dashcaddy/CHANGELOG.md

Changelog

All notable changes to DashCaddy are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

1.5.0 - 2026-05-17

Changed (BREAKING)

• API routes now mounted exclusively under /api/v1/. The legacy un-versioned /api/ mount has been removed. Frontend, OpenAPI spec, DashCA pages, and all internal path matchers (CSRF exclusions, auth public routes, audit log, rate-limit mounts) updated accordingly. Existing integrations that hit /api/... directly must update to /api/v1/.... Held at minor bump (1.5.0) rather than major (2.0.0) — DashCaddy is still pre-1.0-API-stable.

Added

• LICENSE (proprietary EULA) at repo root.
• CHANGELOG.md (this file) — Keep a Changelog format.
• Gitea Actions workflow (.gitea/workflows/ci.yml) that runs npm test (with coverage) and npm run lint on every push to main/master and on PRs, plus a security job running npm audit and the security-focused test subset.

Fixed

• 9 pre-existing no-empty ESLint errors in backup-manager.js and routes/backups.js (intentional ignore-failure catches now annotated).

Removed

• Stale files at repo root: *.bak, server-old.js, and ad-hoc deployment/migration/test reports (DEPLOYMENT-SUCCESS.md, FINAL-DEPLOYMENT-REPORT.md, DESLOPIFICATION-ROADMAP.md, error-handling-*.md, WHAT-IS-DASHCADDY.md, etc.). Already gitignored — disk-only cleanup.

---

1.4.10 - 2026-05-17

Fixed

• release.sh now stages build-rewritten files (sw.js, index.html) so they're included in the published tarball.

1.4.9 - 2026-05-17

Fixed

• Container-logs feature was misusing wireModal, which short-circuited the rest of features.js and broke unrelated dashboard features.

1.4.8 - 2026-05-17

Fixed

• CSP hash now computed on LF-normalized index.html so Windows and Linux builds produce identical hashes.

1.4.7 - 2026-05-17

Fixed

• Dashboard unbroken: corrected bundle order, closed dangling IIFE, removed duplicate const declaration.

1.4.6 - 2026-05-17

Fixed

• sw.js cache tag now derived from bundle content hash, so service worker invalidates correctly when bundle content changes.

1.4.5 - 2026-05-17

Fixed

• Frontend deploy routed through the host-side updater (matches the API container's own update path).

1.4.4 - 2026-05-16

Fixed

• notify endpoint exempted from CSRF (it's called by the host-side updater, not the browser).
• release.sh JSON parsing made portable (no longer assumes GNU jq semantics on every host).

1.4.3 - 2026-05-16

Added

• Seamless release flow: push-notify endpoint, VERSION file copy into release tarball, robust SSH mirror handling on port 22022.

1.4.2 - 2026-05-16

1.4.1 - 2026-05-16

Changed

• Version bump only — packaging plumbing for the 1.4.x release line.

1.4.0 - 2026-05-06

Added

• scripts/release.sh — one-command release cutting and publishing.

---

1.3.1 - 2026-05-06

Fixed

• Installer: added src/ directory to the deploy manifest; dropped MakeDirectory=yes from the systemd updater path unit.
• Self-updater: copies src/, replaces routes/ in place instead of nesting it inside the existing tree.

1.3.0 - 2026-05-06

Added

• Self-updater supports DASHCADDY_API_SOURCE_DIR env override for non-standard deploy layouts.

Fixed

• Self-updater now clears all pending history entries, not just one.

---

1.2.0 - 2026-05-14

Added

• Container Log Viewer with streaming, search, and download.
• Service filter, batch operations across multiple services, and snapshot capture.
• Auto CSP hash updates during build.
• Dashboard version button and self-update UI wiring.
• Release policy checks and dashboard version verification.

Changed

• All routine console.log calls gated behind window.DASHCADDY_DEBUG flag for quieter production output.
• All console.error calls routed through ErrorHandler for consistent tracking.

Fixed

• Updater no longer triggers a false-positive "update available" loop when commit hash is unknown.

---

1.1.5 - 2026-03-23

Added

• Pylon health relay for remote service health checks (with relay fallback on /probe/:id).
• Host-side auto-updater for zero-touch API container rebuilds.

Fixed

• Service edit preserves service ID on subdomain change; accepts localhost as a valid IP.
• Taxi theme accent color now distinct from text.
• Prevents encryption key conflicts; adds license backup on rotation.

1.1.1 - 2026-03-23

Fixed

• Service edit, CSRF token stability, and license restore.

---

[1.0.x] - 2026-03-05 → 2026-03-22

Initial release line. Highlights from work between v1.0 and v1.1:

Added

• Cross-platform path support (Windows + Linux deployments).
• Subdirectory routing mode for public-domain deployments.
• Auto-update system for DashCaddy instances.
• Batched status endpoint (frontend performance).
• Install-wide onboarding tour (no longer per-browser).
• Daily log digest and Docker hygiene/maintenance.
• Unified backup/restore v2.0 with full state capture.
• DNS uptime bars and fully-dynamic DNS server config.

Changed

• Phase 1-3 refactor: extracted config/context/utils into src/, split monolithic server.js, standardized all 25+ route files with explicit dependency injection.
• Unified error handling system (throw-based, migrated 25 route files).
• ESLint + Prettier baseline with auto-fixes.

Security

• 7 critical + 16 high/medium API security bugs fixed.
• 7 frontend security vulnerabilities fixed (4 critical, 3 high).
• Logger sanitization to prevent log injection.

Tests

• Comprehensive test suite reaching 80%+ coverage threshold.
• docker-security test suite (41 tests).
• auth-manager and credential-manager test suites.

1.0.0 - 2026-03-05

Initial release of DashCaddy. Unified dashboard for Docker container management, Caddy reverse proxy configuration, DNS automation, and SSL certificate provisioning.