chore(release): v0.38.4

[fclairamb]

🤖 I have created a release beep boop

0.38.4 (2026-10-14)

Features

• http: HTTP results split the response time into DNS, connect, TLS, server and download time. The result page shows a Timing card, and the check page has a Timing chart next to the response time. Each probe now opens a new connection, so a check that runs more often than every 90 s now counts connect and TLS time in its response time. The new metrics are dns_time_ms, connect_time_ms, tls_time_ms, ttfb_time_ms, download_time_ms and redirect_time_ms. (9947d0b)
• http: HTTP checks can test response headers with equals, contains, absent and other operators. The new headerAssertions takes the same operators as body assertions, plus exists and not_exists. Rules like "X-Powered-By must not be sent" or "Cache-Control must not contain no-store" are now possible. The check form has a new "Header assertions" section, and headers_pattern keeps working. (9947d0b)
• http: An HTTP check can test where its redirects end up. Set expectedFinalUrl, and the check goes down when the final URL is different, for example a login or parking page. The comparison ignores the case of the scheme and host, default ports and the fragment. The failure output includes final_url. (9947d0b)
• dash0: An HTTP check can be copied as a cURL command. "Copy as cURL" is in the check page menu and on the incident page. The command has the method, headers, body, redirects, TLS verification, HTTP version and timeout. Secrets are never included: basic auth becomes $SOLIDPING_BASIC_AUTH, and a comment line says when secret headers were left out. (9947d0b)
• checks: Checks can send a new value on every run to get past a CDN cache. ${var:timestamp}, ${var:iso8601}, ${var:uuid} and ${var:random} work anywhere ${env:...} does, for example ?cb=${var:timestamp}. Within one run, each name keeps the same value. The URL stored in a result now keeps ${param:...} references instead of the secret values. (9947d0b)
• icmp: An ICMP check can go down on packet loss or a slow round trip. Set max_packet_loss_percent or max_avg_rtt_ms. Before, one reply out of five kept the check up. The incident gives the reason, for example packet loss 40% > 20%. (9947d0b)
• notifications: Incident notifications say which regions see the failure. Alerts include "Failing from: Europe West, US East (2 of 3 regions)", and resolved alerts include "Failed from: ...". The webhook payload has a new incident.regions with failingRegions (slugs), regionCount and failQuorum. It is recorded when the incident opens and updated when it escalates. (9947d0b)
• incidents: Open incidents that nobody has acknowledged can send reminders. Set an interval from 15 min to 24 h on the check (reminderIntervalSeconds) or as an organization default. The check's channels then get incident.reminder: "Still down after 1 h 15 min, not acknowledged (reminder 3)". Reminders are off by default and stop on ack, snooze or resolve. Twilio and PagerDuty channels never get them. (9947d0b)
• mcp: The MCP server lists 23 tools by default instead of 46. Tools are grouped in toolsets. core and statuspages are listed by default, and admin (integrations and maintenance windows) must be requested. Add ?toolsets=all to the endpoint URL to list them all, or use SP_MCP_TOOLSETS or --toolsets with stdio. The 19 replaced tool names still work and are listed with toolsets=legacy. (9947d0b)
• helm: The Helm chart can run SolidPing on PostgreSQL through CloudNativePG. Set database.cnpg.enabled=true to create a CNPG Cluster and read the connection string from its secret. The cluster survives helm uninstall. SQLite stays the default, so existing installs are not moved on upgrade. The Kubernetes install page now documents the chart. (#544) (30218d5)

