Statora 1.2.0-beta.13

Pre-release built from develop for testing upcoming features. Not intended for production.

Container image: docker.io/timothestoifl24/statora:1.2.0-beta.13 (or docker.io/timothestoifl24/statora:beta for the newest beta).

Changes in the upcoming 1.2.0 so far

Added

• First-run setup: on a fresh instance the first visit asks you to create the admin account instead of showing the sign-in page. This initial admin can't be deleted, disabled or demoted, and statora reset-admin resets its password. On existing instances, the oldest local admin becomes the initial admin; without a local admin, statora reset-admin creates one. The API's user objects have a new is_initial_admin field.
• Monitor dashboard: a summary bar shows how many monitors are up and how many need attention. Down and degraded monitors come first, tinted, with how long they've been failing. Search and filter chips (Problems, HTTP, TCP, Ping, DNS, SQL, Groups) survive the auto-refresh, groups expand inline to show their members, and / focuses the search, n opens a new monitor.
• Tile view and wallboard: switch the monitor list to tiles, or open /admin?kiosk=1 for a full-screen wallboard without the sidebar. Failing monitors get bigger tiles with the last error and buttons to report an incident or pause them.
• Open incidents badge in the admin navigation.
• Theme-aware logo: /static/brand/logo-auto.svg switches its wordmark between navy and white with the status page's light or dark theme, so it stays readable in both. Use it as a status page's logo URL in place of logo.svg or logo-dark.svg.
• Hide the local sign-in form: under Authentication → Local accounts, hide the username and password form so the sign-in page only shows your identity providers. It needs at least one enabled provider, comes back by itself if none is left, and /login?local=1 still shows it for local admins.
• Monitor icons and links: give a monitor an icon (pick one of the bundled Font Awesome icons, including brand logos, or upload or link your own image) and a link to the app behind it. Status pages show the icon and link the component name to the app; the monitor list and tiles show them too. New icon and link_url fields in the monitor API.
• Status page favicon: each status page can have its own browser-tab icon, uploaded or as a URL (favicon in the API).
• Image uploads: POST /api/v1/media stores a PNG, JPEG, WebP, GIF, ICO or SVG image (up to 256 KB) in the database and returns a media: reference for favicon and icon. Uploaded SVGs must not contain scripts and are served sandboxed.

Changed

• statora create-admin is removed, and so are statora init's --admin-username, --admin-password and --admin-email options. Create the first admin in the web UI, and use statora reset-admin to recover it.
• Container images move to Docker Hub: images are now published as docker.io/timothestoifl24/statora, with the same tags as before. ghcr.io/timothestoifl24/statora gets no new images; update the image name in your docker-compose.yml, docker run command or Kubernetes manifests.
• Admin layout: the navigation moved into a sidebar, with the user menu and theme toggle at its bottom.
• Status pages in the admin panel: a new overview shows each page's status, favicon and size. Create a page and edit its settings in a dialog; creating a page takes you straight to its components, which have their own editor.
• Forms in dialogs: creating and editing monitors (including clone), incidents, maintenance windows, users and authentication providers opens a dialog over the current page instead of a separate page. Validation errors stay in the dialog, and edit dialogs have their Delete button (and for providers, Test connection) in the footer. A newly created provider reopens right away, so its callback URLs are at hand. Direct links still open the full page.
• Bigger buttons: the row menus and other icon buttons in the admin panel are at least 32 px, so they're easier to hit.
• Public status page: a calmer status card replaces the coloured banner and says how many components are affected. Active incidents show as a timeline inside it, maintenance as a slim strip, and each component shows its uptime next to its status.
• Fonts and icons: the admin panel and status pages use Inter and JetBrains Mono, shipped with Statora (no requests to font CDNs). Icons now come from Font Awesome Free instead of Tabler Icons; login buttons for Google, GitHub, GitLab and Microsoft providers show the provider's logo.
• Python 3.13 or newer: Python 3.12 is no longer supported; CI tests Python 3.13 to 3.15.

Security

• statora serve refuses a placeholder secret key: it now exits with an error instead of a warning when STATORA_SECRET_KEY still has the default or the Kubernetes example value. With a known key, anyone could forge a session cookie. Set a long random value (for example openssl rand -hex 32) before upgrading.
• Uploaded images are rebuilt, never stored as uploaded: raster images (PNG, JPEG, WebP, GIF, ICO) are decoded and re-encoded as a clean PNG (at most 256 px), which removes anything hidden in the file. SVGs are rebuilt from an allowlist of shapes and attributes, without scripts, style sheets, event handlers, links or embedded content. The file type is detected from its contents, oversized dimensions are refused before decoding, and upload requests over 512 KB are refused before they're read.
• Stricter URLs: links must be well-formed http(s) URLs without user names or passwords, and image URLs (favicon, logo, monitor icon) must use https. A status page's logo URL is now validated too, and can also be an upload. Logos saved earlier with an http URL stay in the API but are no longer shown; change them to https.
• Security headers: every response sends X-Content-Type-Options, Referrer-Policy and a strict Content-Security-Policy: scripts only load from Statora itself (no inline scripts, no eval). The admin panel and sign-in page can't be shown inside another site's frame; status pages still can. Strict-Transport-Security is sent when STATORA_SECURE_COOKIES is on.
• NUL characters in URLs or request bodies are refused with 400 instead of causing a server error.

What's Changed

New features

• Repost the PR image comment for every rebuild by @timothestoifl24 in #33

Full Changelog: v1.2.0-beta.12...v1.2.0-beta.13

Statora 1.2.0-beta.12

Pre-release built from develop for testing upcoming features. Not intended for production.

Container image: docker.io/timothestoifl24/statora:1.2.0-beta.12 (or docker.io/timothestoifl24/statora:beta for the newest beta).

