Release 1.3.5

A maintenance release from a review of the interface a keyboard reaches, the account the service runs as, and the statistics page at every width. Upgrading is drop-in: no migrations, no configuration changes. On Linux, running install.sh again is what moves the service off root, and an existing database keeps working.

✨ New

• The overlays behave like modals. Focus moves into a dialog, stays there, and returns to whatever opened it — it used to sit on the control behind the backdrop while Tab walked the whole page underneath. It stays through a save, too: a button that disables itself while it works took focus out of the dialog with it, and the browser says nothing when it does. Menus hand it back the same way, so choosing an integration to add no longer drops you at the top of the document.
• Every dialog can be closed without a mouse. The close control was a bare icon carrying a click: not in the tab order, and announced as nothing, so a reader had to know to press Escape.
• The date range is reachable. Its trigger answered a pointer and nothing else, and the presets sit inside the popover it opens, so a keyboard-only reader was left with whatever range the page loaded with. The month and year arrows behind it announced as nothing.
• The settings menu opens its nine dialogs, and the export menu its two formats; every entry was click-only.
• A change states its direction. All that was announced was a bare magnitude — "5%", with no word for which way, where on ping and packet loss the two directions are opposite verdicts.

🔒 Security

• The service no longer runs as root. Nothing MySpeed does needs a privilege, and it downloads a third-party speedtest CLI at first boot and then spawns it — so running that as uid 0 meant a replaced upstream asset, or any remote-code flaw in the server, executing with full access to the host. The Docker image already dropped privileges; the native installer did not. It now creates a dedicated myspeed account and runs the unit under the standard systemd sandbox — falling back to root, and saying so, where the account cannot be created or the chosen directory is one it could not reach.
• The uninstaller removes that account, instead of leaving an entry in /etc/passwd whose home directory was the path it had just deleted. Not under --keep-data: data that is kept keeps its owner.

🐛 Fixes

• Optimal values — 1.2.3, .. and a lone . were all accepted as thresholds, because the check asked whether every character was a digit or a dot rather than whether the value was a number. No server code reads them, so one was stored behind a success and handed to the browser, where it cannot be read: every speed on the dashboard turned grey.
• Integrations — a display name longer than the column no longer answers 500. No module declares that field, so the loop holding every length cap never saw it: MySQL refused it with a stack in the operator's log, sqlite stored it whole and reported success.
• Restoring a backup — a refused restore says which stored value it could not read. It is abandoned whole on the first one the validator turns down, taking the nodes, the integrations and the history with it, and the only answer was "Error importing config" — leaving every stored value to check by hand.
• Translations — the stability card prints its jitter in milliseconds again. It read "0.8 M" in German, "0.8 m" in Spanish and "0.8 Mms" in French, and Russian gave the same unit in two scripts in one card. All four are held against each other from here.
• The statistics page — a reading is no longer stated without its verdict. The grade is worn by the icon, and the icon was the first thing a tight card gave up; it is kept at every width now, and the figure steps instead — once for all four panels rather than four times at four different widths. The top row squares from 1417px too, where the summary's descriptions stop fitting and it was left holding room it had nothing to put in: at 1300px all three cards read at full size on 365px each, where two had been a step down.
• Installing on Windows — the installed entry credits the project, with About, Help and Update links, where Add/Remove Programs had shown a bare given name as Publisher and no link back. Not the "Unknown publisher" line on the UAC prompt: that one is read from the file's signature and nothing else changes it.

---

Downloads

Platform	x86-64	ARM64
Windows	EXE · MSI · EXE (no AVX2) · MSI (no AVX2)
Linux	Binary · No AVX2	Binary
macOS	Binary	Binary

Source Distribution

• ZIP Archive (requires Bun runtime)

Docker Images

• i7gamer/myspeed:latest
• i7gamer/myspeed:1.3.5

---

What's Changed

• Fix/panel row steps by @i7Gamer in #19

Full Changelog: v1.3.4...v1.3.5