← Back to OptimusHub

Changelog

All notable changes to OptimusHub, newest first. Versions follow MAJOR.MINOR.PATCH.

1.2.2 - 2026-10-18

Added

• Catalog Update tab in Admin Page - second tab alongside Software Update. Upload a signed catalog tar, preview the operations manifest, and apply it via a live streaming log.
• Pre-flight key verification before the apply stream opens, giving a clean error response instead of a mid-stream failure.
• Deploy Type selector on Catalog Builder operation cards (docker / Helm / k8s / binary), visible only for the applications catalog. Drives the correct directory layout in the built tar so the deployment type is unambiguous on apply.
• "Delete Tar" button per tar row in the Catalog Builder - removes the file and reverts the order to draft when no tars remain.
• Deploy Type column on the Catalog Builder order detail page.
• Audit log coverage for all catalog-update actions - upload, apply, and key validation now appear as labeled entries in the Log Observatory instead of generic access events.

Fixed

• Full catalog delete: deleting an item now removes both the filesystem entry and the database record, so deleted items no longer appear as ghost entries in the catalog UI. Matches the behavior of the add/remove wizard.
• Description not updated on edit: when updating an existing catalog item, a new description is now always saved. Previously the existing description was silently preserved even when a new one was supplied.
• Apply history not saved: the history file was being written to a path owned by the system user and was silently dropped. Moved to the correct writable location.
• Nested deployment archives: the Catalog Builder now inline-expands inner archives when building a tar, so the destination receives files at the correct <type>/<version>/ path without a nested archive blob. A compatible fallback handles older-format tars on apply.
• Deployment type dropdown accidentally removed from Catalog Builder method list - restored.

1.2.1 - 2026-10-17

Added

• Catalog Update tab (initial release) in Admin Page: upload a signed catalog tar, decrypt and verify the operations manifest, preview what will change, and apply via a live streaming log. Apply history is tracked per installation.

1.2.0 - 2026-10-15

Added

• OptimusHub Updater - feature complete. A standalone update daemon (accessible from Admin → Updater) with a browser-based interface for safe in-place upgrades. Fetches the release manifest from the registry, pulls or loads images, verifies integrity, restarts the stack, runs a health check, and automatically reverts on failure. Full streaming log throughout.
• Air-gap update path: upload release packages directly in the browser when the installation has no outbound registry access. The updater detects local packages on startup so they are ready without a manual upload step.
• Local package version validation: uploading a package from the wrong release shows an immediate warning badge. The update stream also fails fast with a clear message before attempting to load a mismatched package.
• Backup reminder: a persistent "back up your database before updating" notice is shown in the local upload section whenever packages are staged.
• Updater Settings: configurable registry URL and pull token, both persisted across restarts.
• Admin page → Updater tile: live health probe; shows "Open Updater" when the daemon is reachable and SSH start instructions when it is not.
• Installer now starts the updater daemon and registers it as a system service after a successful install.

Improved

• Release packages now include per-image files and a signed manifest alongside the full tarball, enabling the air-gap and selective update paths.

1.1.15 - 2026-10-15

Improved

• Parallel image pulls: fixed a DNS overload that occurred when all image pulls fired simultaneously, causing intermittent pull failures. Each pull is now tracked individually so a specific failure is named in the log rather than silently missing from the output.

1.1.14 - 2026-10-15

Fixed

• Updater - local package version validation: uploading a package from the wrong release (e.g. targeting v1.1.13 but uploading a v1.1.11 file) now shows a yellow warning badge immediately. The update stream also fails fast with a clear error before attempting to use the mismatched package.
• Updater - backup reminder: a "back up your database before updating" notice is now always visible in the Local Upload section whenever packages are staged, regardless of whether an update is currently available.

1.1.12 - 2026-10-15

Fixed

• DB backup/restore: the database management client bundled in the backend image was an older version that refused to connect to the current database server's newer major version, causing every export and restore to fail with a version mismatch error. The bundled client has been updated to match the server version.

1.1.10 - 2026-10-14

Fixed

• DB backup/restore: the production install package was missing a configuration entry that routes database export and restore operations around the connection pooler. Only the development configuration had been updated in earlier releases. Production installs now correctly bypass the pooler for these operations.
• License page: the platform version line was missing because the version endpoint was not included in the frontend proxy configuration. A proxied alias has been added; the license page now shows the correct version on load.