Changes in the upcoming 1.2.0 so far

Added

• First-run setup: on a fresh instance the first visit asks you to create the admin account instead of showing the sign-in page. This initial admin can't be deleted, disabled or demoted, and statora reset-admin resets its password. On existing instances, the oldest local admin becomes the initial admin; without a local admin, statora reset-admin creates one. The API's user objects have a new is_initial_admin field.
• Monitor dashboard: a summary bar shows how many monitors are up and how many need attention. Down and degraded monitors come first, tinted, with how long they've been failing. Search and filter chips (Problems, HTTP, TCP, Ping, DNS, SQL, Groups) survive the auto-refresh, groups expand inline to show their members, and / focuses the search, n opens a new monitor.
• Tile view and wallboard: switch the monitor list to tiles, or open /admin?kiosk=1 for a full-screen wallboard without the sidebar. Failing monitors get bigger tiles with the last error and buttons to report an incident or pause them.
• Open incidents badge in the admin navigation.
• Theme-aware logo: /static/brand/logo-auto.svg switches its wordmark between navy and white with the status page's light or dark theme, so it stays readable in both. Use it as a status page's logo URL in place of logo.svg or logo-dark.svg.
• Hide the local sign-in form: under Authentication → Local accounts, hide the username and password form so the sign-in page only shows your identity providers. It needs at least one enabled provider, comes back by itself if none is left, and /login?local=1 still shows it for local admins.
• Monitor icons and links: give a monitor an icon (pick one of the bundled Font Awesome icons, including brand logos, or upload or link your own image) and a link to the app behind it. Status pages show the icon and link the component name to the app; the monitor list and tiles show them too. New icon and link_url fields in the monitor API.
• Status page favicon: each status page can have its own browser-tab icon, uploaded or as a URL (favicon in the API).
• Image uploads: POST /api/v1/media stores a PNG, JPEG, WebP, GIF, ICO or SVG image (up to 256 KB) in the database and returns a media: reference for favicon and icon. Uploaded SVGs must not contain scripts and are served sandboxed.

Changed

• statora create-admin is removed, and so are statora init's --admin-username, --admin-password and --admin-email options. Create the first admin in the web UI, and use statora reset-admin to recover it.
• Container images move to Docker Hub: images are now published as docker.io/timothestoifl24/statora, with the same tags as before. ghcr.io/timothestoifl24/statora gets no new images; update the image name in your docker-compose.yml, docker run command or Kubernetes manifests.
• Admin layout: the navigation moved into a sidebar, with the user menu and theme toggle at its bottom.
• Status pages in the admin panel: a new overview shows each page's status, favicon and size. Create a page and edit its settings in a dialog; creating a page takes you straight to its components, which have their own editor.
• Forms in dialogs: creating and editing monitors (including clone), incidents, maintenance windows, users and authentication providers opens a dialog over the current page instead of a separate page. Validation errors stay in the dialog, and edit dialogs have their Delete button (and for providers, Test connection) in the footer. A newly created provider reopens right away, so its callback URLs are at hand. Direct links still open the full page.
• Bigger buttons: the row menus and other icon buttons in the admin panel are at least 32 px, so they're easier to hit.
• Public status page: a calmer status card replaces the coloured banner and says how many components are affected. Active incidents show as a timeline inside it, maintenance as a slim strip, and each component shows its uptime next to its status.
• Fonts and icons: the admin panel and status pages use Inter and JetBrains Mono, shipped with Statora (no requests to font CDNs). Icons now come from Font Awesome Free instead of Tabler Icons; login buttons for Google, GitHub, GitLab and Microsoft providers show the provider's logo.
• Python 3.13 or newer: Python 3.12 is no longer supported; CI tests Python 3.13 to 3.15.

Security

• statora serve refuses a placeholder secret key: it now exits with an error instead of a warning when STATORA_SECRET_KEY still has the default or the Kubernetes example value. With a known key, anyone could forge a session cookie. Set a long random value (for example openssl rand -hex 32) before upgrading.
• Uploaded images are rebuilt, never stored as uploaded: raster images (PNG, JPEG, WebP, GIF, ICO) are decoded and re-encoded as a clean PNG (at most 256 px), which removes anything hidden in the file. SVGs are rebuilt from an allowlist of shapes and attributes, without scripts, style sheets, event handlers, links or embedded content. The file type is detected from its contents, oversized dimensions are refused before decoding, and upload requests over 512 KB are refused before they're read.
• Stricter URLs: links must be well-formed http(s) URLs without user names or passwords, and image URLs (favicon, logo, monitor icon) must use https. A status page's logo URL is now validated too, and can also be an upload. Logos saved earlier with an http URL stay in the API but are no longer shown; change them to https.
• Security headers: every response sends X-Content-Type-Options, Referrer-Policy and a strict Content-Security-Policy: scripts only load from Statora itself (no inline scripts, no eval). The admin panel and sign-in page can't be shown inside another site's frame; status pages still can. Strict-Transport-Security is sent when STATORA_SECURE_COOKIES is on.
• NUL characters in URLs or request bodies are refused with 400 instead of causing a server error.

What's Changed

Breaking changes

• Create the initial admin in a first-run setup instead of the CLI by @timothestoifl24 in #32

Full Changelog: v1.2.0-beta.11...v1.2.0-beta.12

Statora 1.2.0-beta.11

Pre-release built from develop for testing upcoming features. Not intended for production.

Container image: docker.io/timothestoifl24/statora:1.2.0-beta.11 (or docker.io/timothestoifl24/statora:beta for the newest beta).

Changes in the upcoming 1.2.0 so far

Added

• Monitor dashboard: a summary bar shows how many monitors are up and how many need attention. Down and degraded monitors come first, tinted, with how long they've been failing. Search and filter chips (Problems, HTTP, TCP, Ping, DNS, SQL, Groups) survive the auto-refresh, groups expand inline to show their members, and / focuses the search, n opens a new monitor.
• Tile view and wallboard: switch the monitor list to tiles, or open /admin?kiosk=1 for a full-screen wallboard without the sidebar. Failing monitors get bigger tiles with the last error and buttons to report an incident or pause them.
• Open incidents badge in the admin navigation.
• Theme-aware logo: /static/brand/logo-auto.svg switches its wordmark between navy and white with the status page's light or dark theme, so it stays readable in both. Use it as a status page's logo URL in place of logo.svg or logo-dark.svg.
• Hide the local sign-in form: under Authentication → Local accounts, hide the username and password form so the sign-in page only shows your identity providers. It needs at least one enabled provider, comes back by itself if none is left, and /login?local=1 still shows it for local admins.
• Monitor icons and links: give a monitor an icon (pick one of the bundled Font Awesome icons, including brand logos, or upload or link your own image) and a link to the app behind it. Status pages show the icon and link the component name to the app; the monitor list and tiles show them too. New icon and link_url fields in the monitor API.
• Status page favicon: each status page can have its own browser-tab icon, uploaded or as a URL (favicon in the API).
• Image uploads: POST /api/v1/media stores a PNG, JPEG, WebP, GIF, ICO or SVG image (up to 256 KB) in the database and returns a media: reference for favicon and icon. Uploaded SVGs must not contain scripts and are served sandboxed.

