v0.8.6

X-PLUG/mPLUG-DocOwlv0.8.6Sep 3, 2026by svilenmarkov

Upgrading?

AI Summary

This maintenance release addresses various stability and security issues, including a critical rate-limit bypass vulnerability, and introduces new authentication helpers for custom API configurations.

Key Highlights

  • Fixed X-Forwarded-For spoofing vulnerability that allowed rate-limit bypass for authentication.
  • Added `withAllowInsecure` and `withBasicAuth` functions to the custom-api module.
  • Improved video widget caching and RSS thumbnail handling for relative paths.
  • Fixed multiple widget-specific bugs including Reddit fetching, Docker container identification, and sorting.

New Features

  • New authentication helpers
  • Video caching improvements
  • UI and widget bug fixes

Full Release Notes

## Fixed
- Reddit widget not fetching new posts due to challenge page changes
- Unhealthy docker containers not getting identified correctly 
- selfhst icons showing outdated icons
- X-Forwarded-For spoofing which would allow rate-limit bypass for auth
- Misleading currency symbols for some markets in the markets widget
- Incorrect handling of https sock-path in the `docker-containers` widget
- Incorrect sorting for `reddit`, `hacker-news` and `lobsters` widgets with `sort-by: engagement`
- Search bang indicator not getting cleared correctly after pressing `enter`
- Not being able to use the `dns-stats` widget on a Pi-hole instance without a password
- Not being able to use `webp` extension for icons
- RSS feeds not showing correct thumbnails when image URL is a relative path
- Incorrect `manifest.json` path when using `base-url`

## Changes
- Videos widget will now cache and reuse video lists if an update fails for a channel
- Added `withAllowInsecure` function to `custom-api`
- Added `withBasicAuth` function to `custom-api`

Related Repositories