v0.13.0

0.13.0 (2026-07-11)

Features

• audit: add comprehensive audit log for user and billing actions (d75eb33)
• backup: scheduled local backups, independent of Telegram (c9293e1)
• core: surface connguard and BBR status in the health report (7a2693e)
• log: timestamp panel logs, in the operator's timezone (64bb14d)
• server: lock out repeated invalid API keys, add a key-free liveness probe (94f84cb)
• xray: add a Restart button to the Xray card (82e8ad1)
• xray: run Xray in the operator's timezone so its log matches the panel's (09e58f7)

Bug Fixes

• billing: always show tariff settings regardless of enabled state (7cc5c32)
• datasec: correct error message about secrets.key recovery (26abc24)
• lint: name the UserEventRetentionDays doc comment after its const (6b8c784)
• log: pass structured key/value args to the slog helpers (33d87d4)
• payment amount verification, login lockout hardening, and timezone-correct logs (4169129)
• payments: verify the charged amount matches the order before granting a plan (f585749)
• security: bump Go toolchain to 1.26.5 to patch stdlib CVEs (f4c7b2f)
• server: keep login lockouts when shedding the rate-limiter map (33e3774)
• sub: hide the tariff and payment block for users with no plan (94d2d19)
• ui: stop the Xray card overflowing on mobile (849fd65)
• unify first-run URL label to "Full URL" (a6e8912)

Performance Improvements

• store: index and prune the connections table (92e66e2)