2.37

Browser UI restructuring, project banner

Code structure

• The browser UI's pure logic moved out of the 1,400-line app.js into small DOM-free modules that also run in Node tests: util.js, settings.js (localStorage, injectable store), filters.js (what lines are visible) and highlight.js, next to the existing formats.js. app.js keeps the DOM wiring and shrank by about 80 lines.
• The text filter now reuses its compiled regular expression instead of rebuilding it for every incoming line, which helps with busy streams.
• 19 new tests for these modules (228 in total). Behaviour was also checked in a real browser (text filter, regex, invert, level chips, colors).

Documentation

• A project banner for the README, the wiki and the repository social preview.
• Contributor docs describe the browser module layout and where new logic belongs.

No functional changes for users.

2.36

Maintenance release: internal restructuring, no behaviour change to speak of

This release reorganises the server code and hardens the project's supply chain. Upgrading is safe and recommended, especially if you are still on a release before 2.35 (which fixed an authentication bypass on the log socket).

Code structure

• index.js (360 lines) is now a ~40-line entry point. The server is built by lib/frontail.js (start() returns a handle with close()), the per-browser socket logic lives in lib/log_socket.js, and the download endpoints in lib/downloads.js.
• Tests can now start the server in-process; 209 tests (up from 174), including new tests for the download endpoints, presets and the server lifecycle.

Fixes

• Container downloads now stop their docker logs process when the browser aborts the download (journal and ssh downloads already did).

Supply chain and security tooling

• Every third-party GitHub Action is pinned to a commit SHA and enforced by the repository; workflow tokens are read-only by default; the Docker base image is pinned by digest.
• Explicit CodeQL configuration (JavaScript and the Actions workflows, extended security queries), Trivy scanning of dependencies, config and the Docker image, and an OpenSSF Scorecard run.
• SECURITY.md with private vulnerability reporting, issue and pull-request templates, CONTRIBUTING.md, CODE_OF_CONDUCT.md and CODEOWNERS.
• Release tags are signed, and releases are now immutable once published (this one is the first created through the draft-then-publish flow).

Documentation

• New screenshots from the live demo, and a full wiki: https://github.com/hbenali/frontail/wiki

2.35 (security fix)

Security fix: authentication bypass on the log socket

Severity: high, for installations that enable Basic Auth (-U/-P). Affects every earlier release, including the upstream project this is forked from.

With Basic Auth enabled, the web page was protected but the WebSocket that streams the logs was not reliably protected: its session check could be satisfied without having passed Basic Auth. A client that could reach the server and work out which log sources it serves could read the live log stream without credentials.

Fixed in 2.35. The session is now marked authenticated only after Basic Auth succeeds, sessions are no longer created for visitors who fail it, and the socket requires a validly signed session cookie whose server-side session is authenticated. Session cookies also get SameSite=Lax and a 24 h lifetime.

What to do: upgrade to 2.35. If you can't immediately, restrict network access to frontail (firewall, VPN or an authenticating reverse proxy in front of it). Installations without -U/-P were never protected by this mechanism and are unaffected by the change. After upgrading, browsers pick up a fresh session automatically on the next page load; a tab that was open before the upgrade needs a refresh.

Other

• The npm package now contains only what runs (bin, lib, web, preset, index.js): 1.2 MB → 76 kB, 149 → 36 files (it used to include screenshots, tests and CI files).

Details and how to report a vulnerability: see the Security page of the wiki.

Full Changelog: 2.34...2.35

2.34

Security

• Full-log reads are capped and de-duplicated. Each "read from beginning" request used to spawn a child process or file stream with no limit, so any browser could spam them. A new request now replaces that browser's previous read, and at most 8 reads run at once across all clients; extra requests get a too many full-log reads in progress message instead of piling up.

Features

• New Prometheus gauge frontail_active_reads (full-log reads in progress).

Documentation

• Fresh screenshots taken from the live demo, higher resolution, with new JSON-lines and access-log examples; used in the README and the wiki (Log formats, Web UI guide): https://github.com/hbenali/frontail/wiki
• Wiki Security and Metrics pages updated for the read limit.

Full Changelog: 2.33...2.34

2.33

Features

• Automatic reconnect for --ssh and --journal sources. A dropped session is retried with exponential backoff (2 s, 4 s, ... up to 60 s; reset after a 30 s healthy run) and reported in the log view (ssh exited with code 255; reconnecting in 4s). Reconnects resume with tail -n 0, so already-shown lines aren't repeated. SSH now sends keepalives so a silently dead connection is detected. A missing ssh/journalctl binary is reported once and not retried.

Fixes

• Reconnecting sources no longer add a blank line to the view each time (blank lines inside the stream are kept).

Documentation

• Updated the wiki (Log sources, Troubleshooting) for reconnect behaviour: https://github.com/hbenali/frontail/wiki

Project

• Release tags are now signed (git tag -s); earlier tags (2.28–2.32) were published unsigned.

