LinkBoard - Releases

Added

• New "Link target" setting (issue #15): choose whether service links open in a new tab, in the same tab, or per service. The default is "New tab". With "Per service", each service's own "Link target" field in the service editor decides (defaulting to "New tab").

Changed

• The "Link target" field in the service editor is only shown while the global setting is "Per service", and now displays labeled options ("New tab" / "Same tab") instead of the raw values _blank / _self.
• Behavior change: the stored per-service link target was previously always honored. With the new global default "New tab", services configured to open in the same tab do so again only after selecting "Per service" in the settings.
• The per-service link target is now validated server-side; values other than _blank / _self are stored as _blank.

Fixed

• The "Edit category" panel now scrolls when its content is taller than the window (issue #14). Previously the panel was cut off at the bottom on short viewports (e.g. small window with 120% zoom) and wheel scrolling moved the dashboard behind it instead.

Added

• Services can be dragged between categories in the compact list display mode: dropping a row into another category's list moves the service there at the exact drop position. The stored card-grid position is cleared on the move, so the service gets a fresh default spot when switching back to cards mode.

Fixed

• Sections can now be dropped vertically between two rows (issue #13). While dragging a category by its handle, drop zones appear above, between, and below the rows; dropping there makes the category its own row at that position. Previously a dragged section could only be placed side by side into an existing row.

Added

• Drag & drop reordering in the compact list display mode: in edit mode each row gets a drag handle to reorder services within their category. The order is persisted as the service sort order, so the cards grid layout stays completely untouched. This lifts the 1.8.0 limitation of switching to cards mode to reorder.

Changed

• The compact list now displays services in their stored sort order instead of mirroring the cards-grid position — a one-time change for 1.8.0 list-mode users; the cards layout itself is unaffected. While a search filter is active, reordering is disabled.

Added

• Compact list display mode (discussion #12): a new "Display mode" setting renders services as single-line rows instead of cards — icon, text, and inline status dot. A companion "List row content" setting selects what each row shows: title, URL, title and description, or title and URL. Widgets are not rendered in list mode. Grid layout data is preserved, so switching back to cards is lossless; to reorder services, switch to cards mode temporarily.

Fixed

• Fritz!Box widget: the digest handshake never reached the box (issue #11). FRITZ!OS validates the SOAP body before authentication, and libcurl's explicit-digest mode strips the body off its first POST while waiting for the 401 challenge — the box answered that bodyless request with 500 "XML error" instead of the challenge, so the credentials were never sent. The proxy now uses CURLAUTH_ANYSAFE, which sends the first request complete and unauthenticated (the sequence curl --anyauth performs, proven against real hardware) and authenticates on the challenge. Basic auth stays excluded, so credentials cannot be downgraded to cleartext.

Changed

• The Fritz!Box mock now validates the SOAP body before authentication, in the order the real box does — a bodyless probe draws 500 "XML error" even on the credentialed TR-064 endpoint, which is exactly the failure mode that broke the previous handshake.

Fixed

• Fritz!Box widget: a single non-UTF-8 byte silently discarded a whole SOAP reply (issue #11). FRITZ!OS emits its replies without an encoding declaration but with ISO-8859-1 bytes in them — the character lists in a WANPPPConnection GetInfo reply contain a section sign (§) — and libxml rejects the entire document over that one byte, leaving the tile empty with HTTP 200 and no error anywhere. A reply that is not valid UTF-8 now gets a second parse as Latin-1.
• Fritz!Box widget: a 200 reply whose body defeats the parser is now named in the tile ("its reply could not be parsed") instead of being indistinguishable from an unconfigured box.

Changed

• The Fritz!Box mock serves its replies as ISO-8859-1 under FRITZMOCK_LATIN1=1, reproducing the FRITZ!OS encoding.

Added

• Fritz!Box widget: when the TR-064 probe fails, the tile now names the failure instead of silently reporting an unconfigured box (issue #11). An HTTP 401 is called out as the box rejecting the configured credentials; other statuses and cURL errors are shown verbatim. An empty answer and a rejected request need different fixes, and the tile no longer hides which one happened.

Changed

• The Fritz!Box mock verifies the digest hash for real (MD5, qop="auth") instead of accepting any Authorization header, so a broken digest implementation can no longer pass the mock and fail on real hardware. Credentials default to lb/secret, overridable via FRITZMOCK_USER/FRITZMOCK_PASS.

