What's Changed
- docs: add Pangolin setup to the Traefik section by @GilbN in #328
- feat(security): page, filter and explain the alert history by @GilbN in #329
- ci: pin the backend TimescaleDB service to 2.30 by @GilbN in #334
- chore(deps): bump the python-minor-patch group across 1 directory with 4 updates by @dependabot[bot] in #332
- chore(deps): bump the frontend-minor-patch group across 1 directory with 14 updates by @dependabot[bot] in #335
- fix(deps): update aiohttp to 3.14.5 and certifi to 2026.10.23 by @GilbN in #336
- fix(analytics): drop AS8100 from the vendored hosting-ASN list by @GilbN in #337
- chore(deps): bump litestar to 2.25.0, advanced-alchemy to 1.12.0 and ty to 0.0.91 by @GilbN in #338
- fix(deps): require brotli 1.2.1 for CVE-2026-111497 by @GilbN in #339
- Release v0.22.0 by @GilbN in #340
Added
- The README's Traefik setup has a Pangolin section. It covers the fields to keep in Pangolin's access log and how to get the visitor's address in the log.
- Security > Alert history can be filtered by IP and by up to five scenarios. The Scenario dropdown lists the scenarios of the newest 500 alerts in the window with their counts, and the alert sheet has a "Show only this scenario" button. Back-to-back alerts of the same kind from one IP collapse into one row that expands. On phones the filters sit in a Filters drawer.
Changed
- Security > Alert history shows the alert kinds as tabs with an explanation of each, and "Detections" is now "Log scenarios". An empty WAF or Bot detection view says what that kind needs.
- Security > Alert history shows the bans the bot challenge raises under Bot detection, marked "Bot ban". Rejected submissions are now marked "Bot rejected".
- Security > Alert history has an Outcome column that says what each alert did, such as "Ban, active" or "Alert only". The Banned badge next to the IP shows the IP's current state.
- Security > Alert history says which settings it needs when CrowdSec machine credentials are missing. Before, the Security page left the card out.
Fixed
- AS8100 no longer gets the Hosting badge. It used to belong to QuadraNet and now belongs to Splice Internet, an Australian residential ISP.
- Security > Alert history stopped at 50 alerts. "Load older" now loads up to 1,000 alerts from the selected window. Filter by IP or scenario to go further back. The list stops refreshing while older alerts are loaded, and "Back to newest" returns to the latest alerts and turns refreshing back on.
Security
- GeoMetrikks now requires Brotli 1.2.1, which fixes CVE-2026-111497. Brotli 1.2.0 and older can crash or run attacker code when they decode crafted data. GeoMetrikks decodes Brotli responses from the servers it calls, such as RDAP registries and the public IP lookup.
- GeoMetrikks now ships aiohttp 3.14.5 and certifi 2026.10.23. aiohttp 3.14.3 had request smuggling and resource exhaustion advisories, and the old certifi bundle still trusted emSign root CAs whose intermediate keys were compromised.
Full Changelog: v0.21.0...v0.22.0