1.1.8 - 2026-10-14

Fixed

• Installer: admin credentials were missed when the container health check completed before the backend finished printing its startup banner. The credential fetch now retries several times before concluding the database already exists.
• Updater: the dashboard incorrectly showed "update available" on all images even when running the latest release. Version comparison now handles double-digit minor/patch numbers correctly; badges show "✓ up to date" when already on the latest version, and the backup warning and confirm button are hidden in that case.
• Updater: a registry URL entered with extra path components was stored verbatim and broke the update server API call. The URL is now normalised to the host root on both load and save, healing any existing corrupted state files.
• Updater: authentication failures now show an explicit message about the required permission level instead of the generic offline notice.
• DB backup/restore: export and restore operations were being routed through the connection pooler, which does not support the protocol features those operations require. A direct database connection is now used, fixing the 500 error on export.

Added

• License page: shows platform version (Backend vX.Y.Z · Frontend vX.Y.Z) fetched on page load.

1.1.7 - 2026-10-13

Added

• Updater auto-detects release package files present in the install directory on startup. The local update path is available immediately after extracting the release package - no browser upload required.

1.1.6 - 2026-10-12

Fixed

• Updater connectivity: the registry check was hitting a nonexistent URL. It now correctly queries the update registry and finds the latest non-prerelease manifest by name.
• Updater Settings page was showing the current registry URL as the placeholder hint, leading users to re-enter the wrong path. The hint now always shows the default registry address.

Added

• Air-gap (local) update path: the updater dashboard now has a permanent "Local Upload" section. Upload the per-image release files and optionally the manifest from the release package. The updater switches automatically to local load mode when local files are present, streaming the load log via SSE exactly as the registry path does.

1.1.5 - 2026-10-12

Added

• OptimusHub Updater: standalone update daemon with a browser-based interface for safe image updates. Fetches the release manifest from the registry, pulls images or loads them from local files, verifies SHA-256 integrity, restarts the stack, runs a health check, retries once on failure, and reverts to the previous image tags on a second failure. Full streaming log throughout.
• Updater Settings: configurable registry URL and pull token, both persisted across restarts.
• Installer now writes a state file after a successful install, starts the updater daemon in the background, and registers it as a system service with a fallback for environments without a service manager.
• Admin page → Updater tile: live health probe to the daemon; shows an "Open Updater" button when it is running and SSH start instructions when it is not.

Improved

• Release packages now include per-image files and a signed manifest alongside the full tarball and installer.

1.1.4 - 2026-10-11

Security

• Server networking libraries updated to address an HTTP/2 race condition that could crash the server under concurrent connections (GO-2026-6617).
• Message queue client updated, resolving multiple critical and high severity CVEs.
• Frontend dependencies updated, addressing multiple high-severity CVEs including path traversal and file-read issues.
• Cluster Exporter updated with the same networking library fix.

Fixed

• CI/CD webhook providers now preserve wrapped errors correctly, so failures are reported with their real cause.

Distribution

• Tarball distribution and installer improvements from 1.0.x/1.1.x are consolidated into the main release line.

1.1.3 - 2026-10-11

Audit Log

• Complete WHO / WHAT / WHERE / WHEN coverage across all OptimusHub operations - no known gaps remain.
• Catalog deployments now use per-catalog action labels: apps.deploy, data.deploy, monitoring.deploy, utils.deploy, utils.deploy_remote, utils.helm_deploy.
• Every deploy records the target machine (IP, environment, topology, cluster node IPs, Helm namespace/release, kubeconfig).
• SSH console and Docker Control Center sessions now log the actual target host and SSH user, not just the key name.
• New labels for SSH file browsing and Remote Browser access.
• The audit log now audits itself: viewing, exporting, summarizing and clearing logs are all recorded (clearing includes the deleted date window).
• Log Observatory detail panel is self-contained: user, action, resource and all target details are shown in the expanded row.

Upgrade note: existing catalog.deploy audit rows can be relabeled with the migration SQL in the release notes.

