Changelog¶

What each release changed, newest first. Before upgrading, read the upgrade notes.

0.14.3¶

Released 2026-10-19.

0.14.2¶

Released 2026-10-17.

Fixes¶

• poller: Reject non-positive intervals and retry a task after a panic (#490)

0.14.1¶

Released 2026-10-17.

Fixes¶

• server: Resolve the client address on every request (#451)
• auth: Limit password attempts per client address (#452)
• web: Log refused sign-ins (#453)
• plugin: Drop partial reads; a failed read returns nothing (#455)
• web: Reword four messages to name who acts (#485)
• web: Use short active sentences on the device pages (#486)
• web: Use short active sentences on the traffic pages (#487)
• web: Use short active sentences on the settings and sign-in pages (#488)

0.14.0¶

Released 2026-10-14.

Features¶

• docs: Publish a changelog page written from the commit log (#440)
• docs: Publish an upgrade notes page written from the commit log (#442)

Fixes¶

• web: Count a scan's finds as devices and open ports (#443)
• plugin: Read a Pi-hole whose query log was reset (#445)
• web: Wrap long looked-up names and stop calling the rest less busy (#444)
• openwrt: Record the router's own addresses so it is one device (#448)
• web: Say what the notifications page is for and how to fill the device list (#447)

0.13.0¶

Released 2026-10-14.

Features¶

• server: Add trusted proxy config and client IP resolution (#427)
• poller: Port-scan a device as soon as it is discovered (#439)

Fixes¶

• poller: Resume each task's schedule from its own record of when it last ran (#438)

0.12.4¶

Released 2026-10-14.

Fixes¶

• inventory: Keep a device's name when no source's claim gives one (#437)

0.12.3¶

Released 2026-10-13.

Fixes¶

• inventory: List only the latest sweep's services and log no event for advertised-only ports (#430)

0.12.2¶

Released 2026-10-13.

Fixes¶

• inventory: Keep each source's claim per address so a multi-address device keeps one name (#428)
• inventory: Keep each router address's own detail and stop guessing names in the claim backfill (#429)

0.12.1¶

Released 2026-10-13.

Fixes¶

• inventory: Keep a device's name stable when it has several reverse DNS names (#426)
• scans: Drop the import scan kind nothing records (#420)

0.12.0¶

Released 2026-10-13.

Features¶

• inventory: Store and show the vendor's registered name (#425)

Fixes¶

• asn: Drop Pvt, Pte and other regional company suffixes from short names (#424)
• traffic: Do not count an equal-port reply as an incoming connection (#423)
• topology: Keep a quiet device current within the online window (#422)
• routeros: Record the router's own addresses so it is one device (#421)

0.11.2¶

Released 2026-10-12.

0.11.1¶

Released 2026-10-12.

0.11.0¶

Released 2026-10-11.

Features¶

• plugin: Read DNS queries from Technitium (#405)
• inventory: Record what each device looks up (#406)
• web: Show the names a device looks up (#407)
• mcp: Add list_dns (#408)
• inventory: Keep the addresses each lookup was answered with (#410)
• web: Name traffic peers by what the device looked up (#411)
• mcp: Say what looked_up means in list_traffic (#412)
• plugin: Read DNS queries from Pi-hole (#414)
• plugin: Read DNS queries from AdGuard Home (#415)

Fixes¶

• web: Let the 2FA page switch to a recovery code field (#397)

0.10.1¶

Released 2026-10-09.

Fixes¶

• auth: Limit password attempts per account (#371)
• auth: Accept each TOTP code once (#385)
• auth: Accept recovery codes in any case, with or without dashes (#386)
• auth: Replace recovery codes in one transaction (#387)

0.10.0¶

Released 2026-10-06.

Features¶

• auth: Let an API token expire (#388)

Fixes¶

• web: Keep one-time secrets out of the session store (#372)

0.9.6¶

Released 2026-10-06.

Fixes¶

• notify: Say that ntfy priority 0 is allowed (#375)
• auth: Match session exemptions against the path (#373)
• notify: Do not follow redirects when sending (#374)
• hosts: Check every source's hostname the same way (#376)
• server: Send no CORS headers unless origins are configured (#378)

0.9.5¶

Released 2026-10-06.

Fixes¶

• plugin: Bound NetFlow counts and flow end times (#379)
• api: Change only the fields a device PATCH sends (#381)
• notify: Name new devices on a source's first scan (#384)
• inventory: Count devices, not addresses, in the port scan log (#383)

0.9.4¶

Released 2026-10-05.

Fixes¶

• inventory: Match search text literally (#382)
• plugin: Warn at startup when a router is reached over plain HTTP (#377)

0.9.3¶

Released 2026-10-03.

