v0.6.1

Security / 安全修复

• Docker read-only access exposed container secrets (GHSA-m6h7-mm5r-r53q): in v0.6.0.4 and earlier, read-only accounts and API tokens with only docker:read could read the plain text of container environment variables, Command, Entrypoint and start arguments through GET /api/docker/containers/{id}, and full command lines in the process list. Identities without docker:write now see variable names only, with values, commands, arguments and process command arguments shown as ********; image details hide Env, Cmd, Entrypoint and build history commands the same way. The plain text moved to GET /api/docker/containers/{id}/secrets, which requires docker:write; the edit form fetches it, and fields submitted as the placeholder keep their old values. Thanks to Yousef Alturki (@YousefAlturki) for the responsible report. / Docker 只读权限泄露容器敏感信息（GHSA-m6h7-mm5r-r53q）：v0.6.0.4 及更早版本中，只读账号与只有 docker:read 的 API 令牌可经 GET /api/docker/containers/{id} 读到容器环境变量、Command、Entrypoint 与启动参数明文，进程列表也显示完整命令行。现在没有 docker:write 的身份只看到变量名，值、命令、参数与进程命令参数显示为 ********；镜像详情中的 Env、Cmd、Entrypoint 与构建历史命令同样隐藏。明文改由需要 docker:write 的 GET /api/docker/containers/{id}/secrets 提供，编辑表单自动读取，提交仍为占位符的字段沿用原值。感谢 Yousef Alturki 负责任地报告。
• Container name could bypass the self-container guard: calling stop, kill, pause, delete, edit or upgrade with a container name or ID prefix skipped the protection for the container Gately runs in; requests are now resolved to the full container ID first. Edit and upgrade rebuilds handle the old container by full ID, fixing a name-based call that deleted the new container during cleanup and could not roll back; start, stop and delete on a container being rebuilt return 409. / 容器名可绕过自身保护：按容器名或 ID 前缀调用停止、强杀、暂停、删除、编辑、升级时会跳过 Gately 自身容器的保护，现在先解析为完整 ID；编辑、升级重建按完整 ID 处理旧容器，修复按名称调用时清理阶段误删新容器、无法回滚；重建期间对该容器的启停与删除返回 409。
• Security policy: report vulnerabilities through GitHub private vulnerability reporting or by email, see SECURITY.md. / 安全策略：通过 GitHub 私密漏洞报告或邮件提交漏洞，见 SECURITY.md。

New / 新功能

• Certificate issuance network (#35): the new Network option (Auto / IPv4 only / IPv6 only) restricts reaching the CA, the DNS provider API and the TXT propagation check to one address family, for hosts with an IPv6 address but no working IPv6, where the check timed out querying authoritative servers. Connections to an HTTPS_PROXY-style proxy are not restricted, and DNS servers given as host names are resolved in the chosen family. / 证书签发网络（#35）：新增「网络」选项（自动 / 仅 IPv4 / 仅 IPv6），让访问 CA、调用 DNS 服务商接口与检查 TXT 生效只使用一种地址族，解决主机有 IPv6 地址但 IPv6 不通时查询权威服务器超时；连接 HTTPS_PROXY 等代理不受限制，主机名形式的 DNS 服务器按所选地址族解析。
• Set default site (#37): listeners whose default site is not configured yet show a Set default site button. / 设置默认站点（#37）：默认站点尚未配置的监听显示「设置默认站点」按钮。
• Notifications and logs follow the console language (#40): when the server language is Follow system and neither GATELY_LANG nor LANG is set (usual on Docker, fnOS and OpenWrt), notifications and logs use the interface language from the administrator's latest login or top-bar switch instead of English; read-only logins do not change it. Program-generated notification sources are translated, user-named sources are kept as is, and prefixed log lines such as [warn] [auth] ... are no longer half translated. / 通知与日志跟随界面语言（#40）：服务端语言为「跟随系统」且没有 GATELY_LANG、LANG（Docker、飞牛、OpenWrt 通常如此）时，通知与日志使用管理员最近一次登录或顶栏切换的界面语言，不再回落英文；只读账号登录不改变它。程序生成的通知来源会翻译，用户填写的保持原样，[warn] [auth] ... 这类带前缀的日志不再中英混排。

Fixes / 修复

• Docker self-container protection (#38): upgrade, batch upgrade, edit and Compose up/delete stop the old container first, which killed Gately mid-rebuild and left its container stopped; these are refused for the container Gately runs in (batch upgrade skips it) and the UI points to updating on the host. Restarting Gately's own Compose project restarts Gately last. / Docker 自身容器保护（#38）：升级、批量升级、编辑与 Compose up/删除会先停止旧容器，导致 Gately 在重建中途退出、容器停在停止状态；现在对自身拒绝（批量升级跳过），界面提示在宿主机上更新；重启自身所在的 Compose 项目时自身最后重启。

Upgrading / 升级

• Docker: pull the new image and recreate the container. OpenWrt: install the new .apk / .ipk, then luci-app-gately of the same version if you want the LuCI page. fnOS: install the new .fpk in the App Center. Other installs can upgrade online in Settings. / Docker 拉取新镜像后重建容器；OpenWrt 覆盖安装新的 .apk / .ipk，需要 LuCI 页面时再安装同版本 luci-app-gately；飞牛在应用中心安装新版 .fpk；其他部署方式可在「系统设置」中在线升级。

Release notes: https://gately.cn/en/news/v0.6.1 · 更新说明：https://gately.cn/news/v0.6.1