Releases & Updates
A curated, version-by-version record of every meaningful change shipped to our web application and API — from new features and refinements to security fixes and breaking changes, presented chronologically as they go live.
The API now supports custom roles — each can be named, granted a specific set of permissions, and given its own members. Access to every protected part of the API is now fully driven by a permission engine and a security classifier. Role changes require an MFA confirmation and are written to an audit record.
Endpoints for access management now emit access role ordinals. Clients consuming the field will require a configuration update.
When a user's role changes, their existing sessions lose the old level of access straight away and the old cache is immediately invalidated at the infrastructure level.
A new administrative interface to read and edit configuration entries; every change is audited and immediately invalidates the client cache.
The site's central configuration now drives the contact form and strictly enforces its validation rules.
Invited collaborators can now be granted access limited strictly to managing their own project's passwords. Full management access requires per-request approval and is always audited.
The configuration endpoint now returns a strong ETag and honours If-None-Match, so clients refresh from their local cache instead of re-downloading the configuration.
Added a dedicated proxy glyph and localized monitor-name qualifiers (Primary / Secondary / Tertiary / Reverse) on the status page, so duplicate services like two firewalls read distinctly.
The Cloudflare Turnstile verification widget now automatically retries when it fails to mint a token (for example after the page has been idle), so forms recover on their own without a manual refresh.
You can now request a secure reset link by email, then choose a new password. Also, a new two-factor step for accounts that have 2FA enabled.
Resending a password-reset or account-activation email now confirms it was sent and shows a live countdown before you can request another.
A new consistent layout for the whole authentication flow is now live in production.
Apps can now fetch feature flags and the announcement banner anonymously and cache the result.
Sections with forms can now read the current validation requirements and also verify the form before it's submitted.
The two-factor step during password reset now reports a locked account using the same machine-readable code as sign-in.
Registration now returns structured, de-duplicated field-level error codes, so validation can pinpoint the exact field.
Verified email address action now returns the same address in the success response, making it easier for the user to check.
Names now accept curly/iOS apostrophes, nicknames are canonicalized consistently, and the configured name character set is enforced on registration.
The API documentation now describes validation error codes as HTTP 400 instead of 422.
Added optional two-factor authentication using an authenticator app, with single-use recovery codes for backup access.
Account emails — address confirmation, two-factor codes, and password-reset messages — are now delivered reliably, with automatic handling of bounced or rejected addresses.
You can now reset a forgotten password from the sign-in screen through a secure email link. Accounts with two-factor authentication are asked to confirm their second factor during the reset.
Authentication responses now use a consistent set of machine-readable codes, so apps can present clearer, more specific messages.
The API's OpenAPI document now reports the release version and build date.
Signed-in sessions are more secure: refresh tokens now rotate automatically, with detection of reused tokens.
Sign-in and account-recovery flows are now protected against automated abuse, and accounts are temporarily locked after repeated failed sign-in attempts.
A new setting lets you pick your time zone and switch between 12/24-hour clocks. Automated selection based on browser has been added as well.
Pages with status now follow a global site routing convention with its dedicated landing page.
A site-wide visual polish brings a new teal gradient to the navigation bar and other sections. Refined dropdown menus, smoother hover effects, and small layout cleanups throughout.
Release cards now show contributors with avatars, collapsible summaries, links to the source signature of the specific commit and smoother animations.
The status page now shows a per-service icon and real service name, an at-a-glance count of monitored services, an "Online" label on each, and clearer handling of services that are newly added and have no data.
Resolved an issue where some form submissions could result in failed action before they were processed.
Small fixes including a centered status indicator in the footer on iOS, better responsive labels on the status page, and a more accurate Czech translation for the "down" status.
Authentication system hardening with automatic session control and strict login policy. Added MFA support and authentication with social networks.
The first stable release of the official API, which is the core for the system infrastructure, is now part of the changelog pipeline.
A fully automated release pipeline with a window into GitHub. Entries now carry an author, notes, a publisher, and a general summary.
Showing 10 of 10