- Use actual verified field from backend for PBS backups through PVE storage
- Was incorrectly hardcoded to null causing verified checkmarks not to show
- Added format field checking for pbs-ct and pbs-vm
- Changed unknown type fallback from VM to LXC (more common)
- Fixes issue where all backups showed as VM type
- Added service field to WebhookConfig to identify Discord webhooks
- Use Discord-specific template when sending Discord webhooks
- Fixed backup type detection for PBS backups (vm/ct)
- Fixed shared storage duplicate IDs across instances
- Fixed alert acknowledge/clear response format to match frontend expectations
- Fix CPU core display to show for all guests with CPU data
- Previously only showed cores when CPU > 0 (truthy)
- Now shows "(0.0/X cores)" consistently for all running/stopped guests
- Improve code organization with new helper utilities
- Clean up import statements and remove debug logs
- System.json settings now take priority over environment variables
- Fixed issue where POLLING_INTERVAL env var would override saved settings
- Polling interval changes in UI now persist correctly after restart
- Remove token logging - tokens were being logged in plaintext
- Add client IP logging for security auditing
- Add HTTPS warning when tokens sent over HTTP
- Remove debug output that exposed tokens in console
- Add optional auth requirement via REQUIRE_AUTH_FOR_AUTO_REGISTER env var
- Prevent token exposure in error messages
- Already has duplicate node prevention
Security improvements:
- Tokens no longer logged anywhere
- Source IPs tracked for audit trail
- Optional authentication for high-security environments
- HTTPS enforcement warnings
- Remove sessionStorage for API tokens - it clears on tab close
- localStorage is correct for persistent auth tokens
- sessionStorage would log users out every time they close the tab
- Keep other security improvements from previous commit
- Fix unsafe JSON parsing in WebSocket with proper error handling
- Fix unsafe JSON parsing in Settings import with validation
- Improve API token security by using sessionStorage as primary storage
- Remove debug console statements from production code
- Fix race conditions in WebSocket alert handling with atomic updates
- Add NaN validation for parseFloat operations in search queries
- Add safer error handling alternatives in generics utility
- Improve graceful shutdown in Settings API with proper timing
- All changes verified with successful frontend and backend builds
- Fix XSS vulnerabilities in Tooltip component by replacing innerHTML with textContent and adding content sanitization
- Fix XSS vulnerability in UnifiedBackups by replacing innerHTML with safe DOM manipulation
- Add proper null checks for props.guest.cpu in GuestRow to prevent NaN errors
- Replace unsafe non-null assertions with proper conditional rendering
- Fix memory leak in Settings component by improving interval cleanup
- Fix WebSocket reconnection race condition by adding proper timeout cleanup
- Create standardized error handler utility for consistent error handling
- Enable VM state support in monitoring (resolves TODO)
- Improve type safety throughout the codebase
- All changes verified with successful frontend and backend builds
- Updated README to show env vars instead of .env editing
- Updated FAQ with correct port change instructions
- Updated .env.example header to clarify it's for deployment overrides
- Made it clear UI is primary configuration method
- Environment variables are for deployment-time overrides only
- Remove .env syncing - UI no longer writes to .env file
- system.json is the single source for UI-managed settings
- .env files are read-only for deployment overrides
- Environment variables still override everything (Docker/systemd)
- Cleaner separation: env vars for deployment, JSON for runtime
- Updated documentation to clarify configuration hierarchy
- Simpler code with less failure points
- UI settings now automatically update .env file when changed
- .env file and system.json stay in sync
- Settings hierarchy preserved: env vars > .env > UI
- .env file is auto-generated/updated when UI saves settings
- Improved user experience - changes in UI reflect in .env and vice versa
- Fix release channel not saving when changed in UI
- Add system settings persistence for update-related config
- Expand .env file support to include all non-sensitive settings:
- UPDATE_CHANNEL, AUTO_UPDATE_ENABLED, AUTO_UPDATE_CHECK_INTERVAL, AUTO_UPDATE_TIME
- POLLING_INTERVAL, CONNECTION_TIMEOUT, ALLOWED_ORIGINS, LOG_LEVEL
- Update documentation with all available .env settings
- Settings now properly persist across restarts
- Environment variables override saved settings at startup
- Fix bug where RC channel always returned first release without proper comparison
- Ensure RC channel returns the latest release (newest by creation date)
- Stable channel correctly returns first non-prerelease
- Add manual update instructions for users stuck on rc.1
- Update Go from 1.19 to 1.23.4 for latest security patches
- Update golang.org/x/crypto from v0.23.0 to v0.41.0 (critical security fixes)
- Update golang.org/x/net from v0.21.0 to v0.43.0 (security updates)
- Update golang.org/x/sys from v0.20.0 to v0.35.0
- Update golang.org/x/term from v0.20.0 to v0.34.0
