These four locales had translation files but were never wired into i18n
resources or the nezhaLang dropdown, so users could not select them.
Register ja-JP, ro-RO, uk-UA, gl-ES; missing keys fall back to en-US per
the Weblate community-translation workflow.
Mirror the server HideForGuest flag on services: rename the
enable_show_in_service field to hide_for_guest across the form, schema
and generated types, reuse the existing HideForGuest label, and drop the
now-orphaned ShowInService i18n keys. Services are now visible to guests
by default and hidden only when the box is checked, matching servers.
Surface the new nezha:inventory:{read,delete,*} scopes that gate listing
and deleting servers/server-groups, separate from nezha:server:* which now
covers per-server runtime operations. Refine server-scope descriptions to
match the backend split.
- Add safeExternalHref(): only render http(s) URLs as clickable hrefs,
blocking attacker-controlled template metadata from becoming
javascript:/data: links.
- Refine CSRF header attachment and auth-loading state in the fetcher,
api-tokens client, useAuth, and settings route.
Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
Add the reserved_hosts setting (input + i18n across all locales) so operators
behind a reverse proxy can declare public dashboard hostnames members must not
register as NAT domains (GHSA-x6fg-52vr-hj4w).
Show the backend error message on NAT create/update failure instead of a
generic "unexpected error", so a reserved-host rejection is explained.
Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
Add an API tokens management route to create, list, and revoke PATs, showing
the plaintext token once on creation with scope and server-id selection.
Mirror the nz-csrf cookie into the X-CSRF-Token header on unsafe fetcher
methods (POST/PUT/PATCH/DELETE) for the server-side double-submit check, and
self-heal expired sessions via refresh-token without a recursive fetch loop.
Gate protected routes behind resolved auth state to avoid pre-auth SWR fetches,
and fix the login loading/race so stale probes cannot clobber the session.
Add i18n keys for the new screens across all locales.
Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
Backend moves /api/v1/file from GET to POST so SameSite=Lax cookies
can no longer expose this state-changing endpoint to cross-site
CSRF. Update createFM() accordingly.
Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
Backend GHSA-8qhj-4f8c-j8qg moves /api/v1/cron/:id/manual from GET to
POST so SameSite=Lax cookies no longer expose this state-changing
endpoint to cross-site CSRF. Update runCron() accordingly.
Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
Settings page used a plain number input for ip_change_notification_group_id,
requiring users to manually enter a group ID. Replace it with a searchable
Combobox component (consistent with alert-rule/service/cron pages) and wrap
the settings route with NotificationProvider to load notification group data.
Closesnezhahq/nezha#1174
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
Settings page used a plain number input for ip_change_notification_group_id,
requiring users to manually enter a group ID. Replace it with a searchable
Combobox component (consistent with alert-rule/service/cron pages) and wrap
the settings route with NotificationProvider to load notification group data.
Closesnezhahq/nezha#1174
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
Codex
Sam5440andnaiba/CloudCode
Weblate (bot)andLee Vincent
Bot
naiba
Copilot
dysf888
Buriburizaemon
