What's Changed (Docker Specific - all related to CI/build)

• Group dependabot PRs to reduce PR spam by @yubiuser in #2004
• ci: switch image publishing to docker/github-builder by @crazy-max in #2008
• Readme Rework by @PromoFaux in #1958
• Replace Python test suite with BATS and consolidate workflows by @PromoFaux in #2009
• Add timeout to curl command in branch validation by @RynoCODE in #2011
• Use bats-assert library functions in BATS test suite by @Copilot in #2018
• ci: run build job on pull request event by @crazy-max in #2021
• Update github-builder to v1.5.0 and enable fail-fast by @yubiuser in #2022

New Contributors

• @crazy-max made their first contribution in #2008
• @RynoCODE made their first contribution in #2011
• @Copilot made their first contribution in #2018

Full Changelog: 2026.02.0...2026.04.0

Component Release Notes

What's Changed (FTL v6.6)

• Fix possible resolver issue on armv5tel by @DL6ER in pi-hole/FTL#2781
• Introduce CMake options for optional dependencies by @aeolio in pi-hole/FTL#2795
• Fix build without mbedtls [v2] by @aeolio in pi-hole/FTL#2796
• Fix overTime data when database.DBimport = false by @DL6ER in pi-hole/FTL#2788
• Fix cross-compilation issues w/ custom toolchain by @aeolio in pi-hole/FTL#2797
• Add new option for controling name resolution via MAC address by @DL6ER in pi-hole/FTL#2790
• Fix obtaining client groups by name by @DL6ER in pi-hole/FTL#2791
• Ensure API sessions are restored before starting the HTTP server by @DL6ER in pi-hole/FTL#2803
• Add form-action 'self' to Content-Security-Policy by @yubiuser in pi-hole/FTL#2804
• Add query_frequency to /padd endpoint by @yubiuser in pi-hole/FTL#2806
• Guard query-count counters against unsigned underflow by @DL6ER in pi-hole/FTL#2815
• Add universal crash backtrace via _Unwind_Backtrace by @DL6ER in pi-hole/FTL#2811
• config: show totp_secret presence in CLI output by @DL6ER in pi-hole/FTL#2813
• Fix client count inflation for rate-limited queries by @DL6ER in pi-hole/FTL#2814
• Fix stack buffer overflow in get_process_name() by @DL6ER in pi-hole/FTL#2821
• Do not restart FTL while pihole -g is still ongoing by @DL6ER in pi-hole/FTL#2419

Security Advisories

• GHSA-r7g8-3fj7-m5qq - Authorization bypass: CLI API sessions can import Teleporter archives and modify configuration reported by @mzalzahrani
• Remote Code Execution (RCE) via Newline Injection in Multiple Configuration Parameters reported by @T0X1Cx
  • pi-hole/FTL/security/advisories/GHSA-vfmq-jrx3-wv3c
  • pi-hole/FTL/security/advisories/GHSA-wxhv-w77q-6qwp
  • pi-hole/FTL/security/advisories/GHSA-28g5-gg88-wh5m
  • pi-hole/FTL/security/advisories/GHSA-fqv2-qhfh-ghcj
  • pi-hole/FTL/security/advisories/GHSA-23w8-7333-p9fj

New Contributors

• @aeolio made their first contribution in pi-hole/FTL#2795

Full Changelog: pi-hole/FTL@v6.5...v6.6

What's Changed (Web v6.5)

• Amend teleporter help text that the long-term data is not included by @yubiuser in pi-hole/web#3721
• Do not use 3 columns when boxed layout is used by @rdwebdesign in pi-hole/web#3722
• Use ENTER instead of ⏎ by @yubiuser in pi-hole/web#3727
• Don't link to github releases if docker tag is nightly by @yubiuser in pi-hole/web#3718
• Do not try to compare component version when remote version info is not available by @yubiuser in pi-hole/web#3729
• Show loading overlay when adding/removing CNAME records as it requires a FTL restart by @yubiuser in pi-hole/web#3742
• fix: check on responseJSON when wrong password by @guybrush2105 in pi-hole/web#3693
• Remove the loggingButton from Settings > System > Actions by @yubiuser in pi-hole/web#3747

Security Advisories

• Multiple Stored HTML Injections and XSS in different web interface pages reported by @andrejtomci

  • GHSA-jx8x-mj2r-62vq - Stored HTML Injection in queries.js

  • GHSA-9rfm-c5g6-538p - Stored HTML attribute injection

  • GHSA-px6w-85wp-ww9v - Stored XSS / HTML injection in the Network page/Dashboard

  • GHSA-7xqw-r9pr-qv59 - Reflected XSS / HTML injection in taillog.js (Also reported by @n1rwhex and @mzalzahrani)

New Contributors

• @guybrush2105 made their first contribution in pi-hole/web#3693

Full Changelog: pi-hole/web@v6.4.1...v6.5

What's Changed (Core v6.4.1)

• Remove additional ':' from debug log system time output by @yubiuser in pi-hole/pi-hole#6551
• Remove readonly from piholeNetworkFlush.sh to avoid error message by @rdwebdesign in pi-hole/pi-hole#6554
• Add antigravity index by @DL6ER in pi-hole/pi-hole#6573
• Fix return status capture of FTL check_download exists by @yubiuser in pi-hole/pi-hole#6572
• Remove misleading TODO comment for SetWebPassword by @10adnan75 in pi-hole/pi-hole#6531

Security Advisories

• GHSA-c935-8g63-qp74 – Local Privilege Escalation reported by @smittix

New Contributors

• @10adnan75 made their first contribution in pi-hole/pi-hole#6531
• @Copilot made their first contribution in pi-hole/pi-hole#6580

Full Changelog: pi-hole/pi-hole@v6.4...v6.4.1