Fixed

• Fritz!Box widget: a PPPoE box's uptime and line rates stayed at the IGD tariff values (issue #11). A real box hands out the external IP on WANIPConnection even while calling that service Unconfigured, and the widget took the present IP as proof of a live connection — skipping the WANPPPConnection probes that carry the uptime and the actual sync rates. Only the reported status decides now; values without any status still count.

Changed

• The Fritz!Box mock's PPPoE mode matches the captured behavior of a real FRITZ!Box 7590: the external IP is served despite Unconfigured, and WANCommonInterfaceConfig reports an Ethernet WAN with the configured tariff rates instead of a dead DSL link.

Fixed

• Fritz!Box widget: configuring credentials broke the tile entirely with an HTTP 500 (issue #11). Digest authentication was attached to every request up front, which makes libcurl send the first POST with an empty body while it waits for a 401 challenge — the credential-free IGD endpoint never challenges, processed the empty request and answered 500 "XML error". The proxy now sends every request plainly first and repeats it with digest credentials only after the target has answered 401.
• Fritz!Box widget: the TR-064 WANPPPConnection interface reports its bit rates in kbit/s, not bit/s — a 226 Mbit/s PPPoE line would have shown as "0.2 Mbps". Confirmed against a capture from real FRITZ!OS hardware (issue #11), which now serves as the test fixture.

Changed

• The Fritz!Box mock reproduces two more behaviors of a real box: control requests without a SOAP body draw 500 "XML error", and the unimplemented IGD WANPPPConnection service answers with a UPnPError instead of 404.

Fixed

• Fritz!Box widget: boxes whose internet connection runs over PPPoE stayed empty. UPnP splits the WAN across two services and a box fills in only the one matching its connection type — the widget asked WANIPConnection alone, which a PPPoE box answers with the status Unconfigured and no values. It now falls back to WANPPPConnection, on the IGD interface and, once box credentials are configured, on the TR-064 interface where FRITZ!OS actually serves it.
• The 1.7.1 explanation for an empty tile named only IP client and bridge mode as the cause of Unconfigured, which is wrong for a PPPoE box. The tile now points at the credentials such a box needs, and says so differently once both interfaces have been asked.

Changed

• Documented what separates the two Fritz!Box cases in WIDGETS.md: an IP-routed line needs no credentials, a PPPoE line needs "Allow access for applications" plus a FRITZ!Box user permitted to read the box settings.
• The widget proxy accepts follow-up requests marked optional: a probe for a service the upstream may not implement no longer fails the whole tile.
• The Fritz!Box widget checks and the widget error-reporting checks now run in CI.

Fixed

• A Fritz!Box tile that stays empty now says why. Boxes that don't run the internet connection themselves — IP client mode, bridge mode, cascaded behind another router — report the WAN status Unconfigured and no uptime, which left four unexplained dashes on the tile; the reported status is now shown underneath them.

Changed

• Documented the two things that keep the Fritz!Box widget from filling in: the Nextcloud server must be allowed to open outgoing connections to tcp/49000 on the box (a firewall dropping them shows up as cURL 28), and a box without its own internet connection has no WAN values to report.

Added

• The widget proxy can consume SOAP/XML responses in addition to JSON, and can authenticate with HTTP digest where a service demands it.

Fixed

• The Fritz!Box widget returned placeholders instead of data. It now reads the external IP, uptime, and maximum line rates from the TR-064/IGD interface on port 49000, which it derives from the service URL — no credentials needed when the box transmits status information over UPnP.

Added

• The widget proxy can consume SOAP/XML responses in addition to JSON, and can authenticate with HTTP digest where a service demands it.

Fixed

• The Fritz!Box widget returned placeholders instead of data. It now reads the external IP, uptime, and maximum line rates from the TR-064/IGD interface on port 49000, which it derives from the service URL — no credentials needed when the box transmits status information over UPnP.

