What's Changed
🚀 Features
- harden CodeQL findings gate + fix cookie-suppression comment placement
- fail CodeQL findings gate on any severity by default, add documented exceptions
- add shared CodeQL findings-gate script and ignore-list schema
- add What's New changelog popup shown after app updates
- render Security group in WhatsNewModal
- add security category to changelog generation
- add What's New modal and Appearance Settings integration
- add per-user changelog API and User model fields
- add embedded changelog package and generation pipeline
🐛 Bug Fixes & Improvements
- split docker-build.yml multi-arch build to fix arm64 QEMU timeout (#1232)
- bump nanoid to 3.3.18 to patch GHSA-2v37-7h3g-55p8
- split docker-build.yml multi-arch build to fix arm64 QEMU timeout
- close out issue #619 test-infrastructure debt (unskip Vitest suites, replace tautological E2E assertions, fix real bugs found along the way) (#1223)
- add accessible names to icon-only delete button and log filter selects
- scope local CodeQL/Trivy scans to feature-adding changes
- stop full local 3-browser Playwright runs, defer to CI
- match established 10s WebKit headroom for reload-then-verify in ntfy token security test
- give the manual-challenge panel heading the same WebKit headroom as its button
- recognize Firefox's NS_BINDING_ABORTED as an expected navigation race
- bound and catch networkidle waits in theme/banner spec helpers
- serialize proxy-host-drag-drop suite to remove group-state race
- bound and catch networkidle waits in modal-dropdown-triage
- wait for dropdown option visibility before focusing in DNS provider type tests
- wait for API response before asserting whitelist conflict error
- raise invalid-syntax error banner timeout (webkit)
- raise close-modal assertion timeouts in caddy-import gap test
- raise session-resume banner timeout to match file convention
- wait for login form before filling on empty-password test
- retry create-user-then-login race in test fixtures on 401
- stop inferring CrowdSec install state from incidental file presence
- auto-sync PLAYWRIGHT_CADDY_PROXY_PORT for local E2E rebuilds
- keep toast notifications accessible while a modal dialog is open
- guard Login.tsx state update against unmount race condition
- inject What's New changelog fixture in local E2E rebuild script
- scope proxy-hosts heading locator and seed test data for bulk-selection test
- add aria-current to active navigation links
- replace tautological assertions in remaining security-UI and settings E2E specs
- correct Access List UUID usage and CGNAT warning i18n keys
- replace tautological assertions in proxy-hosts and access-lists E2E specs
- replace tautological assertions in certificates.spec.ts with real backend-verified checks
- unskip Security.* Vitest suites now that undici/jsdom WebSocket bug is fixed
- update dependencies for axe-core, electron-to-chromium, and immer to latest versions
- retry transient SQLite lock errors when creating uptime monitors
- apply busy-timeout/WAL pragma to uptime test DB to resolve SQLite lock flake
- update opentelemetry http instrumentation to v0.70.0
- remove unused imports/variables flagged by CodeQL in settings/tasks E2E specs
- remove unused imports/variables flagged by CodeQL in security E2E specs
- remove unused imports/variables flagged by CodeQL in core E2E specs and fixtures
- correct CodeQL suppression comment placement in auth, crowdsec, and backup handlers
- strengthen file path safety checks in system administration handler
- correct stale node:24.19.0-alpine3.24 image digest
- strengthen file path safety checks in system administration handler
- wrap WAF-check requests in retryAction for CI network resilience
- avoid redundant login for rate-limit test's new user
- use API-based cleanup in auth-middleware-cascade afterEach
- unique per-test proxy domain and correct dialog-dismiss timing
- remap local Caddy proxy port to avoid host port 80 conflict
- use rendered content instead of page.url() to detect access denial
- replace strict-mode-unsafe dialog locator in ACL integration tests
- resolve Security Enforcement failures in auth/ACL/WAF/rate-limit specs
- replace docker-socket-proxy with Orthrus remote agent
- align frontend audit log response types with backend contract
- target Caddy proxy port for WAF/ACL checks, stop shared-session logout
- fix Containers dropdown resetting to placeholder after selection
- fix test-side hangs and wrong-origin WAF assertion in security specs
- replace CSS-class-guessing locators and too-tight timeout in security specs
- make Security Enforcement jobs actually run security-enforcement/ and security/ specs
- suppress What's New modal for ad-hoc raw-API test users
- guard WhatsNewModal against null group fields
- normalize nil array fields to empty on entry read
- suppress What's New changelog modal for shared/auto-created test users
- inject E2E changelog fixture before Shard 4 image build
- auto-revert generated changelog.json after local Docker builds
- extend gotoTolerant() coverage to theme/appearance nav helpers
- close non-semver gaps in seeding and permanent dismissal
- handle stale post-login navigation in shared loginUser helper
- treat non-semver running versions as dev builds
- resolve WhatsNewModal session-dismissal and stale-state bugs
Full Changelog: v0.36.0...v0.36.2