Release 15.0.8 — Chocolate Chip Muffin

Nightscout 15.0.8 is a broad maintenance, security, and compatibility release. It adds safer database administration, improves modern AID and connector compatibility, fixes several reports and displays, and substantially modernizes Nightscout's dependencies and test coverage.

Highlights

• New date-range cleanup tools — Authenticated administrators can preview and delete entries, treatments, and device-status records for a selected date range. Profile cleanup is also available from Admin Tools.
• Better connector compatibility — nightscout-connect 0.0.13 adds updated Dexcom Share/G7-era, Glooko, LibreLinkUp, and Nightscout-source behavior. Existing BRIDGE_* Dexcom settings now use the Connect implementation by default, with a legacy opt-out.
• Reports and displays — Adds GMI and Revised GMI to Glucose Distribution, finer AAPS temporary-basal rendering, an emoji clock component, and fixes for historical COB, OpenAPS forecast lines, trend arrows, units, and timezone handling.
• Security hardening — Sanitizes persisted free text across API and WebSocket write paths, safely renders stored values, validates and bounds API batches, and offers opt-in same-origin iframe protection.
• Modernized runtime and build — Removes the direct Lodash, browser crypto, and request dependencies; updates vulnerable runtime packages; modernizes jsdom and development tooling; and ships a smaller multi-stage Docker image.

Added

• Date-range record deletion with a preview step for entries, treatments, and devicestatus in Admin Tools (#8467).
• Profile-pruning support and supporting database indexes (#8490).
• An opt-in, server-only webhook notification plugin for newly received glucose values, with deduplication and retry behavior (#8427).
• GMI and Revised GMI estimates in the Glucose Distribution report (#8330).
• An emoji component for the custom clock view (#7949).
• API_SECRET_FILE support for Docker secrets and other file-mounted secret providers (#8300).
• API v3 filter_parameters array support as documented by the OpenAPI specification (#8253).

Fixed

• Restored OpenAPS pill updates and forecast lines when enacted records do not contain a rate (#8324).
• Preserved controller-reported COB while viewing historical data (#8492).
• Increased basal rendering granularity for AAPS temporary basal rates (#8281).
• Corrected the clock view when browser units differ from server units (#8505).
• Normalized legacy trend values such as Up, Down, Slide up, and Slide down for clock arrows and direction pills (#8497).
• Corrected report day boundaries for GMT/UTC timezone strings, including half-hour and quarter-hour offsets (#8469).
• Corrected Out-of-Range RMS calculations in mmol/L and spacing in the Day-to-Day insulin distribution summary (#8454, #8452).
• Fixed a Bolus Wizard Preview case that could snooze a high alarm when no insulin was on board (#8558).
• Restored split view behavior and made configured FRAME_URL_1–FRAME_URL_8 origins compatible with Content Security Policy (#8548).
• Guarded null JWT verification results and hardened API v3 filter parsing (#8508, #8487).
• Updated translations, including Traditional Chinese, and corrected several Loopalyzer localization gaps (#8397, #8496).

Security and reliability

• Persisted user-controlled text is sanitized consistently across API v1, API v3, and WebSocket writes, with additional output encoding for stored values (#8591).
• API write endpoints reject invalid payload shapes and cap batches at 10,000 documents to bound validation and storage work (#8592).
• ALLOW_UNRESTRICTED_FRAME_EMBEDDING=false enables X-Frame-Options: SAMEORIGIN and CSP frame-ancestors 'self'. The 15.0.8 default remains true to preserve existing iframe and split-view deployments (#8593).
• Updated Express, body-parser, Socket.IO, DOM sanitization, UUID, and related transitive dependencies; development and test tooling received a separate modernization pass (#8517, #8518).
• Expanded behavioral coverage using captured AAPS, Loop, Trio, and phone-uploader fixtures, plus new security, API, WebSocket, report, and client-core tests.

Changed

• Legacy Dexcom BRIDGE_* configuration is mapped to nightscout-connect by default for newer Dexcom Share compatibility. Set DEXCOM_BRIDGE_USE_LEGACY=true to keep using share2nightscout-bridge (#8556, #8557).
• Nightscout-source Connect sync can select collections with CONNECT_SOURCE_COLLECTIONS and limit results with CONNECT_SOURCE_MAX_COUNT.
• Glooko Connect adds regional hosts, web/automatic authentication, and an optional v3 graph fallback. LibreLinkUp adds more region and client-version overrides.
• Direct Lodash usage was replaced with native JavaScript and focused local utilities (#8502).
• The Docker build now uses separate builder and runtime stages, prunes development dependencies, supports native amd64/arm64 publishing, and updates the example Compose MongoDB image to 5.0.32 (#8417, #8486).
• NIGHTSCOUT_HOSTNAME is now the preferred server bind setting. The older HOSTNAME variable remains supported for compatibility.

Upgrade notes

• Nightscout requires Node.js 20 or newer and npm 10 or newer. Node 22 is the recommended local and container baseline.
• If you intentionally embed Nightscout from another origin, the current default continues to permit it. Consider explicitly setting ALLOW_UNRESTRICTED_FRAME_EMBEDDING=true so your intent remains clear; set it to false for same-origin framing protection. The permissive default is expected to change in a future release.
• Dexcom Bridge users are migrated through nightscout-connect automatically. If the updated path causes a deployment-specific problem, set DEXCOM_BRIDGE_USE_LEGACY=true while troubleshooting.
• API clients sending more than 10,000 documents in one request must split the upload into smaller batches.
• Docker Compose users upgrading an existing MongoDB 4.4 data directory should review MongoDB's supported upgrade path before adopting the example's MongoDB 5.0 image.

Thank you

Thanks to everyone who contributed code, testing, translations, reviews, and issue reports for this release, including @AndyLow91, @ryceg, @bewest, @bniels707, @sulkaharo, @starfrenzy, @MtlPhil, @gluk0, @quarktwain, @Angus-repo, @motinis, @egyptianbman, @IsraelAfangideh, @earldouglas, @bjorkert, @yodax, @MilosKozak, @savek-cc, @adamlounds, @hershyheilpern, @petervanrijt, @luborjurena, and the Dependabot and Copilot contributors.

Full Changelog: v15.0.7...v15.0.8