Changed

• Container images move to Docker Hub: images are now published as docker.io/timothestoifl24/statora, with the same tags as before. ghcr.io/timothestoifl24/statora gets no new images; update the image name in your docker-compose.yml, docker run command or Kubernetes manifests.
• Admin layout: the navigation moved into a sidebar, with the user menu and theme toggle at its bottom.
• Status pages in the admin panel: a new overview shows each page's status, favicon and size. Create a page and edit its settings in a dialog; creating a page takes you straight to its components, which have their own editor.
• Forms in dialogs: creating and editing monitors (including clone), incidents, maintenance windows, users and authentication providers opens a dialog over the current page instead of a separate page. Validation errors stay in the dialog, and edit dialogs have their Delete button (and for providers, Test connection) in the footer. A newly created provider reopens right away, so its callback URLs are at hand. Direct links still open the full page.
• Bigger buttons: the row menus and other icon buttons in the admin panel are at least 32 px, so they're easier to hit.
• Public status page: a calmer status card replaces the coloured banner and says how many components are affected. Active incidents show as a timeline inside it, maintenance as a slim strip, and each component shows its uptime next to its status.
• Fonts and icons: the admin panel and status pages use Inter and JetBrains Mono, shipped with Statora (no requests to font CDNs). Icons now come from Font Awesome Free instead of Tabler Icons; login buttons for Google, GitHub, GitLab and Microsoft providers show the provider's logo.
• Python 3.13 or newer: Python 3.12 is no longer supported; CI tests Python 3.13 to 3.15.

Security

• statora serve refuses a placeholder secret key: it now exits with an error instead of a warning when STATORA_SECRET_KEY still has the default or the Kubernetes example value. With a known key, anyone could forge a session cookie. Set a long random value (for example openssl rand -hex 32) before upgrading.
• Uploaded images are rebuilt, never stored as uploaded: raster images (PNG, JPEG, WebP, GIF, ICO) are decoded and re-encoded as a clean PNG (at most 256 px), which removes anything hidden in the file. SVGs are rebuilt from an allowlist of shapes and attributes, without scripts, style sheets, event handlers, links or embedded content. The file type is detected from its contents, oversized dimensions are refused before decoding, and upload requests over 512 KB are refused before they're read.
• Stricter URLs: links must be well-formed http(s) URLs without user names or passwords, and image URLs (favicon, logo, monitor icon) must use https. A status page's logo URL is now validated too, and can also be an upload. Logos saved earlier with an http URL stay in the API but are no longer shown; change them to https.
• Security headers: every response sends X-Content-Type-Options, Referrer-Policy and a strict Content-Security-Policy: scripts only load from Statora itself (no inline scripts, no eval). The admin panel and sign-in page can't be shown inside another site's frame; status pages still can. Strict-Transport-Security is sent when STATORA_SECURE_COOKIES is on.
• NUL characters in URLs or request bodies are refused with 400 instead of causing a server error.

Full Changelog: v1.2.0-beta.10...v1.2.0-beta.11

Statora 1.2.0-beta.10

Pre-release built from develop for testing upcoming features. Not intended for production.

Container image: docker.io/timothestoifl24/statora:1.2.0-beta.10 (or docker.io/timothestoifl24/statora:beta for the newest beta).

Changes in the upcoming 1.2.0 so far

Added

• Monitor dashboard: a summary bar shows how many monitors are up and how many need attention. Down and degraded monitors come first, tinted, with how long they've been failing. Search and filter chips (Problems, HTTP, TCP, Ping, DNS, SQL, Groups) survive the auto-refresh, groups expand inline to show their members, and / focuses the search, n opens a new monitor.
• Tile view and wallboard: switch the monitor list to tiles, or open /admin?kiosk=1 for a full-screen wallboard without the sidebar. Failing monitors get bigger tiles with the last error and buttons to report an incident or pause them.
• Open incidents badge in the admin navigation.
• Theme-aware logo: /static/brand/logo-auto.svg switches its wordmark between navy and white with the status page's light or dark theme, so it stays readable in both. Use it as a status page's logo URL in place of logo.svg or logo-dark.svg.
• Hide the local sign-in form: under Authentication → Local accounts, hide the username and password form so the sign-in page only shows your identity providers. It needs at least one enabled provider, comes back by itself if none is left, and /login?local=1 still shows it for local admins.
• Monitor icons and links: give a monitor an icon (pick one of the bundled Font Awesome icons, including brand logos, or upload or link your own image) and a link to the app behind it. Status pages show the icon and link the component name to the app; the monitor list and tiles show them too. New icon and link_url fields in the monitor API.
• Status page favicon: each status page can have its own browser-tab icon, uploaded or as a URL (favicon in the API).
• Image uploads: POST /api/v1/media stores a PNG, JPEG, WebP, GIF, ICO or SVG image (up to 256 KB) in the database and returns a media: reference for favicon and icon. Uploaded SVGs must not contain scripts and are served sandboxed.

