v0.8.6

kyegomez/swarmsv0.8.6Sep 3, 2026by svilenmarkov

Upgrading?

AI Summary

This release addresses a variety of stability and security issues across widgets like Reddit, Docker containers, and markets, fixing authentication bypasses and incorrect data handling. It also enhances the custom API functionality by adding secure authentication helpers.

Key Highlights

  • Fixed X-Forwarded-For spoofing vulnerability bypassing rate limits
  • Fixed Reddit widget not fetching posts due to challenge page changes
  • Added `withAllowInsecure` and `withBasicAuth` functions to custom-api
  • Fixed sorting issues for engagement metrics in multiple widgets

New Features

  • `withAllowInsecure` function for custom-api
  • `withBasicAuth` function for custom-api
  • Videos widget caching for failed updates
  • Fixed Docker container identification for unhealthy instances
  • Fixed RSS feed thumbnails for relative image URLs

Full Release Notes

## Fixed
- Reddit widget not fetching new posts due to challenge page changes
- Unhealthy docker containers not getting identified correctly 
- selfhst icons showing outdated icons
- X-Forwarded-For spoofing which would allow rate-limit bypass for auth
- Misleading currency symbols for some markets in the markets widget
- Incorrect handling of https sock-path in the `docker-containers` widget
- Incorrect sorting for `reddit`, `hacker-news` and `lobsters` widgets with `sort-by: engagement`
- Search bang indicator not getting cleared correctly after pressing `enter`
- Not being able to use the `dns-stats` widget on a Pi-hole instance without a password
- Not being able to use `webp` extension for icons
- RSS feeds not showing correct thumbnails when image URL is a relative path
- Incorrect `manifest.json` path when using `base-url`

## Changes
- Videos widget will now cache and reuse video lists if an update fails for a channel
- Added `withAllowInsecure` function to `custom-api`
- Added `withBasicAuth` function to `custom-api`

Related Repositories