Lissy93/dashy 4.5.0

Release 4.5.0

on GitHub

Dashy 4.5.0 is out!

For full details, see discussion #2277 - any questions or feedback, drop them there :)

✨ New features

• Drag and drop editing. Grab any section, item or widget and drag it around to reorder or move it.
• A new Live Tennis widget. Live scores from the ATP and WTA tours, updating as you watch.
• The GitHub stats widget is rebuilt. It now uses GitHub's own API, so it's more reliable, and you can add a token to raise the rate limit.
• Nicer numbers in the custom-api widget. New formats for bytes, bitrate and duration, plus scaling, prefixes, suffixes and swapping raw values for your own labels.
• Long item titles look better. They scroll when you hover and show the full text in a tooltip, instead of getting cut off.
• A logout redirect option. Send people to a page of your choice after they log out, handy when you're behind an auth proxy.
• You can turn off the proxy endpoints. Set the DISABLE_PROXY_ENDPOINTS env var if you don't need Dashy's built-in CORS proxy.
• Client-side only OIDC. A new option to skip the server-side token checks, for setups that want OIDC purely in the browser.

🐛 Bug fixes

• Edits save to the right place. Fixed section and widget edits sometimes being saved to the wrong section.
• The left-click menu is back. The left-click context menu on items works again.
• The config editor opens reliably. Fixed the Edit App Config menu occasionally failing to open.
• Expired sessions now log you out. No more looking logged in when your session has actually expired.
• Netlify status checks work again. Fixed the serverless functions that had broken on newer Node versions.
• Steadier status checks. Fixed a rounding glitch on short check intervals, plus some general reliability tweaks.
• Saved config shows up straight away. Changes saved on the server now apply right away, without needing a refresh.
• Friendlier OIDC handling. Dashy warns instead of breaking if your login provider fails to hand back a token.

💥 Changes which might impact you (but probably won't)

Node version updated to 24

We've upgraded to the lates Node version. So Dashy now expects Node 24 LTS or newer (24.11.0+). Node 22 LTS versions above 22.18.0 are still supported. If you get an "" error, I've explained the solution here (TL;DR: Switch node version with nvm, or just pass the --ignore-engines flag to ignore).

Dropped arm/v7 support

Our main/official Docker image no longer builds nativity for 32-bit ARM/v7 architectures. This will only affect you if you're on a 32-bit Raspberry Pi 2 or similar board. We did this because the latest Alpine images have dropped arm/v7 support, and also, emulating arm/v7 with QEMU in our docker build workflow was slow, heavy and flaky. Without it, a full docker build is now down to ~2 mins, reliable and with minimal resource usage.

Browser support

Dashy now officially only supports Chrome 111+, Firefox 114+, Safari 16.4+. So basically any browser released in 2023 or later. That limitation came from upgrading to Vite 8, which was necessary for performance and security.

Updated key names for show/hide sections and items for OIDC users/groups

I've simplified the config to controlling which users or groups can see which sections and items. Under section and item there's a displayData object. This now has options for: showForGroups, showForRoles, hideForGroups and hideForRoles. Each of these accept an array. For an update example, see here. The docs and schema have been updated accordingly. Note that the old way of doing this will continue to work, but will be dropped in the next major version.

Section names must be present and unique

Previously we relied upon generated IDs for tracking each section. This was clumsy and error prone. Now we use a slug generated from the section name. This means that each section must have a name present, and it must be unique to that page. The schema has been updated to enforce this, as well as the UI editor. If you don't want to see section name, use CSS to hide it: .section-header { display: none !important; }

Some server files moved

I found that the ./services/ directory was a bit of a mess, as the files there were a mix of endpoints, scripts and helpers. I've re-organised this so there's now a sub-directory for all the endpoints, and everything else goes in ./services/utils. This shouldn't have an impact on anything, unless you're doing something funny with linking to server utils directly.

Dependencies

As always, there's been some changes/updates to dependencies, to keep everything up-to-date and secure.
We've added the sortablejs dependency (used for the drag-and-drop editing). And done some major upgrades to express, jose, js-yaml, vue-i18n and vue-router. I've made all required code updates and migrations to keep things working smoothly with the new and changed functionality of these.
If you're running Dashy on bare metal, you should already be doing a yarn install when updating Dashy, so you've got all the right dependencies and versions. Actually, I care about you guys having safe dependencies so much, that I've made some upstream fixes too: GHSA-pm4m-ph32-ghv5 bug for js-yaml and key size mismatch jose#883

Files starting with dot be accessible

Any file beginning with a . placed in user-data will no longer be served up. You'll need to rename it (and references to it) to continue using. This was because of some upstream Express changes, but also it's general good security so makes sense to keep.

Expired OIDC sessions sign-out if cannot refresh

If your OIDC token on the frontend is expired, Dashy will attempt to renew it in the background if enableSilentRenew is enabled (and your provided has the offline_access scope added). If this fails, then you'll be signed out and need to re-login. If it's annoying, setup silent renewal, or increase session timeout, or set disableServerSideCheck. I've also pushed a lot of debuging/error catching for OIDC too, which will make fixing any configuration issues easier.

YAML features

conf.yml parsing moved to strict YAML 1.2 core. However I've patched in support for merge keys, timestamps and binary labels so keep things working. But the rarely-used !!set / !!omap / !!pairs tags and some loose YAML 1.1 scalar forms are no longer supported.

Dropped support for legacy auth algos

This shouldn't affect you unless you're using a very old OIDC provider with some niche key algothirm. We've dropped support for ES256K/secp256k1 and Ed448 algos, since they were insecure.

🏅 Credits

Thanks @bensynapse for your contribution of the new tennis widget!

Dashy is free and always will be. It's made possible thanks to our wonderful sponsors.
Drop them a follow and show them some love 💖