itsDNNS/docsight v2026-03-08.2 on GitHub

Security

Reverse proxy hardening (#160): _get_client_ip() no longer blindly trusts X-Forwarded-For headers, preventing rate limit bypass via IP spoofing. Set REVERSE_PROXY=1 env var to enable Werkzeug ProxyFix for trusted proxy setups. SESSION_COOKIE_SECURE is auto-enabled in proxy mode.
SSRF URL validation (#160): Config URL keys (modem_url, bqm_url, etc.) reject non-HTTP schemes (file://, gopher://, etc.). Theme registry downloads are restricted to trusted GitHub domains only.
DOM XSS escaping (#160): All innerHTML assignments rendering server-sourced data now use escapeHtml() across BNetzA, correlation, speedtest, BQM, and channel compare views.
Module isolation (#160): Community modules no longer receive decrypted secrets (modem_password, admin_password, etc.) unless explicitly declared in their manifest. Route conflict detection blocks community modules from shadowing core endpoints (/login, /api/config, etc.).

All Python packages bumped to latest stable: cryptography 42→46, pypdf 4→6, flask 3.0→3.1, beautifulsoup4 4.12→4.14, and others
GitHub Actions updated: checkout v6, setup-python v6, docker actions v4-v7
Lucide Icons 0.575.0 → 0.577.0

SURFboard S34 (#165): Fix HNAP data requests using GetMoto*/GetCustomer* variants
CM8200A (#172): Fix TLS handshake and authentication flow
Signal Trends X-axis: Labels now display 6 evenly spaced horizontal timestamps instead of overlapping rotated text