Changed

• Container images move to Docker Hub: images are now published as docker.io/timothestoifl24/statora, with the same tags as before. ghcr.io/timothestoifl24/statora gets no new images; update the image name in your docker-compose.yml, docker run command or Kubernetes manifests.
• Admin layout: the navigation moved into a sidebar, with the user menu and theme toggle at its bottom.
• Status pages in the admin panel: a new overview shows each page's status, favicon and size. Create a page and edit its settings in a dialog; creating a page takes you straight to its components, which have their own editor.
• Forms in dialogs: creating and editing monitors (including clone), incidents, maintenance windows, users and authentication providers opens a dialog over the current page instead of a separate page. Validation errors stay in the dialog, and edit dialogs have their Delete button (and for providers, Test connection) in the footer. A newly created provider reopens right away, so its callback URLs are at hand. Direct links still open the full page.
• Bigger buttons: the row menus and other icon buttons in the admin panel are at least 32 px, so they're easier to hit.
• Public status page: a calmer status card replaces the coloured banner and says how many components are affected. Active incidents show as a timeline inside it, maintenance as a slim strip, and each component shows its uptime next to its status.
• Fonts and icons: the admin panel and status pages use Inter and JetBrains Mono, shipped with Statora (no requests to font CDNs). Icons now come from Font Awesome Free instead of Tabler Icons; login buttons for Google, GitHub, GitLab and Microsoft providers show the provider's logo.
• Python 3.13 or newer: Python 3.12 is no longer supported; CI tests Python 3.13 to 3.15.

Security

• statora serve refuses a placeholder secret key: it now exits with an error instead of a warning when STATORA_SECRET_KEY still has the default or the Kubernetes example value. With a known key, anyone could forge a session cookie. Set a long random value (for example openssl rand -hex 32) before upgrading.
• Uploaded images are rebuilt, never stored as uploaded: raster images (PNG, JPEG, WebP, GIF, ICO) are decoded and re-encoded as a clean PNG (at most 256 px), which removes anything hidden in the file. SVGs are rebuilt from an allowlist of shapes and attributes, without scripts, style sheets, event handlers, links or embedded content. The file type is detected from its contents, oversized dimensions are refused before decoding, and upload requests over 512 KB are refused before they're read.
• Stricter URLs: links must be well-formed http(s) URLs without user names or passwords, and image URLs (favicon, logo, monitor icon) must use https. A status page's logo URL is now validated too, and can also be an upload. Logos saved earlier with an http URL stay in the API but are no longer shown; change them to https.
• Security headers: every response sends X-Content-Type-Options, Referrer-Policy and a strict Content-Security-Policy: scripts only load from Statora itself (no inline scripts, no eval). The admin panel and sign-in page can't be shown inside another site's frame; status pages still can. Strict-Transport-Security is sent when STATORA_SECURE_COOKIES is on.
• NUL characters in URLs or request bodies are refused with 400 instead of causing a server error.

What's Changed

Maintenance

• Bump pyasn1 from 0.6.4 to 0.6.5 in the uv group across 1 directory by @dependabot[bot] in #31

Full Changelog: v1.2.0-beta.9...v1.2.0-beta.10

Statora 1.2.0-beta.9

Pre-release built from develop for testing upcoming features. Not intended for production.

Container image: docker.io/timothestoifl24/statora:1.2.0-beta.9 (or docker.io/timothestoifl24/statora:beta for the newest beta).

Changes in the upcoming 1.2.0 so far

Added

• Monitor dashboard: a summary bar shows how many monitors are up and how many need attention. Down and degraded monitors come first, tinted, with how long they've been failing. Search and filter chips (Problems, HTTP, TCP, Ping, DNS, SQL, Groups) survive the auto-refresh, groups expand inline to show their members, and / focuses the search, n opens a new monitor.
• Tile view and wallboard: switch the monitor list to tiles, or open /admin?kiosk=1 for a full-screen wallboard without the sidebar. Failing monitors get bigger tiles with the last error and buttons to report an incident or pause them.
• Open incidents badge in the admin navigation.
• Theme-aware logo: /static/brand/logo-auto.svg switches its wordmark between navy and white with the status page's light or dark theme, so it stays readable in both. Use it as a status page's logo URL in place of logo.svg or logo-dark.svg.
• Hide the local sign-in form: under Authentication → Local accounts, hide the username and password form so the sign-in page only shows your identity providers. It needs at least one enabled provider, comes back by itself if none is left, and /login?local=1 still shows it for local admins.
• Monitor icons and links: give a monitor an icon (pick one of the bundled Font Awesome icons, including brand logos, or upload or link your own image) and a link to the app behind it. Status pages show the icon and link the component name to the app; the monitor list and tiles show them too. New icon and link_url fields in the monitor API.
• Status page favicon: each status page can have its own browser-tab icon, uploaded or as a URL (favicon in the API).
• Image uploads: POST /api/v1/media stores a PNG, JPEG, WebP, GIF, ICO or SVG image (up to 256 KB) in the database and returns a media: reference for favicon and icon. Uploaded SVGs must not contain scripts and are served sandboxed.

Changed

• Container images move to Docker Hub: images are now published as docker.io/timothestoifl24/statora, with the same tags as before. ghcr.io/timothestoifl24/statora gets no new images; update the image name in your docker-compose.yml, docker run command or Kubernetes manifests.
• Admin layout: the navigation moved into a sidebar, with the user menu and theme toggle at its bottom.
• Status pages in the admin panel: a new overview shows each page's status, favicon and size. Create a page and edit its settings in a dialog; creating a page takes you straight to its components, which have their own editor.
• Forms in dialogs: creating and editing monitors (including clone), incidents, maintenance windows, users and authentication providers opens a dialog over the current page instead of a separate page. Validation errors stay in the dialog, and edit dialogs have their Delete button (and for providers, Test connection) in the footer. A newly created provider reopens right away, so its callback URLs are at hand. Direct links still open the full page.
• Bigger buttons: the row menus and other icon buttons in the admin panel are at least 32 px, so they're easier to hit.
• Public status page: a calmer status card replaces the coloured banner and says how many components are affected. Active incidents show as a timeline inside it, maintenance as a slim strip, and each component shows its uptime next to its status.
• Fonts and icons: the admin panel and status pages use Inter and JetBrains Mono, shipped with Statora (no requests to font CDNs). Icons now come from Font Awesome Free instead of Tabler Icons; login buttons for Google, GitHub, GitLab and Microsoft providers show the provider's logo.
• Python 3.13 or newer: Python 3.12 is no longer supported; CI tests Python 3.13 to 3.15.