1.1.2 - 2026-10-10

Audit Log

• Labeling added for previously anonymous operations (about 40% of writes were logged as generic api_access): Kubernetes node operations, Helm, catalog wizard, DCSD, vSphere alerts, OH backups, SQL/NoSQL connections, Utils tools, CI/CD admin and project actions, admin connection tests, and account profile/avatar updates.
• Request-body details captured for Helm (install/upgrade/rollback, release name), catalog wizard (item and version) and DCSD (compose action, target IP).
• Log Observatory shows an action chip in the main row, with ACTION and RESOURCE at the top of the expanded detail.

Fixed

• cicd.member_delete and pipeline definition/variables saves were being mislabeled as other actions.

1.1.1 - 2026-10-08

Audit Log

• Retention extended to 90 days; new "Last 60 days" and "Last 90 days" filters.
• Automatic daily archive: logs older than 90 days are exported to timestamped CSV files under the backups directory and then purged from the database.
• Utils Catalog browse and deploy actions now produce labeled audit entries.

1.1.0 - 2026-10-08

Added

• OptimusHub internal database backup scheduler (Admin → DB Management): cron-based schedule with presets, local path, retention count, optional S3 upload, "Run now", and a job history table with download. Manual export is unchanged.

Changed

• All Utils tool pages share a consistent header pattern and theme tokens (HostMap, JWT Decoder, Host Vitals, Log Tail, Cron Builder, Remote Stress Test, CI/CD YAML Converter, PFX Extractor, images2ctl, Query Studio, Database Backup, Database Benchmarking, API Tester, Network Connectivity).
• Utils Catalog layout aligned with the Application and Monitoring catalogs; categories fit in a single row.

1.0.10 - 2026-10-03

Fixed

• Build reliability improved for installations without direct internet access (1.0.8 and 1.0.9 were intermediate build-pipeline fixes).

1.0.7 - 2026-10-03

Changed

• Dark theme palette aligned with the optimushub.net brand: deeper navy backgrounds, solid borders, cooler text.

1.0.4 - 2026-09-27

Added

• HostMap included in main and release pipelines.

1.0.3 - 2026-09-27

Added

• HostMap network scanner in the Utils Catalog: agentless TCP-connect discovery of live hosts, open ports, hostnames and MACs on the local network or a remote host over SSH. Scan history and CSV export.

1.0.2 - 2026-09-17

Fixed

• Installer: removed misleading reset command from the "existing database" message.

1.0.1 - 2026-09-16

Added

• Installer verifies the SHA-256 integrity of the bundle before installing.

1.0.0 - 2026-09-11

First production release.

Added

• Tarball installer for customer installs, including air-gapped environments: setup wizard, admin credentials shown after install, optional TLS.
• Offline bundles for runner images, infrastructure images and scan databases.

Fixed

• Large SFTP uploads through the VM console.
• Critical security dependency updated.

Before 1.0.0

Pre-release development, March – September 2026, grouped by area.

Platform and Security

• Global audit log (May 27) with Log Observatory: sortable table, search, filter pills, pagination.
• Namespace-level RBAC for Kubernetes clusters; granular permissions for Utils Catalog, DB backup and SQL querier; dba role.
• Brute-force lockout (5 attempts / 30 minutes), password strength enforcement, 12-character minimum.
• Initial admin password encrypted in the database; public endpoint removed.
• API tokens with device-flow approval and token management UI.
• SOC 2 readiness: governance docs and code fixes.
• Container socket access hardened using a least-privilege proxy, later split into two separate instances.
• Global CA trust store for air-gapped deployments; CA support for vSphere.
• Internal Certificate Authority, TLS certificate management and automatic renewal with deployment automation.
• License generator public key moved into the encrypted database.
• See Security History below for dependency CVE fixes and hardening.

CI/CD Module (May 28 – June)

• Full pipeline module: projects → pipelines, wizard, live dashboard, pipeline overview.
• Pipeline-as-code YAML import/export, clone, version history, project roles.
• Triggers: push webhook, pull request (branch and action filters), scheduled presets, pipeline-success.
• Deploy targets: Docker-on-host, SSH, Linux service, Kubernetes/Helm with multiple values files per environment; manual and 4-eyes approval gates.
• Application Catalog integration with version write-back.
• Security checks: secret scanning, container scanning, static analysis, per-language lint; admin-mandatory and organization custom checks (policy as code).
• Software bill of materials generation, signed build artifacts, Security Dashboard, Dry Run and Validate.
• Project and pipeline environment variables, build caching, multi-host remote Docker runners, concurrency limits.
• Offline vulnerability database upload for air-gapped environments; opti cicd CLI commands.
• CI/CD YAML Converter utility.
• Prebuilt offline runner images for .NET, Go, Java, Node, PHP, Python, Ruby, Rust and security tooling.

