v1.40.1

Security fixes

• Fix XSS when rendering tree CVE-2026-66824 / GCVE-1-2026-20140, reported by @Wachizungu
• Fix DoS when submitting an existing capture CVE-2026-66913 / GCVE-1-2026-20075 / GHSA-qx55-vgf5-p6p8, reported by @EQSTLab

New features

• Show websocket streams from HAR dump (UI is not finalized)

• Private captures (only visible as admin or with a temporary token)

• Expose form to change the visibility of a capture

• Scripts to build trees and index archived captures in the background

Changes

• Support kvrocks 2.16
• Massive refactoring of how the captures are queried from the cache (related to private captures)
• Improve race conditions when handling captures to monitor
• Speedup background indexing

Fixes

• Improve handling of Trusted Timestamp verification, reported by @Wachizungu
• Make sure the VT module uses the global proxy, if any, reported by @Wachizungu
• Properly escape values passed to a URL on the tables views, reported by @Wachizungu

What's Changed

• fix: typo in ollama_report module by @Wachizungu in #1354
• build(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #1348
• build(deps): bump docker/build-push-action from 7.2.0 to 7.3.0 by @dependabot[bot] in #1350
• build(deps): bump docker/metadata-action from 6.1.0 to 6.2.0 by @dependabot[bot] in #1351
• build(deps): bump docker/login-action from 4.2.0 to 4.4.0 by @dependabot[bot] in #1352
• build(deps): bump actions/setup-python from 6 to 7 by @dependabot[bot] in #1353
• build(deps): bump docker/login-action from 4.4.0 to 4.5.2 by @dependabot[bot] in #1369

Full Changelog: v1.40.0...v1.40.1