- Introduced a new Remote Desktop client dashboard accessible via the Tools menu, allowing users to connect to devices in a new browser tab.
- Added localization strings for the Remote Desktop feature in multiple languages.
- Updated sidebar to include a link to the new dashboard with appropriate permissions and styling enhancements.
- Introduced a new glass surface effect for cards, modals, and forms, enhancing the UI with a frosted glass appearance.
- Added localization strings for the glass surface feature in multiple languages.
- Implemented settings for enabling/disabling the glass effect, adjusting color, blur, and opacity through the settings interface.
- Updated CSS variables to support the new glass surface styling.
- Removed references to SMTP configuration in subtitles across multiple language files to streamline messaging.
- Ensured consistency in the presentation of alert rules and remote commands.
- Added a modular studio layout with a live preview panel, autosave, server-side appearance profiles, and a built-in theme gallery.
- Expanded Google Fonts picker and enabled custom font uploads (woff2/ttf).
- Updated the appearance tab for real-time changes without full page reloads and introduced a read-only mode for users without edit permissions.
- Improved localization by updating language files with new strings for branding and appearance features.
- Redesigned the updates tab to adopt a Windows 11-inspired layout, improving user experience.
- Added a hero section for update status with dynamic messaging based on update state.
- Implemented new CSS styles for better visual consistency and responsiveness.
- Updated JavaScript functions to manage update status rendering and alerts effectively.
- Enhanced localization support by adding new language strings for the updates section.
- Added session management features to synchronize media capture and input handling across active tabs.
- Updated audio handling to respect session activity and mute states.
- Improved clipboard functionality to only allow copying to local clipboard from the active session.
- Refactored input capture logic to ensure it only activates for the active viewer tab.
- Introduced a new `syncSessionMediaCapture` function to manage media input across sessions.
- Introduced email notifications for help requests, allowing operators assigned to device folders or groups to receive alerts.
- Moved SMTP configuration to **Settings → Email**, including options for host, credentials, and alert email.
- Updated console layout for better usability and removed legacy SMTP automation tab.
- Added `nodemailer` as a dependency for email handling.
Updated the language code validation logic to improve security against path traversal attacks. The regex now uses separate constants for base tags and sub-tags, ensuring better readability and maintainability.
Updated the entire project to AGPL-3.0, including all components and documentation. The stable releases up to v3.3.x will remain under Apache 2.0 until the next major feature release. Withdrawn and recreated French and Traditional Chinese translations under the new license. Updated relevant documentation and changelog to reflect these changes.
Use plainBodyObject() for device file read API to avoid array .length
tampering; rate-limit ticket DELETE; document intentional sanitizers in
codeql-config.yml for branding, fonts, network monitor, and server paths.
Refs #196
Translate Organizations device-groups UI across all locales, consolidate [Unreleased] notes for 3.3.0, and copy VERSION into native console paths (#192).
Updated CodeQL configuration to exclude additional paths for security checks. Introduced a new file access rate limiter to prevent abuse of file download endpoints. Improved path resolution functions to ensure confined access and added validation in body scalar functions to reject non-scalar types. Enhanced error handling in API endpoint validation to prevent invalid inputs.
Fixes#192 — script and GHCR update flows now drop data/.last_update_result.json
the same way betterdesk.sh already does, so a failed in-panel attempt no longer
sticks around after a successful external update.
github-actions[bot]