Workspaces (Web IDE)

• Web IDE workspaces proxied through the backend, with live provisioning status and logs.
• Per-workspace git identity from the OptimusHub user; git server host injection.
• Language templates (including .NET and Ruby); Gitea, GitHub, GitLab and Bitbucket support.
• Cleanup automation stops the IDE service on workspace delete.
• Cross-platform runtime support for 7 languages; Docker and git auto-install including air-gapped RHEL.

Kubernetes and Infrastructure

• Kubernetes cluster provisioning: live logs, kubeconfig auto-save, firewall configuration for supported Linux distributions, official air-gap artifacts.
• Node Management tab; images2ctl token auth.
• Cluster Import Wizard; Cluster Exporter as an independent tool.
• NFS SubDir provisioner moved to the Applications catalog with Helm support.
• Deployment automation embedded in the backend binary; runtime environment auto-installed in air-gapped environments.
• Infrastructure and tooling bundles refreshed to current versions.

Catalogs and Data Resources

• MySQL (Standalone/Cluster, offline packages, Helm chart) and MongoDB Replica Set.
• Helm "Load template" for values.yaml across all catalog types.
• iOS-style category folders in the Utils Catalog; custom add/remove resource icons.
• Prometheus /metrics endpoint, Loki log forwarding and admin Integrations UI.

vSphere

• VM groups and rules with checkbox VM picker; DR plan "Import from VM Group".
• Database backup redesign with Redis backup support.

Utilities Catalog

• Added: PFX Certificate Extractor, Nginx Config Builder, images2ctl, GPLPe, API Tester, Network Connectivity Tester (with Network Report), Network Diagnostics, SQL Querier → Query Studio (SQL + NoSQL, MariaDB, history, CSV export), Database Benchmarking, Host Vitals, Remote Stress Test, JWT Decoder, Cron Expression Builder, Log Tail, SSL/TLS Debugger.
• Docker Control Center: containers, images, volumes, networks, exec, logs, stats, bulk image delete.
• opti CLI with full API coverage, distributed through the catalog.

User Experience

• Light (bright) theme with full theme token system; persisted menu selection.
• White-labeling: company name, tagline, logo, and accent, background, sidebar and banner colors.
• In-app notifications and alerting with email delivery, license and TLS certificate expiry alerts.
• Multi-tab SSH console with file download and PTY resize fixes; optional sudo password on SSH keys.
• In-app documentation hub with sidebar navigation.
• Frontend migrated to current build tooling; connection pooling added for improved database performance.

Foundation (March – April 2026)

• Initial platform: infrastructure, monitoring and application catalogs, Docker and Kubernetes management, Web IDE workspaces, OIDC and local authentication.

Security History

As of 1.1.4, all known dependency CVEs have been addressed. Dependency CVE fixes and hardening, newest first. Release-specific fixes in 1.0.0 and 1.1.4 are listed in their entries above.

Dependency updates

Hardening

• Injection: argument-injection fixes in node operations and the CI/CD converter; command/argument injection in artifact signing and scanning executors; code injection in git hostname extraction; Kubernetes executor path traversal; Docker deploy inputs validated before interpolation; automation passwords escaped and redacted from logs.
• Access control: IDOR and fail-open scan findings fixed; global settings authorization; webhook events endpoint moved behind authentication; branch listing gated by auth, URL validation and host binding.
• Network and sessions: Docker network modes restricted to safe values; TLS verification enforced for IDE WebSocket connections; proxy cookie handling hardened (prefix denylist, Domain stripped); session cookie no longer cleared on unauthenticated requests; HTTP git clones require explicit opt-in.
• Secrets: initial admin password encrypted at rest; license public key moved to encrypted DB; leaked sample token removed; container socket proxy split into least-privilege instances.
• Supply chain: every build runs secret scanning, container scanning, static analysis, and code vulnerability scanning.