own instance
• Move every setting into the widget's config screen
• One list of the containers you chose, from every host
• Open a container's service from its row
• Pick a host on the left, configure it on the right
• Read the address a container labels itself with
• Show the widgets the demo never had
• Store the icon when a bookmark or container is saved
• The brand orange is the default accent, everywhere it was blue
• The same status dot the monitor widget uses

Fixed

• A task list's boxes are meant to be untickable
• Accept the addresses Docker itself uses
• Build the split from the form's own primitives
• Dialogs opened from Preferences dim what is behind them
• Fill the telemetry cell while its reading is on the way
• Keep test and CI commits out of the release notes
• :latest is the stable release again, not a beta from August
• Let the Data panel read as three choices, not one wall
• Make clearing the history say what it clears
• Make the stable path answerable without a terminal
• Monitoring stops showing settings it hasn't read yet
• Name the widget, align its columns and use the house dropdown
• One name for the default dashboard, in English, on every install
• Quotes and horizontal rules come out of the widget again
• Restore the vertical spacing every settings screen had lost
• Saving a Notepad's settings no longer erases the note
• Say where the icons come from even when nothing is pending
• Show one host's containers at a time
• Start the picker clean every time it opens
• Stop cutting container addresses in the settings screen
• Stop the release titles from becoming features
• Stop the width rule from collapsing the toggle switches
• The port in the example address follows the connection type
• The ports column takes what it needs and the name keeps the rest
• The preferences panel uses the width it has
• The settings window slides in again

Changed

• Ask who you are without waiting for the locale file
• Fold Alerts into Monitoring and stop over-explaining
• Give every widget the same header
• One settings window, at one size
• Read a host's container stats in one request
• Read the token in one place
• Resolve picker results in one place
• Stop rebuilding every widget on each re-render
• Summarise the overview in the database
• Drop nine strings nothing asks for any more
• Translate the monitoring widget into every locale

Update window, mobile scrolling and UI polish

Added

• Let the API widget's view be chosen explicitly
• Put the whole update behind one modal with a timeline
• Report the update progress step by step

Fixed

• Degrade gracefully on an unexpected weather payload
• Drop the ignored User-Agent on the geocoding request
• Fail the build when asset sync fails
• Flip the forecast tooltip when the top bar would cut it off
• Keep the clock working on an unusable time zone
• Let config modals scroll without clipping select dropdowns
• Let the dashboard scroll down to the last item on mobile
• Make the colour picker usable with touch and screen readers
• Name an expired session instead of blaming the update
• Prune history on startup and forget deleted monitors
• Refresh the starter dashboard for new installs
• Reject setup early and cap request bodies
• Restore the dark autofill colours in every text field
• Stop the scrollbar flashing when a dialog opens, and cover the rest
• Stop the scrollbar flashing when a widget dialog opens
• Tolerate a missing build stamp outside the bundler

Changed

• Define the shared style primitives in one place
• Drop the shared input rule that overrode the components
• Make locale files cacheable
• Stop embedding duplicate and unused assets
• Unify motion curves, dialogs and inputs
• Describe the update window
• Drop an unused component and its dead translations
• Lay the API widget's advanced form out in two columns
• Make the release script fail safely and preview itself
• Stop truncating long select labels and drop the native resizer
• Translate the update window into every locale

Added

• Six more service presets for the API widget — Proxmox VE, Home Assistant, Uptime Kuma, Overseerr/Jellyseerr, Bazarr and Prowlarr. A preset can now ask for one extra detail on top of the base URL and credential — the node, entity or status page it should read — which is what these services need to point at something specific.
• A search box in the service picker — the list holds seventeen services now, so you can type the name instead of scrolling for it.
• Uptime monitoring in the live demo — the demo dashboard shows the status page, per-service latency history and the hover tooltip, with one service in an outage so the feature reads at a glance.

