technitium-console/CHANGELOG.md

# Changelog

What changed in each release, newest first. Every release is also on the
[Releases page](https://github.com/byGarcia/technitium-console/releases), with the files the
installer downloads.

## Which version for which server

A console release is built and checked against one Technitium DNS Server release: every action it
sends, every text it shows and every control it offers, compared with that server's own console.
**Update the console together with the server.** The oldest server each release is made for is
also `technitiumServerMinimum` in its `package.json`, which is what the update notice reads.

| Console | Technitium DNS Server | Notes |
|---|---|---|
| **1.3.x** | **15.5.x, 15.6.x** (1.3.4 checked against 15.6.2) | Current. Every screen redesigned for the phone, a Dashboard that compares periods, Cache in one panel. |
| 1.2.x | 15.5.x, 15.6.x | Superseded by 1.3.x on the same server. Allowed and Blocked become one Blocking section, a light theme, and the console comes as an image for Docker. Supports a console folder of its own (`DNS_SERVER_WEB_SERVICE_WWW_FOLDER_PATH`), so server updates leave it alone. |
| 1.1.x | 15.5.x | Superseded by 1.2.x on the same server. If you stay on it, use 1.1.3: earlier ones flood the server from Cache, Allowed and Blocked. |
| 1.0.0 | 15.4 | Cannot save Settings on a 15.5 server. Upgrade. |

To update, run the installer again (the same one-line command). It needs no restart of the DNS
service. On Docker, pull the image again: see [Docker](README.md#docker).

---

## v1.3.4 (2026-10-21)

**Two display fixes, both reported by users.** Still Technitium DNS Server 15.6.2: no API changes.

- **View Logs: a log file reads from the top again.** A file that starts with a run of zero bytes,
  which an unclean shutdown can leave, showed an empty viewer until you scrolled down. That run now
  takes no room; Download still gives you the file exactly as it is. Reported by @Colossus5000 in
  [#20](https://github.com/byGarcia/technitium-console/issues/20).
- **Top Clients: no stray dot under an address, and the count on its line.** A client with no
  resolved name, which is most IPv6 clients, showed a `.` under its address. The stock console
  writes it there; this one now leaves that line out, in the Dashboard's card and in the Top 1000
  list. The Queries count and the row menu sit on the client's line again. Reported by @armgenio in
  [#22](https://github.com/byGarcia/technitium-console/issues/22).

## v1.3.3 (2026-10-19)

**Behaves like the stock console in every place a census found it did not.** After a report that
the DNS Client server list did not open, every change and click handler of the stock console was
compared with this one, and each difference found was fixed. Still Technitium DNS Server 15.6.2:
no API changes.

- **DNS Client: the server list opens again.** The arrow next to *Server* showed nothing, because
  the browser filtered the list by the text already in the field. It now always lists every
  server, and choosing one also sets the protocol, as the stock console does. Reported by @JF62 in
  [#15](https://github.com/byGarcia/technitium-console/issues/15).
- **DNSSEC: Add Key works with its defaults.** It opened as a Key Signing Key with an automatic
  rollover of 30 days, which the server refuses. The rollover now exists only for a Zone Signing
  Key and follows how the key is generated, in Add Key and in Sign Zone.
- **Cluster: the node selects act on the node chosen.** Zones reloads its list from the node (and
  stays on its page), Cache lists, flushes and deletes on it, View Logs and Query Logs follow it,
  and DHCP locks the node while a scope is being edited. With no node chosen they show this server
  instead of a dash.
- **Records: the add and edit form does what the stock one does on its own.** Changing the type
  empties the previous type's fields and leaves the TTL empty so the server applies its default
  (it was sent as 3600, wrong for NS). FWD records get *Use "This Server"*, APP records fill
  *Record Data* from the class's template, and SVCB parameters offer the known keys again. The
  records filters apply on *Go*, with a *Page Number* field, as in the stock console.
- **Zones:** *Zones Per Page* and *Records Per Page* are remembered, and up to 500 records per page
  are offered again. Zone Options' tabs and override boxes follow the catalog chosen. Add Zone
  preselects the cluster's catalog, reads the TSIG keys again for a secondary, and keeps a chosen
  zone file when the zone type changes, as Import Zone does when switching to the text editor.
- **Quick lists.** *None* in the TSIG Quick Add empties the list instead of adding a key named
  `none`; *None* in the forwarders' Quick Select also goes back to UDP; and picking the line
  already chosen in any list does nothing, as in a native select.
- **Login:** the 30 second OTP timeout starts the form over, and the automatic login of a fresh
  install no longer opens the OTP panel. **SSO and LDAP:** a group map to a local group that no
  longer exists shows and saves the first group, as the stock console does. **Dashboard:**
  *Custom* reloads at once when both dates are already set.
- **The update dialog has a Copy button** beside each command.

