getwud/wud 9.0.0

on GitHub

What's Changed in WUD v9.0.0

🚀 Major Features & Enhancements

• SQL Persistence Layer: Migrate persistence layer from LokiJS to SQL (SQLite) with Drizzle ORM, automatic schema migrations, and transparent legacy data migration.
• Role-Based Access Control (RBAC): 3 roles: Administrator (admin), Read/Write (rw), and Read-Only (ro).
• User Management in Web UI: Database-backed user administration in Web UI (Configuration > Users) with role assignment and secure password resets.
• Personal API Tokens: Generate personal API tokens with granular scopes (read, write) and optional expiration dates for programmatic REST API access.
• OpenID Connect (OIDC) Role Sync: Automatic user onboarding and role synchronization from Identity Provider group claims (admingroup, rwgroup, groupsclaim).
• User Profile & Theme Sync: User Profile page with theme preference synchronization (dark/light) across sessions, password change, and API token management.
• Modern Logging: Migrate logger from unmaintained Bunyan to Pino with Pino-pretty formatting and live logs viewer via Server-Sent Events (SSE).
• Interactive OpenAPI Documentation: Interactive OpenAPI API Reference in Docusaurus with "Try it out" explorer, request/response schema inspector, and code samples.
• Docker Compose Stack Display: Display Docker Compose stack / project name with filtering chip and drawer details (#1205).
• Home Assistant MQTT Overhaul: Full Home Assistant update entity support, bidirectional Install action button, per-watcher devices, and MQTT storm prevention (#1148, #649, #381, #216).
• NTFY Enhancements: Support for tags and icon properties (#1216) and real container selection in Trigger Test dialog (#1216).
• Docker Hardened Images: Support for Docker Hardened Images (dhi.io) registry (#875).

⚠️ Breaking Changes & Migration Guide

• Anonymous authentication removed: WUD now enforces mandatory authentication. At least one administrator account must be provisioned (via WUD_AUTH_ADMIN_USER/WUD_AUTH_ADMIN_PASSWORD, legacy WUD_AUTH_BASIC_*, or an OIDC provider with an admin group). WUD will fail-fast on startup if no administrator is available.
• Deprecate static Basic Authentication environment variables: Administrators should be bootstrapped via WUD_AUTH_ADMIN_USER/WUD_AUTH_ADMIN_PASSWORD (or via OIDC admin groups), and local users should be managed dynamically via the Web UI (Configuration > Users).
• Standardized REST API contract and error responses: All error responses now consistently return { "error": "<ErrorType>", "message": "<Details>" }. Custom scripts or integrations parsing legacy flat error strings need to be updated to read message. External REST API requests use standard HTTP Basic Authentication (basicAuth).

🐛 Bug Fixes

• Fix docker watcher crashing on startup when watchdigestdefault is configured (#1150).
• Fix Gitlab registry provider ignoring configuration defaults.
• Fix docker watcher ignoring container labels when registry provider is unknown (#1124).
• Fix tag listing exclusion for non-semver tags breaking digest updates when wud.tag.include is used (#1164).
• Fix WUD_WATCHER_LOCAL_WATCHATSTART=false being ignored on empty store (#1184).
• Fix tag comparison when coerced semver versions are equal (#1183).
• Fix group by label in containers table (#1182).
• Fix Docker events container ID extraction to support Docker 29.8.0+ (#1208).
• Persist items-per-page setting in localStorage across page reloads (#1181).
• Fix inverted TLS_VERIFY option in SMTP trigger (#837).
• Fix asset loading when navigating between nested configuration routes (#1127).