v1.13.0 - "The Audit Release"

The largest release yet: the tree behind this is the result of four adversarial audits and the fixes they produced, most recently a 145-finding sweep across twelve independent auditing lenses (all fixed or otherwise resolved) plus a hardening pass on the admin console itself.

Security

• The admin console can now be locked to your services account, not just your nick: setup optionally asks for your services host right after the admin nick question and wires it into ADMIN_HOSTMASKS for you, blank to skip as before. A stolen nick alone can no longer run admin commands.
• The admin console's listen mode no longer locks the operator out of their own console when the operator and the bot share one home router (a NAT hairpin): the operator's own connection arrives with a private address rather than the shared public one it advertises, and is now accepted alongside it - without opening the door to a stranger on the public internet.
• The dashboard and console login throttles no longer remember every address that ever mistyped a password indefinitely; a link from another site can no longer log you out or submit dashboard actions with your session; the first-run setup link is now good for one browser only.

Also in this release

• A download nobody accepted is now reported as such, with a configurable wait (DCC_ACCEPT_TIMEOUT) instead of a fixed 30 seconds.
• Multi-list operators get an accurate per-list "List update completed" line instead of only the first list's count.
• Only one DCCore runs from a folder at a time.
• Several !rar packing races and cleanup issues, a handful of mislabelled/confusing log and dashboard messages, and a long list of documentation corrections (stale file names, stale step numbers, stale claims about what's implemented).

133 changes in total - see docs/UPDATES.md for the full writeup, and docs/INSTALL.md for upgrading from an existing install.

🤖 Generated with Claude Code