2.32

Features

• New log sources: --journal / --journal-unit <unit> follow the systemd journal (the way to get "syslog" on systems without /var/log/syslog), and --ssh [user@]host:/path follows a remote file over ssh. Failures (ssh login, dropped session) are shown in the log view. Full-log reads and downloads work per source, including mixed file/container setups (previously they could load the wrong source).
• Prometheus metrics: opt-in --metrics exposes /metrics (behind Basic Auth when enabled).
• More auto-colorized formats and the browser format code split into formats.js.
• GitHub wiki with full documentation, published from docs/wiki: https://github.com/hbenali/frontail/wiki

Fixes

• Unreadable or missing files are no longer silent: permission-denied and no-such-file errors are shown in the log view as [frontail] <file>: <reason> (a root-only /var/log/messages or an absent /var/log/syslog used to look like "no logs").
• Daemon mode (-d) forwards all options, and writes its pid file on modern Node.
• Colors and indentation defaults restored (regression from 2.28–2.30, fixed in 2.31) and now covered by a regression test.
• tail's stderr is line-buffered; full-log reads release their child processes when a client disconnects.

Security

• Cross-site WebSocket protection (--allowed-origin for proxies that rewrite Host), Content-Security-Policy, security headers, HTML-escaped page title, constant-time credential comparison without hashing, ReDoS-safe logfmt rule.
• Docker image: patched zlib (CVE-2026-85091).
• Trivy (dependencies, secrets, config, image) and CodeQL results are reported in the Security tab.

Maintenance

• Type-checking with tsc (checkJs) in CI; Node 22/24 matrix.

Upgrade notes

• Behind a reverse proxy that rewrites Host? If the log view stops updating, add --allowed-origin https://your-public-host (see the Security page of the wiki).

Full Changelog: 2.31...2.32