v1.0.0.19

🔒 Security

• Fixed argument injection in the network scanner. The Scan Interface setting and the scan subnet were passed straight to arp-scan. Someone with API access could use them to add their own command options. Inputs are now validated and passed safely. Invalid subnets return a clear 400 error. Upgrading is recommended, especially if dashboard authentication is off.

🐛 Bug Fixes

• Offline detection now works with CIDR input. Scanning 192.168.1.0/24 (instead of 192.168.1.) now marks devices that disappeared as Offline.
• "Test Notification" reports the real result. Before, it always said it worked, even when the webhook URL was unreachable or rejected the message.
• Faster, more accurate scans in the all-in-one image. arp-scan was missing from the combined Docker image, so scans always fell back to the slower ping sweep. It's now included.
• Agent memory usage is accurate. Agents now report used memory the same way free does. Before, the number was too high on many systems.
• No more long hangs on offline agents. Requests to an unreachable agent now time out after 10 seconds instead of up to 100.
• Scans can't stall forever. System tools used during a scan now have a 60-second limit.
• Dashboard stability: the device lists no longer crash when the API returns an error. The Settings dialog now tells you when saving fails instead of closing as if it worked.
• Login and setup: empty usernames are handled cleanly. The minimum username length is checked after spaces are trimmed.

⬆️ Updates

• Runtime: Node.js 20 → 24 LTS, since Node 20 no longer gets updates.
• Frontend: Next.js 16.4, React 19.3, ESLint 10, TypeScript 6, and smaller dependency updates. npm security fixes applied.
• Backend: Entity Framework Core and ASP.NET Core packages 10.0.12, Swashbuckle 10.3.