What's Changed

• Amend teleporter help text that the long-term data is not included by @yubiuser in #3721
• Do not use 3 columns when boxed layout is used by @rdwebdesign in #3722
• Use ENTER instead of ⏎ by @yubiuser in #3727
• Don't link to github releases if docker tag is nightly by @yubiuser in #3718
• Do not try to compare component version when remote version info is not available by @yubiuser in #3729
• Show loading overlay when adding/removing CNAME records as it requires a FTL restart by @yubiuser in #3742
• fix: check on responseJSON when wrong password by @guybrush2105 in #3693
• Remove the loggingButton from Settings > System > Actions by @yubiuser in #3747

Security Advisories

• Multiple Stored HTML Injections and XSS in different web interface pages reported by @andrejtomci

  • GHSA-jx8x-mj2r-62vq - Stored HTML Injection in queries.js

  • GHSA-9rfm-c5g6-538p - Stored HTML attribute injection

  • GHSA-px6w-85wp-ww9v - Stored XSS / HTML injection in the Network page/Dashboard

  • GHSA-7xqw-r9pr-qv59 - Reflected XSS / HTML injection in taillog.js (Also reported by @n1rwhex and @mzalzahrani)

New Contributors

• @guybrush2105 made their first contribution in #3693

Full Changelog: v6.4.1...v6.5

What's Changed

• Set the end date for live query update to end of epoch by @rrobgill in #3677
• Improve initial loading of Query Log by @DL6ER in #3715

Also fixes two security advisories:

• GHSA-6xp4-jw73-f4qp: fixed with d328f14
• GHSA-8rw8-vjgp-rwj6: fixed with 1a0c6f4

Full Changelog: v6.4...v6.4.1

What's Changed

• Start using commented tags for editorconfig-checker by @yubiuser in #3643
• Remove some unused code (leftover from v5) by @rdwebdesign in #3636
• Make sure the table is redrawn after the dnssec API call returns by @rdwebdesign in #3645
• Add hint that partial matching may not return all possible results by @DL6ER in #3654
• Enable one-time code autofill for TOTP input by @sebastianlivoni in #3658
• Set "All Time " range for query log datepicker based on Database ranges (moment) by @PromoFaux in #3657
• Request ANSI colour codes when calling gravity API by @PromoFaux in #3662
• Pi-hole Web v6.4 by @PromoFaux in #3670

New Contributors

• @sebastianlivoni made their first contribution in #3658

Full Changelog: v6.3...v6.4

What's Changed

• Clarify client description priorities on the groups/client interface by @DL6ER in #3521
• Remove superfluous settings-level-expert class by @yubiuser in #3503
• Remove link to rate limit documentation which does not add further etails by @yubiuser in #3526
• Add some color to gravity output by @yubiuser in #3530
• settings-system : Avoid division by zero in DNS metrics by @rrobgill in #3533
• Make the "Add to denied/allowed domains" buttons red and green by @darkexplosiveqwx in #3551
• Remove query type from domainNeeded option by @yubiuser in #3557
• Handle pie chart item style conditionally by @yubiuser in #3532
• Use label-primary for number of enabled list icon on sidebar by @yubiuser in #3563
• Use innerHTML instead of append to fix gravity color output by @yubiuser in #3566
• Trim whitespaces before adding custom DNS record by @yubiuser in #3569
• Bind address to new element instead of raw HTML construction by @DL6ER in #3567
• Use /flush/network instead of /flush/arp by @yubiuser in #3553
• Prevents getting stuck loading unlimited query log results by @ablankenship10 in #3592
• Fix 2FA icon styles #3431 by @idotj in #3585
• Fix header.lp closing head tag formatting by @h3xcat in #3607
• Fix the link on the upstream chart legend by @rdwebdesign in #3606
• Rename config key dns.domain > dns.domain.name by @yubiuser in #3611
• Improve line graph tooltip by @yubiuser in #3601
• Make DNSSEC icon conditional in Queries Log (redo of #3399) by @yubiuser in #3535
• Query Log: The underscore is special by @DL6ER in #3578
• Fix addList function to include type in API request URL by @PromoFaux in #3620
• Pin github action to SHA by @yubiuser in #3593
• Adjust domain count according to pi-hole/FTL#2177 by @yubiuser in #3619
• Also pin editorconfigchecker by sha by @yubiuser in #3621
• Update FTL %cpu and %mem everytime total CPU stats are updated by @yubiuser in #3622
• Clarify uptime in container matching the host uptime with a tooltip by @yubiuser in #3624
• Adjust text BitWarden to Bitwarden by @jprusik in #3629

New Contributors

• @darkexplosiveqwx made their first contribution in #3551
• @ablankenship10 made their first contribution in #3592
• @idotj made their first contribution in #3585
• @h3xcat made their first contribution in #3607
• @jprusik made their first contribution in #3629

Full Changelog: v6.2.1...v6.3

No Functional changes, retagging as we managed to tag previous to the merge commit....

