Node.js 24.22.1, xterm.js 6, and tabs that survive a restart
What's Changed
| Area | Change | Issue | PR |
|---|---|---|---|
| Security | Node.js 24.22.1, the October 2026 security release (1.2.0 runs 24.8.0). It fixes a Brotli decoder overflow (CVE-2026-111497) that DumbTerm exposed before login | #31 | #35 |
| Security | Every npm dependency is at its latest version, so npm audit goes from 8 findings (1 critical) to 0
| #31 | #35 |
| Security | Before login, a malformed WebSocket cookie, a blocked origin with ALLOWED_ORIGINS set, or a shell that fails to start could crash the whole server. All three are fixed, and a malformed PIN request no longer returns a stack trace
| #35 | |
| Terminal | xterm.js 6: WebGL rendering, with the DOM renderer as the fallback (xterm.js 6 removed the canvas renderer) | #31 | #35 |
| Terminal | Insert mode and other ANSI modes work | #34 | #40 |
| Terminal | Fonts and Starship's Nerd Font glyphs load under a BASE_URL sub-path
| #32 | #36 |
| Sessions | An open editor (vim, nano, less) is no longer saved into the session | #38 | #42 |
| Sessions | The last command and its coloured output are kept | #39 | #43 |
| Sessions | A restored tab's new shell no longer inherits the old program's terminal modes, and after a reload the idle prompt is no longer shown twice | #34 | #40 |
| Restarts | docker stop shuts down cleanly with exit code 0, instead of being killed after 10 seconds
| #33 | #37 |
| Restarts | After docker restart or docker compose up -d, every open tab reconnects by itself with a new shell. exit still ends a tab
| #41 | #47 |
| Restarts | Closing a tab ends its shell on the server | #41 | #47 |
| Updates | Browsers pick up new versions: the service worker fetches from the network first and removes old versions' caches | #35 | |
| Docker | A Run workflow button rebuilds the published image without the build cache, picking up Node.js and Debian security patches without a code change | #35 | |
| CI | A test suite (160 tests) and CI on every PR: tests on Node.js 24, the image build, a Node.js 24.22.1+ check, and the tests run again inside the image | #35 | |
| Docs | The README matches xterm.js 6's addons and the Node.js 24 requirement | #35, #49 |
Release PR: #48 · Full Changelog: v1.2.0...v1.3.0
Behaviour changes
| 1.2.0 | 1.3.0 | |
|---|---|---|
docker-compose.yml
| Builds from source | Runs the published dumbwareio/dumbterm:latest. The build section is still there, commented out
|
| Server stopped and not restarted | Tabs said "Connection closed normally." at once | Tabs retry for about 30 seconds, then say "Press any key to reconnect, or refresh the page." |
| Closing a tab | Its shell kept running until the page was reloaded | Its shell ends right away |
| Renderer fallback | Canvas | DOM. The terminal also fits inside its padding now, so it is one column and one row smaller |
| Local development | Node.js 20 or newer | Node.js 24 or newer |
Upgrading
| Install | How |
|---|---|
| Docker Compose | docker compose pull && docker compose up -d (Compose doesn't pull a newer latest by itself)
|
| Docker | docker pull dumbwareio/dumbterm:latest, then remove and recreate the dumbterm container
|
| Local | git pull origin main && npm install, on Node.js 24 or newer
|
| Roll back | Use dumbwareio/dumbterm:1.2.0
|
After updating:
- Open tabs reconnect on their own, and saved tabs carry over.
- Reload the page twice. The first reload still comes from 1.2.0's cache; the second loads 1.3.0, and the footer shows v1.3.0.
- Still on v1.2.0? Hard reload with
ctrl shift rorcmd shift r.
Known issues
| Issue | |
|---|---|
| #44 | A prompt can show twice after a Tab completion listing when the command wraps |
| #45 | Mouse input in xterm's default (non-SGR) encoding doesn't reach the shell |
| #46 | A shell that fails to start says "Connection closed normally." |
| #50 | Tabs left open across a future upgrade get no update prompt (reload to update) |
| #51 | The offline cache can end up incomplete if an asset fails to load during an update |
Please let us know if you run into any issues
Thanks and stay dumb! 🚀
What's Changed
- Node.js 24.22.1 security release, all dependencies to latest (xterm.js 6), crash fixes and CI by @gitmotion in #35
- Serve fonts and pages correctly under a BASE_URL sub-path by @gitmotion in #36
- Shut down gracefully on SIGTERM/SIGINT, and let docker stop reach node by @gitmotion in #37
- Stop swallowing SM/RM so insert mode works; keep terminal modes and idle prompts out of saved sessions by @gitmotion in #40
- fix(terminal): don't save an open editor's screen into the session (#38) by @gitmotion in #42
- fix(terminal): keep the last command and its coloured output in saved sessions (#39) by @gitmotion in #43
- fix(terminal): reconnect tabs after a server restart by @gitmotion in #47
- docs: drop the removed canvas addon from the README by @gitmotion in #49
- v1.3.0 by @gitmotion in #48
Full Changelog: v1.2.0...v1.3.0