Changed

• The API widget documentation covers the extra preset field, and explains why an endpoint that answers with a top-level JSON array cannot be rendered as a list.
• The Go module path now points at this repository instead of the project's former home.
• The updater's download, checksum and archive-extraction steps are covered by tests, as are the colour picker's conversions.

Added

• 1.6.0 beta cycle: cross-dashboard item moves, generic API widget with presets, uptime monitoring with history and alerts, Homepage/Dashy import and native export, and a card motion system
• Accept dashboard_id in UpdateItem to move items
• Add 8 more service presets
• Add a Move action to the reorder sheet
• Add an Open Collective donation link to About
• Add append-only monitor_checks history store
• Add block auto-place primitives
• Alerts via ntfy/Gotify/webhook
• Always-on backend scheduler
• Arrival highlight after moving between dashboards
• Auto-refresh the open history drawer
• Bucket the heartbeat across the whole range
• Built-in uptime monitoring, a generic API widget, cross-dashboard moves and Homepage/Dashy import
• Bulk-move items via a kebab menu and topbar selection
• Clear-data action, Exit button, wider list
• Coordinated ranges and Uptime-Kuma-style hover
• Dissolve cards on delete
• Exclusive topbar modes and a donation link in About
• Full-screen status page with shared detail
• Generic API widget (metric mode)
• Group the service picker by category
• Guided service presets (AdGuard, Paperless, Immich)
• Import UI + materializer + native export button
• Keep topbar, redesign list rows, red clear menu
• Latency chart, incidents and range selector
• Make edit, settings and the status page exclusive modes
• Materialize newly-created cards
• Move bookmarks and widgets between dashboards
• Move sections between dashboards with their subtree
• Native YAML export + competitor parsers
• On/off toggle and topbar status icon
• Per-item history and uptime endpoint
• Redesign toasts (bottom-center, actions, progress bar)
• Rich hover tooltip on status dots
• Server-side fetch endpoint for the generic API widget
• Settings endpoint for mode and interval
• Status-checks toggle in settings
• Status-history detail drawer
• Status-page overview of all monitors
• Support list mode via array path extraction
• Support non-selectable category headers
• Timed probe and monitored-item enumeration
• Uptime-Kuma-grade detail redesign
• Visible board entrance + stronger create/move/delete cues

Fixed

• Allow selecting an option with an empty value
• API config polish and config-on-add
• History drawer crashed on services with no outages
• Invalid Date in history timestamps
• Probe the URL stored in bookmark content
• Robust positioning, centered callout, click-to-toggle
• Stop run-together changelog headers
• Use the panel's own field styling for notify URL/token

Changed

• Dedicated Data section, disambiguate backup vs import
• Drawer footer and modal-style close button
• Recent-beats heartbeat like Uptime Kuma
• Split Monitoring and Notifications sections
• Chore(lint): modernize remaining b.N benchmarks to b.Loop()
• Chore(lint): satisfy sqlrowserr and modernize analyzers
• Clarify that new dashboards are created from the Add menu, not the switcher
• Docs(changelog): reflow historical entries to the correct formatting
• Docs(readme): cover the API widget, monitoring and import/export
• Document API widget, monitoring, dashboards, import/export and preferences
• I18n(dashboard): clarify move picker title as 'Move to… (Dashboard)'
• I18n(dashboard): translate the move-to picker into all locales
• Revert(mobile): drop move-to-dashboard from the reorder sheet
• Show the Add (+) menu when creating dashboards and bookmarks
• Style(monitoring): wider, column-aligned status-page list
• Use the new product mockup as the README hero

Added

• Earlier font loading and a smoother hero animation

Changed

• Let the compositor run the hero pulse
• Preload the mono face too, it is above the fold

Added

• Correct 404s, stricter security headers, and lighter icons, fonts and screenshots
• Publish llms.txt
• Send HSTS and a content security policy

