v1.11.2 — SSH thread-pool starvation fix

Fix: patching multiple hosts at once could stall indefinitely once a host's upgrade included a kernel package - dracut/update-initramfs can run for minutes with no output, and every host's blocking SSH I/O shared Python's default thread pool, so a couple of slow kernel upgrades could starve unrelated hosts of a worker thread even after those hosts had already finished. Dedicated thread pool for SSH I/O now sized well above any realistic concurrent-host count.

Raised the upgrade command's idle-output timeout from 300s to 1800s so a legitimately slow, silent kernel upgrade no longer gets killed as a false-positive timeout.

v1.11.1 - Fix batch notifications on the actual patch buttons

group patch, patch all, and patch-all-groups now correctly send one combined notification per run. 1.11.0 batched the scheduler and two API endpoints the UI never called; this wires the buttons themselves via a shared batch id.

v1.11.0 - Batch notifications for multi-host patch runs

Group patch, patch-all, and scheduled multi-host runs now send a single combined email/webhook covering all hosts instead of one per host. Single-host patches are unaffected.

v1.10.3 — clean up patch log progress-bar spam

Fixed

• Patch logs showed huge blocks of repeated text from progress-bar redraws (apt percentage updates, needrestart's process/candidate scan bars, dpkg's "Reading database..." counter). These tools use carriage returns (\r) to redraw the same terminal line in place; the SSH output reader only split on newlines, so every redraw frame got crammed onto one giant line instead of collapsing to the final state.
• Carriage-return redraws are now collapsed to their last frame, matching what you'd actually see watching the terminal live.

v1.10.2 — minimizable operation panel

Added

• The patch/reboot output panel can now be minimized to a slim header bar instead of covering the bottom-right of the page for the duration of the operation. Click the chevron to collapse; click the collapsed bar (or the chevron again) to restore.

v1.10.1 — fix Patch security button

Fixed

• "Patch security" button applied all pending updates instead of security-only ones — it was wired to the exact same handler as "Patch all", with no security-only path anywhere in frontend or backend.

Changed

• Single-host patching now supports a security-only mode:
  • APT: filters to packages already flagged is_security, upgrades only those via apt-get install --only-upgrade
  • DNF: uses native dnf upgrade --security, cross-checked against dnf updateinfo list security
  • Nobara: warns and skips rather than silently running a full nobara-sync (no security filter exists there)

v1.10.0 — Native OIDC login

Native OpenID Connect login, replacing reverse-proxy forward auth.

• Auth: built-in OIDC client (Authorization Code + PKCE, confidential client, backchannel token exchange, userinfo claims) with server-side sessions and real logout
• Auth: optional group restriction via PATCHKIT_OIDC_REQUIRED_GROUP
• Auth: fully opt-in through PATCHKIT_OIDC_* env vars — with none set, PatchKit runs open (or via legacy forward auth) and pulls in no extra dependencies (stdlib only)
• Auth: the proxy-IP allowlist now defaults to open; set PATCHKIT_TRUSTED_PROXIES when running behind a reverse proxy so fresh installs aren't locked out
• Frontend bounces to login on 401 and shows a logout control; added oidc.env.example and documented the systemd unit

v1.9.0 — Security hardening

Security hardening release.

• Security: block direct access — requests must arrive via a trusted reverse proxy (PATCHKIT_TRUSTED_PROXIES); prevents spoofing the forward-auth header
• Security: credential API no longer returns private keys or sudo passwords (fingerprint only)
• Security: database and known_hosts files locked to owner-only (0600) at startup
• Security: global sudo password masked in settings API
• Security: HTML-escape all host- and command-derived output in the UI (patch logs, package names, OS names) to prevent XSS from managed hosts
• Security: validate webhook URLs (http/https only; block loopback and link-local targets)
• Security: confine ad-hoc OS-detection key paths to the PatchKit home directory
• Security: host connectivity test no longer returns raw server tracebacks

v1.8.9 - Scheduler reliability fixes

Raised misfire_grace_time from APScheduler default of 1 second to 1 hour so scheduled patch/autoscan jobs no longer get silently skipped on minor delays. Also fixed scheduler startup ordering so Next Run timestamps update correctly after a restart.

v1.8.7 - Autoscan fix

Autoscan interval setting now actually schedules periodic scans via APScheduler. Previously the setting was saved but never read by the backend, so no autoscan job ever ran.