Security

• statora serve refuses a placeholder secret key: it now exits with an error instead of a warning when STATORA_SECRET_KEY still has the default or the Kubernetes example value. With a known key, anyone could forge a session cookie. Set a long random value (for example openssl rand -hex 32) before upgrading.
• Uploaded images are rebuilt, never stored as uploaded: raster images (PNG, JPEG, WebP, GIF, ICO) are decoded and re-encoded as a clean PNG (at most 256 px), which removes anything hidden in the file. SVGs are rebuilt from an allowlist of shapes and attributes, without scripts, style sheets, event handlers, links or embedded content. The file type is detected from its contents, oversized dimensions are refused before decoding, and upload requests over 512 KB are refused before they're read.
• Stricter URLs: links must be well-formed http(s) URLs without user names or passwords, and image URLs (favicon, logo, monitor icon) must use https. A status page's logo URL is now validated too, and can also be an upload. Logos saved earlier with an http URL stay in the API but are no longer shown; change them to https.
• Security headers: every response sends X-Content-Type-Options, Referrer-Policy and a strict Content-Security-Policy: scripts only load from Statora itself (no inline scripts, no eval). The admin panel and sign-in page can't be shown inside another site's frame; status pages still can. Strict-Transport-Security is sent when STATORA_SECURE_COOKIES is on.
• NUL characters in URLs or request bodies are refused with 400 instead of causing a server error.

What's Changed

Bug fixes

• Keep page content from showing through the dev docs banner by @timothestoifl24 in #30

Full Changelog: v1.2.0-beta.8...v1.2.0-beta.9

Statora 1.2.0-beta.8

Pre-release built from develop for testing upcoming features. Not intended for production.

Container image: docker.io/timothestoifl24/statora:1.2.0-beta.8 (or docker.io/timothestoifl24/statora:beta for the newest beta).

Changes in the upcoming 1.2.0 so far

Added

• Monitor dashboard: a summary bar shows how many monitors are up and how many need attention. Down and degraded monitors come first, tinted, with how long they've been failing. Search and filter chips (Problems, HTTP, TCP, Ping, DNS, SQL, Groups) survive the auto-refresh, groups expand inline to show their members, and / focuses the search, n opens a new monitor.
• Tile view and wallboard: switch the monitor list to tiles, or open /admin?kiosk=1 for a full-screen wallboard without the sidebar. Failing monitors get bigger tiles with the last error and buttons to report an incident or pause them.
• Open incidents badge in the admin navigation.
• Theme-aware logo: /static/brand/logo-auto.svg switches its wordmark between navy and white with the status page's light or dark theme, so it stays readable in both. Use it as a status page's logo URL in place of logo.svg or logo-dark.svg.
• Hide the local sign-in form: under Authentication → Local accounts, hide the username and password form so the sign-in page only shows your identity providers. It needs at least one enabled provider, comes back by itself if none is left, and /login?local=1 still shows it for local admins.
• Monitor icons and links: give a monitor an icon (pick one of the bundled Font Awesome icons, including brand logos, or upload or link your own image) and a link to the app behind it. Status pages show the icon and link the component name to the app; the monitor list and tiles show them too. New icon and link_url fields in the monitor API.
• Status page favicon: each status page can have its own browser-tab icon, uploaded or as a URL (favicon in the API).
• Image uploads: POST /api/v1/media stores a PNG, JPEG, WebP, GIF, ICO or SVG image (up to 256 KB) in the database and returns a media: reference for favicon and icon. Uploaded SVGs must not contain scripts and are served sandboxed.

Changed

• Container images move to Docker Hub: images are now published as docker.io/timothestoifl24/statora, with the same tags as before. ghcr.io/timothestoifl24/statora gets no new images; update the image name in your docker-compose.yml, docker run command or Kubernetes manifests.
• Admin layout: the navigation moved into a sidebar, with the user menu and theme toggle at its bottom.
• Status pages in the admin panel: a new overview shows each page's status, favicon and size. Create a page and edit its settings in a dialog; creating a page takes you straight to its components, which have their own editor.
• Forms in dialogs: creating and editing monitors (including clone), incidents, maintenance windows, users and authentication providers opens a dialog over the current page instead of a separate page. Validation errors stay in the dialog, and edit dialogs have their Delete button (and for providers, Test connection) in the footer. A newly created provider reopens right away, so its callback URLs are at hand. Direct links still open the full page.
• Bigger buttons: the row menus and other icon buttons in the admin panel are at least 32 px, so they're easier to hit.
• Public status page: a calmer status card replaces the coloured banner and says how many components are affected. Active incidents show as a timeline inside it, maintenance as a slim strip, and each component shows its uptime next to its status.
• Fonts and icons: the admin panel and status pages use Inter and JetBrains Mono, shipped with Statora (no requests to font CDNs). Icons now come from Font Awesome Free instead of Tabler Icons; login buttons for Google, GitHub, GitLab and Microsoft providers show the provider's logo.
• Python 3.13 or newer: Python 3.12 is no longer supported; CI tests Python 3.13 to 3.15.

Security

• statora serve refuses a placeholder secret key: it now exits with an error instead of a warning when STATORA_SECRET_KEY still has the default or the Kubernetes example value. With a known key, anyone could forge a session cookie. Set a long random value (for example openssl rand -hex 32) before upgrading.
• Uploaded images are rebuilt, never stored as uploaded: raster images (PNG, JPEG, WebP, GIF, ICO) are decoded and re-encoded as a clean PNG (at most 256 px), which removes anything hidden in the file. SVGs are rebuilt from an allowlist of shapes and attributes, without scripts, style sheets, event handlers, links or embedded content. The file type is detected from its contents, oversized dimensions are refused before decoding, and upload requests over 512 KB are refused before they're read.
• Stricter URLs: links must be well-formed http(s) URLs without user names or passwords, and image URLs (favicon, logo, monitor icon) must use https. A status page's logo URL is now validated too, and can also be an upload. Logos saved earlier with an http URL stay in the API but are no longer shown; change them to https.
• Security headers: every response sends X-Content-Type-Options, Referrer-Policy and a strict Content-Security-Policy: scripts only load from Statora itself (no inline scripts, no eval). The admin panel and sign-in page can't be shown inside another site's frame; status pages still can. Strict-Transport-Security is sent when STATORA_SECURE_COOKIES is on.
• NUL characters in URLs or request bodies are refused with 400 instead of causing a server error.

What's Changed

New features

• Add a theme-aware Statora logo for status pages by @timothestoifl24 in #29

Full Changelog: v1.2.0-beta.7...v1.2.0-beta.8

Statora 1.2.0-beta.7

Pre-release built from develop for testing upcoming features. Not intended for production.

