xping v1.4.7

[1.4.7] - 2026-09-27

Security

• Terminal escape sequences and control characters from servers are
  removed before display and CSV/Markdown export. Before, a malicious
  server could move the cursor, overwrite output or write to the clipboard.
• The DNS parsers no longer hang on a compression pointer loop, which
  a malicious response could trigger.
• Raw DNS queries use a random transaction ID on a connected socket and
  drop mismatched replies, which makes spoofing hard.
• dig gets names through -q / -t, so a name such as -f/etc/passwd
  from a check file can no longer read local files.
• profile list --names prints only valid names. Bash completion passes
  them to compgen -W, which expands $(...).
• http counts the body instead of storing it, and stops at 100 MB.
  WHOIS responses are capped at 1 MB.
• The completion rc block single-quotes the script path. CI and release
  workflows use read-only tokens and pass secrets as environment
  variables.
• Every GitHub Action in CI and release workflows is pinned to a commit
  SHA, so a moved or hijacked tag can't change what runs with release
  credentials. Dependabot keeps the pins current.

Added

• xping smtp HOST — checks a mail server.
  • It checks the greeting, the EHLO extensions, STARTTLS (or implicit
    TLS on 465) and certificate verification for the server's name.
  • It shows the AUTH mechanisms and size limit offered over TLS, and
    whether the server's reverse DNS resolves back.
  • A mail domain is tested through its preferred MX; --no-mx tests
    the host itself.
  • It ends with QUIT and never sends mail.
  • --port 25|587|465. Missing or invalid TLS is a warning unless
    --require-tls is given. --min-days checks certificate expiry.
  • It is an smtp type in check files.
• xping diff BEFORE AFTER — compare two --json results of the
  same check. Either side can be - for stdin.
  • It recognises the kind of result and compares the numbers that
    matter, each with its "better" direction: RTT, jitter, loss, HTTP
    phases, TLS days, speed, clock offset, Wi-Fi signal and so on.
  • It shows the route changes of trace / mtr, added and removed DNS
    records, and status changes in dnscheck / doctor / check /
    blocklist.
  • Changes under 3% count as noise.
  • --max-regression PCT exits 1 on a bigger regression or a worse
    status.
• xping wifi — Wi-Fi link quality.
  • It shows signal and noise (dBm) with a grade, the SNR, the channel,
    band and width, the link rate and MCS, the standard, the security,
    and how many nearby networks share (or on 2.4 GHz overlap) your
    channel.
  • It gives advice: move closer, interference, switch to 5 GHz, or the
    least used of channels 1 / 6 / 11.
  • --nearby lists the networks around you. --min-signal DBM makes it
    an alarm.
  • Data comes from system_profiler (macOS), iw / nmcli (Linux) or
    netsh wlan (Windows), with no root and no network traffic.

Changed

• xping blocklist shows a compact summary instead of one row per list
  per address, which was 43 rows for a typical domain.
  • Each checked address or domain gets one row, e.g. "clean on 8/8 IP
    lists".
  • Any result that is not clean is still shown in full.
  • --all restores the full table.
  • The closing line now says "43 checks on 11 lists" instead of the
    misleading "43 lists".
• xping ntp shows the measurement accuracy (± half the round trip),
  and says when the offset is within it. JSON output has a new
  uncertainty_ms field.
• xping udp and xping ntp no longer repeat the address on an "IP"
  line when the target already is an IP.