## v1.3.2 (2026-10-18)

**An update notice, and a hardened installer.** The console now tells you when there is a newer
one, and an audit of the whole product tightened the installer and the release workflow. Still
Technitium DNS Server 15.6.2: no API changes, all 132 endpoints are covered.

- **The console tells you when a newer console is out**, the way the server does for itself: an
  *Update* mark next to *Web Console*, and a dialog with the release notes and the two commands
  to update. It asks at most once a day, through your own DNS server, and only announces releases
  made for the server you run. It follows *Check for update* in *Settings › General*. How it works
  and what leaves your network: [README](README.md#keeping-it-up-to-date).

**Security**, from an audit of the whole product:

- The installer no longer trusts a group-writable root folder that carries a POSIX access control
  list: there the group bits can stand for another account that may write, and that account
  could race root's copy and make it write or delete outside the console folder. Where neither
  `ls` nor `getfacl` can show lists (BusyBox without the acl package), group write is not trusted
  at all, and the installer says how to fix it.
- The installer no longer creates a folder just because the running server's environment names
  it. Only `/opt/technitium-console` is created that way; any other new folder has to be created
  by the administrator first.
- On a Docker host, the commands the installer prints quote the Compose service names it reads,
  and strip control characters from every name it shows, so a label set in an image cannot add a
  command to the line you paste or rewrite the screen.
- `--version` accepts only a release tag, so it can no longer point the download at another
  repository's release.
- The release workflow now unpacks the build job's artifact outside its checkout and accepts only
  the tarball and its checksum, so nothing from the job that runs npm can replace a script the
  release job runs.
- Links that come from the server, such as the update notice's, are followed only when they are
  http or https. The zone records filter no longer blanks the console on a pattern that is not a
  valid expression. The update check refuses oversized queries and names longer than DNS allows.

## v1.3.1 (2026-10-17)

**Technitium DNS Server 15.6.2.** The server release makes the Dashboard's figures links to Query
Logs and rewords one warning, and this console now does the same. No API changes: all 132
endpoints are still covered.

- Dashboard: clicking Total Queries, a response code (No Error, Server Failure, NX Domain, Refused)
  or a response type (Authoritative, Recursive, Cached, Blocked) opens Query Logs filtered to it,
  as in 15.6.2. Clients and Dropped are not links.
- Edit Zone File and Import Zone: the SOA serial warning now says that secondary zones will also
  need a manual resync.
- The note parity check now also compares the end of each note. It missed the reworded warning
  because the old text still matched at the start.

## v1.3.0 (2026-10-16)

**A Dashboard that answers at a glance, Blocking that explains itself, and every screen at home on
a phone.** Same API and same behaviour as the stock console: checked against Technitium DNS
Server 15.6.1.

