Release v0.36.2

What's Changed

🚀 Features

• harden CodeQL findings gate + fix cookie-suppression comment placement
• fail CodeQL findings gate on any severity by default, add documented exceptions
• add shared CodeQL findings-gate script and ignore-list schema
• add What's New changelog popup shown after app updates
• render Security group in WhatsNewModal
• add security category to changelog generation
• add What's New modal and Appearance Settings integration
• add per-user changelog API and User model fields
• add embedded changelog package and generation pipeline

🐛 Bug Fixes & Improvements

• split docker-build.yml multi-arch build to fix arm64 QEMU timeout (#1232)
• bump nanoid to 3.3.18 to patch GHSA-2v37-7h3g-55p8
• split docker-build.yml multi-arch build to fix arm64 QEMU timeout
• close out issue #619 test-infrastructure debt (unskip Vitest suites, replace tautological E2E assertions, fix real bugs found along the way) (#1223)
• add accessible names to icon-only delete button and log filter selects
• scope local CodeQL/Trivy scans to feature-adding changes
• stop full local 3-browser Playwright runs, defer to CI
• match established 10s WebKit headroom for reload-then-verify in ntfy token security test
• give the manual-challenge panel heading the same WebKit headroom as its button
• recognize Firefox's NS_BINDING_ABORTED as an expected navigation race
• bound and catch networkidle waits in theme/banner spec helpers
• serialize proxy-host-drag-drop suite to remove group-state race
• bound and catch networkidle waits in modal-dropdown-triage
• wait for dropdown option visibility before focusing in DNS provider type tests
• wait for API response before asserting whitelist conflict error
• raise invalid-syntax error banner timeout (webkit)
• raise close-modal assertion timeouts in caddy-import gap test
• raise session-resume banner timeout to match file convention
• wait for login form before filling on empty-password test
• retry create-user-then-login race in test fixtures on 401
• stop inferring CrowdSec install state from incidental file presence
• auto-sync PLAYWRIGHT_CADDY_PROXY_PORT for local E2E rebuilds
• keep toast notifications accessible while a modal dialog is open
• guard Login.tsx state update against unmount race condition
• inject What's New changelog fixture in local E2E rebuild script
• scope proxy-hosts heading locator and seed test data for bulk-selection test
• add aria-current to active navigation links
• replace tautological assertions in remaining security-UI and settings E2E specs
• correct Access List UUID usage and CGNAT warning i18n keys
• replace tautological assertions in proxy-hosts and access-lists E2E specs
• replace tautological assertions in certificates.spec.ts with real backend-verified checks
• unskip Security.* Vitest suites now that undici/jsdom WebSocket bug is fixed
• update dependencies for axe-core, electron-to-chromium, and immer to latest versions
• retry transient SQLite lock errors when creating uptime monitors
• apply busy-timeout/WAL pragma to uptime test DB to resolve SQLite lock flake
• update opentelemetry http instrumentation to v0.70.0
• remove unused imports/variables flagged by CodeQL in settings/tasks E2E specs
• remove unused imports/variables flagged by CodeQL in security E2E specs
• remove unused imports/variables flagged by CodeQL in core E2E specs and fixtures
• correct CodeQL suppression comment placement in auth, crowdsec, and backup handlers
• strengthen file path safety checks in system administration handler
• correct stale node:24.19.0-alpine3.24 image digest
• strengthen file path safety checks in system administration handler
• wrap WAF-check requests in retryAction for CI network resilience
• avoid redundant login for rate-limit test's new user
• use API-based cleanup in auth-middleware-cascade afterEach
• unique per-test proxy domain and correct dialog-dismiss timing
• remap local Caddy proxy port to avoid host port 80 conflict
• use rendered content instead of page.url() to detect access denial
• replace strict-mode-unsafe dialog locator in ACL integration tests
• resolve Security Enforcement failures in auth/ACL/WAF/rate-limit specs
• replace docker-socket-proxy with Orthrus remote agent
• align frontend audit log response types with backend contract
• target Caddy proxy port for WAF/ACL checks, stop shared-session logout
• fix Containers dropdown resetting to placeholder after selection
• fix test-side hangs and wrong-origin WAF assertion in security specs
• replace CSS-class-guessing locators and too-tight timeout in security specs
• make Security Enforcement jobs actually run security-enforcement/ and security/ specs
• suppress What's New modal for ad-hoc raw-API test users
• guard WhatsNewModal against null group fields
• normalize nil array fields to empty on entry read
• suppress What's New changelog modal for shared/auto-created test users
• inject E2E changelog fixture before Shard 4 image build
• auto-revert generated changelog.json after local Docker builds
• extend gotoTolerant() coverage to theme/appearance nav helpers
• close non-semver gaps in seeding and permanent dismissal
• handle stale post-login navigation in shared loginUser helper
• treat non-semver running versions as dev builds
• resolve WhatsNewModal session-dismissal and stale-state bugs

---

Full Changelog: v0.36.0...v0.36.2