Changed

• User-controlled HTTP, WebSocket, and SMTP destinations are pinned to their validated DNS addresses; loopback, link-local, multicast, documentation, and reserved targets are rejected while RFC1918, ULA, and CGNAT homelab targets remain supported.
• SMTP connections are restricted to common mail ports and now enforce bounded reads/writes, validated protocol responses, safe message headers, and correct STARTTLS or implicit TLS negotiation.
• User settings are restricted to a typed allowlist; enum, boolean, color, URL, opacity, and length constraints are normalized before any values are persisted, and unknown imported settings are ignored.
• Widget batch loading is paginated, time-bounded, rate-limited, deduplicated with atomic locks, and cached briefly to avoid repeated upstream requests.
• Manual status checks are rate-limited and service-locked; bulk checks process the stalest services first within fixed request and runtime budgets while background checks remain comprehensive.

Fixed

• Widget request failures no longer expose credential-bearing URLs or upstream exception details to dashboard viewers and application logs.
• Temporary widget session cookie files are removed even when a request or response mapping fails.
• WebSocket handshakes now verify the server's Sec-WebSocket-Accept value.
• Notification test failures no longer return provider exception details or log potentially sensitive exception messages.
• Read-only global-board viewers can no longer trigger status checks for the designated source user's services.

Added

• Global TLS certificate verification policy with an optional per-service exception for status checks and widgets.

Changed

• Outbound requests are restricted to HTTP(S), reject loopback, link-local and reserved targets, do not follow redirects, and enforce response-size limits.
• Notification channel secrets are no longer returned by the API; blank secret fields preserve stored credentials on update.
• Imports are size-limited, validated and executed inside a database transaction.
• Uploaded icons receive server-generated filenames; active SVG uploads are no longer accepted.

Fixed

• Manual status refresh can no longer trigger checks and notifications for other users.
• TLS certificate verification is enabled by default for status checks, widgets, notifications and update checks.

Added

• PHP 8.5 support (max-version raised from 8.4 to 8.5 in appinfo/info.xml). Nextcloud 33 and 34 support PHP 8.5, so LinkBoard no longer shows as incompatible on those servers (#9).

Fixed

• Material Design Icon names entered in camelCase (e.g. mdiCloud, mdiSwapHorizontal — the exact form copied from the Pictogrammers/MDI site) now render for both services and categories. Previously only kebab-case (mdi-cloud) was recognized; the camelCase form fell through to the icon CDN and ultimately produced a 404, leaving services with a letter fallback and categories with a dark-red ? (#8).

Added

• Inline format hint below widget config fields. When a widget defines a pattern (regex) and validationMessage for a config field, the editor now shows a red helper text under the field when the value doesn't match. Initially enabled for Proxmox VE and Proxmox Backup Server API tokens. Non-blocking — the backend remains authoritative.

Fixed

• Pi-hole widget rewritten for the v6 REST API (the legacy /admin/api.php?summaryRaw endpoint was removed in v6). The widget now performs the two-step session login (POST /api/auth → GET /api/stats/summary?sid=...) via the existing buildFollowUpRequests framework path. Config field renamed from api_token (optional) to password (required in v6); existing Pi-hole services must be reconfigured once.

Fixed

• Import dropped services whose name field was an empty string (e.g. icon/widget-only cards) — they are now imported as intended.
• Import discarded the category type and config (grid settings) — categories with a custom _gridSettings.colCount now keep their layout instead of falling back to the 12-column default.
• Import re-assigned sortOrder sequentially instead of preserving the exported values — category and service order now matches the source instance.
• Import dropped the per-service showScrollbar flag — it is now restored from the export.

Added

• Nextcloud 34 compatibility (max-version raised from 33 to 34 in appinfo/info.xml)

Added

• New "Link target" setting (issue #15): choose whether service links open in a new tab, in the same tab, or per service. The default is "New tab". With "Per service", each service's own "Link target" field in the service editor decides (defaulting to "New tab").

Changed

• The "Link target" field in the service editor is only shown while the global setting is "Per service", and now displays labeled options ("New tab" / "Same tab") instead of the raw values _blank / _self.
• Behavior change: the stored per-service link target was previously always honored. With the new global default "New tab", services configured to open in the same tab do so again only after selecting "Per service" in the settings.
• The per-service link target is now validated server-side; values other than _blank / _self are stored as _blank.

Fixed

• The "Edit category" panel now scrolls when its content is taller than the window (issue #14). Previously the panel was cut off at the bottom on short viewports (e.g. small window with 120% zoom) and wheel scrolling moved the dashboard behind it instead.

Added

• Services can be dragged between categories in the compact list display mode: dropping a row into another category's list moves the service there at the exact drop position. The stored card-grid position is cleared on the move, so the service gets a fresh default spot when switching back to cards mode.