Fixes¶

• db: Keep a device's traffic history when its peer is deleted (#362)
• ports: Scan only addresses on your own networks (#365)
• ports: Keep a device's ports open when it does not answer the scan (#364)
• auth: Keep the 2FA secret out of reach once it is on (#366)
• inventory: Keep a folded device's curation, ports, services and traffic (#363)
• auth: Count wrong 2FA codes per account, not per session (#367)
• auth: Allow only one admin, even when setup runs twice at once (#368)

0.9.2¶

Released 2026-10-02.

Features¶

• web: Serve IBM Plex from this origin (#290)
• web: Put the version and the docs in the footer (#302)

Fixes¶

• auth: List tokens and users in the same order every time (#295)
• web: Keep the top bar on one row on a phone (#296)
• web: Name the signed-in account on error pages (#297)
• web: Keep the logo link's name for screen readers on a phone (#298)
• web: Raise the smallest labels from 10px to 11px (#299)
• web: Stop repeating the page title as its first heading (#300)
• web: Show every empty page in a card (#303)
• web: Say "scans", not "sweep", on an empty scan log (#304)
• inventory: Name the class in a type edit's change (#305)
• web: Make the green and red chips readable (#306)
• web: Underline links inside sentences (#307)
• web: Line up select arrows and stop selects growing with their options (#308)
• web: Keep numbers, dates and hardware addresses whole (#309)
• web: Open the sections from a menu button on phones and tablets (#310)
• web: Keep focus in the filters and search once typing pauses (#311)
• web: Fold the device and traffic tables into cards on a phone (#312)
• web: Fit the device list on a tablet and beside the rail (#313)
• web: Keep long names and many ports inside the device list (#314)
• web: Let phone cards reach the edges of their table card (#315)
• web: Keep a long device name inside the top bar and its path (#316)
• web: Fold a device's long port list and long notes (#317)
• web: Stack port changes on a phone and line up paired cards (#318)
• web: Cap an organisation's device list and word the data credit once (#319)
• web: Order the map's search, map and legend on a phone (#320)
• web: Stop the world map's "More" spilling its box (#321)
• web: Wrap a long topology group into columns (#322)
• web: Keep map labels readable at any zoom (#323)
• web: Take a hidden map label out of its node's box (#324)
• web: Count bytes on into petabytes and exabytes (#325)
• web: Give setup the same password field as Add a user (#326)
• web: State a viewer's one token permission instead of a radio (#327)
• web: Mark up password forms the way password managers expect (#328)
• web: Name the maps as groups, not images (#329)
• web: Fold the scans table into cards on a phone (#330)
• web: Focus the password after a failed sign-in (#331)
• auth: Refuse a second admin (#332)
• web: Straighten the users table lines and even the panel padding (#333)
• web: Keep hub names off their devices on the network map (#334)

0.9.1¶

Released 2026-10-01.

0.9.0¶

Released 2026-10-01.

Features¶

• scanner: Ask nameless hosts for their names over mDNS (#274)
• scanner: Ask still-nameless hosts for their names over NetBIOS (#275)
• scanner: Name the rest after their UPnP friendlyName over SSDP (#276)
• scanner: Name the rest after the services they advertise over DNS-SD (#277)
• inventory: Record, classify and show the services devices advertise (#278)
• scanner: Port-scan the ports devices advertise (#279)
• plugin: Read devices and networks from an OpenWrt router (#282)
• plugin: Read what is plugged into an OpenWrt router (#283)
• inventory: Tell when a watched device goes quiet or comes back (#284)
• web: Watch a device (#285)
• mcp: Watch devices from the API and MCP (#286)

Fixes¶

• inventory: Close a moved service's old port (#280)
• netflow: Scale IPFIX flows sampled by packet interval and space (#288)

0.8.0¶

Released 2026-09-30.

Features¶

• mcp: Explain_device, why a device has the class it has (#272)
• notify: An http provider whose body is a template (#271)
• inventory: Delete devices nobody curated after 90 days away (#273)

0.7.0¶

Released 2026-09-30.

Features¶

• mcp: Say where a device is plugged in and how fast, in get_device (#268)
• mcp: Get_topology, what is plugged in where across the network (#269)

0.6.0¶

Released 2026-09-30.

Features¶

• routeros: Read the bridge, neighbour and Wi-Fi tables (#252)
• plugin: Read what is plugged into a RouterOS device (#253)
• db: Store what each device says is plugged into it (#254)
• topology: Read every RouterOS device on the sweep's schedule (#255)
• topology: Assemble the network's tree from every device's tables (#256)
• web: Lay out the topology page top down (#257)
• web: Show the network's topology on its own page (#258)
• web: Show where a device is connected on its page (#259)
• topology: Group wired devices by VLAN, with the port on each (#260)
• routeros: Read each port's link and each Wi-Fi client's rates (#263)
• topology: Record each link's rate and each Wi-Fi client's (#264)
• web: Show how fast a device is connected on its page (#265)

0.5.1¶

Released 2026-09-28.

