nfsen-ng v1.0.0-beta.2 (2026-07-08)

Update recommended — this beta includes a static-file security fix: php-via's static handler was scoped to the project root with no extension allowlist, so backend/**/*.php, backend/settings/settings.php, composer.json, and the entire .git/ history were served over plain HTTP. It's now scoped to frontend/ only. If you expose an instance, please update.

Highlights:

• Sankey gains an optional destination-port column — src IP → dst port → dst IP — with the port shown as a centered chip on its node (#152).
• No more reload-and-lose-state: php-via 0.12.0 context revival rebuilds a torn-down SSE context on reconnect, so a backgrounded tab keeps its active tab, dark mode, scroll, and in-progress filter text instead of hard-reloading (#151).
• Fixes: the Flows tab now honours the source selector (#155); the traffic graph's last data point no longer renders as 0 (#154); alert rules with an nfdump traffic filter now actually evaluate and can fire (#153).
• Unraid: Community Applications packaging under deploy/unraid/ — UI + nfcapd collector templates, plus an all-in-one Compose stack.
• :latest now tracks the newest release, betas included — so docker pull ghcr.io/mbolli/nfsen-ng:latest works for pre-releases (previously stable-only), and digest-based update checks (Unraid's Docker page, Watchtower) flag each new release.

Help us test v1.0.0-beta.2 before the stable release:

curl -O https://raw.githubusercontent.com/mbolli/nfsen-ng/master/deploy/docker-compose.yml
# set image: ghcr.io/mbolli/nfsen-ng:1.0.0-beta.2  (or :latest)
# and set your nfcapd source path
docker compose up -d

Please open issues at https://github.com/mbolli/nfsen-ng/issues. The goal is a stable v1.0.0 shortly after.

Added

• Sankey diagram: optional Ports toggle inserting the destination L4 port as a middle column (src IP → dst port → dst IP), pooling all traffic per port into one node (#152)
• Unraid packaging under deploy/unraid/: an all-in-one Compose stack (UI + nfcapd collector from the single image) plus two Community Applications templates and a Sankey-derived icon

Changed

• Docker :latest now tracks the newest release regardless of pre-release status; :1/:1.0 stay reserved for stable, :edge still tracks master
• Sankey destination-port labels now sit as a centered chip on each port node instead of floating above it (#152)
• Bundled Caddy no longer serves /frontend/* directly — everything is proxied to php-via, which serves and Brotli-compresses static assets itself; retired the custom caddy-cbrotli build in favour of stock caddy:latest
• Alert webhook payload now includes title/message/body, so the webhook URL can point straight at a Gotify or Apprise endpoint (#153)
• Bumped mbolli/php-via to ~0.12.0: versioned assets get long-lived immutable cache headers, vendor libs a weekly must-revalidate, and all static responses now emit ETag/Last-Modified and honour conditional GET
• nouislider/echarts now load with defer instead of blocking the parser

Fixed

• Flows tab ignored the source selector — a single-source pick still queried every configured source (#155)
• Traffic graph's most recent point always rendered as 0, one slot behind the real latest value (#154)
• Alert rules with an nfdump traffic filter always evaluated to zero and could never fire (#153)
• Flows/Statistics/Sankey filter text could be silently cleared by an unrelated SSE re-render while typing; upgraded Datastar to v1.0.2 (#151)
• A forced reload reset the active tab to Graphs and dark mode to the system default; tab/theme/graph prefs now round-trip through localStorage, and php-via 0.12.0 context revival avoids the reload entirely (#151)

Security

• withStaticDir() pointed at the project root with no extension allowlist, serving backend/**/*.php, settings.php, composer.json, and the full .git/ history over HTTP — now scoped to frontend/ only

Full Changelog: v1.0.0-beta.1...v1.0.0-beta.2