V2 is out!

Breaking Changes

Guardian now ships as a single Docker image (hydroshieldmkii/guardian), replacing
guardian-backend + guardian-frontend. The old images will not receive further updates.

To keep your data, point the new service at your existing v1 volume. Its actual
name has your compose project as a prefix (check with docker volume ls, e.g.
guardian_backend_data):

services:
  guardian:
    image: hydroshieldmkii/guardian:latest
    container_name: guardian
    ports:
      - "3000:3000"
    volumes:
      - backend_data:/app/data
    environment:
      - TRUST_PROXY_HOPS=1
    restart: unless-stopped

volumes:
  backend_data:
    external: true
    name: guardian_backend_data

Back up plex-guard.db from the volume before upgrading. Your settings, devices, and
history carry over; no manual migration is needed.

New Features

• IPv6 support. LAN/WAN classification, CIDR ranges, and allow lists all accept IPv6 alongside IPv4.
• Live dashboard updates. The dashboard now receives pushed updates over Server-Sent Events instead of polling the backend every few seconds.
• Rate limiting on authentication and API endpoints, with TRUST_PROXY_HOPS for correct client-IP detection behind a reverse proxy. See the README.

Improvements

• Full test suite across frontend and backend
• Stronger TypeScript typing
• Notification emails now escape user-supplied content.
• Consolidated CI/CD and a single Docker image build.
• Updated dependencies

Bug Fixes

• IPv6 clients had their streams terminated with "Invalid or missing client IP address" (#114 and #115 by @strausmann).
• A /0 CIDR range in an allow list matched nothing instead of everything.
• Zero-padded IP addresses like 010.0.0.1 are now rejected as ambiguous rather than silently reinterpreted.
• Boolean settings (SMTP TLS, Apprise, Plex SSL) were compared as strings.
• Temporary access returned null instead of false; user sync could persist the literal string "undefined"; settings import undercounted skipped keys.