Full Changelog: 2.32...2.33

2.32

Features

• New log sources: --journal / --journal-unit <unit> follow the systemd journal (the way to get "syslog" on systems without /var/log/syslog), and --ssh [user@]host:/path follows a remote file over ssh. Failures (ssh login, dropped session) are shown in the log view. Full-log reads and downloads work per source, including mixed file/container setups (previously they could load the wrong source).
• Prometheus metrics: opt-in --metrics exposes /metrics (behind Basic Auth when enabled).
• More auto-colorized formats and the browser format code split into formats.js.
• GitHub wiki with full documentation, published from docs/wiki: https://github.com/hbenali/frontail/wiki

Fixes

• Unreadable or missing files are no longer silent: permission-denied and no-such-file errors are shown in the log view as [frontail] <file>: <reason> (a root-only /var/log/messages or an absent /var/log/syslog used to look like "no logs").
• Daemon mode (-d) forwards all options, and writes its pid file on modern Node.
• Colors and indentation defaults restored (regression from 2.28–2.30, fixed in 2.31) and now covered by a regression test.
• tail's stderr is line-buffered; full-log reads release their child processes when a client disconnects.

Security

• Cross-site WebSocket protection (--allowed-origin for proxies that rewrite Host), Content-Security-Policy, security headers, HTML-escaped page title, constant-time credential comparison without hashing, ReDoS-safe logfmt rule.
• Docker image: patched zlib (CVE-2026-85091).
• Trivy (dependencies, secrets, config, image) and CodeQL results are reported in the Security tab.

Maintenance

• Type-checking with tsc (checkJs) in CI; Node 22/24 matrix.

Upgrade notes

• Behind a reverse proxy that rewrites Host? If the log view stops updating, add --allowed-origin https://your-public-host (see the Security page of the wiki).

Full Changelog: 2.31...2.32

2.31

Fixes

• Log colorizing and indentation were off by default since 2.28 (a side effect of the commander upgrade inverted --ui-no-colors / --ui-no-indent handling). Colors are on again by default; the flags work as documented. Upgrading is recommended for anyone on 2.28–2.30.
• tail child processes and process exit listeners are released on close; in-flight full-log reads are cancelled when the client disconnects.
• CodeQL findings: ReDoS-safe logfmt rule; credential comparison no longer hashes the password.

Security

• Cross-site WebSocket protection: browsers may only open the log socket from the page's own host. Behind a reverse proxy that rewrites Host, allow the public address with the new repeatable --allowed-origin <origin> option (also forwarded in daemon mode).
• Content-Security-Policy (script-src 'self', same-origin connections, frame-ancestors 'self'); the page bootstrap moved from an inline script to init.js.

Upgrade note

If frontail sits behind a reverse proxy that changes the Host header and the log view stops updating, add --allowed-origin https://your-public-host.

Full Changelog: 2.30...2.31

2.30

Features

• More auto-colorized log formats: Spring Boot, Logback [thread] LEVEL logger, Python logging, PostgreSQL, MySQL/MariaDB, Kubernetes klog, Redis, Java stack traces, Python tracebacks, logfmt, Go-style YYYY/MM/DD timestamps.

Fixes

• Daemon mode (-d) now forwards -C/--container-engine, --ui-no-colors and --ui-colors-preset (they were silently dropped), applies --config values, no longer always passes --ui-no-indent, and no longer crashes writing the pid file on modern Node.
• The Apache/Nginx access-log colorizing rule never matched (quotes arrive HTML-escaped); fixed, and HTTP/2 and HTTP/3 are accepted.
• Security hardening: the page title (built from file/container names) is now HTML-escaped; a missing index file returns 500 instead of crashing.

Project

• Added CLAUDE.md/AGENTS.md, rewrote RELEASING.md, removed the obsolete .travis.yml.

Full Changelog: 2.29...2.30

2.29

Security

• Fix: with -U/-P set, the log stream's socket.io namespace was not covered by the session check, so a client with no cookie could still connect and receive log lines. It is now enforced (regression test added). Upgrading is recommended for anyone using Basic Auth.
• Security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy).

Features

• --config <path> JSON config file (CLI flags win), with an optional files list.
• Graceful shutdown on SIGINT/SIGTERM.

Maintenance

• Requires Node >= 22.12 (Node 20 dropped); CI runs on 22 and 24.
• Dependencies bumped to latest majors: commander 15, cookie 2, serve-static 2, jsdom 30, sinon 22, etc.; dropped command-exists, untildify, uuid, configstore, is-docker, universal-analytics.

Included from 2.28

• --password-file and FRONTAIL_USER/FRONTAIL_PASSWORD keep the password out of ps; constant-time credential comparison; removed dead Google Universal Analytics (--disable-usage-stats is a deprecated no-op).

Full Changelog: 2.28...2.29

2.28

Changes

• Security: new --password-file option and FRONTAIL_USER / FRONTAIL_PASSWORD env vars keep the Basic Auth password out of ps; daemon mode passes credentials via env; constant-time credential comparison.
• Privacy: removed the dead Google Universal Analytics usage stats (and its dependencies). --disable-usage-stats is kept as a deprecated no-op.
• Maintenance: upgraded commander 3 → 14 and eslint 6 → 10 (flat config).

Full Changelog: 2.27...2.28