What's Changed
[-] fix pgwatch_instance_up metric for down sources, closes #1158 (#1162)
[-] use random JWT secret instead of hardcoded key (#1475)
Important
The Web UI/API signed and validated all JWTs with a hardcoded key published in the source, letting anyone forge accepted tokens and bypass authentication.
Tokens now rotate on every restart, invalidating leaked ones.
Full Changelog: v4.1.0...v4.2.0