v0.8.6

sergeyzwezdin/hubav0.8.6Sep 3, 2026by svilenmarkov

Upgrading?

AI Summary

This release addresses a variety of critical bugs and security vulnerabilities in the huba dashboard, specifically fixing widget fetch issues, Docker health detection, and a rate-limit bypass exploit.

Key Highlights

  • Fixed Reddit widget not fetching new posts due to challenge page changes
  • Fixed X-Forwarded-For spoofing vulnerability that allowed rate-limit bypass
  • Fixed unhealthy Docker containers not getting identified correctly
  • Added `withAllowInsecure` and `withBasicAuth` helper functions for custom APIs
  • Fixed currency symbols and icons showing incorrectly in markets and selfhst widgets

New Features

  • Added `withAllowInsecure` function to `custom-api`
  • Added `withBasicAuth` function to `custom-api`

Full Release Notes

## Fixed
- Reddit widget not fetching new posts due to challenge page changes
- Unhealthy docker containers not getting identified correctly 
- selfhst icons showing outdated icons
- X-Forwarded-For spoofing which would allow rate-limit bypass for auth
- Misleading currency symbols for some markets in the markets widget
- Incorrect handling of https sock-path in the `docker-containers` widget
- Incorrect sorting for `reddit`, `hacker-news` and `lobsters` widgets with `sort-by: engagement`
- Search bang indicator not getting cleared correctly after pressing `enter`
- Not being able to use the `dns-stats` widget on a Pi-hole instance without a password
- Not being able to use `webp` extension for icons
- RSS feeds not showing correct thumbnails when image URL is a relative path
- Incorrect `manifest.json` path when using `base-url`

## Changes
- Videos widget will now cache and reuse video lists if an update fails for a channel
- Added `withAllowInsecure` function to `custom-api`
- Added `withBasicAuth` function to `custom-api`

Related Repositories