- Dashboard: every figure, the Queries chart, a week by hour, Server, the three top lists and the
  three breakdowns (now stacked bars) fit in the first screen. Each figure shows its trend and its
  change against the previous period of the same length; Clients has no change for Last Week and
  Last Year, where the server cannot give a comparable number. Clicking a chart point, a slice, a
  bar or an hour opens Query Logs filtered to it.
- About: two panels for the console itself under Server: its version, license, source, release
  notes, where to report a problem or share an idea, and how to support it.
- Cache: one panel instead of two. The Domain field on top, the path of the current name with
  Refresh and Delete, the names under it as chips that open them, and each record on one line with
  its details underneath.
- Blocking › Overview: Check a domain says whether this server blocks a name and why (which block
  lists, which of your rules, or which allow rule lets it through), next to Block and Allow.
- Blocking › Lists: comment lines act as group headings. Add, rename and ungroup groups, add lists
  into a group and move lists up and down. The save bar says what changed and the tab is marked
  while changes are unsaved.
- Blocking › Rules: deleting from the table no longer asks and offers Undo for a few seconds. The
  tree view and Flush still ask.
- Settings: since Save Settings sends all nine panes, the save bar names the panes holding a change
  it would send, with how many fields each, and their tabs are marked. A field put back as it was
  does not count.
- Settings › General, Web Service and Optional Protocols, and Administration › SSO, have a section
  index: a strip that stays at the top while you scroll and marks where you are, or a column beside
  the form on wide screens. Permissions' strip now stays at the top too.
- The save bar of Settings and the other long forms no longer disappears behind a section title
  scrolling under it.
- The sidebar marks Blocking when blocking is off or paused, with the time it comes back.
- Blocking's three tabs have a one-line subtitle saying what each is for.
- Login: a cover beside the sign-in form, in both themes and at phone width. The form, its steps
  and its messages are unchanged.
- Query Logs: the filters fit in two bands, Live Update is a switch in the header, rows stay on one
  line with the full value on hover, and the response colour is a pill instead of a tinted row.
  Below 960 px the filters fold under their title and say which ones are set, so the first results
  are on the first screen of a phone.
- Tables never scroll sideways: when one does not fit, each row becomes a block with its name and
  actions first and the other columns labelled underneath (Zones, records, Cache, Users, Sessions,
  Query Logs, DHCP, Cluster, Recently Blocked).
- View Logs: the log fills the window and long lines wrap, lined up under the message, instead of
  being cut at the right edge. Copying gives the original text.
- Panel titles sit one step above table headers.
- Fields, dropdowns and buttons share one height. Domain names and list URLs no longer break in the
  middle of a word, and a new check (`npm run lint:breaks`) keeps it that way.
- Session rows keep the user agent to two lines.
- The installer accepts a web root whose files root's own group can write. Technitium's install
  script leaves every file of its console as root:root 0664, so since 1.2.3 upgrading or
  uninstalling over a stock web root, or over a console a server update had written into, stopped
  with "root-owned, non-shared regular file required". Write by any other group or account is
  still refused.

## v1.2.4 (2026-10-12)

**Technitium DNS Server 15.6.1.** The server release changes one note in its own console, and
this one now says the same. No API changes: all 132 endpoints are still covered.

- LDAP Authentication: the note on how the LDAP server name is resolved is now two notes, one for
  Windows and one for Linux, as in 15.6.1. The Linux one asks for `127.0.0.1` in
  `/etc/resolv.conf`.
- The note parity check no longer counts a note as present on a run of words it shares with
  another note. That is how the new Linux note passed before it was here.

## v1.2.3 (2026-10-04)

**Security hardening and live figures that survive minute reloads.** The root installer
rejects filesystem paths that non-root accounts can change, session cleanup preserves
newer logins, and private DNSSEC fields travel in POST bodies. Last Hour retains the
queries the server has not consolidated yet, and Recently Blocked follows its count.

- Last Hour keeps pending live readings across minute reloads on the Dashboard
  and Blocking Overview, discarding them only when the server's UTC minute
  boundary includes them. Quiet intervals retain their place in the chart.
- Recently Blocked follows the Overview's Blocked count, keeps the last good
  rows during refreshes, and discards late responses after context changes.
- Dashboard Top five lists show their position and a subtle proportional bar.
- Adding a rule keeps a closed tree's selection and only opens an added domain
  in a list the current user can view.
- The sortable-column parity check fails when its upstream snapshot is absent
  and accepts an explicit snapshot path.
- Root installer publication, restore and custom-list migration reject writable
  service-owned trees, links, special files and ambiguous pathnames. State and
  staging use protected root-owned storage; state and systemd changes use unique
  temporary files. Unsafe trees are refused without changing their ownership.
- DNSSEC signing and private-key import send PEM fields in POST form bodies.
- Logout revokes the displayed session, and expiry responses preserve tokens
  belonging to newer sessions or other tabs.
- Update the development-only jsdom dependency undici from 8.10.0 to 8.10.2 to
  include its published security fixes.

**Installer migration:** existing service-owned or group-writable console, backup or
state trees are refused. Use a fresh root-owned console folder or a dedicated console
volume mounted read-only in the DNS server. The installer does not repair ownership
in place. See [Installing](README.md#installing) and [Security](SECURITY.md).

---

## v1.2.2 (2026-10-03)

**Blocking › Overview moves in real time too, and the live charts stay still.** The live Last Hour
of 1.2.1 left two things to finish. Blocking's Overview, which reads the same figures as the
Dashboard, now follows the server as queries arrive and reloads every minute like the Dashboard.
And the charts no longer replay their entry animation on every live update, nor switch back on a
series you had switched off in the legend.

