Release v1.8.0 · MorganKryze/cairn

cairn now fits where your domain has room, reads properly on a screen reader, and hands you the receipts for what you pulled.

✨ Features

Serve cairn from a sub-path. Some organisations hand out paths rather than subdomains. -base-path /cairn puts the whole site under example.org/cairn/ and cairn carries the prefix through every link, redirect, asset and cookie itself, then strips it back off, so the proxy in front needs no rewriting rule: point it at cairn and stop there. A domain, a subdomain and a sub-subdomain worked already and are unchanged. /healthz still answers at the root, so container healthchecks keep working untouched. See Reverse proxies.
Right-to-left languages lay out the right way round. Set an Arabic, Hebrew, Persian or Urdu locale and cairn writes dir="rtl"; the stylesheet is written with logical properties, so the whole page mirrors rather than being patched side by side. The interface words are still yours to translate with strings, since none of the seven built-in languages is right-to-left. See Languages.
Search results reach screen readers. Filtering the cards is a visual change, and a visual change alone tells a screen-reader user nothing. Typing now announces how many services matched and which one Enter would open, in all seven languages, and the arrow keys re-announce as you move. Two new overridable strings, search.one and search.many.

A misbehaving Gatus can no longer exhaust the server. The status response is read through a bounded reader: a fast endless stream now fails instead of growing in memory, which the five-second timeout alone did not prevent.
Slow and idle clients are dropped. The server gained WriteTimeout and IdleTimeout alongside the existing header timeout, so a client that never reads its answer stops holding a connection.
HSTS is sent, but only over HTTPS. It follows the same rule as the cookies: a plain-HTTP LAN deployment must not be stranded by a header it cannot honour.

The page is a third lighter: 186 KB down to 132 KB. The display font was cut from 118 KB to 62 KB by pinning the two variable axes the stylesheet never varies, keeping optical sizing intact. The rebuild recipe is in the reference.
Releases are signed and attestable. The image carries a keyless cosign signature, SLSA provenance and an SBOM; the binaries carry their own attestation and a checksums.txt. The verification commands are two lines.
CI runs on pull requests, which it did not before, so a contribution is built, vetted, tested and scanned before it lands. Publishing steps are gated to pushes, so a fork PR needs no credentials.
Every GitHub action is pinned to a commit rather than a movable tag, and each job asks only for the permissions it writes with.
Coverage is 83%, up from 76%, with the config-reload and status-poll loops now under test; the CI floor moved from 70% to 80%.
The demo makes zero third-party requests. It serves its own icons instead of the CDN, so the page proving cairn's air-gap story no longer contradicts it in the network tab.
A CODE_OF_CONDUCT.md, and the README finally states the accessibility work it had already earned.

docker pull ghcr.io/morgankryze/cairn:1.8.0

This release also moves 1.8, 1, stable and latest.