Container image: docker.io/timothestoifl24/statora:1.2.0-beta.7 (or docker.io/timothestoifl24/statora:beta for the newest beta).

Changes in the upcoming 1.2.0 so far

Added

• Monitor dashboard: a summary bar shows how many monitors are up and how many need attention. Down and degraded monitors come first, tinted, with how long they've been failing. Search and filter chips (Problems, HTTP, TCP, Ping, DNS, SQL, Groups) survive the auto-refresh, groups expand inline to show their members, and / focuses the search, n opens a new monitor.
• Tile view and wallboard: switch the monitor list to tiles, or open /admin?kiosk=1 for a full-screen wallboard without the sidebar. Failing monitors get bigger tiles with the last error and buttons to report an incident or pause them.
• Open incidents badge in the admin navigation.
• Hide the local sign-in form: under Authentication → Local accounts, hide the username and password form so the sign-in page only shows your identity providers. It needs at least one enabled provider, comes back by itself if none is left, and /login?local=1 still shows it for local admins.
• Monitor icons and links: give a monitor an icon (pick one of the bundled Font Awesome icons, including brand logos, or upload or link your own image) and a link to the app behind it. Status pages show the icon and link the component name to the app; the monitor list and tiles show them too. New icon and link_url fields in the monitor API.
• Status page favicon: each status page can have its own browser-tab icon, uploaded or as a URL (favicon in the API).
• Image uploads: POST /api/v1/media stores a PNG, JPEG, WebP, GIF, ICO or SVG image (up to 256 KB) in the database and returns a media: reference for favicon and icon. Uploaded SVGs must not contain scripts and are served sandboxed.

Changed

• Container images move to Docker Hub: images are now published as docker.io/timothestoifl24/statora, with the same tags as before. ghcr.io/timothestoifl24/statora gets no new images; update the image name in your docker-compose.yml, docker run command or Kubernetes manifests.
• Admin layout: the navigation moved into a sidebar, with the user menu and theme toggle at its bottom.
• Status pages in the admin panel: a new overview shows each page's status, favicon and size. Create a page and edit its settings in a dialog; creating a page takes you straight to its components, which have their own editor.
• Forms in dialogs: creating and editing monitors (including clone), incidents, maintenance windows, users and authentication providers opens a dialog over the current page instead of a separate page. Validation errors stay in the dialog, and edit dialogs have their Delete button (and for providers, Test connection) in the footer. A newly created provider reopens right away, so its callback URLs are at hand. Direct links still open the full page.
• Bigger buttons: the row menus and other icon buttons in the admin panel are at least 32 px, so they're easier to hit.
• Public status page: a calmer status card replaces the coloured banner and says how many components are affected. Active incidents show as a timeline inside it, maintenance as a slim strip, and each component shows its uptime next to its status.
• Fonts and icons: the admin panel and status pages use Inter and JetBrains Mono, shipped with Statora (no requests to font CDNs). Icons now come from Font Awesome Free instead of Tabler Icons; login buttons for Google, GitHub, GitLab and Microsoft providers show the provider's logo.
• Python 3.13 or newer: Python 3.12 is no longer supported; CI tests Python 3.13 to 3.15.

Security

• statora serve refuses a placeholder secret key: it now exits with an error instead of a warning when STATORA_SECRET_KEY still has the default or the Kubernetes example value. With a known key, anyone could forge a session cookie. Set a long random value (for example openssl rand -hex 32) before upgrading.
• Uploaded images are rebuilt, never stored as uploaded: raster images (PNG, JPEG, WebP, GIF, ICO) are decoded and re-encoded as a clean PNG (at most 256 px), which removes anything hidden in the file. SVGs are rebuilt from an allowlist of shapes and attributes, without scripts, style sheets, event handlers, links or embedded content. The file type is detected from its contents, oversized dimensions are refused before decoding, and upload requests over 512 KB are refused before they're read.
• Stricter URLs: links must be well-formed http(s) URLs without user names or passwords, and image URLs (favicon, logo, monitor icon) must use https. A status page's logo URL is now validated too, and can also be an upload. Logos saved earlier with an http URL stay in the API but are no longer shown; change them to https.
• Security headers: every response sends X-Content-Type-Options, Referrer-Policy and a strict Content-Security-Policy: scripts only load from Statora itself (no inline scripts, no eval). The admin panel and sign-in page can't be shown inside another site's frame; status pages still can. Strict-Transport-Security is sent when STATORA_SECURE_COOKIES is on.
• NUL characters in URLs or request bodies are refused with 400 instead of causing a server error.

What's Changed

Breaking changes

• Publish container images to Docker Hub instead of GHCR by @timothestoifl24 in #27

Full Changelog: v1.2.0-beta.6...v1.2.0-beta.7

Statora 1.2.0-beta.6

Pre-release built from develop for testing upcoming features. Not intended for production.

Container image: ghcr.io/timothestoifl24/statora:1.2.0-beta.6 (or ghcr.io/timothestoifl24/statora:beta for the newest beta).

Changes in the upcoming 1.2.0 so far

Added

• Monitor dashboard: a summary bar shows how many monitors are up and how many need attention. Down and degraded monitors come first, tinted, with how long they've been failing. Search and filter chips (Problems, HTTP, TCP, Ping, DNS, SQL, Groups) survive the auto-refresh, groups expand inline to show their members, and / focuses the search, n opens a new monitor.
• Tile view and wallboard: switch the monitor list to tiles, or open /admin?kiosk=1 for a full-screen wallboard without the sidebar. Failing monitors get bigger tiles with the last error and buttons to report an incident or pause them.
• Open incidents badge in the admin navigation.
• Hide the local sign-in form: under Authentication → Local accounts, hide the username and password form so the sign-in page only shows your identity providers. It needs at least one enabled provider, comes back by itself if none is left, and /login?local=1 still shows it for local admins.
• Monitor icons and links: give a monitor an icon (pick one of the bundled Font Awesome icons, including brand logos, or upload or link your own image) and a link to the app behind it. Status pages show the icon and link the component name to the app; the monitor list and tiles show them too. New icon and link_url fields in the monitor API.
• Status page favicon: each status page can have its own browser-tab icon, uploaded or as a URL (favicon in the API).
• Image uploads: POST /api/v1/media stores a PNG, JPEG, WebP, GIF, ICO or SVG image (up to 256 KB) in the database and returns a media: reference for favicon and icon. Uploaded SVGs must not contain scripts and are served sandboxed.

