The maintenance release: Ookla tests no longer fail for an hour at a time with "The configuration file could not be loaded", an open tab asks for the password again after a restart instead of freezing, and six findings from a security audit are hardened. Email notifications now require TLS by default — see below; there is no migration.
🔒 Security
- Email requires TLS — a relay not reached over TLS from the start must now offer STARTTLS. The upgrade was opportunistic, so anyone on the path could strip it and read the relay login and the mail. Set
SMTP_ALLOW_PLAINTEXT=truefor a relay that speaks no TLS at all. - Password checks are capped server-wide — comparisons run one at a time under a total cap, so a few dozen addresses can no longer keep the server busy comparing.
- Cross-site writes are refused — trusted-proxy header authentication no longer admits a write a browser attributes to another site, and a passwordless instance no longer waives the password for a browser request naming another origin. Behind a same-host reverse proxy, the proxy must declare the forwarded client; the setup banner and README say how.
- Restore refuses an out-of-range bcrypt cost — a backup whose hash cost was outside 4–12 locked the owner out.
- Statistics mask a private server's error text for readers other than the operator, as the other routes already did.
🐛 Fixes
- No more "The configuration file could not be loaded" — when the hourly interface check missed the IPv4 address once, a dual-stack adapter switched to IPv6 for an hour, and Ookla, whose configuration server is IPv4-only, failed every test in that hour. A still-assigned IPv4 address is now kept; the switch to IPv6 happens only once the address is gone.
- An open tab asks for the password again after a restart — sessions do not survive a restart, and the dashboard froze on stale data until reloaded. While the server is unreachable, the page now retries by itself and closes the "API not reachable" dialog once it answers.
- The web interface is reachable sooner after a start — the first boot's CLI downloads no longer hold the port closed, and the network check before it gives up after 5 seconds.
- Unreachable nodes and iperf3 targets time out on schedule — status checks, the node proxy and iperf3 latency samples took about 21 seconds to give up on a host that drops packets, instead of their own limits.
- The Docker healthcheck follows
SERVER_HOST— with the listener bound to another address, the container was reported unhealthy forever. - The Linux service survives a slow boot — the systemd unit waits 5 seconds between restarts and starts once the network is online; a quick failure at boot, such as a data mount not yet up, used to leave the service stopped. Rerun the installer to update the unit.
- Opening the database waits for a briefly locked file instead of failing at once.
🔧 Runtime
- Updated libraries — Nodemailer 10.4, Undici 8.12.4, i18next 27.1, react-i18next 18.0, Chart.js 4.6 and Vite 8.3.7, plus minor and patch updates. The Docker image builds the Cloudflare CLI with Rust 1.99.1.
Runtime compatibility
Source installs require Bun 1.4.4 or newer, or Node.js 22.19.0 or newer for development and tests. The x64 compiler target is Nehalem/SSE4.2 with runtime AVX dispatch; the baseline filenames are compatibility aliases. The Windows executable was verified in a KVM guest on the Westmere-v2 CPU model with AVX and AVX2 disabled (SSE4.2/POPCNT present).
Qualification scope and limitations
v1.7.3 uses the owner-approved-reduced-cpu-floor-gated qualification scope. Linux, macOS, source-runtime and Docker checks passed. Windows binaries passed listener-free reset and version checks; installers passed build/provenance checks and WiX ICE validation. On the Westmere-v2 guest CPU with AVX and AVX2 disabled, the exact published Windows executable started, served its loopback listener and stopped cleanly. Windows native HTTP/service runtime with enforced outbound denial and the complete Windows MSI install/upgrade/rollback/uninstall lifecycle are not verified; these two checks are deferred, not passed. See the qualification manifest for the exact evidence and artifact digests.
Downloads
| Platform | x86-64 | ARM64 |
|---|---|---|
| Windows | EXE · MSI · EXE (no AVX2) · MSI (no AVX2) | — |
| Linux | Binary · No AVX2 | Binary |
| macOS | Binary | Binary |
Both Windows executables are byte-identical; the baseline filenames are compatibility aliases.
Source Distribution
- ZIP Archive (requires Bun 1.4.4 or newer)
Docker Images
i7gamer/myspeed:latesti7gamer/myspeed:1.7.3
Installation Scripts
Checksums and Qualification
What's Changed
- Tolerate a runner-image rollout between the KVM seal and probe jobs by @i7Gamer in #122
- chore(deps): bump the server-minor-and-patch group with 4 updates by @dependabot[bot] in #124
- chore(deps): bump the client-minor-and-patch group in /client with 7 updates by @dependabot[bot] in #125
- chore(deps): bump rust from 1.99.0-alpine to 1.99.1-alpine in the docker-minor-and-patch group by @dependabot[bot] in #123
- chore(ci): bump docker/login-action from 4.6.0 to 4.7.0 by @dependabot[bot] in #126
- chore(deps): bump the client-minor-and-patch group in /client with 8 updates by @dependabot[bot] in #128
- chore(deps): bump the server-minor-and-patch group with 6 updates by @dependabot[bot] in #127
- chore(deps): bump the client-minor-and-patch group in /client with 5 updates by @dependabot[bot] in #130
- chore(deps): bump jsdom from 30.1.3 to 31.0.0 by @dependabot[bot] in #131
- chore(deps): bump react-i18next from 17.1.11 to 18.0.1 in /client by @dependabot[bot] in #133
- chore(deps): bump the server-minor-and-patch group across 1 directory with 5 updates by @dependabot[bot] in #129
- chore(deps): bump i18next from 26.7.1 to 27.1.0 in /client by @dependabot[bot] in #132
- Harden six findings from the security audit by @i7Gamer in #134
- Open the web port before the CLI downloads and bound the interface probe by @i7Gamer in #136
- Keep an assigned IPv4 address when only IPv6 answers the probe by @i7Gamer in #137
- Fixes from the project-wide review by @i7Gamer in #138
Full Changelog: v1.7.2...v1.7.3