- **Blocking › Overview, Last Hour:** Total Queries, Blocked, their sparklines, the queries over
  time bars and the blocked share ring follow the server every 2 seconds, on the node or the whole
  cluster you are viewing. The page also reloads once a minute, and not while its tab is hidden.
- **The charts take new figures in place.** On the Dashboard every chart was rebuilt, and animated
  again from scratch, every 2 seconds, even with no new queries. Now a reading that brings nothing
  draws nothing, and one that does moves the chart without animating it.
- **A series switched off in the legend stays off** until the next minute reload, as in the stock
  console. With 1.2.1 it came back within 2 seconds.

---

## v1.2.1 (2026-10-03)

**Last Hour moves in real time, the row menus are back, and Technitium 15.6 is supported.** With
Last Hour selected, the query counts and the Queries chart follow the server as queries arrive,
and in a cluster they now add up every node. Query Logs entries and the Dashboard's top lists have
their row menus again, to query the DNS server, open the matching logs, or allow and block a
domain. On Technitium 15.5 or later with systemd, the installer now sets up the dedicated console
folder by itself.

### Technitium 15.6

- **Settings › Cache › Prefetch has the new Enable Cache Prefetch switch.** Since 15.6 a Prefetch
  Trigger of 0 no longer turns prefetching off, so its "set 0 to disable prefetching" hint is gone
  too. On a 15.5 server the switch shows unchecked and has no effect, as the server ignores it.
- **Administration › Cluster shows each node's version under its name**, once the server reports
  it. A remote node gets one after its first heartbeat.
- The 15.6 fixes in the stock console's DHCP screen did not apply here: this console never builds
  markup from those values.
- Console 1.2.0 keeps working on a 15.6 server. It just does not offer the new switch, and saving
  Settings leaves it as it was.

### Fixes

- **Logs › Query Logs fits narrower windows**
  ([#4](https://github.com/byGarcia/technitium-console/issues/4)). Under about 1366 pixels, Domain
  and Answer were squeezed to a character wide and the rest of the table hid past the right edge.
  They now keep a readable width, and the table fits down to small laptop windows.
- **The Dashboard's Cluster view adds every node up.** It showed the node serving the console
  alone, because the console never told the server it wanted the whole cluster. Blocking ›
  Overview and the More dialogs had the same fault and are fixed too.
- **Blocking › Overview: each Your Rules number sits over its own word**
  ([#5](https://github.com/byGarcia/technitium-console/issues/5)), so the card reads like the other
  three.

### Dashboard

- **Last Hour now moves in real time.** Between the minute refreshes, the query counts, the
  Queries chart and the response types follow the server's own counters every 2 seconds, on the
  node or the whole cluster you are viewing. Clients, query and protocol types and the top lists
  still update once a minute, as the server only counts them that way.
- While the browser tab is hidden the Dashboard asks for nothing, and it catches up as soon as you
  come back.
- **Last Hour refreshes every 60 seconds.** The selected period and cluster node stay in place.
- Other periods do not poll: their data does not change as the current minute advances.
- Requests never overlap, and the current figures stay visible during a refresh.

### Row menus

- **Query Logs entries open in DNS Client again**
  ([#4](https://github.com/byGarcia/technitium-console/issues/4)). Each row's menu offers Query
  DNS Server, then Allow Domain or Block Domain, as in the stock console.
- **The Dashboard's top lists and their More dialogs have their row menus back**: Show Query
  Logs, Query DNS Server, and Block Domain or Allow Domain. Jumping to DNS Client or Query Logs
  fills the form and runs the query, on the cluster node the Dashboard is showing.
- **Administration › Sessions: each row's details button is now View User Details**, the stock
  console's wording for it.
- DNS Client now sends its cluster node with the query, and the More dialogs ask the node the
  Dashboard is showing. Both used to answer from the node serving the console.

### Installer

- On Technitium 15.5 or later with systemd, the installer now creates and owns
  the dedicated console folder and service drop-in itself. It publishes before
  the single restart, verifies the running service, and rolls back to the stock
  console if activation fails.
- Reinstalling or updating the console in that folder does not restart the DNS
  service. Uninstall switches back to the stock console before removing the
  folder, and refuses to remove a drop-in changed by the administrator.
- `--no-configure-service` keeps the previous replacement mode available.