Bug Fixes

• discord: Discord buttons work when the bot has no Interactions Endpoint URL. Acknowledge, I'm unavailable and Escalate failed with "The bot did not respond quick enough", and nothing showed in the logs. Discord sends the button press over the Gateway in that case, and SolidPing ignored it. It now answers it like the HTTPS endpoint does, so the endpoint URL is optional when the Gateway is on. (#557) (3b5937f)
• http: An HTTP check with no expected status passes on any 2xx, not only 200. Healthy endpoints answering 201, 202 or 204 showed as down. Existing checks change too. To keep the old behaviour, set expectedStatusCodes: ["200"]. (9947d0b)
• db: A first start that was interrupted no longer leaves a database that never starts again. Stopping a container during its first start could end with no such column: organization.default_escalation_policy_uid on every boot. A failed or interrupted migration now stays pending and runs again. On SQLite, the first boot builds the database in a temporary file and renames it when done, and each upgrade first saves a backup (solidping.db.pre-<migration>.bak) when there is room on disk. (#549) (c7479ed)
• webpush: Push notifications keep working after the first restart. On a fresh install, the push key served during the first run was never stored, so the first restart made a new one and every browser subscribed in between stopped receiving pushes. The key is now stored before it is used. A browser hit by this can turn push off and on again. (#539) (caf64b4)
• server: HEAD requests get the same answer as GET. Every route answered 405 Method Not Allowed to HEAD, so external uptime monitors that probe with HEAD saw SolidPing status pages as down. (9947d0b)
• checks: Run now during a run in progress now gives a result. The request was dropped and the region reported running, so with a 1 h period the dashboard waited forever. The region now answers queued and runs again as soon as the current run ends. Editing a check while it runs no longer loses that run's result. (9947d0b)
• server: A fresh instance idles at about 30 MiB of its own memory instead of 140. The seeded admin password was hashed with 64 MiB argon2id, and that memory stayed resident for minutes. Every login did the same. Measured on linux/arm64, RssAnon went from 141 to 31 MiB 60 s after first boot, and from 207 to 26 MiB 10 s after a login. The browser sample checks are now created disabled, and a Linux host with 2 GiB of RAM or less and no cgroup limit gets half its RAM as the soft memory cap (SP_RUNTIME_AUTO_MEMORY_LIMIT=false turns this off). (9947d0b)
• auth: On a host with 2 GiB of memory or less, password hashing uses the OWASP minimum argon2id profile. A login now allocates 19 MiB instead of 64 MiB (m=19456 t=2 p=1). This applies only to single-process installs (SP_NODE_ROLE=all) where no argon2 cost is set. Existing hashes are converted at the next login. SP_AUTH_PASSWORD_ARGON2_AUTO_PROFILE=false keeps 64 MiB. (9947d0b)
• onboarding: A fresh install seeds 11 sample checks that work, instead of about 75. Most samples targeted services nobody runs locally (databases, message brokers, game servers, test FTP servers), so about half of them were down and the first dashboard was red. The 11 seeded checks are HTTP, DNS, SSL and TCP checks against public services. Every sample is still in the create-check picker, and test and demo modes seed them all. (#537) (262c2cc)
• logs: Logs pick a readable format on their own. The new default format, auto, gives JSON on Kubernetes, colored output in a terminal or in a container, and plain text otherwise. SP_LOG_FORMAT=json, text or pretty still wins. The colored format has a timestamp and keeps attributes in a stable order. NO_COLOR and FORCE_COLOR are honored. LOG_LEVEL is no longer reset to info once the configuration loads. (#536) (4c13730)
• logs: A fresh server prints a few lines at startup and the URL to open. It used to print 541 lines in its first minute and never said where to go. Check runs are DEBUG now. An INFO line is written when a check goes down, comes back up, warns or goes stale, and names the check. Workers and sample seeding print one line each. (#538) (bbe682a)
• logs: A fresh start no longer warns about normal things. The SQL errors on a missing table, the worker hostname, the retention setting, Sentry and Redis warnings are gone or moved to DEBUG. The metrics endpoint gets one line instead of two that contradicted each other. A fresh start now prints one WARN: credentials encryption is disabled. (#539) (caf64b4)
• auth: Signing in on the demo org no longer files a join request. A visitor who signed up from the live demo was told "A join request was sent to its admins", and nobody ever answered it. Sign-ins on the demo org, and on the default org in SaaS mode, now land on the create-your-org screen. On self-hosted installs, sign-ins on the default org still send join requests to its admins. (9947d0b)
• dash0: A first-time visitor is no longer told their session expired. Opening / or /d/ in a fresh browser showed "Your session has expired. Please log in again." The visitor now lands on the sign-in page with no banner. An expired or revoked session still shows it. (9947d0b)
• onboarding: The first check is no longer pre-filled with your mail provider. The empty dashboard suggests your email domain as the first URL to monitor, and skips free webmail. The skip list only had .com names, so a gmx.de, yahoo.fr or orange.fr address got its mail provider suggested. Country variants and national providers are now skipped too. (#532) (b3e6672)
• webhooks: Webhook signing secrets work as is with the official Standard Webhooks libraries. New secrets are whsec_ followed by standard base64 with padding. The dashboard and API show older secrets in the same form. It is the same key, so receivers that already verify keep working and nothing needs rotating. A pasted secret that is not valid base64 now gets a 400 on create and update. (9947d0b)
• config: SP_AUDIT_RETENTION_DAYS=0 keeps audit events forever, as documented. The value 0 was ignored, and the cleanup still deleted events older than 365 days. 0 now means "keep forever" in the env variable, in config.yml and in the audit.retention_days server parameter. (9947d0b)
• helm: Uploaded files survive a pod restart on PostgreSQL. With database.type=postgres, /data was not mounted, so logos, status page assets and screenshots were lost on every restart. /data is now mounted whatever the database. (#544) (30218d5)
• dash0: Toasts no longer cover the Run now, Disable and Edit buttons on a check page. After you created a check, the "Not on any status page yet" toast sat over these buttons. It is now a hint inside the check page, with its "Publish it" action. All toasts now start below the page header. (9947d0b)
• dash0: Region events name the region. On the Events page, region.offline and region.recovered had an empty detail. They now show the region name. (#552) (f3ac93e)
• dash0: Page titles stay readable on a phone. On narrow screens, the header buttons squeezed the title to one word per line, for example on SLOs and Escalation policies. The buttons now wrap below the title. (#553) (01d1c95)
• dash0: The status page editor works on a phone. Section headers and resource rows wrap instead of overflowing. (#554) (fb53d50)
• http: Forcing HTTP/2 against an HTTP/1.1-only server always gives the clear error. About 2% of such cleartext probes reported a generic connection error instead of "expected HTTP/2, but the server did not negotiate it". (#547) (b74bf7c)
• server: The platform watchdog no longer flags daily checks as stale. A heartbeat check that runs once a day was reported as "silent for 95h" between the compaction of its last result and its next run. The watchdog now also reads the check's last result time. (#542) (bd4af36)
• api: The number of check types is the same everywhere. The docs said 39 in one place and 43 in another. Every page now says 43. GET /api/v1/check-types has a new excludedFromTally field, true for sleep and private-location. The incidents API docs also list the parameters the server actually reads (state, checkUid, cursor). (9947d0b)
• deps: update github.com/dop251/goja digest to 0c308c5 (#546) (cba413a)
• deps: update github.com/dop251/goja digest to 245c54f (#551) (90b9c25)
• deps: update github.com/dop251/goja digest to 480b366 (#545) (b86f196)
• deps: update go dependencies (non-major) (#543) (87eb548)

---

This PR was generated with Release Please. See documentation.

[fclairamb]

🤖 Created releases:

• v0.38.4

🌻