0.48.0 (2026-11-13)
Features
- add the GeoIP database card to the Security page (ac69ddc)
- check whether an access list would refuse your current address (0bb6a00)
- GeoIP database card and missing-database alert (#1903) (74cbb0e)
- note when a country list would block you or is not enforced (ea757ac)
- replace or remove the GeoIP database from the API (d622521)
- report active alerts to the notification bell (0ddb6da)
- show active alerts in the notification bell (fc0af5e)
- show the GeoIP database source, date and size in its status (369a854)
Bug Fixes
- apply a reloaded GeoIP database to the proxy (fd5c52e)
- apply the admin whitelist correctly to access lists (#1899) (2ac3242)
- check the access list switch the same way on every settings path (26c45c0)
- explain refused access list saves and the missing GeoIP database (ccf1f7e)
- explain refused redirect targets (39225c6)
- keep country list hosts reachable while the GeoIP database is missing (a77c1bf)
- keep file paths out of GeoIP reload errors (5e41cb9)
- keep the GeoIP database when only its checksum is out of date (0fd23d7)
- keep the loaded GeoIP database when a reload fails (16c402e)
- label the automatic backup taken before a certificate delete (8aee93f)
- let admin whitelist addresses through country and local network lists (c6dfd41)
- make the access list tester agree with the proxy (a594f7e)
- refuse GeoIP database files with an out-of-range build date and cover the file operations (46b38d6)
- refuse only listed addresses on block lists when an admin whitelist is set (5e7fa0b)
- report a missing GeoIP database at build time and in the status (a9f46ae)
- restore shell quoting in the Dockerfile after the typo cleanup (0e597dc)
- security: count only failed emergency attempts against the limit (7bad65e)
- security: harden access control checks (cac98c1)
- security: harden access list handling (335b510)
- security: harden access list updates (f01128e)
- security: harden backup handling (28d7792)
- security: harden emergency request handling (541669c)
- security: harden handling of sensitive requests (809544b)
- security: harden live log connections (47ad341)
- security: harden private key handling (42024dd)
- security: harden redirect handling (e206028)
- security: harden request logging (f0e342c)
- security: harden route handling in the proxy layer (49e78b9)
- security: limit audit writes for throttled emergency requests (2106a63)
- security: tighten emergency request limits and socket handling (a2a3d00)
- send security headers with refused requests (48dac89)
- serialise emergency reset attempts per address (bda91c3)
- ship the GeoIP database outside the data volume (d6a39b7)
- ship the GeoIP database outside the data volume (#1893) (9474adb)
- tighten access list handling (#1892) (2a686a7)
- tighten handling of sensitive requests (#1898) (2ca7fd0)
- tighten redirect handling (#1926) (fdfe078)
- tighten route handling in the proxy layer (#1889) (99e903c)
- use the newer GeoIP database and fall back when the data copy fails (0322465)