v0.8.6

glanceapp/glancev0.8.6Sep 3, 2026by svilenmarkov

AI Summary

This release addresses critical security vulnerabilities, particularly regarding rate-limit bypass, and resolves numerous issues across Reddit, Docker, and Markets widgets. It also introduces new utility functions for custom API configurations to handle authentication and insecure connections more securely.

Key Highlights

Fixed X-Forwarded-For spoofing vulnerability to prevent rate-limit bypass.
Resolved issues with Reddit, Hacker News, and Lobsters widgets regarding engagement sorting.
Added `withAllowInsecure` and `withBasicAuth` functions for enhanced custom API configuration.
Fixed Docker container health detection and Pi-hole DNS stats widget compatibility.

New Features

Added `withAllowInsecure` function to `custom-api`.
Added `withBasicAuth` function to `custom-api`.

Full Release Notes

## Fixed
- Reddit widget not fetching new posts due to challenge page changes
- Unhealthy docker containers not getting identified correctly 
- selfhst icons showing outdated icons
- X-Forwarded-For spoofing which would allow rate-limit bypass for auth
- Misleading currency symbols for some markets in the markets widget
- Incorrect handling of https sock-path in the `docker-containers` widget
- Incorrect sorting for `reddit`, `hacker-news` and `lobsters` widgets with `sort-by: engagement`
- Search bang indicator not getting cleared correctly after pressing `enter`
- Not being able to use the `dns-stats` widget on a Pi-hole instance without a password
- Not being able to use `webp` extension for icons
- RSS feeds not showing correct thumbnails when image URL is a relative path
- Incorrect `manifest.json` path when using `base-url`

## Changes
- Videos widget will now cache and reuse video lists if an update fails for a channel
- Added `withAllowInsecure` function to `custom-api`
- Added `withBasicAuth` function to `custom-api`