v1.3.132

v1.3.132

UI

• Visible brand/icon watermark on every tile — pinned cards and emoji/letter tiles now included (no more blank backgrounds). Restored the tilted/diffuse brand watermark, un-throttled pinned-card watermarks, and bumped opacity for thin-line logos.

Security hardening (since 1.3.130)

• Login brute-force guard: POST /api/auth/login limited to 5 attempts / 5 min per IP+user (429 + Retry-After).
• UI-set admin password no longer overwritten on restart.
• Swagger /docs off by default (NETDASH_DOCS_ENABLED=true to enable).
• python-jose -> PyJWT (CVE-2024-33663 / CVE-2024-33664); explicit cryptography pin.
• SSRF guard for server-side fetches (blocks cloud-metadata endpoints).

Discovery

• Find ICMP-blocked hosts in normal mode (e.g. Proxmox at .200) via TCP sweep; stop truncating stat labels.
• Expanded brand/type recognition (UniFi, QNAP, printers, cameras, remote-desktop tools).

Deployment

• QNAP via Dockge (Container Station stays as the Docker engine).
• CI test gate (ruff + pytest) before the multi-arch build.

Image: ghcr.io/lobrzut/netdash:1.3.132 and :latest