0.316.1 v1.16.22

Name: ink
Author: vadimdemedes

high risk

vadimdemedes/inkSep 27, 2026 → Sep 28, 20261 day between releases

What's New

Adds web server security restrictions and requires approval for repository worktree hooks.

Breaking Changes

Web server returns 421 for requests addressed to unauthorized host names.
Repository worktree hooks are skipped if not approved.
Approval records from versions 1.16.21 and earlier are invalid and must be re-approved.

New Features

Web server now only responds to specific host names (localhost, loopback, etc.).
Cookies for the web UI are now HttpOnly and SameSite=Strict.
Repository worktree hooks now require approval based on script SHA256 and resolved path.

Improvements

Web server security enhanced by restricting host bindings to prevent reverse proxy errors.
Web UI cookies improved with HttpOnly and SameSite=Strict attributes for better security.

Bug Fixes

Web server now correctly handles unauthorized host requests with 421 errors.

Upgrade Notes

If using a reverse proxy or Tailscale Serve, add the host name to `[web] allowed_hosts` in your configuration to avoid 421 errors. Additionally, re-approve all repository worktree hooks as approval records from 1.16.21 are invalid.

The Two Releases

0.316.1

Sep 27, 2026· 25 days ago

Fixes bug handling for GoodWe WiFi ET decoding and OCPP charging power calculations.

Full release notes

v1.16.22

Sep 28, 2026· 24 days ago

Enhances web server security by restricting host bindings and introduces a new approval workflow for repository worktree hooks.

Full release notes