v0.8.6

MCP-UI-Org/mcp-uiv0.8.6Sep 3, 2026by svilenmarkov

AI Summary

This release addresses critical security vulnerabilities, fixes the Reddit widget's inability to fetch posts, and resolves issues with Docker container health checks and currency display.

Key Highlights

Fixed X-Forwarded-For spoofing vulnerability allowing rate-limit bypass
Fixed Reddit widget not fetching new posts due to challenge page changes
Fixed Docker containers not being identified as unhealthy correctly
Added `withAllowInsecure` and `withBasicAuth` functions to custom-api

New Features

Added `withAllowInsecure` function to `custom-api`
Added `withBasicAuth` function to `custom-api`

Full Release Notes

## Fixed
- Reddit widget not fetching new posts due to challenge page changes
- Unhealthy docker containers not getting identified correctly 
- selfhst icons showing outdated icons
- X-Forwarded-For spoofing which would allow rate-limit bypass for auth
- Misleading currency symbols for some markets in the markets widget
- Incorrect handling of https sock-path in the `docker-containers` widget
- Incorrect sorting for `reddit`, `hacker-news` and `lobsters` widgets with `sort-by: engagement`
- Search bang indicator not getting cleared correctly after pressing `enter`
- Not being able to use the `dns-stats` widget on a Pi-hole instance without a password
- Not being able to use `webp` extension for icons
- RSS feeds not showing correct thumbnails when image URL is a relative path
- Incorrect `manifest.json` path when using `base-url`

## Changes
- Videos widget will now cache and reuse video lists if an update fails for a channel
- Added `withAllowInsecure` function to `custom-api`
- Added `withBasicAuth` function to `custom-api`