[github-actions]

Here's what's new in Charon

0.47.0 (2026-11-09)

Features

• ci: stamp non-release builds with the released base version (d59f167)
• compare versions semantically in update checks and backup validation (22ec244)

Bug Fixes

• add Appearance to the Settings sidebar menu (9765dce)
• add the missing local-host labels to the German, Spanish, French and Chinese translations (2a8b090)
• allow for archive headers in the import size check (41fbbdc)
• associate form labels with their controls (fe92812)
• bound the bulk delete request body, chunk large selections, and cover delete failure paths (199a12a)
• cap and anchor the what's new changelog for every user (a2ac687)
• carry the old CrowdSec mode setting over to the current one at startup (846ed34)
• check security settings values and narrow the failed-apply restore (#1844) (085c7b1)
• ci: add curl retries to Syft download in workflows (7a20d5d)
• ci: embed changelog data in release, development and pr images (344b2e0)
• ci: enhance grype scan handling to tolerate specific exit codes (7565b65)
• ci: generate clean changelog data and fail when it is missing (e4103fc)
• ci: increase timeout for golangci-lint in quality checks (206ecd6)
• ci: never skip the Docker build on manual dispatch (d24b01b)
• ci: publish version tags for release images (fc25621)
• ci: skip toolchain pin sync when the branch tip moved past the built commit (18e569b)
• ci: smoke test what's new on built images before publishing and label nightlies with the built commit (6308979), closes #1867
• ci: tighten changelog guard sha and merge checks, order prereleases by SemVer, warn on missed release (9f513f6)
• ci: update CodeQL action versions to v4.39.3 (41b4a0c)
• count a host with its own WAF handler as protected (#1852) (a867e87)
• count a host with its own WAF handler as protected in the security status (693859d)
• delete orphaned certificates with one bulk request when removing proxy hosts (08870cc)
• deps: update Alpine image version to 3.24.4 in Dockerfile (bce27a4)
• deps: update i18next and react-i18next to latest versions (026bf0d)
• deps: update kin-openapi to version 0.153.0 (af8d622)
• deps: update mongo-driver to v2.10.0 and sqlite to v1.62.0 (10dbb45)
• explain a selected WAF rule set that has no rules (6abbb38)
• explain why CrowdSec imports and acquisition saves cannot write to the config folder (ddc5386)
• fold review feedback into the bouncer registration changes (dfe9e67)
• give a hub upgrade the full first time share in the hub helper (bc8e4bb)
• keep a failed CrowdSec import from leaving the configuration folder incomplete (e35ca7c)
• keep a failed CrowdSec import from leaving the configuration folder incomplete (#1832) (3e4dd4b)
• keep a new CrowdSec key in use when saving it fails (f2990b5)
• keep a working CrowdSec bouncer key and register through the shared key check (#1824) (f38e04f)
• keep the bouncer registration swap whole and check keys against the local engine address (37c2ee0)
• keep the Caddy admin address inside the container (#1816) (5d0dbd5)
• keep the default security row in step with the CrowdSec setting at startup (001b398)
• keep the import error wording and cover the remaining archive failure paths (e6579c5)
• keep the modified time of a restored security setting (674505f)
• keep the saved CrowdSec key when CrowdSec cannot be reached (0645198)
• log skipped export symlinks once and check the pid before a reload signal (87ed593)
• make clickable overlays keyboard and screen-reader accessible (55e080f)
• make CrowdSec key checks safer when CrowdSec cannot be reached (#1814) (02003ed)
• make private IP forward host warning neutral for LAN and VPN addresses (2425f2b)
• make the break-glass disable switch the security suite off everywhere (148436c)
• make the what's new dialog safe to browse and render (58cfca7)
• pass the CrowdSec config file to every cscli call at container start (fa5db1e)
• pin zlib in toolchain image (1382ca1)
• read the CrowdSec engine address from one place (fbeb8da)
• read the proxy configuration from inside the container in the test tooling (bba8d6d)
• refuse a CrowdSec preset apply at once while a hub restore runs (0785150)
• refuse a WAF rule set without rules (c314ffc)
• register the CrowdSec bouncer through the shared key check (78a2622)
• reject out-of-range security settings values (7559799)
• release a held CrowdSec key only when it is still the one that was checked (d49e985)
• remove an unused proxy configuration file and extend the admin address tests (0daa97a)
• remove the unused Caddy Admin API setting from System Settings (ec2d75f)
• remove the WAF preset that has no rules and require rules in the form (5fa5fae)
• rename test constant that tripped gosec G101 (5629dac)
• report bouncer registration as unknown when the list cannot be read (5937686)
• require rules in a WAF rule set (#1838) (a7c1384)
• restore only the settings a refused change touched (0d54776)
• restore What's New and stamp builds with SemVer build-metadata versions (#1873) (80aa6a2)
• security: harden input handling in the CrowdSec API (656da91)
• security: harden log output in the CrowdSec integration (0340e88)
• security: harden Orthrus agent runtime privileges (5928595)
• security: harden Orthrus agent runtime privileges (#1874) (c4f7345)
• security: harden the proxy admin interface (6083d34)
• security: tighten ID parsing bounds in the Orthrus agent (c098b19)
• security: validate the Docker socket path in the Orthrus agent (8b1449d)
• serve test engines at the local CrowdSec address and tidy review items (deeaaf3)
• set up the database tables before the CrowdSec startup check (37de277)
• show a clear message when an import upload is too large (67bc47e)
• show an unknown state for bouncer registration (c0e1983)
• show the running version and update status in the system settings update card (6d16570)
• show where a held CrowdSec key comes from (a4fa566)
• stop key-leak log test colliding with random temp-dir digits (ec1ff4a)
• stop repeating the commit sha when the version already includes it (fe7dd8a)
• stop writing and reading the old CrowdSec mode setting (06e7f58)
• take a single backup for a bulk certificate delete (eb7d5ba)
• take a single backup when bulk-deleting certificates (#1876) (8aa1066)
• tidy CrowdSec engine address, restore busy answer and hub fallbacks (#1836) (126784c)
• tidy CrowdSec start-up and import error messages (#1817) (376c17e)
• tidy security test helpers, translations and docs (#1849) (b5e454c)
• try the hub mirror when a single hub item download fails (765d825)
• update Caddy version to 2.11.8 in Dockerfile (76e690c)
• update type definition for MonitorCard to use TFunction (5431c80)
• use one CrowdSec key file path everywhere (98c880a)
• use the bulk endpoint for bulk certificate deletion in the UI (8b6cf3d)
• write back blank values when a refused change is restored (6e7f0b9)

---

Merge this PR to cut the release.

[github-actions]

✅ Supply Chain Verification Results

✅ PASSED

📦 SBOM Summary

• Components: 1873

🔍 Vulnerability Scan

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	13
🟢 Low	2
Total	16

📎 Artifacts

• SBOM (CycloneDX JSON) and Grype results available in workflow artifacts

---

_{Generated by Supply Chain Verification workflow • View Details}

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-actions]

🤖 Created releases:

• v0.47.0

🌻