Fixed

• Sections can now be dropped vertically between two rows (issue #13). While dragging a category by its handle, drop zones appear above, between, and below the rows; dropping there makes the category its own row at that position. Previously a dragged section could only be placed side by side into an existing row.

Added

• Drag & drop reordering in the compact list display mode: in edit mode each row gets a drag handle to reorder services within their category. The order is persisted as the service sort order, so the cards grid layout stays completely untouched. This lifts the 1.8.0 limitation of switching to cards mode to reorder.

Changed

• The compact list now displays services in their stored sort order instead of mirroring the cards-grid position — a one-time change for 1.8.0 list-mode users; the cards layout itself is unaffected. While a search filter is active, reordering is disabled.

Added

• Compact list display mode (discussion #12): a new "Display mode" setting renders services as single-line rows instead of cards — icon, text, and inline status dot. A companion "List row content" setting selects what each row shows: title, URL, title and description, or title and URL. Widgets are not rendered in list mode. Grid layout data is preserved, so switching back to cards is lossless; to reorder services, switch to cards mode temporarily.

Fixed

• Fritz!Box widget: the digest handshake never reached the box (issue #11). FRITZ!OS validates the SOAP body before authentication, and libcurl's explicit-digest mode strips the body off its first POST while waiting for the 401 challenge — the box answered that bodyless request with 500 "XML error" instead of the challenge, so the credentials were never sent. The proxy now uses CURLAUTH_ANYSAFE, which sends the first request complete and unauthenticated (the sequence curl --anyauth performs, proven against real hardware) and authenticates on the challenge. Basic auth stays excluded, so credentials cannot be downgraded to cleartext.

Changed

• The Fritz!Box mock now validates the SOAP body before authentication, in the order the real box does — a bodyless probe draws 500 "XML error" even on the credentialed TR-064 endpoint, which is exactly the failure mode that broke the previous handshake.

Fixed

• Fritz!Box widget: a single non-UTF-8 byte silently discarded a whole SOAP reply (issue #11). FRITZ!OS emits its replies without an encoding declaration but with ISO-8859-1 bytes in them — the character lists in a WANPPPConnection GetInfo reply contain a section sign (§) — and libxml rejects the entire document over that one byte, leaving the tile empty with HTTP 200 and no error anywhere. A reply that is not valid UTF-8 now gets a second parse as Latin-1.
• Fritz!Box widget: a 200 reply whose body defeats the parser is now named in the tile ("its reply could not be parsed") instead of being indistinguishable from an unconfigured box.

Changed

• The Fritz!Box mock serves its replies as ISO-8859-1 under FRITZMOCK_LATIN1=1, reproducing the FRITZ!OS encoding.

Added

• Fritz!Box widget: when the TR-064 probe fails, the tile now names the failure instead of silently reporting an unconfigured box (issue #11). An HTTP 401 is called out as the box rejecting the configured credentials; other statuses and cURL errors are shown verbatim. An empty answer and a rejected request need different fixes, and the tile no longer hides which one happened.

Changed

• The Fritz!Box mock verifies the digest hash for real (MD5, qop="auth") instead of accepting any Authorization header, so a broken digest implementation can no longer pass the mock and fail on real hardware. Credentials default to lb/secret, overridable via FRITZMOCK_USER/FRITZMOCK_PASS.

Fixed

• Fritz!Box widget: a PPPoE box's uptime and line rates stayed at the IGD tariff values (issue #11). A real box hands out the external IP on WANIPConnection even while calling that service Unconfigured, and the widget took the present IP as proof of a live connection — skipping the WANPPPConnection probes that carry the uptime and the actual sync rates. Only the reported status decides now; values without any status still count.

Changed

• The Fritz!Box mock's PPPoE mode matches the captured behavior of a real FRITZ!Box 7590: the external IP is served despite Unconfigured, and WANCommonInterfaceConfig reports an Ethernet WAN with the configured tariff rates instead of a dead DSL link.

Fixed

• Fritz!Box widget: configuring credentials broke the tile entirely with an HTTP 500 (issue #11). Digest authentication was attached to every request up front, which makes libcurl send the first POST with an empty body while it waits for a 401 challenge — the credential-free IGD endpoint never challenges, processed the empty request and answered 500 "XML error". The proxy now sends every request plainly first and repeats it with digest credentials only after the target has answered 401.
• Fritz!Box widget: the TR-064 WANPPPConnection interface reports its bit rates in kbit/s, not bit/s — a 226 Mbit/s PPPoE line would have shown as "0.2 Mbps". Confirmed against a capture from real FRITZ!OS hardware (issue #11), which now serves as the test fixture.