---

## v1.2.0 (2026-10-02)

**Allowed and Blocked are now one Blocking section, and Docker gets an image.** Overview, Rules
and Lists: what blocking is doing, your own rules and your lists, each in one place. It is a deliberate exception
to "design only", written down with its limits: it calls only endpoints the server already has,
with the stock console's own actions and wording, and Settings › Blocking is left exactly as it
was. If Technitium runs in Docker, a small image now copies the console into a volume that the
official server serves, and updating it restarts nothing: see
[Docker](https://github.com/byGarcia/technitium-console#docker). There is a light theme now, and
it follows your system unless you pick one. On the way, the Dashboard's chart learned to tell the
time the way the stock console does.

### 🌗 Light theme

- **Change Theme is back** in the account menu, as in the stock console: Use System Theme
  (default), Light Theme and Dark Theme, applied the moment you click. Asked for by @scgf in
  [#1](https://github.com/byGarcia/technitium-console/issues/1), and by @armgenio in
  [#2](https://github.com/byGarcia/technitium-console/issues/2).
- **It remembers what the stock console remembers.** The choice is kept under the same browser
  key, so if you picked Light in the stock console you get Light here without doing anything, and
  the other way round. Follow the system and it changes when your system does, without a reload.
- **The light palette is measured, not inverted.** Every text colour reaches 4.5:1 on every
  surface it is drawn on, field borders and the focus ring reach 3:1, and the chart colours were
  checked against each other again on white, including for red-green colour blindness. Technitium's
  amber stays the fill; where amber is text on white it darkens so it can be read.
- **Amber is not offered.** The stock console's fourth theme is not drawn; a browser that has it
  stored gets Dark, and its choice is left as it was.
- The charts repaint when the theme changes, and series you switched off stay off.

### ✨ The Blocking section

- **Overview.** Total Queries and Blocked with a trend line under each and Blocked's share of the
  total, Block List Domains and Your Rules. Blocking's status, with Disable for the stock console's
  eight durations and, while paused, the time it comes back. Allowed against blocked over time as
  stacked bars, and a ring with the blocked share, for the Dashboard's five fixed periods and with
  its node selector and memory. Top Blocked Domains with **Allow Domain** and Top Domains with
  **Block Domain**, in a menu on each row, as on the stock Dashboard. And Recently Blocked: the last
  ten blocked queries, from the app that logs them.
- **Rules.** Every domain you blocked or allowed by hand in one table, filtered by All, Blocked or
  Allowed with their counts, searchable, and paged 50 at a time however many there are. Delete
  asks as the stock console asks. **Tree** switches to the domain tree you already know. Import,
  Export and Flush sit at the foot, each for Blocked or Allowed.
- **Block or allow a domain.** One field with Block and Allow, on Overview and on Rules. Enter
  blocks, as the stock console's form does.
- **Lists.** Each block list URL is a row: its readable name when it is in the Quick Add
  catalogue, an Enabled switch, its type and Remove. Add a block list or an allow list by URL or
  with Quick Add. Changes wait in a bar with Save and Discard, so even Quick Add › None can be
  undone, and Save sends only the list URLs, cleaned as Settings cleans them. Block List Domains,
  Allow List Domains and the next update come with **Update Now**, and the figures say they are
  updating until the server has finished.
- **More lists in Quick Add.** On Lists, Quick Add has a search field that filters by name or by
  the list's host, and after Technitium's catalogue it offers more lists chosen by this console,
  under More lists. Settings › Blocking offers Technitium's catalogue as before.
- **Old addresses still land.** `/allowed/` and `/blocked/` open Rules filtered to that list, and
  the filter stays in the address, so it survives a reload.
- **Nothing hides for want of a permission.** A panel you cannot view shows a padlock and the
  permission it needs; a control you cannot use is disabled and says why. The section appears for
  anyone who can view Blocked or Allowed.

