0.97.0 (2026-08-06)
Added
- account for VM memory ballooning in host memory reporting (#1750) (c613010)
- add inspect image action on stack container cards (#1780) (4e54a92)
- add node-scoped opt-out for image update detection (#1715) (fa503dd)
- add ntfy notification channel (#1761) (0ba09eb)
- add stack:read permission gate to Settings Labels section (#1747) (7c02f6e)
- add target-aware RBAC authorization to Scheduled Operations (#1745) (209c9c5)
- auth: add SSO-only authentication mode (#1714) (e175db8)
- compose-doctor: show All Clear when findings are acknowledged (#1721) (543e4ef)
- expose Community audit log via system:audit navigation (#1740) (a1e2846)
- fleet-secrets: graduate encrypted fleet-wide environment bundles to Community (#1758) (5f5cd5e)
- fleet: add Node details sheet to the node card kebab (#1752) (97be019)
- fleet: reapply Compose configuration without a version update (#1716) (b0b423b)
- fleet: show itemized prune plans (#1734) (44d6078)
- live-refresh stack detail container and health state (#1712) (60092dd)
- make the Files explorer tree pane resizable (#1774) (85b8411)
- rbac: make Settings authorization permission-aware (#1738) (a3026f4)
- rbac: make stack-scoped grants node-specific (#1727) (9922d8e)
- recovery: make rollback-recovery image lifecycle visible and controllable (#1753) (41bf075)
- schedules: auto-update stacks by Stack Label (#1717) (72cdbb0)
- surface ZFS ARC reclaimable as dashboard context line (#1760) (71be163)
- validate scheduled task target existence at creation time (#1757) (5240957)
Fixed
- allow chmod on protected stack files (#1772) (a826cd3)
- auth: align WebSocket token_version checks with HTTP (#1744) (a74905f)
- auth: gate scoped JWTs on container-exec WebSocket (#1741) (ce4b91e)
- auth: keep active sessions alive and add stay-signed-in (#1711) (681ecc7)
- bump golang.org/x/text to v0.39.0 in Docker CLI and Compose builds (#1728) (d698eb4)
- compose-doctor: resolve effective healthcheck coverage (#1713) (78475d9)
- condition --volumes in downStack() on the removeVolumes option (#1764) (92d974b)
- credit issue openers linked to a PR without closing text (#1718) (ea38113)
- dashboard: scope alert-rule count to stacks on the active node (#1722) (c90e960)
- files: preserve tree expand state after mutations (#1773) (9b48121)
- fleet-secrets: invalidate stale preview when target inputs change (#1756) (bfabdc2)
- forward scoped node-admin permission for Settings writes through remote proxy (#1748) (ba017ee)
- image-updates: explain persistent digest rebuilds after update (#1784) (4fa5325)
- keep fleet prune estimate bytes after a target timeout (#1783) (575848e)
- mesh: close error-listener race in pilot tunnel reverse-dial connect (#1754) (48c89d2)
- networking: ignore verified Mesh attachments in drift (#1729) (3c93406)
- proxy: forward scoped stack evidence for alerts, auto-heal, and node-wide image refresh (#1749) (2e2b095)
- rbac: enforce operational permission parity (#1736) (c704cb5)
- rbac: handle permission metadata failures (#1735) (a65bf4d)
- rbac: permission-gate alerts, auto-heal, and image updates (#1743) (1580131)
- reduce prune estimate work and add managed-scope timeout (#1768) (e2fc3a5)
- resources: attribute free images to managed prune by repository family (#1769) (a29d451)
- surface NOT_EMPTY error code so DeleteFileConfirm can offer recursive delete (#1765) (4be3319)
- ui: flatten single-container Update onto the service row (#1759)q (1c9060a)
- ui: restore equal gutters on container logs modal (#1771) (63a3594)
- ui: show delayed busy feedback on confirm actions (#1763) (5d89a10)