v1.0.42 — Update notifications

v1.0.42 lets the admin UI tell you when a newer WAF release is available. It has no database migrations or Compose changes.

What changed

Update banner for admins

When a newer release is published, admins and superadmins see a banner under the header after signing in:

WAF vX.Y.Z is available. You're running vA.B.C. Release notes and upgrade steps

The link opens the release notes on this repository's Releases page. Dismiss hides the banner for that version only; the next release shows it again. Viewers and operators don't see the banner.

Latest release on the About page

The About page has a new Latest release row under Version. It shows the newest published version, an Update available badge or You're up to date, and a link to the release notes. It also says when the check is turned off, or when GitHub couldn't be reached.

How the check works

• The admin API, not the browser, asks the GitHub API for the newest published release of this repository. Drafts and pre-releases are ignored.
• The answer is cached in Redis for 6 hours, and a failed check for 30 minutes, so an installation makes only a few requests a day.
• If GitHub is unreachable or rate-limited, the banner simply doesn't appear. Nothing else is affected.
• No data about your installation is sent beyond a normal HTTPS request whose User-Agent includes the WAF version.
• Only plain vX.Y.Z tags are accepted, and the release link is always built from the tag, pointing at this repository.

Turning it off

On hosts without internet access, or if you'd rather not check, set this in .env:

UPDATE_CHECK_ENABLED=false

The admin API then never contacts GitHub, and the About page says the check is turned off. The setting defaults to true when it's missing from .env.

When you'll first see it

The banner works from this release onward, so an installation running v1.0.42 shows it once a newer release is published. Older versions can't show it.

Images and upgrade

Production images target linux/amd64:

• ghcr.io/socfortress/waf-caddy:1.0.42
• ghcr.io/socfortress/waf-admin-api:1.0.42
• ghcr.io/socfortress/waf-admin-ui:1.0.42

Back up the database, configuration, certificate storage, and deployment settings. Preserve local Compose overrides. Upgrading from v1.0.40 or older? Also follow the v1.0.41 notes, whose per-site JWT audience and exclusion regex changes apply, and the v1.0.40 notes, including its certificate persistence migration. Older installations must also review the v1.0.39 and v1.0.37 notes.

Update deployment files with git pull --ff-only, preserving customizations, and set both values in .env:

WAF_IMAGE_TAG=1.0.42
CRS_CADDY_DIGEST=sha256:5c63210e65ae83c6c940f74f1438bc64481003ea0de1c4d9196e539d7c9a9b85

Optionally add UPDATE_CHECK_ENABLED=false (see above). The digest takes precedence over the tag. Production Caddy and the CRS validator must use the same release digest. Verify docker compose config, stop configuration edits, and upgrade the services together:

docker compose pull
docker compose stop admin-ui admin-api caddy-waf waf-sandbox
docker compose up -d --wait postgres redis http-echo caddy-waf waf-sandbox
docker compose up -d --wait admin-api admin-ui
docker compose ps

After upgrading, open About and check that Version shows v1.0.42 and Latest release shows v1.0.42 with You're up to date. If the check is turned off, it says so instead.

Validation

• Backend suite: 713 passed, including 41 new update-check tests: version comparison, caching, quiet failures, Redis outage, tampered cache entries, rejected release data, and permissions.
• Frontend suite: 135 passed, including 14 new tests for the banner and the About page, plus the production build.
• The published waf-admin-api:1.0.42 image reports version 1.0.42. Run against the live GitHub API, it found v1.0.41 as the latest release and correctly reported no update, and reported an update when its version was set to 1.0.40.
• The banner and About page were checked in a browser in light and dark themes, including Dismiss surviving a reload.

Images are built from merged source e0b994750ed60b2e8be045bef96daa5753b4f240. See publication verification for digests, revisions, platforms, and anonymous pull checks.

Rollback

There are no schema changes. To roll back to v1.0.41, set its image tag and Caddy digest in .env and run the same upgrade sequence. UPDATE_CHECK_ENABLED is ignored by older versions and can stay in .env.

This release does not deploy changes to the lab or production servers.