Security
- SNMP community strings are masked in the activity log. Masking applies as a row is written, so rows already stored keep what they hold — change any community you entered through the interface on an earlier version.
- Blocked addresses expire here as well as on the router, so an attacker who comes back is blocked again by itself.
- The manager's own interface addresses are exempt from auto-block. In a container those are the container's addresses, so a bridged install should still whitelist the address the routers reach it on.
- IPv6 ranges work in the auto-block whitelist, and an entry that could never match is refused with the reason.
- Webhooks using GET are sent unsigned — there is no body to verify a signature against. Authenticate a GET target with a custom header or a token in the URL.
- Creating, renaming and deleting a site is now done by a superadmin, or by an administrator with no site limits. If your organisation onboards customers regularly, give that person a superadmin account.
- Site limits now cover webhooks, the auto-block lists and the activity log. Administrators without site limits are unaffected.
- A device can no longer be filed into a site you cannot open. A bulk import refuses only the rows concerned and tells you which.
Added
- Refresh feeds on the Security page — fetch the security advisories and the vendor changelogs now instead of waiting for the daily update. One press does both, and the message says which of them arrived. Administrators only.
Fixed
- "Last poll" no longer reads as fresh for a device that just failed to answer; the device page shows when it was last tried and when it last answered.
- A reading that could not be taken from a device is reported as a failure rather than as a device with nothing to report.
- An upgrade is confirmed only when the device comes back on the version that was offered, and the report names the version it landed on when it does not.
- The upgrade queue no longer offers devices that have never been polled.
- A viewer opening Mass Commands sees the page instead of an error.
- The topology map keeps the arrangement you left it in.
- Out-of-scope devices answer 403 across the API and an unknown id answers 404; two endpoints used to answer 404 for both. Integrations that branch on the status code should know this one.