V1.3.5.3

Spirit Panel V1.3.5.3

Security-focused release: origin hardening for Layer-7 floods when the panel sits behind Cloudflare.

Added

• Nginx connection and request limits — separate budgets for web, API, and auth; higher allowance for /api/remote (FeatherWings); concurrent connection cap per IP. Zones in deploy/nginx/spirit-panel-http.conf.
• Cloudflare origin helpers — cloudflare-realip.conf, sync-cloudflare-realip.sh, and ufw-cloudflare-origin.sh (80/443 from Cloudflare only). WAF / Managed Challenge guidance in SECURITY.md and PRODUCTION.md.
• TLS session hardening in the reference nginx site (TLS 1.2/1.3, shared session cache, tickets off).
• Nginx open-file headroom — raise-nginx-nofile.sh raises worker_rlimit_nofile / systemd LimitNOFILE so floods do not tip nginx into Too many open files (HTTP 500 on static assets).

Upgrade: spirit.sh update --ref V1.3.5.3 (or spirit.sh update on the release channel).

After updating, install rate-limit zones, restore Cloudflare visitor IPs, raise nginx FD limits, then (once Proxied DNS works) lock origin 80/443 to Cloudflare. See SECURITY.md → Layer-7 / TLS floods. Do not re-run a full install just to refresh nginx — copy/merge the site config and keep your server_name / cert paths.

V1.3.5.2

Spirit Panel V1.3.5.2

Infrastructure Status page, shell layout/navbar branding, atmosphere scenes, and a broad admin/client UI polish pass — plus security dependency and node health fixes.

Added

• Status page — optional fleet status under Settings → Features. Logged-in users always have access when enabled; admins can also allow public /status. Choose server names vs counts-only. Per-node online/maintenance, counters, live vs allocated meters, and fleet Global Memory / Disk / Average CPU (host-core weighted).
• Shell layout branding — Sidebar or Navbar for admin and client areas (Settings → Branding → Layout → Navigation).
• Navbar style presets — Classic / Pills / Underline / Compact icons / Split when shell layout is Navbar.
• Atmosphere scenes — fresh login and panel backdrops (Aurora, Orbits, Constellation, Ripple, Beams, Tide, Ember, Lattice, Prism, Halo, Mist, Solid). Old preset IDs map across automatically.

Removed

• Previous login/panel background presets (nebula, gradient, mesh, grid, and the rest of the old list).

Fixed

• Light mode atmosphere — panel scenes no longer paint a dark navy stage behind light UI.
• Dependency advisories: nodemailer, vite, zod, and fast-uri override; pnpm audit / audit:security clean.
• Duplicate HSTS on proxied API responses when nginx already sets it.
• Nginx server_tokens off.
• Node online/offline flap — 45s grace across a missed FeatherWings health check; dashboard no longer caches a failed check.

Changed

• Admin Settings tabs regrouped (Registration → Security; Discord login and Cloudflare DNS → Features).
• Broad admin/client chrome polish: manage tabs, theme cycle, navbar, My Servers, node/location/user/server detail, Announce, tickets visibility, Profile tabs, and Installer 3.0.x channel/skip-rebuild behavior.

Upgrade: spirit.sh update (or spirit.sh update --ref V1.3.5.2).

V1.3.5.0

Spirit Panel V1.3.5.0

FeatherWings 1.4.3 recovery settings, console Tab completion, and the boot fix that was skipping every server.

Added

• FeatherWings 1.4.3 runtime options. Each server can start again after the node reconnects (a manual Stop or Kill skips the next restore) and can turn crash restarts on or off. Startup → Recovery edits those. Node settings write crash detection, install exit-code checking, and Docker CPU shares into the generated Wings config (replace config.yml and restart FeatherWings to apply).
• Console Tab completion asks FeatherWings and inserts the returned range. Repeated Tab cycles when there is more than one match. Older Wings builds ignore the request.

