v0.8.6

QwenLM/Qwen3-VLv0.8.6Sep 3, 2026by svilenmarkov

Upgrading?

AI Summary

This release addresses critical security vulnerabilities, including an X-Forwarded-For spoofing bug, and fixes numerous issues related to Docker containers, widget fetching, and icon rendering.

Key Highlights

  • Fixed security vulnerability allowing rate-limit bypass via X-Forwarded-For spoofing
  • Resolved issues with Reddit, Hacker News, and Lobsters widget fetching
  • Fixed Docker container health identification and incorrect manifest paths
  • Added `withAllowInsecure` and `withBasicAuth` functions to the custom-api

New Features

  • Added `withAllowInsecure` function to `custom-api`
  • Added `withBasicAuth` function to `custom-api`

Full Release Notes

## Fixed
- Reddit widget not fetching new posts due to challenge page changes
- Unhealthy docker containers not getting identified correctly 
- selfhst icons showing outdated icons
- X-Forwarded-For spoofing which would allow rate-limit bypass for auth
- Misleading currency symbols for some markets in the markets widget
- Incorrect handling of https sock-path in the `docker-containers` widget
- Incorrect sorting for `reddit`, `hacker-news` and `lobsters` widgets with `sort-by: engagement`
- Search bang indicator not getting cleared correctly after pressing `enter`
- Not being able to use the `dns-stats` widget on a Pi-hole instance without a password
- Not being able to use `webp` extension for icons
- RSS feeds not showing correct thumbnails when image URL is a relative path
- Incorrect `manifest.json` path when using `base-url`

## Changes
- Videos widget will now cache and reuse video lists if an update fails for a channel
- Added `withAllowInsecure` function to `custom-api`
- Added `withBasicAuth` function to `custom-api`

Related Repositories