v0.36.0

0.36.0 (2026-09-05)

Features

• api: add session/RBAC auth, user management, and WS scoping (9421169)
• auth: add -auth.create-admin to bootstrap the first admin (fe20de4)
• auth: add RBAC, local provider, and auth stores (453d892)
• auth: cap sessions and kick WS clients on grant change (3ea1a40)
• config: add settings.auth and password recovery cli flag (59b25bc)
• notify: support smtp AUTH LOGIN and pushover end-to-end encryption (edd2502)
• ui: add login and RBAC-aware admin pages (323ae45)
• ui: toggle timestamps for release/deployed/queried timestamps (#984) (da1c075)
• web: resolve the client IP behind trusted proxies (d00e6c9)
• web: use the forwarded host for CSRF and cookies (3615c98)

Bug Fixes

• notify: honour the smtp timeout, TLS and auth params (80182de)
• notify: send param names Shoutrrr accepts (5c3764c)
• ui: declare missing params in the notify API types (124b965)
• util: deny template loads from disk (fe6be1f)