Changed

• Admin layout: the navigation moved into a sidebar, with the user menu and theme toggle at its bottom.
• Status pages in the admin panel: a new overview shows each page's status, favicon and size. Create a page and edit its settings in a dialog; creating a page takes you straight to its components, which have their own editor.
• Forms in dialogs: creating and editing monitors (including clone), incidents, maintenance windows, users and authentication providers opens a dialog over the current page instead of a separate page. Validation errors stay in the dialog, and edit dialogs have their Delete button (and for providers, Test connection) in the footer. A newly created provider reopens right away, so its callback URLs are at hand. Direct links still open the full page.
• Bigger buttons: the row menus and other icon buttons in the admin panel are at least 32 px, so they're easier to hit.
• Public status page: a calmer status card replaces the coloured banner and says how many components are affected. Active incidents show as a timeline inside it, maintenance as a slim strip, and each component shows its uptime next to its status.
• Fonts and icons: the admin panel and status pages use Inter and JetBrains Mono, shipped with Statora (no requests to font CDNs). Icons now come from Font Awesome Free instead of Tabler Icons; login buttons for Google, GitHub, GitLab and Microsoft providers show the provider's logo.
• Python 3.13 or newer: Python 3.12 is no longer supported; CI tests Python 3.13 to 3.15.

Security

• statora serve refuses a placeholder secret key: it now exits with an error instead of a warning when STATORA_SECRET_KEY still has the default or the Kubernetes example value. With a known key, anyone could forge a session cookie. Set a long random value (for example openssl rand -hex 32) before upgrading.
• Uploaded images are rebuilt, never stored as uploaded: raster images (PNG, JPEG, WebP, GIF, ICO) are decoded and re-encoded as a clean PNG (at most 256 px), which removes anything hidden in the file. SVGs are rebuilt from an allowlist of shapes and attributes, without scripts, style sheets, event handlers, links or embedded content. The file type is detected from its contents, oversized dimensions are refused before decoding, and upload requests over 512 KB are refused before they're read.
• Stricter URLs: links must be well-formed http(s) URLs without user names or passwords, and image URLs (favicon, logo, monitor icon) must use https. A status page's logo URL is now validated too, and can also be an upload. Logos saved earlier with an http URL stay in the API but are no longer shown; change them to https.
• Security headers: every response sends X-Content-Type-Options, Referrer-Policy and a strict Content-Security-Policy: scripts only load from Statora itself (no inline scripts, no eval). The admin panel and sign-in page can't be shown inside another site's frame; status pages still can. Strict-Transport-Security is sent when STATORA_SECURE_COOKIES is on.
• NUL characters in URLs or request bodies are refused with 400 instead of causing a server error.

What's Changed

Bug fixes

• Keep PR label descriptions with a semicolon intact by @timothestoifl24 in #28

Full Changelog: v1.2.0-beta.5...v1.2.0-beta.6

Statora 1.2.0-beta.5

Pre-release built from develop for testing upcoming features. Not intended for production.

Container image: ghcr.io/timothestoifl24/statora:1.2.0-beta.5 (or ghcr.io/timothestoifl24/statora:beta for the newest beta).

Changes in the upcoming 1.2.0 so far

Added

• Monitor dashboard: a summary bar shows how many monitors are up and how many need attention. Down and degraded monitors come first, tinted, with how long they've been failing. Search and filter chips (Problems, HTTP, TCP, Ping, DNS, SQL, Groups) survive the auto-refresh, groups expand inline to show their members, and / focuses the search, n opens a new monitor.
• Tile view and wallboard: switch the monitor list to tiles, or open /admin?kiosk=1 for a full-screen wallboard without the sidebar. Failing monitors get bigger tiles with the last error and buttons to report an incident or pause them.
• Open incidents badge in the admin navigation.
• Hide the local sign-in form: under Authentication → Local accounts, hide the username and password form so the sign-in page only shows your identity providers. It needs at least one enabled provider, comes back by itself if none is left, and /login?local=1 still shows it for local admins.
• Monitor icons and links: give a monitor an icon (pick one of the bundled Font Awesome icons, including brand logos, or upload or link your own image) and a link to the app behind it. Status pages show the icon and link the component name to the app; the monitor list and tiles show them too. New icon and link_url fields in the monitor API.
• Status page favicon: each status page can have its own browser-tab icon, uploaded or as a URL (favicon in the API).
• Image uploads: POST /api/v1/media stores a PNG, JPEG, WebP, GIF, ICO or SVG image (up to 256 KB) in the database and returns a media: reference for favicon and icon. Uploaded SVGs must not contain scripts and are served sandboxed.

Changed

• Admin layout: the navigation moved into a sidebar, with the user menu and theme toggle at its bottom.
• Status pages in the admin panel: a new overview shows each page's status, favicon and size. Create a page and edit its settings in a dialog; creating a page takes you straight to its components, which have their own editor.
• Forms in dialogs: creating and editing monitors (including clone), incidents, maintenance windows, users and authentication providers opens a dialog over the current page instead of a separate page. Validation errors stay in the dialog, and edit dialogs have their Delete button (and for providers, Test connection) in the footer. A newly created provider reopens right away, so its callback URLs are at hand. Direct links still open the full page.
• Bigger buttons: the row menus and other icon buttons in the admin panel are at least 32 px, so they're easier to hit.
• Public status page: a calmer status card replaces the coloured banner and says how many components are affected. Active incidents show as a timeline inside it, maintenance as a slim strip, and each component shows its uptime next to its status.
• Fonts and icons: the admin panel and status pages use Inter and JetBrains Mono, shipped with Statora (no requests to font CDNs). Icons now come from Font Awesome Free instead of Tabler Icons; login buttons for Google, GitHub, GitLab and Microsoft providers show the provider's logo.
• Python 3.13 or newer: Python 3.12 is no longer supported; CI tests Python 3.13 to 3.15.

