Skip to content

v2.4.0

Latest
Latest

Choose a tag to compare

View all tags
@seitzbg seitzbg released this 10 Oct 19:56
v2.4.0
6e03843
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Feature and security release: a y-axis fit option for the graphs, and Go and Caddy toolchain updates for new net/http and crypto/tls advisories.

Upgrade notes

  • No configuration changes are needed. Graphs keep their current scaling (Peaks) until a viewer picks Typical on the Graphs toolbar, or you set SMOKED_Y_FIT=typical (or -y-fit typical) to make it the default. An unknown value stops smoked at startup.
  • Bundled Caddy: if you run the root docker-compose.yml with the federation profile, rebuild its Caddy image (docker compose --profile federation build caddy) to pick up Go 1.27.2 and Caddy v2.11.7. The examples/federation stack uses the stock upstream caddy:2.11-alpine image, which this release doesn't change.

Added

  • A y-axis fit option for the graphs. The Graphs toolbar has a new Fit control. Peaks
    (the default, unchanged) scales each graph so every median spike fits. Typical scales to the
    98th percentile of the median line and ignores the smoke, the way SmokePing scales to its median:
    a few rare spikes clip at the top frame instead of squeezing the usual latency into the bottom of
    the plot. This matters most on a short step (60 s by default), which can catch more brief stalls
    as median spikes than SmokePing's 300 s rounds. The choice applies to the grid, the four-range view,
    zoom and the unison scale, and each browser remembers it. -y-fit / SMOKED_Y_FIT=typical sets
    the default for viewers who haven't chosen; an unknown value stops smoked at startup.
    /api/version reports it as y_fit.

Security

  • Go toolchain bumped 1.26.6 → 1.26.9 and golang.org/x/net v0.58.0 → v0.60.0 for the
    standard-library fixes in GO-2026-6603, GO-2026-6605, GO-2026-6607 to GO-2026-6613 and GO-2026-6617
    (net/http, net/textproto, crypto/tls; five of them are also fixed in x/net), which govulncheck
    flagged as reachable from the collector's HTTP server and API, the agent client, the HTTP and DNS
    probes, the alert notifiers and smoked mcp. The collector image's Go build stage moves to the
    matching golang:1.26-alpine digest. No source changes.
  • Bundled Caddy image rebuilt on Go 1.27.2 and Caddy v2.11.7 (from Go 1.26.6 and v2.11.4), clearing
    the same net/http/crypto/tls CVEs in the Caddy binary (CVE-2026-78667, CVE-2026-78669,
    CVE-2026-97031). Caddy 2.11.7 already requires the patched x/text, x/crypto and grpc versions, so
    those build-time floors are dropped; the golang.org/x/net floor moves to v0.60.0.
Assets 5
Loading