v1.4.1

New

• Form sites with an https:// upstream can skip the check of the upstream's
  certificate, e.g. for internal services with a self-signed certificate
  (Caddy's tls_insecure_skip_verify). The connection stays encrypted. The
  site list marks these sites with "Certificate not verified"; rollbacks
  restore the setting.

Changes

• Security: zod 4.6.7, fixing memory exhaustion while validating oversized
  collections (GHSA-mrhx-c7xc-m3w5).
• Metrics show the change against the previous period as a colored percentage
  only; the period is in the tooltip.
• Metrics list the status codes in ascending order.