Release 1.3.4

Changes since 1.3.3

A maintenance release from a second whole-project review, covering the integrations' outbound side, the node proxy, the install and release scripts, and the statistics page at every width and in every language. Upgrading is drop-in: one migration runs by itself on MySQL, and sqlite needs nothing.

🔒 Security

• An integration can only reach a real destination. A webhook, healthchecks, gotify, ntfy or InfluxDB URL pointing at a link-local address — 169.254.169.254 is the cloud metadata service — is refused before the request leaves and reported as a failed send. Loopback still works, so InfluxDB or gotify on the same host is unaffected.
• A node can no longer decide what runs at your origin. Proxied answers are limited to JSON, CSV and binary; anything else arrives as bytes rather than as a document your instance renders.
• Your ntfy topic is redacted like a password. With no token set it is the whole of publish and subscribe control, and it used to be visible on a demo instance and in a configuration export marked "secrets redacted".
• Integration credentials stay out of the log. A failed database write used to print the telegram token, the webhook URL and the influx token to disk.
• A demo instance answers for less. The exports, the adapter list and the node proxy are closed to strangers, and the welcome dialog can be dismissed.
• The statistics endpoint has its own rate limit, like the export that reads the same rows.
• Release inputs never reach a shell as code, anywhere in the publishing chain.

🐛 Fixes

• Nodes — removing a stored node password works, instead of reporting success while the old one was kept and reused. A revalidated request is no longer reported as "the node redirected the request". A password prompt that cannot reach the node says so.
• Backups — restoring a history no longer silently discards the rows whose ids clash with tests recorded since, and the result says how many were imported and how many skipped.
• Network interfaces — an adapter that disappears for one refresh, as a VPN restart does, no longer repoints every later measurement onto the wrong link. Detection is also faster.
• Integrations — a Discord display name over 80 characters no longer blocks every notification.
• In the browser — the dashboard works where localStorage is blocked: Incognito, third-party cookies off, and the embedded frames it is meant to sit in on Homepage or Heimdall. Signing in and out can no longer hang with nothing on screen.
• The statistics page — the summary card takes its own row from 1250px. Opened, it uses the width of the screen instead of a fixed column, wraps long descriptions instead of cutting them, and keeps every value on its own line. Row labels are no longer cut in any of the fifteen languages. A failed test's reason gets a second line on a phone.
• Installing — a failed or interrupted download no longer overwrites a working install and reports success. Published x86-64 binaries are started and asked to serve a page before they are uploaded.

---

Downloads

Platform	x86-64	ARM64
Windows	EXE · MSI · EXE (no AVX2) · MSI (no AVX2)
Linux	Binary · No AVX2	Binary
macOS	Binary	Binary

Source Distribution

• ZIP Archive (requires Bun runtime)

Docker Images

• i7gamer/myspeed:latest
• i7gamer/myspeed:1.3.4

---

What's Changed

• Fix/review p0 p1 by @i7Gamer in #17
• Fix/review p1 p3 by @i7Gamer in #18

Full Changelog: v1.3.3...v1.3.4