0.5.0¶

Released 2026-09-25.

Features¶

• inventory: Announce each finished scan and what it changed (#244)
• notify: Ntfy and signed webhook providers (#246)
• notify: Send each finished scan from its own goroutine (#247)
• web: Pick what each destination is sent (#248)

0.4.0¶

Released 2026-09-25.

Breaking changes¶

• config: Group retention, location, server settings (#205)

  a config that sets inventory.retention, auth.* or mcp.enabled, or the matching JOCASTA_ variables, now has those settings ignored. Move them to the new paths.

Features¶

• mcp: Add triage_devices and weekly_report prompts (#157)
• asn: Resolve internet addresses to the organisation that announces them (#158)
• db: Add traffic_hourly and its queries (#167)
• plugin: Decode router flow exports (#168)
• plugin: Credit NAT replies and drop the exporter's own feed (#169)
• traffic: Roll flows up by the hour per device (#170)
• traffic: Prune hourly totals past their retention (#172)
• serve: Collect traffic from configured routers (#159)
• web: Show who a device talks to (#160)
• web: A Traffic page for the whole network (#161)
• mcp: Add list_traffic (#162)
• traffic: Keep connection attempts, counted per peer (#164)
• web,mcp: Show devices probing the network (#165)
• web: Tab traffic by network segment (#166)
• db: Add broadcasts_hourly (#176)
• traffic: Record the broadcasts and multicast a device sends (#177)
• web: Show what a device broadcasts (#178)
• db: Count connections by which side started them (#180)
• traffic: Count connections the peer started (#181)
• web: Show what was reached from the internet (#182)
• plugin: Report the exporter and the address NAT sent a flow from (#183)
• db: Add probes_hourly and outside_addresses (#184)
• traffic: Record what the internet tries on the network (#185)
• web,mcp: Show what the internet tried on the network (#186)
• web: Show who opened each row's connections, and filter by it (#188)
• traffic: Keep the last 15 minutes of activity in memory (#189)
• db: Add the traffic map queries (#190)
• inventory: Build the traffic map (#191)
• web: Lay out the network map (#192)
• web: A Map page that redraws itself each minute (#193)
• scanner: Name port 8883 as MQTT over TLS (#194)
• geo: Resolve internet addresses to a country (#196)
• geo: Embed a world outline (#197)
• db: Add the world map query (#198)
• inventory: Internet traffic by country (#199)
• web: A World view on the Map page (#200)
• config: Name the country the network is in (#202)
• web: Find the network's country from the router's outside address (#203)
• web: Draw lines from home on the world map (#204)

Fixes¶

• traffic: Keep only conversations, and name the service a peer offers (#171)
• traffic: A knock's late answer is not a conversation (#174)
• traffic: Credit ping replies that land a flush late (#175)
• geo: Name each country after itself, not a territory filed under its code (#207)
• Use documentation addresses in CLI fixtures, drop "X, not Y" copy (#210)
• cli: Use the configured store in scan, ports and plugin run (#217)

0.3.0¶

Released 2026-09-23.

Features¶

• auth: Add TOTP two-factor authentication to login (#143)
• inventory: Prune events and scans past a retention window (#146)
• mcp: Serve the inventory to AI agents over MCP (#147)
• mcp: Answer failures with the API's problem documents (#148)
• mcp: Add get_device and list_events tools (#149)
• mcp: Add list_networks, get_network and list_devices network and type filters (#150)
• mcp: Add get_stats and list_groups tools (#151)
• mcp: Add get_port_overview tool (#152)
• mcp: Add list_scans tool (#153)
• mcp: Add update_device_curation, the first write tool (#154)

0.1.2¶

Released 2026-09-09.

Features¶

• auth: Configurable session lifetime, idle timeout and cookie-secure (#141)

Fixes¶

• docker: Let a mounted config set server.port (#142)

0.1.1¶

Released 2026-09-09.

Features¶

• web: Type scale, section headings, and a skip link (#132)
• web: One focus rule for content htmx swaps in (#133)
• web: Theme toggle reflects the theme; exact time on demand (#134)
• web: Give presence dots a spoken status and explain the observation window (#135)
• web: Surface collection health on the overview (#136)
• web: Lead the device page with facts; keep a row's identity while quick-editing (#137)
• web: Clearer network, source, ports and scan pages (#138)
• auth: Persist web sessions in SQLite (#140)

Fixes¶

• web: Comfortable touch targets and a repaired inline edit form on mobile (#139)

0.0.5¶

Released 2026-09-08.

Features¶

• web: Redesign Users and add a topbar account menu (#130)
• web: Redesign the API tokens page around the shared settings shell (#131)

0.0.4¶

Released 2026-09-07.