Changed

• The Fritz!Box mock reproduces two more behaviors of a real box: control requests without a SOAP body draw 500 "XML error", and the unimplemented IGD WANPPPConnection service answers with a UPnPError instead of 404.

Fixed

• Fritz!Box widget: boxes whose internet connection runs over PPPoE stayed empty. UPnP splits the WAN across two services and a box fills in only the one matching its connection type — the widget asked WANIPConnection alone, which a PPPoE box answers with the status Unconfigured and no values. It now falls back to WANPPPConnection, on the IGD interface and, once box credentials are configured, on the TR-064 interface where FRITZ!OS actually serves it.
• The 1.7.1 explanation for an empty tile named only IP client and bridge mode as the cause of Unconfigured, which is wrong for a PPPoE box. The tile now points at the credentials such a box needs, and says so differently once both interfaces have been asked.

Changed

• Documented what separates the two Fritz!Box cases in WIDGETS.md: an IP-routed line needs no credentials, a PPPoE line needs "Allow access for applications" plus a FRITZ!Box user permitted to read the box settings.
• The widget proxy accepts follow-up requests marked optional: a probe for a service the upstream may not implement no longer fails the whole tile.
• The Fritz!Box widget checks and the widget error-reporting checks now run in CI.

Fixed

• A Fritz!Box tile that stays empty now says why. Boxes that don't run the internet connection themselves — IP client mode, bridge mode, cascaded behind another router — report the WAN status Unconfigured and no uptime, which left four unexplained dashes on the tile; the reported status is now shown underneath them.

Changed

• Documented the two things that keep the Fritz!Box widget from filling in: the Nextcloud server must be allowed to open outgoing connections to tcp/49000 on the box (a firewall dropping them shows up as cURL 28), and a box without its own internet connection has no WAN values to report.

Added

• The widget proxy can consume SOAP/XML responses in addition to JSON, and can authenticate with HTTP digest where a service demands it.

Fixed

• The Fritz!Box widget returned placeholders instead of data. It now reads the external IP, uptime, and maximum line rates from the TR-064/IGD interface on port 49000, which it derives from the service URL — no credentials needed when the box transmits status information over UPnP.

Added

• The widget proxy can consume SOAP/XML responses in addition to JSON, and can authenticate with HTTP digest where a service demands it.

Fixed

• The Fritz!Box widget returned placeholders instead of data. It now reads the external IP, uptime, and maximum line rates from the TR-064/IGD interface on port 49000, which it derives from the service URL — no credentials needed when the box transmits status information over UPnP.

Changed

• User-controlled HTTP, WebSocket, and SMTP destinations are pinned to their validated DNS addresses; loopback, link-local, multicast, documentation, and reserved targets are rejected while RFC1918, ULA, and CGNAT homelab targets remain supported.
• SMTP connections are restricted to common mail ports and now enforce bounded reads/writes, validated protocol responses, safe message headers, and correct STARTTLS or implicit TLS negotiation.
• User settings are restricted to a typed allowlist; enum, boolean, color, URL, opacity, and length constraints are normalized before any values are persisted, and unknown imported settings are ignored.
• Widget batch loading is paginated, time-bounded, rate-limited, deduplicated with atomic locks, and cached briefly to avoid repeated upstream requests.
• Manual status checks are rate-limited and service-locked; bulk checks process the stalest services first within fixed request and runtime budgets while background checks remain comprehensive.

Fixed

• Widget request failures no longer expose credential-bearing URLs or upstream exception details to dashboard viewers and application logs.
• Temporary widget session cookie files are removed even when a request or response mapping fails.
• WebSocket handshakes now verify the server's Sec-WebSocket-Accept value.
• Notification test failures no longer return provider exception details or log potentially sensitive exception messages.
• Read-only global-board viewers can no longer trigger status checks for the designated source user's services.

Added

• Global TLS certificate verification policy with an optional per-service exception for status checks and widgets.

