v0.97.0

0.97.0 (2026-08-06)

Added

• account for VM memory ballooning in host memory reporting (#1750) (c613010)
• add inspect image action on stack container cards (#1780) (4e54a92)
• add node-scoped opt-out for image update detection (#1715) (fa503dd)
• add ntfy notification channel (#1761) (0ba09eb)
• add stack:read permission gate to Settings Labels section (#1747) (7c02f6e)
• add target-aware RBAC authorization to Scheduled Operations (#1745) (209c9c5)
• auth: add SSO-only authentication mode (#1714) (e175db8)
• compose-doctor: show All Clear when findings are acknowledged (#1721) (543e4ef)
• expose Community audit log via system:audit navigation (#1740) (a1e2846)
• fleet-secrets: graduate encrypted fleet-wide environment bundles to Community (#1758) (5f5cd5e)
• fleet: add Node details sheet to the node card kebab (#1752) (97be019)
• fleet: reapply Compose configuration without a version update (#1716) (b0b423b)
• fleet: show itemized prune plans (#1734) (44d6078)
• live-refresh stack detail container and health state (#1712) (60092dd)
• make the Files explorer tree pane resizable (#1774) (85b8411)
• rbac: make Settings authorization permission-aware (#1738) (a3026f4)
• rbac: make stack-scoped grants node-specific (#1727) (9922d8e)
• recovery: make rollback-recovery image lifecycle visible and controllable (#1753) (41bf075)
• schedules: auto-update stacks by Stack Label (#1717) (72cdbb0)
• surface ZFS ARC reclaimable as dashboard context line (#1760) (71be163)
• validate scheduled task target existence at creation time (#1757) (5240957)

Fixed

• allow chmod on protected stack files (#1772) (a826cd3)
• auth: align WebSocket token_version checks with HTTP (#1744) (a74905f)
• auth: gate scoped JWTs on container-exec WebSocket (#1741) (ce4b91e)
• auth: keep active sessions alive and add stay-signed-in (#1711) (681ecc7)
• bump golang.org/x/text to v0.39.0 in Docker CLI and Compose builds (#1728) (d698eb4)
• compose-doctor: resolve effective healthcheck coverage (#1713) (78475d9)
• condition --volumes in downStack() on the removeVolumes option (#1764) (92d974b)
• credit issue openers linked to a PR without closing text (#1718) (ea38113)
• dashboard: scope alert-rule count to stacks on the active node (#1722) (c90e960)
• files: preserve tree expand state after mutations (#1773) (9b48121)
• fleet-secrets: invalidate stale preview when target inputs change (#1756) (bfabdc2)
• forward scoped node-admin permission for Settings writes through remote proxy (#1748) (ba017ee)
• image-updates: explain persistent digest rebuilds after update (#1784) (4fa5325)
• keep fleet prune estimate bytes after a target timeout (#1783) (575848e)
• mesh: close error-listener race in pilot tunnel reverse-dial connect (#1754) (48c89d2)
• networking: ignore verified Mesh attachments in drift (#1729) (3c93406)
• proxy: forward scoped stack evidence for alerts, auto-heal, and node-wide image refresh (#1749) (2e2b095)
• rbac: enforce operational permission parity (#1736) (c704cb5)
• rbac: handle permission metadata failures (#1735) (a65bf4d)
• rbac: permission-gate alerts, auto-heal, and image updates (#1743) (1580131)
• reduce prune estimate work and add managed-scope timeout (#1768) (e2fc3a5)
• resources: attribute free images to managed prune by repository family (#1769) (a29d451)
• surface NOT_EMPTY error code so DeleteFileConfirm can offer recursive delete (#1765) (4be3319)
• ui: flatten single-container Update onto the service row (#1759)q (1c9060a)
• ui: restore equal gutters on container logs modal (#1771) (63a3594)
• ui: show delayed busy feedback on confirm actions (#1763) (5d89a10)