Fixed

• Answer unknown paths with a real 404

Changed

• Cache assets in tiers instead of five minutes for everything
• Correct the language setup, docs sync and scripts
• Give the landing screenshots a srcset
• Preload the two faces above the fold, keep fonts out of the CSS
• Size the brand mark for each place it is used

Added

• Self-hosted fonts, optimized landing images, and consistent third-party licensing

Fixed

• Stop run-together changelog headers

Changed

• Add OFL notices for bundled fonts and declare license
• Align attribution with the CodigoSH convention
• Optimize project landing screenshots via astro:assets
• Self-host fonts with @fontsource, drop the Google Fonts CDN

Added

• Derive a meta description from each doc's first paragraph
• Reframe the hub around a growing suite of self-hosted tools
• Reusable landing template with editorial content
• SEO overhaul: reusable project landing template, a full Lastboard landing, auto-generated documentation meta descriptions, and a suite-first home

Fixed

• Cap screenshot height so portrait shots don't dominate
• Detect project licenses from the LICENSE file (Forgejo API omits them)
• Install git before checkout so the release job has a real repo
• Mockup hero, uniform screenshot gallery, correct license
• Replace 'all rights reserved' with an open-source footer notice
• Run the release job on node:20-alpine so checkout works
• Use English copy in fallback project data

Changed

• Add Apache-2.0 license to align with the other CodigoSH repos
• Fix run-together section headers in the 1.2.0 entry

Added

• Accessibility improvements for modals and keyboard navigation
• Clearer, consistent save model in preferences
• Ed25519 release signing, verified in the auto-updater (OPS-02)
• Enable release signing (embed public key) + sign verify mode
• Fix profile editing on upgraded databases and require signed updates
• Improve modal and keyboard accessibility
• One honest "Saved" per auto-saved preference
• Quieter WebSocket reconnect logging
• Redesigned preferences panel with auto-save and consistent labels
• Regroup preferences so every card says what it holds
• Require a valid signature on every update (OPS-02)
• Security and reliability improvements with updated dependencies
• Signed updates, security hardening, accessibility and a redesigned preferences panel

Fixed

• Accept X-Forwarded-Host in WS origin check for reverse proxies
• Body limits, IDOR checks, proxy-header gating and robustness
• Dispatch retention prune after a successful release, not on tag push
• Drop script-src 'unsafe-inline', use a per-request nonce (SEC-06)
• Escape user-controlled values across templates (XSS hardening)
• Harden WebSocket hub and validate Markdown link schemes
• Quick wins — healthcheck PORT, install RED, noopener, strings.Contains
• Quieter WebSocket reconnect logging
• Restore dropped column migrations so upgrades never break
• Sanitize Notepad content on load (XSS-01)

Changed

• Add shared escape helpers and harden sanitizer URL scheme
• Drop now-unused serveFile helper
• Drop unnecessary 'as any' casts in BookmarkGrid (CAL-03)
• Migrate inline event handlers to addEventListener (CSP step 1)
• Add .env.example documenting all runtime variables (OPS-01)
• Add -race, govulncheck and staticcheck to the test workflow (TEST-04)
• Build the frontend in the security job before govulncheck/staticcheck
• Chore(deps): bump golang.org/x/net to v0.53.0 and Go to 1.26.5 (govulncheck)
• Chore(settings): drop the leftovers of the removed density slider
• Chore(test): use b.Loop() in crypto benchmarks
• Cover auth middleware, WS hub and Docker client (TEST-02)
• Docs(go): clarify migration ordering and host-vs-cgroup telemetry (CAL-04/05)
• Make NOTICE match what the project actually ships
• Revert(api): DeleteItem stays idempotent (undo ROB-06 404)
• Revert(api): keep IsSecureRequest lax on X-Forwarded-Proto (undo SEC-02)
• Sync guides with the current settings panel and update path
• Trim credits to licence-required attributions

