0.47.0 (2026-11-09)
Features
- ci: stamp non-release builds with the released base version (d59f167)
- compare versions semantically in update checks and backup validation (22ec244)
Bug Fixes
- add Appearance to the Settings sidebar menu (9765dce)
- add the missing local-host labels to the German, Spanish, French and Chinese translations (2a8b090)
- allow for archive headers in the import size check (41fbbdc)
- associate form labels with their controls (fe92812)
- bound the bulk delete request body, chunk large selections, and cover delete failure paths (199a12a)
- cap and anchor the what's new changelog for every user (a2ac687)
- carry the old CrowdSec mode setting over to the current one at startup (846ed34)
- check security settings values and narrow the failed-apply restore (#1844) (085c7b1)
- ci: add curl retries to Syft download in workflows (7a20d5d)
- ci: embed changelog data in release, development and pr images (344b2e0)
- ci: enhance grype scan handling to tolerate specific exit codes (7565b65)
- ci: generate clean changelog data and fail when it is missing (e4103fc)
- ci: increase timeout for golangci-lint in quality checks (206ecd6)
- ci: never skip the Docker build on manual dispatch (d24b01b)
- ci: publish version tags for release images (fc25621)
- ci: skip toolchain pin sync when the branch tip moved past the built commit (18e569b)
- ci: smoke test what's new on built images before publishing and label nightlies with the built commit (6308979), closes #1867
- ci: tighten changelog guard sha and merge checks, order prereleases by SemVer, warn on missed release (9f513f6)
- ci: update CodeQL action versions to v4.39.3 (41b4a0c)
- count a host with its own WAF handler as protected (#1852) (a867e87)
- count a host with its own WAF handler as protected in the security status (693859d)
- delete orphaned certificates with one bulk request when removing proxy hosts (08870cc)
- deps: update Alpine image version to 3.24.4 in Dockerfile (bce27a4)
- deps: update i18next and react-i18next to latest versions (026bf0d)
- deps: update kin-openapi to version 0.153.0 (af8d622)
- deps: update mongo-driver to v2.10.0 and sqlite to v1.62.0 (10dbb45)
- explain a selected WAF rule set that has no rules (6abbb38)
- explain why CrowdSec imports and acquisition saves cannot write to the config folder (ddc5386)
- fold review feedback into the bouncer registration changes (dfe9e67)
- give a hub upgrade the full first time share in the hub helper (bc8e4bb)
- keep a failed CrowdSec import from leaving the configuration folder incomplete (e35ca7c)
- keep a failed CrowdSec import from leaving the configuration folder incomplete (#1832) (3e4dd4b)
- keep a new CrowdSec key in use when saving it fails (f2990b5)
- keep a working CrowdSec bouncer key and register through the shared key check (#1824) (f38e04f)
- keep the bouncer registration swap whole and check keys against the local engine address (37c2ee0)
- keep the Caddy admin address inside the container (#1816) (5d0dbd5)
- keep the default security row in step with the CrowdSec setting at startup (001b398)
- keep the import error wording and cover the remaining archive failure paths (e6579c5)
- keep the modified time of a restored security setting (674505f)
- keep the saved CrowdSec key when CrowdSec cannot be reached (0645198)
- log skipped export symlinks once and check the pid before a reload signal (87ed593)
- make clickable overlays keyboard and screen-reader accessible (55e080f)
- make CrowdSec key checks safer when CrowdSec cannot be reached (#1814) (02003ed)
- make private IP forward host warning neutral for LAN and VPN addresses (2425f2b)
- make the break-glass disable switch the security suite off everywhere (148436c)
- make the what's new dialog safe to browse and render (58cfca7)
- pass the CrowdSec config file to every cscli call at container start (fa5db1e)
- pin zlib in toolchain image (1382ca1)
- read the CrowdSec engine address from one place (fbeb8da)
- read the proxy configuration from inside the container in the test tooling (bba8d6d)
- refuse a CrowdSec preset apply at once while a hub restore runs (0785150)
- refuse a WAF rule set without rules (c314ffc)
- register the CrowdSec bouncer through the shared key check (78a2622)
- reject out-of-range security settings values (7559799)
- release a held CrowdSec key only when it is still the one that was checked (d49e985)
- remove an unused proxy configuration file and extend the admin address tests (0daa97a)
- remove the unused Caddy Admin API setting from System Settings (ec2d75f)
- remove the WAF preset that has no rules and require rules in the form (5fa5fae)
- rename test constant that tripped gosec G101 (5629dac)
- report bouncer registration as unknown when the list cannot be read (5937686)
- require rules in a WAF rule set (#1838) (a7c1384)
- restore only the settings a refused change touched (0d54776)
- restore What's New and stamp builds with SemVer build-metadata versions (#1873) (80aa6a2)
- security: harden input handling in the CrowdSec API (656da91)
- security: harden log output in the CrowdSec integration (0340e88)
- security: harden Orthrus agent runtime privileges (5928595)
- security: harden Orthrus agent runtime privileges (#1874) (c4f7345)
- security: harden the proxy admin interface (6083d34)
- security: tighten ID parsing bounds in the Orthrus agent (c098b19)
- security: validate the Docker socket path in the Orthrus agent (8b1449d)
- serve test engines at the local CrowdSec address and tidy review items (deeaaf3)
- set up the database tables before the CrowdSec startup check (37de277)
- show a clear message when an import upload is too large (67bc47e)
- show an unknown state for bouncer registration (c0e1983)
- show the running version and update status in the system settings update card (6d16570)
- show where a held CrowdSec key comes from (a4fa566)
- stop key-leak log test colliding with random temp-dir digits (ec1ff4a)
- stop repeating the commit sha when the version already includes it (fe7dd8a)
- stop writing and reading the old CrowdSec mode setting (06e7f58)
- take a single backup for a bulk certificate delete (eb7d5ba)
- take a single backup when bulk-deleting certificates (#1876) (8aa1066)
- tidy CrowdSec engine address, restore busy answer and hub fallbacks (#1836) (126784c)
- tidy CrowdSec start-up and import error messages (#1817) (376c17e)
- tidy security test helpers, translations and docs (#1849) (b5e454c)
- try the hub mirror when a single hub item download fails (765d825)
- update Caddy version to 2.11.8 in Dockerfile (76e690c)
- update type definition for MonitorCard to use TFunction (5431c80)
- use one CrowdSec key file path everywhere (98c880a)
- use the bulk endpoint for bulk certificate deletion in the UI (8b6cf3d)
- write back blank values when a refused change is restored (6e7f0b9)