v1.54.0

Security

• Users restricted to specific sites could see device names from the rest of the fleet in live progress updates. While any upgrade or backup ran, progress messages were sent to every signed-in user regardless of their site access, naming devices and reporting how many were affected. The Security and dashboard pages were fixed for this in 1.51.1; this was the same gap in the live update channel. Live progress is now filtered per site, and users who see only part of an operation no longer receive its fleet-wide totals. Unrestricted administrators are unaffected.
  • Live updates on the Commands, Templates, Logs and IDS pages are not yet filtered and are being addressed separately. As before, this only affects what is shown to a signed-in user with restricted site access — nothing is exposed publicly, and no action or device data is reachable that REST access control would not already allow.

Added

• Active Tasks tray. A small panel in the bottom-right corner now shows what the server is working on — upgrades and upgrade queues — from any page. Reloading the page or navigating away no longer hides a running job: the progress is kept on the server, not in the browser tab. Click a task to see its own log.
  • If the server restarts while a job is running, that job is now clearly marked interrupted rather than quietly disappearing.

Fixed

• Starting a second upgrade while another was running produced confusing, jumbled statuses — especially after refreshing the page. The log is no longer rewritten underneath itself, finished upgrades no longer re-stamp their statuses over a newer run, output from two upgrades reads in the right order, and starting an upgrade no longer wipes the live output of one already in progress.