Fixed

• Database update 20261028120000_wings_runtime_options uses MySQL syntax. The first version quoted table names with double quotes, which MySQL rejects.
• FeatherWings boot skipped every server (unexpected end of JSON input) because the server list omitted process_configuration.
• Sidebar attribution keeps Spirit-Panel and the version on one line.
• File editor Find jumps to matches.
• File editor no longer crashes the tab when typing or pasting @.
• Subuser invites no longer send invalid user.* permissions. Catalog matches the API grant list, with Select all.
• FiveM marketplace GitHub installs can target any repository branch.

Changed

• Server Subusers page polish.
• FiveM script detail aligned to Plugins chrome.
• FiveM install wizard groups Releases and Branches.

Upgrade: spirit.sh update (or spirit.sh update --ref V1.3.5.0). This release runs migration 20261028120000_wings_runtime_options. If an update already failed on that migration, run the updater again so it clears the failed record and applies the MySQL SQL. Deploy this panel before upgrading FeatherWings.

V1.3.4.5

Spirit Panel V1.3.4.5

Fleet UX polish, faster server shell, and Support chat aligned with billing conversations.

Security

• Dependency advisories cleared (pnpm audit clean): nodemailer → 10.1.x, fastify → 5.12.7, @fastify/multipart → 10.1.4; overrides for @fastify/busboy, fast-uri, http-cache-semantics, and source-map-js.
• Session-only for profile/2FA/PAT/SSH key changes; email change requires current password.
• Application API keys require explicit permission scopes (no silent full-access default).
• Admin node detail no longer returns daemonTokenId / daemon secrets.
• Database hosts never return stored passwords; host create/update/delete require full admin.
• Plugin catalog mutations require full admin.
• Local backup download path jail hardened (UUID-only segments, no symlink follow).
• Discord ticket webhooks re-validated at send time; email headings HTML-escaped.
• Network guard rejects IPv4-mapped IPv6 loopback/link-local; player-count queries block metadata/loopback hosts while still allowing RFC1918 game allocations.

Performance

• My Servers list API selects only list fields; admin users list no longer loads password hashes.
• Polling skips overlapping My Servers / Alerts refreshes; useAsyncData refetch always fetches fresh.
• Console WebSocket reconnect uses exponential backoff (capped at 30s); client shell routes have an error boundary.
• Server shell loads eagerly; tab chunks suspend only in content; idle/hover prefetch; soft revalidate; analytics/ping/player-count polling pauses while the tab is hidden.

Added

• Dev seed: Demo FiveM Server (FiveM nest/egg + marketplace access).
• Ticket staff alerts (ticket_opened / ticket_user_reply) with deep links and live toasts.
• Delete alerts from the inbox (one or clear all).
• Installer progress UX (spirit.sh 2.0.7).
• FeatherWings join-data for 1.4+ configure, plus remote health/config endpoints.

Fixed

• Clearer console "Node unreachable" notice.
• Admin Subdomains no longer 500s (server_domains migration).
• Admin server Manage Startup for full panel admins when Admin server support is enabled.
• Console auto-scroll stays on by default.
• My Servers no longer duplicates Online/Offline/Installing/Total filters.

Changed

• Alerts, Support inbox, and Support ticket chat polished to fleet/manage chrome (and billing-style chat).
• FiveM Marketplace rebuilt onto the Plugins manage shell.
• Server Analytics, Plugins, and Activity manage tabs polished.
• Admin dashboard / System activity / Locations / Nodes / Subdomains fleet chrome.
• My Servers redesign; Alerts always on (presets/rule CRUD removed).
• Sidebar: removed PWA "Install app"; quieter Spirit-Panel attribution linking to Discord.

Removed

• Unused profile security sidebar, alert presets/rule CRUD UI+API, orphaned helpers.
• Local Redis dump.rdb ignored from git.

Upgrade: spirit.sh update (or spirit.sh update --ref V1.3.4.5). Run pnpm db:deploy if you have pending migrations (e.g. server_domains).