Added

• Content widgets fill their tile (no redundant card padding); docker widget 5x3 for a legible container list
• Demo telemetry widget uses its real 1x3 size
• Fix mobile edit sheet (eye toggle, alphabetical hidden) and demo clock, status pings and Docker update notice
• Fixed 3x2 size and a 6-day forecast
• Fuller, tidier dashboards with more sections and bookmarks
• Make all widgets and multiple dashboards work without a backend
• Markdown widget uses interior space (reduced padding); demo Home layout with real widget sizes
• Mobile bookmark visibility toggle and a revamped interactive demo
• Notepad read-only padding and a fuller, tidier demo with more sections and bookmarks
• Notepad toolbar docked inside the widget (no more overflow in edit mode)
• Refresh seed content with two dashboards and modern icons
• Revamped interactive demo (all widgets, two dashboards, modern icons) and mobile bookmark visibility
• Tighten widget padding to use the interior space
• Toggle bookmark visibility from the reorder sheet
• Verify the automated release/image retention pipeline end-to-end
• Weather widget fixed 3x2 with 6-day forecast, and a leaner curated demo at real widget sizes

Fixed

• Clock size, green status pings and Docker update notice
• Dock the toolbar inside the widget
• Give the telemetry widget its real 1x3 size
• Let content widgets fill their tile
• Minimal padding in read-only mode
• Repair eye-toggle, sort hidden alphabetically, shorten label
• Size the welcome markdown to its content and rebalance Home

Changed

• Docker widget at 5x3 for a legible container list
• Leaner, curated dashboards at real widget sizes
• Add automated release/image retention (prune-releases)
• Add bookmarks guide covering mobile visibility and ordering
• Correct outdated details and remove broken footer nav
• Fix ineffective .gitignore patterns
• Point README documentation links to codigosh.com
• Remove deployment platform reference

Added

• Signature node-network background: a living constellation that adapts to the theme and reacts to the cursor
• Appearance panel to customize theme (light, dark, system), font (including the accessible OpenDyslexic), text size and layout width, all persisted and applied before first paint
• Current version badge on each project card
• Space Grotesk display typography for a distinctive visual identity
• Sponsor shortcut in the header

Changed

• Redesigned the homepage around CodigoSH as a collective, presenting the projects as nodes in the network
• Promoted the icon button to a shared UI utility

Fixed

• Keep the mobile menu button hidden on desktop and restore the menu toggle
• Removed deployment-platform references and dead internationalization code

Added

• Localized, informative update error messages

Fixed

• Log the underlying cause when download/checksum fails
• Publish the Forgejo release as draft until assets are uploaded
• Show real, localized messages when an update fails

Changed

• Ci(forgejo): revert upload-artifact to v3 (v4 unsupported on Forgejo)

Added

• Minor updates

Fixed

• Normalize release notes to Keep-a-Changelog format

Changed

• Extract pure i18n/icon-search logic into testable helpers
• Ci(forgejo): drop dead develop branch triggers
• Ci(forgejo): run full frontend test suite and bump upload-artifact to v4
• Docs(changelog): remove deployment platform references
• I18n: translate remaining English phrases (el, ur, hi, fa, id, ar, bn)
• Style(widgets): capitalize clock/weather text instead of uppercase
• Test(api): add characterization tests for UpdatePreferences, PerformUpdate guards and compareVersions

Added

• Full organization website: projects showcase, per-project pages, documentation, changelog, and organization sections
• Docs-as-code pipeline: sync project documentation from each Forgejo repo at build time
• Dynamic OpenGraph images at build time with CodigoSH brand identity
• Changelog page aggregating stable releases from all showcase projects
• Automatic release notes backfill from each repo's CHANGELOG.md when a release body is missing
• Project filter pills on changelog, latest release chip on homepage, nav dot for recent releases
• Open Collective support section and footer link
• SEO: JSON-LD structured data, sitemap, canonical URLs, web manifest
• Release script and Forgejo Actions workflow