Security

• statora serve refuses a placeholder secret key: it now exits with an error instead of a warning when STATORA_SECRET_KEY still has the default or the Kubernetes example value. With a known key, anyone could forge a session cookie. Set a long random value (for example openssl rand -hex 32) before upgrading.
• Uploaded images are rebuilt, never stored as uploaded: raster images (PNG, JPEG, WebP, GIF, ICO) are decoded and re-encoded as a clean PNG (at most 256 px), which removes anything hidden in the file. SVGs are rebuilt from an allowlist of shapes and attributes, without scripts, style sheets, event handlers, links or embedded content. The file type is detected from its contents, oversized dimensions are refused before decoding, and upload requests over 512 KB are refused before they're read.
• Stricter URLs: links must be well-formed http(s) URLs without user names or passwords, and image URLs (favicon, logo, monitor icon) must use https. A status page's logo URL is now validated too, and can also be an upload. Logos saved earlier with an http URL stay in the API but are no longer shown; change them to https.
• Security headers: every response sends X-Content-Type-Options, Referrer-Policy and a strict Content-Security-Policy: scripts only load from Statora itself (no inline scripts, no eval). The admin panel and sign-in page can't be shown inside another site's frame; status pages still can. Strict-Transport-Security is sent when STATORA_SECURE_COOKIES is on.
• NUL characters in URLs or request bodies are refused with 400 instead of causing a server error.

What's Changed

Maintenance

• Bump the python-minor group with 7 updates by @dependabot[bot] in #26
• Bump astral-sh/setup-uv from 10.3.1 to 10.3.3 by @dependabot[bot] in #25

Full Changelog: v1.2.0-beta.4...v1.2.0-beta.5

Statora 1.2.0-beta.4

Pre-release built from develop for testing upcoming features. Not intended for production.

Container image: ghcr.io/timothestoifl24/statora:1.2.0-beta.4 (or ghcr.io/timothestoifl24/statora:beta for the newest beta).

Changes in the upcoming 1.2.0 so far

Added

• Monitor dashboard: a summary bar shows how many monitors are up and how many need attention. Down and degraded monitors come first, tinted, with how long they've been failing. Search and filter chips (Problems, HTTP, TCP, Ping, DNS, SQL, Groups) survive the auto-refresh, groups expand inline to show their members, and / focuses the search, n opens a new monitor.
• Tile view and wallboard: switch the monitor list to tiles, or open /admin?kiosk=1 for a full-screen wallboard without the sidebar. Failing monitors get bigger tiles with the last error and buttons to report an incident or pause them.
• Open incidents badge in the admin navigation.
• Hide the local sign-in form: under Authentication → Local accounts, hide the username and password form so the sign-in page only shows your identity providers. It needs at least one enabled provider, comes back by itself if none is left, and /login?local=1 still shows it for local admins.
• Monitor icons and links: give a monitor an icon (pick one of the bundled Font Awesome icons, including brand logos, or upload or link your own image) and a link to the app behind it. Status pages show the icon and link the component name to the app; the monitor list and tiles show them too. New icon and link_url fields in the monitor API.
• Status page favicon: each status page can have its own browser-tab icon, uploaded or as a URL (favicon in the API).
• Image uploads: POST /api/v1/media stores a PNG, JPEG, WebP, GIF, ICO or SVG image (up to 256 KB) in the database and returns a media: reference for favicon and icon. Uploaded SVGs must not contain scripts and are served sandboxed.

Changed

• Admin layout: the navigation moved into a sidebar, with the user menu and theme toggle at its bottom.
• Status pages in the admin panel: a new overview shows each page's status, favicon and size. Create a page and edit its settings in a dialog; creating a page takes you straight to its components, which have their own editor.
• Forms in dialogs: creating and editing monitors (including clone), incidents, maintenance windows, users and authentication providers opens a dialog over the current page instead of a separate page. Validation errors stay in the dialog, and edit dialogs have their Delete button (and for providers, Test connection) in the footer. A newly created provider reopens right away, so its callback URLs are at hand. Direct links still open the full page.
• Bigger buttons: the row menus and other icon buttons in the admin panel are at least 32 px, so they're easier to hit.
• Public status page: a calmer status card replaces the coloured banner and says how many components are affected. Active incidents show as a timeline inside it, maintenance as a slim strip, and each component shows its uptime next to its status.
• Fonts and icons: the admin panel and status pages use Inter and JetBrains Mono, shipped with Statora (no requests to font CDNs). Icons now come from Font Awesome Free instead of Tabler Icons; login buttons for Google, GitHub, GitLab and Microsoft providers show the provider's logo.
• Python 3.13 or newer: Python 3.12 is no longer supported; CI tests Python 3.13 to 3.15.

Security

• statora serve refuses a placeholder secret key: it now exits with an error instead of a warning when STATORA_SECRET_KEY still has the default or the Kubernetes example value. With a known key, anyone could forge a session cookie. Set a long random value (for example openssl rand -hex 32) before upgrading.
• Uploaded images are rebuilt, never stored as uploaded: raster images (PNG, JPEG, WebP, GIF, ICO) are decoded and re-encoded as a clean PNG (at most 256 px), which removes anything hidden in the file. SVGs are rebuilt from an allowlist of shapes and attributes, without scripts, style sheets, event handlers, links or embedded content. The file type is detected from its contents, oversized dimensions are refused before decoding, and upload requests over 512 KB are refused before they're read.
• Stricter URLs: links must be well-formed http(s) URLs without user names or passwords, and image URLs (favicon, logo, monitor icon) must use https. A status page's logo URL is now validated too, and can also be an upload. Logos saved earlier with an http URL stay in the API but are no longer shown; change them to https.
• Security headers: every response sends X-Content-Type-Options, Referrer-Policy and a strict Content-Security-Policy: scripts only load from Statora itself (no inline scripts, no eval). The admin panel and sign-in page can't be shown inside another site's frame; status pages still can. Strict-Transport-Security is sent when STATORA_SECURE_COOKIES is on.
• NUL characters in URLs or request bodies are refused with 400 instead of causing a server error.

What's Changed

New features

• Publish the develop docs under /dev next to production by @timothestoifl24 in #23

Full Changelog: v1.2.0-beta.3...v1.2.0-beta.4