Fixes¶

• web: Raise text, link, and badge contrast to WCAG AA (#126)
• web: Merge device-list columns and add a mobile card layout (#129)

0.0.3¶

Released 2026-09-07.

Fixes¶

• ci: Add id-token write permission to release workflow (#124)

0.0.2¶

Released 2026-09-07.

Features¶

• db: Record the open ports on a device (#79)
• scanner: TCP connect port scan (#80)
• inventory: Ingest a port scan (#81)
• poller: Run port scans on their own schedule (#82)
• web: Show a device's open ports (#83)
• scanner: Make port-scan concurrency configurable (#86)
• classify: Rules-based device-type classification (#87)
• inventory: Classify device types and show them as icons (#88)
• web: Show open ports in the device list (#90)
• web: Show a device's network in the list (#91)
• web: Show the classifier's confidence on the device panel (#93)
• web: Let the change log be narrowed to one device (#94)
• web: Filter and sort devices by type (#95)
• web: Give the network page the device filters and paging (#96)
• web: Show the match count and a way to clear the filter (#97)
• api: Add device type validation and extend filtering by type
• web: Update brandmark logo and favicon (#103)
• web: Add ports and services overview (#102)
• server: Add configurable CORS support via rs/cors (#106)
• server: Cap request body size on PATCH routes (#107)
• Session-based login, API tokens, and first-run user setup (#108)
• web: Role-based authorization (read / read_write / admin) (#118)

Fixes¶

• poller: Retry the port scan soon when discovery has not run yet (#84)
• inventory: Keep ignored devices out of network counts (#92)
• web: Keep the device type from overflowing its column (#98)
• Gofmt in cursor test (#99)
• db: Reset dbVersion to 1
• api: Pass JSONWriter in test handler constructor (#104)
• test: Repair health assertion, drop stale migration round-trip test (#105)
• web: Render form parse and validation failures as a page (#110)
• web: Redirect after creating a user or a token (#111)
• web: Swap the whole token list on a revoke, not the one row (#112)
• web: Show the Users link only to an admin, and the refresh line only when it refreshes (#113)
• web: Sign out with a POST, and fix two smaller UI faults (#114)
• web: Topbar current-page marker, and three small presentation fixes (#115)
• web: Keep mobile activity descriptions readable (#119)
• web: Preserve user creation inputs after duplicate errors (#120)
• web: Contain mobile navigation and header controls (#121)
• ci: Valid golangci-lint v2 config, and clear the findings it surfaces (#123)
• web: Show device search failures and retry (#122)

0.0.1¶

Released 2026-09-03.

Features¶

• proj: Init Go module with basic project
• setup: Integrate sqlc and setup dependencies
• setup: Add HTTP server with basic liveness endpoint
• db: Add initial database setup
• server: Refactor server setup and add API handler with health endpoint
• config: Integrate configuration management with koanf
• web: Add web handler with template rendering and static file support
• scanner: ICMP host discovery (#13)
• oui: Resolve MAC addresses to their registered vendor (#17)
• cli: Add CLI framework and commands for serve and scan (#22)
• db: Device inventory schema and sweep ingest (#25)
• inventory: Read the device inventory back out (#29)
• api: Serve the inventory as JSON (#30)
• web: Overview page, htmx shell and vendored assets (#31)
• web: Device list, device detail, and the two logs (#32)
• Curate a device's label, notes, group, type and ignored flag (#33)
• Add poller for regaulr scanning (#42)
• poller: Run a task at start when its work is already due (#43)
• poller: Add logging for task scheduling and execution lifecycle (#44)
• web: Rebuild the UI around a sidebar shell (#45)
• routeros: Read the ARP and DHCP lease tables over REST (#47)
• plugin: Enrich devices from the router's ARP and DHCP tables (#48)
• Add dark mode toggle (#52)
• db: Record what each source claims about a device (#55)
• plugin: Read devices from configured RouterOS sources (#56)
• web: Show what each source says about a device (#57)
• plugins: Read the segments a router serves so the overview can name them (#58)
• web: Filter devices by network, and give each network a page (#60)
• web: Name the network each of a device's addresses is on (#61)
• web: Page the device list (#62)
• web: Show when a device was last checked, not only last seen (#77)

Fixes¶

• gen: Run pinned tools through go tool (#11)
• test: Thread the injected database through handler tests (#27)
• scanner: Drop redundant embedded host selector (#54)
• web: Keep the theme toggle reachable from every screen (#59)
• web: Lay the device filters out for a narrow screen (#64)
• poller: Ask a task once when its first run is due (#68)
• inventory: Retire an address a device has moved off (#72)
• inventory: Keep a source's last name when it goes quiet (#74)
• routeros: A stale ARP entry is not a sighting (#75)