Changed

• English-only site
• CodigoSH brand orange (#e8520e) as accent color throughout
• Forgejo API reads anonymously — no token required for public repos
• Self-hosted static site served by Caddy

Added

• Initial release of Lastboard Agent — Docker API proxy for the Lastboard dashboard

Fixed

• Correct catch-all routing in Go ServeMux
• Make Docker API version transparent: forward client version to daemon
• Fix proxy memory leak for streaming endpoints

Changed

• Change default port from 2377 to 2375
• Harden agent binary: strip symbols, trim paths, no CGO
• Migrate CI to self-hosted Forgejo Actions

Added

• Block the in-app updater when the binary isn't writable
• Optional unprivileged execution via PUID/PGID

Fixed

• Preselect profile, stop toggle-close, remove section-switch zoom

Changed

• Extract templates and stylesheets from components
• Remove dead types and tighten any usage
• Split long handlers into cohesive helpers
• Add native characterization tests for core logic
• Apply gofmt (struct tag alignment, Go 1.26)
• Compile the cmd/lastboard package instead of main.go only
• Document PUID/PGID and unprivileged-mode updates

Added

• Add mobile reorder — drag-to-reorder bookmarks on touch devices
• Eliminate all 40 ts-ignore directives via proper type declarations
• Fix gopls warnings: unused params in serveLoginPage/serveIndexDemo and tagged switch on dbTheme
• Fix section drag and WebSocket server timeout
• Fix static asset gzip compression and immutable cache headers
• Improve status dots, notepad dock UX and health check resilience
• Minor updates
• Security hardening: zip-bomb cap, stricter file/dir perms, full cookie flags on logout, errcheck fixes in update flow
• Show skeleton cards immediately on page load instead of blank screen
• Stable release 1.5.1 - auditoria QA completa, Go 1.26.2, security hardening
• Test release for update system verification
• Upgrade Go 1.26.2, eliminate 49 unused variables/imports, enforce noUnusedLocals in tsconfig

Changed

• Batch health checks, modal blur, faster boot sequence
• Rename FORGEJO_TOKEN secret to CI_TOKEN

Added

• Create and manage multiple dashboards independently

• Set any dashboard as default

• Each dashboard has its own widgets, layout, and background

• Full CRUD via a clean management interface

• Per-dashboard background image with live preview

• Auto-resize and compression to keep storage lean

• Available in dashboard settings

• Monitor and manage Docker containers directly from Lastboard

• Real-time stats with concurrent chunked polling

• Optimized sequential queue to prevent 429 rate limiting and UI flicker

• Protection against accidental stop on the Lastboard Agent container

• Single preference for metric/imperial replacing per-widget config

• Applies across Weather, Telemetry, and all relevant widgets

• Optional city name display with native translations

• Blank state when no city is configured

• Syncs widget config from store on item-id change

• Opt-in persistent login for 30 days

• Translated across all 20 supported languages

Starting with v1.5.0, Docker images are built for linux/amd64 and linux/arm64 natively (no QEMU emulation):

docker pull git.codigosh.com/codigosh/lastboard:latest

Tags: latest (stable), beta (pre-release), vX.Y.Z (pinned)

Fixed

• Fixed version not showing correctly in Settings > Info (now injected at build time via ldflags)
• Fixed demo mode crash (TypeError: o.find is not a function) on bootstrap — /api/dashboards now correctly returns an array
• Fixed wrong-language strings in zh, fr, and ru locales
• Fixed avatar upload causing LocalStorage quota errors (client-side resize before storage)
• Fixed Weather widget showing errors on temporary network failures (silent retry up to 2x before showing error)
• Fixed DOM thrash on Weather widget stats updates (smart diffing)

Changed

• Migrated CI/CD from GitHub Actions to self-hosted Forgejo Actions (git.codigosh.com)
• Added integration test suite: auth, dashboard, user, system handlers
• Removed 62 unused i18n keys (from 452 → 390)
• Simplified role system to admin / user only (no more stale administrator references)