### 🧰 Installer

- **`ghcr.io/bygarcia/technitium-console`**, for amd64, arm64 and arm/v7, on Technitium 15.5 or
  later. It carries this release's tarball, byte for byte, checks it against its checksum again
  every time it runs, copies the console into the volume and exits. Pin `:1.2.0`, follow `:1.2`,
  or take `:latest`.
- **On a Docker host the one-line installer prints the exact steps** for your containers, with
  their own container, service, file and volume names: in, and with `--uninstall`, out. It used to
  print a command that did not work (`sudo sh --dir …`) and a layout that 15.5 no longer needs.
- **Installing into a container's own files is called out**: they are gone the next time the
  container is recreated.
- **A folder holding only your `json/*-custom.json` lists counts as empty**, so they can be in
  place before the first install.
- **`--dir /` is refused.** It used to fall back to the server's own web root and install there.
  A folder holding a DNS server's configuration (`dns.config`, `zones/*.zone`…) is refused too,
  whatever else is in it.
- **Stopping the installer stops it.** A Ctrl-C or a `TERM` in the middle of a run used to clean
  up its working files and carry on without them; now the run ends there, and the next one picks
  up from a clean slate. A run it refuses leaves nothing behind, not even an empty
  `/var/lib/technitium-console`.

### 🛠 Fixes

- **The Dashboard's chart tells the time as the stock console does.** The console never asked the
  server for UTC (`utc=true`), so the hours on the axis were the server's clock and not yours, and
  shifted whenever the two sit in different time zones. It now asks for UTC and labels the hours in
  your local time, as the stock console does.
- **The Allowed and Blocked tree, now Rules › Tree, has no cluster node selector**, which the stock
  console only has on Cache, and after a change it reads the tree back from the primary node, as
  the stock console does.
- **No stray scrollbar beside the section tabs.** Chromium on Linux drew one next to the tabs of
  Settings, Logs, Administration and DHCP.
- **Drop-down lists show their options whole.** A list is now as wide as its longest option,
  within the window, and scrolling it no longer closes it.
- **Big figures stay inside their cards on the Dashboard.** A Block List of millions of domains
  ran out of its card in Server. Server now has two columns while it sits beside Queries, so nine
  characters fit at full size, and any figure that is still too long for its card is drawn
  smaller instead of spilling out. Reported by @armgenio in
  [#2](https://github.com/byGarcia/technitium-console/issues/2).

### 🧪 Under the hood

- Overview, Rules and Lists are also tested against responses recorded from a real server, and
  the rules table against 10,000 rules.
- `CONVENTIONS.md` writes the Blocking section down as a deliberate deviation, with its four
  limits and the two behaviours a maintainer would not guess.
- Every image is checked on each of its three platforms to carry exactly the release's tarball
  before `latest` and `1.2` move to it.
- Every push to `develop` builds `ghcr.io/bygarcia/technitium-console:develop`, the same way a
  release is built, for trying changes before they are released. It is not for production, and it
  never moves `latest` or a version.
- New issues start from a Bug report or Feature request form, which asks for the console and
  server versions and labels the issue.
- Everything in the repository is in English, and `npm run lint:language` now reads every file,
  not only `src/`. The notes from the design process, which were in Spanish, are no longer part
  of the repository.

---

## v1.1.3 (2026-09-30)

**Cache, Allowed and Blocked stop hammering the server.** Please update: these three screens had a
bug since 1.0.0 that kept asking the server for the root of the tree, hundreds of times a second,
for as long as the screen was open.

### 🛠 Fixes

- **Cache, Allowed and Blocked load once.** The screen re-ran its own first load after every
  answer, so it flooded the server's API while open and jumped back to the root whenever you
  opened a node in the tree. Opening a node now stays on it.

### 🧪 Under the hood

- The tests for those screens now answer by domain, as the server does. The old ones answered the
  same thing to every request, which is why the loop was invisible to them.
- Every section was opened against a server with real data and its requests counted: none asks
  for anything more than twice.
- A new check, `dev/check-endpoints.mjs`, confirms that every API endpoint the stock console of
  15.5.1 uses is covered here too: 132 of 132.

---

## v1.1.2 (2026-09-30)

**Sign in with SSO works from any page.** A one-line fix found on the first real install, the
evening 1.1.1 came out.

### 🔑 Single Sign-On

- **"Sign in with SSO" no longer gives a 404.** If your session expired while you were on, say, the
  Dashboard, the login appeared right there and its SSO link pointed at `/dashboard/sso/login`,
  which does not exist. It now always goes to the server's `/sso/login`.

### 🧪 Under the hood

- A test now fails on any link or image in the interface that would resolve against the page you
  happen to be on. This is the second path of that kind found in one day, so it gets a guard.

