v1.17.0

Security

• Deleting the admin user is now permanent — previously, if you removed the admin account, it was silently re-created with the default admin/admin password on the next restart. The seed now only fires when there are zero users in the database, so a deliberate cleanup stays clean.
• Refresh tokens are invalidated when a password changes — change a user's password and any active refresh tokens issued before that moment are rejected. Previously a leaked token could outlive a password reset by up to 7 days. The refresh endpoint now compares the token's password-change timestamp against the user record and returns 401 Session invalidated by password change if they don't match. Existing sessions stay valid through the upgrade — only new password changes invalidate them.

Added

• Upgrade Queue presets — save the current queue (selected devices + upgrade type) as a named preset, then load it back from a dropdown next time. Useful for recurring routines like a monthly RouterOS update on all branch routers. Save / Load / Manage buttons sit next to the queue actions; loading a preset filters out any devices that have been removed since the preset was saved and tells you how many were missing.
• Command Templates — Import / Export (admin only) — share templates between mikr instances or back them up. Per-card Export button or Export all in the toolbar produce a portable JSON file. Import opens a preview that shows every incoming template, flags name collisions, and highlights destructive commands (reset-configuration, wipe, reboot, shutdown, system/script/run, remove) in red. Choose Skip / Rename / Overwrite as the collision strategy — Skip is the default. Multi-line /system/script bodies are coming as a separate template type in a future release.

Fixed

• PoE-aware upgrade ordering now sees VLAN / bridge / bond connections — previously the topology detection only matched neighbours heard directly on a physical PoE-out port. If a powered device was reached through a management VLAN, a bridge, or a bond, the dependency was silently missed and the queue could power-cycle a parent before its children. The detector now follows VLAN → parent, bridge → members, and bond → slaves, so dependencies through any of those layers are picked up correctly.