Changed

• Outbound requests are restricted to HTTP(S), reject loopback, link-local and reserved targets, do not follow redirects, and enforce response-size limits.
• Notification channel secrets are no longer returned by the API; blank secret fields preserve stored credentials on update.
• Imports are size-limited, validated and executed inside a database transaction.
• Uploaded icons receive server-generated filenames; active SVG uploads are no longer accepted.

Fixed

• Manual status refresh can no longer trigger checks and notifications for other users.
• TLS certificate verification is enabled by default for status checks, widgets, notifications and update checks.

Added

• PHP 8.5 support (max-version raised from 8.4 to 8.5 in appinfo/info.xml). Nextcloud 33 and 34 support PHP 8.5, so LinkBoard no longer shows as incompatible on those servers (#9).

Fixed

• Material Design Icon names entered in camelCase (e.g. mdiCloud, mdiSwapHorizontal — the exact form copied from the Pictogrammers/MDI site) now render for both services and categories. Previously only kebab-case (mdi-cloud) was recognized; the camelCase form fell through to the icon CDN and ultimately produced a 404, leaving services with a letter fallback and categories with a dark-red ? (#8).

Added

• Inline format hint below widget config fields. When a widget defines a pattern (regex) and validationMessage for a config field, the editor now shows a red helper text under the field when the value doesn't match. Initially enabled for Proxmox VE and Proxmox Backup Server API tokens. Non-blocking — the backend remains authoritative.

Fixed

• Pi-hole widget rewritten for the v6 REST API (the legacy /admin/api.php?summaryRaw endpoint was removed in v6). The widget now performs the two-step session login (POST /api/auth → GET /api/stats/summary?sid=...) via the existing buildFollowUpRequests framework path. Config field renamed from api_token (optional) to password (required in v6); existing Pi-hole services must be reconfigured once.

Fixed

• Import dropped services whose name field was an empty string (e.g. icon/widget-only cards) — they are now imported as intended.
• Import discarded the category type and config (grid settings) — categories with a custom _gridSettings.colCount now keep their layout instead of falling back to the 12-column default.
• Import re-assigned sortOrder sequentially instead of preserving the exported values — category and service order now matches the source instance.
• Import dropped the per-service showScrollbar flag — it is now restored from the export.

Added

• Nextcloud 34 compatibility (max-version raised from 33 to 34 in appinfo/info.xml)

Fixed

• Status check response time was inflated for HTTPS targets and slow backends because it timed the entire HTTP transaction (DNS + TCP + TLS handshake + server processing). It now records pure TCP-handshake RTT via CURLINFO_CONNECT_TIME_T, matching ICMP ping expectations.

Changed

• Status overview "Last 7 days" view now bucketed server-side (~30-min buckets, 336 points) instead of streaming every raw row to the browser. Eliminates the multi-second freeze and "stop script" dialog. The chart shows the per-bucket average plus a dashed max-line so spikes remain visible.
• historyAll API uses a single batched DB query for all ping-enabled services (no more N+1 over services).

Fixed

• Installation on PostgreSQL failing with "type Bool and also NotNull, so it can not store 'false'" when migration 001011 added the show_scrollbar column (#5). Column is now added as nullable with default false, matching all other boolean columns in the schema.

Added

• Per-service toggle for scrollbar visibility on service cards (default: hidden; content stays scrollable via trackpad, touch, or keyboard)

Fixed

• Page-level wheel scrolling when viewport edges or fixed overlays would otherwise block the native scroll (programmatic smooth-scroll fallback in App.vue)
• Dashboard background image intercepting mouse events (pointer-events: none on the background layer)

Added

• Admin settings page under Settings > Administration > LinkBoard
• Global Board: admins can designate one user's board as a shared read-only dashboard for all users
• Group Restriction: optionally restrict LinkBoard access to specific Nextcloud groups
• Container-aware memory detection for System Resources widget (cgroup v2/v1 support)

Fixed

• System Resources widget showing wrong memory total in LXC/Docker containers (e.g. "1024.0 TiB" instead of actual RAM)
• Response time chart timezone handling (UTC suffix for correct local time display)

Changed

• Admin settings (status check interval) moved from in-app settings to dedicated Nextcloud admin page
• Edit mode restricted to users with write access when global board is active

Added

• Inline-editable Table widget: create and edit tables directly on service cards with add/remove columns and rows, editable headers, and auto-save

Added

• Per-category toggle for responsive column adjustment (default: off), fixing layout issues on smaller viewports