---

## v1.1.1 (2026-09-30)

**A clean uninstall on Docker, and the header keeps up with the server.** Found by installing 1.1.0
from its own release, exactly as the README says to.

### 🧰 Installer

- **`--uninstall` finishes when the console's folder is a mount point**, which it is in the
  Docker layout. It used to empty the folder and then stop with `Device or resource busy`. Now it
  empties it, removes it if it can, and if it cannot, tells you to unset the variable before
  restarting instead of offering a restart that would serve an empty folder.

### 🖥 Interface

- **The tab title, the header and About follow the server.** Rename the server or update it, and
  they change the next time Settings loads, as the stock console does. They used to stay as they
  were when you logged in.
- **The highlighted option of a dropdown stays in view** while you move through it with the
  keyboard.

### 🧪 Under the hood

- The last Spanish names left in the code are gone, and the check that keeps the code in English
  now knows them.

---

## v1.1.0 (2026-09-30)

**Ready for Technitium DNS Server 15.5.** Version 1.0.0 was built for 15.4 and, on a 15.5 server,
could not save Settings at all: 15.5 removed Auto Prefetch, and 1.0.0 still required its two
fields. Everything 15.5 and 15.5.1 changed in the stock console is here, and the installer can now
keep the console in a folder of its own, so a server update no longer puts the stock one back.

### ✨ New in Technitium 15.5, now in the console

- **Administration › LDAP Authentication**: every field, the group map, Test Connection, and the
  bind password kept masked.
- **Edit Zone File** for Primary and Forwarder zones, from the zone's Options menu and from the
  zone list. Other zone types show **View Zone** instead.
- **LDAP users**: Local, Remote/SSO and Remote/LDAP accounts each get the right menu entries,
  profile fields and 2FA options.
- Blocking's new rules, the Docker note under Web Service, and the refreshed block list catalogue.

### 🧰 Installer

- **A folder of its own.** On 15.5 or later, point the server at a folder with
  `DNS_SERVER_WEB_SERVICE_WWW_FOLDER_PATH`, a variable contributed to Technitium for this very
  purpose ([#2138](https://github.com/TechnitiumSoftware/DnsServer/pull/2138)), and the console
  lives there, untouched by server updates. See *Installing* in the README.
- **It only ever writes into a console.** It refuses a folder that is neither Technitium's console
  nor its own, trusts only the real server process, does not follow symbolic links, uninstalls
  only what it installed, and checks every download against the release's published checksum.

### 🛠 Fixes

- **Settings saves again** on 15.5.
- **Settings follows the node you pick**, on a cluster and on a single server alike, and after you
  move the web service to another port or protocol the console follows it there.
- **Single Sign-On**: the Redirect URI shown in Administration › SSO is the right one again.
- **Your account**: Configure 2FA asks before turning 2FA off, Change Password shows your username
  and the code's help, success messages close the dialog and appear on the page, and Create API
  Token shows the new token on its own with its warning. Logging in with the factory password
  opens Change Password straight away, as it should.
- **Nineteen explanations and notes** that had gone missing are back, most of them under the Zone
  Options choices.

### 🔒 Security

- Opening the console at an address with a doubled slash (`https://host//`) could have sent the
  session token to another host; the server's security headers blocked it, and now the console
  never gets that far.
- A saved session that fails when the console starts is cleared.
- None of the cross-site scripting issues fixed in Technitium's own console in 15.5 and 15.5.1
  applied here.

---

## v1.0.0 (2026-09-07)

**First public release.** The whole Technitium DNS Server 15.4 console, rebuilt: twelve sections,
real addresses you can bookmark and reload, a layout that works on a phone, and a one-line
installer that puts it in place and takes it out again.

### ✨ Highlights

- **Same console, new interface.** Every screen, dialog, text and step of the stock console, against
  the same API. Nothing changes on the server.
- **Works on a phone.** No section overflows at 390 px; tables reflow and the navigation collapses.
- **Cache, Allowed and Blocked as a real tree**, full height beside the records, with the path you
  are on written out.
- **An installer you can trust with your DNS server.** It keeps your custom lists, survives being
  interrupted, never restarts the DNS service, and uninstalls back to the original.

### 🛠 Fixes on the way to 1.0

- Sortable columns restored in the App Store and the installed apps list.
- Loading no longer looks like an empty list.
- The App Store is far shorter to scroll: descriptions show two lines, with the rest one click away.