- Update golang.org/x/text from v0.15.0 to v0.28.0
- Update other dependencies to latest versions
This addresses the critical and high severity vulnerabilities reported by GitHub Dependabot
- Fix Export/Import API token authentication (wasn't sending X-API-Token header)
- Add client-side passphrase validation (12+ chars with visual feedback)
- Fix settings persistence for AllowedOrigins field
- Fix hardcoded port display in diagnostics (now shows actual port)
- Add .env file support for non-sensitive configuration (ports, logging, etc)
- Keep sensitive data (API tokens, passwords) using secure methods (systemd env vars)
- Update documentation with configuration guide and latest features
- Document auto-discovery, cluster detection, and export/import features
- Badges should be for statuses/counts, not descriptive properties
- Cluster information is already shown in dedicated section below
- Keeps only functional badges (VMs, Containers, Storage, Backups)
- Cleaner, less cluttered interface
- Both badges now use gray color scheme (bg-gray-200/700, text-gray-600/400)
- Removes the blue coloring from cluster badge that made it inconsistent
- Better visual hierarchy - badges are informational, not action items
- Update checkbox label to 'Enable storage permissions for backup visibility'
- Clarify that PVEDatastoreAdmin is needed to READ backup files (Proxmox API limitation)
- Remove misleading text about managing/creating/deleting backups
- Make it clear Pulse only reads backup data, doesn't control backups
- Add checkbox to control whether backup write permissions are granted
- When checked: adds PVEDatastoreAdmin role on /storage (allows backup management)
- When unchecked: only PVEAuditor role (read-only, no PVE backups in Storage tab)
- Update setup script generation to conditionally add storage permissions
- Update UI to clearly explain the implications of each choice
- Remove DiscoveryModal component and Discover button
- Show discovered nodes directly in PVE/PBS tabs (greyed out)
- Discovered nodes are clickable to configure
- Intelligently filter out nodes that are part of configured clusters
- Prevent duplicate entries for cluster members in discovery results
- Maintain glassmorphic styling throughout
Frontend:
- Enhanced cluster vs standalone node visual distinction in Settings
- Added glassmorphic style to all toast notifications for consistency
- Fixed test connection in edit modal to use stored encrypted credentials
- Added batch credential modal for bulk node operations
- Added network discovery modal with auto-subnet detection
- Improved notification system with dual toast/notification support
- Added event bus for component communication
Backend:
- Fixed duplicate toast notifications during auto-registration
- Fixed PBS auto-registration token extraction from JSON output
- Added network discovery service with background scanning
- Improved cluster detection with actual cluster name from API
- Added helper function to reduce code duplication in cluster detection
- Fixed host URL normalization in auto-registration
- Enhanced PBS client token authentication parsing
Bug Fixes:
- Fixed stacking toast notifications creating visual bugs
- Fixed PBS authentication failures after auto-registration
- Fixed network discovery not finding Proxmox servers
- Fixed test connection for existing nodes with encrypted tokens
- Removed duplicate WebSocket broadcasts for auto-registration events
- PBS host now automatically gets https:// prefix and :8007 port if missing
- Fixed auto-naming to work after host normalization
- Token auth now correctly displays 'Token:' instead of 'User:'
- Edit mode now correctly identifies token vs password auth
- Backend properly clears unused auth fields when switching types
Fixes#263, #261
- Fixed NodeModal to correctly detect token auth based on tokenName instead of user field
- Backend now properly clears user field when using token authentication
- Backend now properly clears token fields when using password authentication
- This fixes the issue where PBS nodes using token auth would show "User:" instead of "Token:"
Fixes#263, #261
- Removed PBS summary card from Dashboard and Backups tabs (not needed)
- Fixed backup frequency chart to use local timezone instead of UTC
- Chart now properly includes today in the date range
- Dates display according to user's browser timezone
- Add System tab with Performance, Network, and Updates sections
- Implement Check for Updates and Apply Update functionality
- Add support for PULSE_UPDATE_SERVER environment variable for testing
- Fix Settings tab navigation issues
- Version bump to v4.1.0-rc.1
The Apply Update button was not showing when an update was available because it only checked for 'idle' status but the API returns 'available' status when an update is ready.
The issue was that the binary was looking for frontend files relative to the current working directory instead of relative to the binary location. This caused a redirect loop when the binary was installed in /opt/pulse but run from elsewhere.
Fixed by:
- Making the binary detect its own location and look for frontend files there
- Adding fallback paths for common installation locations
- Logging where frontend files are being served from for debugging
Pulse Monitor