Fixed

• Grid resize not working in categories with fewer siblings per row (responsive column minimum was too aggressive)

Fixed

• PHPStan CI errors: expand buildRequests() return type to include all optional request spec keys (auth, calls, _websocket_jsonrpc, etc.)
• Widget container overflow: allow widget blocks to wrap instead of being hidden

Added

• Two-stage widget support: buildFollowUpRequests() method for widgets that need sequential API calls
• Arcane widget: reworked with environment auto-detection, shows containers/projects/images/volumes/networks
• Widget container itemsPerRow prop for CSS grid layout control

Added

• Grafana-style grid layout: free drag, resize, and placement of Service Cards within categories
• Configurable grid settings per category (column count, row height, auto-arrange, min-height)
• Lock/unlock edit mode toggle replaces pencil icon

Changed

• Service Cards now use vue-grid-layout instead of CSS Grid with fixed column spans
• Category columns setting replaced by grid settings (colCount: 6/12/24)
• Migration note: Existing Service Cards are automatically converted to the new grid layout, but card sizes may not match the previous layout exactly. A one-time manual adjustment of card sizes and positions may be required after upgrading.

Removed

• Cross-category drag-and-drop (use category dropdown in Service Editor instead)
• Fixed column-span resize handle on Service Cards (replaced by vue-grid-layout handles)

Added

• Font color customization: auto-detection from background luminance + manual color picker for title, category, service, description, widget values/labels, header buttons, and card background
• TrueNAS widget: WebSocket JSON-RPC support for TrueNAS v25.04+

Changed

• Font color settings moved from theme-only to dedicated "Font colors" section with auto/manual toggle
• TrueNAS widget uses WebSocket JSON-RPC (/api/current) instead of REST API
• Widget and resource display components accept manualColors prop for font color overrides

Fixed

• Header button font color not applying (CSS custom property approach instead of inherited color)
• TrueNAS uptime calculation handling numeric and $date boottime formats

Changed

• UniFi widget: added Controller Type selector (UniFi OS vs Legacy Controller) with correct API paths and cookie-based session auth
• Dropped support for Nextcloud 30/31 and PHP 8.1 (now requires Nextcloud 32+ and PHP 8.2+)

Fixed

• Missing translations for Status History modal and Status Overview page (12 new strings in all 57 languages, German fully translated)
• Status label in StatusHistoryModal not using i18n (Status hardcoded instead of t('linkboard', 'Status'))
• Status badge in StatusOverviewPage showing raw status key instead of translated label (Online/Offline/Unknown)
• Period selector buttons missing focus-visible outline for keyboard accessibility

Fixed

• Migration Version001009Date20260316000000 also calling $result->free() instead of closeCursor(), causing fresh installations to fail (same issue as v1.5.3 fix, but in the earlier migration)

Fixed

• Migration Version001010Date20260317000000 calling $result->free() which does not exist on Nextcloud 33's ResultAdapter, causing occ upgrade to fail and leaving Nextcloud stuck in maintenance mode (replaced with closeCursor())

Fixed

• Table names linkboard_notif_channels and linkboard_status_history exceeding Nextcloud 32 primary index name length limit (renamed to linkboard_channels and linkboard_history)

Fixed

• Table name oc_linkboard_notification_channels too long for Nextcloud 32 Oracle DB compatibility (renamed to linkboard_notif_channels)
• Status check retry with GET on 5xx responses from HEAD requests

Added

• Status history tracking – background job records status checks with response times in new linkboard_status_history table
• Status History Modal – click any service's status indicator to view response time charts
• Status Overview Page (/status) – dedicated page showing all monitored services with uptime%, failure counts, and charts
• Mini status history bars on service cards showing last ~10 status checks (configurable opacity in settings)
• Period-based history views (1h, 3h, 24h, 7d)
• Total failure counter per service in status cache
• New settings: "Show status history bars" toggle and "Status bar opacity" slider
• Widget warning display in widget containers

Fixed

• Boolean NotNull columns breaking installation on Nextcloud 32 (Oracle constraint compatibility)

Fixed

• Fix boolean NotNull columns breaking installation on Nextcloud 32 (Oracle constraint check rejects notnull => true on boolean columns)

Fixed

• Fix database.xml validation for Nextcloud App Store (merge duplicate <declaration> blocks)