v1.4.1

New

• Form sites with an https:// upstream can skip the check of the upstream's
  certificate, e.g. for internal services with a self-signed certificate
  (Caddy's tls_insecure_skip_verify). The connection stays encrypted. The
  site list marks these sites with "Certificate not verified"; rollbacks
  restore the setting.

Changes

• Security: zod 4.6.7, fixing memory exhaustion while validating oversized
  collections (GHSA-mrhx-c7xc-m3w5).
• Metrics show the change against the previous period as a colored percentage
  only; the period is in the tooltip.
• Metrics list the status codes in ascending order.

v1.3.2

Security

• The image runs on Node.js 24.22.1, fixing an out-of-bounds write in the
  Brotli decoder (remote code execution), TLS hostname verification bypasses
  and a dns.resolve name truncation, among others.
• Next.js 16.4.2, fixing two critical remote code execution vulnerabilities
  (image optimization API with SVG files, use cache) and a denial of service
  through Server Actions.

Changes

• Metrics show the change against the previous period of the same length, up
  to the same time (e.g. the previous 24 hours): requests, traffic, server
  error rate and average response time, the status classes and, per host,
  requests and server errors. A rise in errors or response time is red, a fall
  green; requests and traffic stay neutral. Also on the dashboard.
• A managed directory that is missing or not writable for UID 1000 is no longer
  reported as "Another instance is reading" / "Another instance is active". The
  access log card and Caddy Config now say "Managed directory not writable",
  the access log card shows the command to fix it, and the container log
  states the cause.

v1.2.0

• Form sites can be redirects: any http(s) target, placeholders such as
  {uri} allowed, with 301, 302, 307 or 308 (Caddy's redir). Basic auth stays
  reserved for reverse proxies, since Caddy redirects before it would ask.
• Caddy Config lists the sites of your Caddyfile with their access log state
  and adds import access_log to the selected ones, or to all at once. Caddy
  checks the change first; it is a revision like any other and can be rolled
  back.
• The Caddyfile editor and the sites.caddy preview have syntax highlighting.

v1.1.0

• Form sites can be protected with HTTP basic auth (one user per site, HTTPS
  only). The password is stored as a bcrypt hash only, kept when the field is
  left empty, and never shown again; the preview hides the hash. Rollbacks
  restore the credentials of the chosen revision. Requires Caddy 2.8 or newer

v1.0.2

• Access log ingestion no longer fails with disk I/O error: SQLite writes its
  temporary files to the data volume, since the container's filesystem is read-only.
• Settings explains an access log without read permission (a file Caddy created
  before mode 644) and shows the command that fixes it.
• Dashboard: the last 24 hours come first, the sites of the running Caddy
  configuration below.

v1.0.0

First public release