V1.3.4.3

Added

• In-app alerts with presets (Essential, Performance, Storage, Account security, Server access, Full watch, Node health)
• Lifecycle metrics: crash, unexpected stop, install failed
• Account/server security watches: failed sign-in, new sign-in, password/2FA/API key changes, subuser add/remove

Changed

• Alerts inbox and watches redesigned with severity, actions, and last-fired
• Browser ping uses Wings websocket auth RTT (no /api/system 401 console noise)
• Select dropdowns flip into viewport and scroll
• Historical trends redesign on server and node analytics

Removed

• Unused leftover pages, unused UI/API helpers, and tracked tsconfig.tsbuildinfo caches

Hosts: spirit.sh update -y (runs new alert migrations).

V1.3.4.2 - fix Admin Settings crash

Spirit Panel V1.3.4.2

Fixed

• Admin Settings crashed on load: useBlocker is incompatible with BrowserRouter. Tab leave confirm + beforeunload kept.

Update

curl -fsSL https://raw.githubusercontent.com/SpiritFramework/SpiritPanel/main/scripts/spirit.sh -o /tmp/spirit.sh
sudo bash /tmp/spirit.sh update -y

V1.3.4.1 - fix shared ESM for panel-web build

Spirit Panel V1.3.4.1

Fixed

• @spirit/shared is now ESM with explicit named re-exports so Vite/Rollup can import compareVersionStatus (fixes panel-web production build failure after V1.3.4.0).

Update

curl -fsSL https://raw.githubusercontent.com/SpiritFramework/SpiritPanel/main/scripts/spirit.sh -o /tmp/spirit.sh
sudo bash /tmp/spirit.sh update -y

V1.3.4.0 - audit leftovers (API, ConfirmModal, CSP)

Spirit Panel V1.3.4.0

Second audit tranche: API hardening, ConfirmModal leftovers, full nginx CSP sync, UI a11y polish.

Security

• Application API keys with permissions: null / empty scopes are denied
• Password reset tokens stored hashed (SHA-256)
• Secret encryption v2 (per-secret salt); legacy still decrypts
• Login lockout by identity alone
• Production rate-limit store errors fail closed

Fixed

• Wings /servers/reset no longer marks mid-install servers installed
• Browser probe hits /api/system (quieter DevTools)
• nginx CSP sync compares the full CSP add_header line
• Settings dirty leave + remaining confirm() → ConfirmModal

Changed

• Version compare in @spirit/shared; installer SCRIPT_VERSION 2.0.6

Update

curl -fsSL https://raw.githubusercontent.com/SpiritFramework/SpiritPanel/main/scripts/spirit.sh -o /tmp/spirit.sh
sudo bash /tmp/spirit.sh update -y

V1.3.3.0 - security and reliability audit tranche

Summary

Security and reliability tranche from the Spirit-Panel audit, plus UX hardening.

Security

• Application API sanitizes server/owner responses (no Wings daemon tokens / password hashes / TOTP / PATs)
• Cannot disable/reset/delete elevated accounts via Application API
• DNS-resolved SSRF checks for DB + SMTP hosts
• SQL guard blocks OUTFILE / LOAD_FILE / LOAD DATA
• Staff node JSON no longer includes daemonTokenId

Reliability

• Atomic allocation claims + in-transaction capacity checks
• Safer Wings-aware server delete
• Schedule run locking via lastRunAt claim
• Zip/tarball updates preserve panel-api and packages dist

UX / ops

• Settings load error + retry; post-login deep links; console command errors; PWA reload banner
• nginx security headers on cached locations; featherwings docs/binary alignment; Redis systemd ordering
• Installer SCRIPT_VERSION 2.0.5

Update

curl -fsSL https://raw.githubusercontent.com/SpiritFramework/SpiritPanel/main/scripts/spirit.sh -o /tmp/spirit.sh
sudo bash /tmp/spirit.sh update -y

V1.3.2.3 - quieter browser latency probe

Summary

• Quieter browser latency probe. Server ping uses one sample every 60s instead of three every 15s, so DevTools is not flooded with expected FeatherWings GET / 404s (Wings has no document at /; the probe only needs a network response for RTT).

Update

curl -fsSL https://raw.githubusercontent.com/SpiritFramework/SpiritPanel/main/scripts/spirit.sh -o /tmp/spirit.sh
sudo bash /tmp/spirit.sh update -y