v0.8.6

facebook/lexicalv0.8.6Sep 3, 2026by svilenmarkov

AI Summary

A bug fix release addressing security vulnerabilities, widget functionality issues (Reddit, Docker containers), and adding authentication helpers to the Custom API widget.

Key Highlights

Security fix for X-Forwarded-For spoofing bypassing rate limits
Fixes for Reddit widget, Docker containers, and DNS stats widget
Added `withAllowInsecure` and `withBasicAuth` functions to custom-api
Fix for incorrect handling of https sock-path in docker-containers widget

New Features

Custom API authentication helpers
WebP extension support for icons
RSS feed thumbnail handling improvements

Full Release Notes

## Fixed
- Reddit widget not fetching new posts due to challenge page changes
- Unhealthy docker containers not getting identified correctly 
- selfhst icons showing outdated icons
- X-Forwarded-For spoofing which would allow rate-limit bypass for auth
- Misleading currency symbols for some markets in the markets widget
- Incorrect handling of https sock-path in the `docker-containers` widget
- Incorrect sorting for `reddit`, `hacker-news` and `lobsters` widgets with `sort-by: engagement`
- Search bang indicator not getting cleared correctly after pressing `enter`
- Not being able to use the `dns-stats` widget on a Pi-hole instance without a password
- Not being able to use `webp` extension for icons
- RSS feeds not showing correct thumbnails when image URL is a relative path
- Incorrect `manifest.json` path when using `base-url`

## Changes
- Videos widget will now cache and reuse video lists if an update fails for a channel
- Added `withAllowInsecure` function to `custom-api`
- Added `withBasicAuth` function to `custom-api`