Full Changelog: v6.2...v6.2.1

What's Changed

• Streamline actions, format and switch to Node.js 22 by @XhmikosR in #3357
• Remove remaining hard-coded /admin/ paths in the webinterface by @DL6ER in #3370
• Fix Local CNAME records records mistake by @yubiuser in #3367
• Fix concurrency issue about const apiUrl by @DL6ER in #3371
• groups-lists: remove unneeded HTML escape by @XhmikosR in #3379
• login.js: fix deprecated submit() usage by @XhmikosR in #3380
• Remove x-dns-prefetch-control meta tag by @XhmikosR in #3378
• group-domains: fix uncaught TypeError due to invalid URLs by @XhmikosR in #3383
• Replace remaining i element cases with em by @XhmikosR in #3381
• Revert the defer addition for now by @XhmikosR in #3382
• header: fix runtime error when query_string is null by @XhmikosR in #3395
• utils: fix typo in showAlert() by @XhmikosR in #3403
• queries: make the Advanced filtering button occupy all space by @XhmikosR in #3402
• Remove icheckbox related-code except for primary by @XhmikosR in #3387
• queries: add missing display: none by @XhmikosR in #3405
• Allow free input in upstream filter by @yubiuser in #3408
• Fix console warning when no password set by @PromoFaux in #3410
• Modernize JS and tighten things by @XhmikosR in #3388
• high-contrast.css: fix duplicate selector by @XhmikosR in #3411
• Remove unused CSS by @XhmikosR in #3420
• Add missing display: none for collapsed boxes by @XhmikosR in #3417
• Remove unused HTML elements by @XhmikosR in #3418
• Update chart.umd.js.map from npm by @XhmikosR in #3419
• settings-api: add missing end closing p tag by @XhmikosR in #3428
• settings-system: fix span end tag typo by @XhmikosR in #3427
• login: fix deprecated submit() function by @XhmikosR in #3425
• settings-api: fix deprecated keyup() function by @XhmikosR in #3424
• gravity: remove the unused ?go code by @XhmikosR in #3426
• disabled and checked are boolean attributes by @XhmikosR in #3434
• queries: replace the deprecated jQuery.parseJSON with JSON.parse by @XhmikosR in #3435
• package.json: sort deps by name by @XhmikosR in #3437
• Use CODEOWNERS instead of deprecated dependbot/reviewers by @yubiuser in #3433
• Add 'Bug: Confirmed' to stale exempt list by @yubiuser in #3432
• Various minor tweaks to the LCARS theme by @rdwebdesign in #3446
• queries: fix box markup by @XhmikosR in #3445
• Use the same default interface used by FTL if none is set in pihole.toml by @rdwebdesign in #3436
• Use font-weight: 600 by @XhmikosR in #3449
• Use mg.script_name to retrieve the scriptname by @rdwebdesign in #3447
• .user-header: use font-weight: 600 by @XhmikosR in #3450
• settings-system.js: remove unused overlay code by @XhmikosR in #3455
• settings-advanced: remove unused code by @XhmikosR in #3454
• index.lp: remove unused classes by @XhmikosR in #3453
• scripts/js/settings-dns-records.js: fix api url base by @onlyJakob in #3456
• Add hint about wildcard search in advanced query filtering by @yubiuser in #3452
• index: make tables stripped by @XhmikosR in #3438
• Replace invalid hostname to prevent XSS by @yubiuser in #3401
• settings-system: fix typo by @XhmikosR in #3460
• sidebar: increase logo size to prevent a reflow by @XhmikosR in #3407
• queries: improve link to search page by @XhmikosR in #3422
• Hide top tables depending on privacy level by @yubiuser in #3362
• settings-dns-records: fix typo by @XhmikosR in #3459
• Fix deprecated ready function by @XhmikosR in #3461
• utils: remove the unused objectToArray util by @XhmikosR in #3462
• utils: improve readability for validateIPv* functions by @XhmikosR in #3423
• settings-api: fix wrong code by @XhmikosR in #3463
• Use text()/textContent when we don't need HTML by @XhmikosR in #3464
• footer: drop redundant addAdvancedInfo() call by @XhmikosR in #3467
• settings-system: remove unneeded span elements by @XhmikosR in #3468
• settings-dhcp: drop unused lookatme-text attribute by @XhmikosR in #3469
• settings-advanced.js: fix wrong role value by @XhmikosR in #3470
• settings-advanced: drop small element by @XhmikosR in #3472
• updateFtlInfo: remove unused code by @XhmikosR in #3474
• settings-level-expert: only toggle the expert elements by @XhmikosR in #3473
• Make use of the new format_path function to add the current page in body by @XhmikosR in #3390
• Use proper Object methods by @XhmikosR in #3441
• queries: minor grammar fix by @XhmikosR in #3477
• queries: change box to an info one by @XhmikosR in #3476
• Fix DataTables warning message in Network page by @rdwebdesign in #3475
• Fix broken themes by @rdwebdesign in #3479
• queries: drop non-existent elements code by @XhmikosR in #3478
• Reset update-hint text every time updateVersionInfo() function is executed by @rdwebdesign in #3480
• Use the same interface name used by FTL in DNS Settings page by @rdwebdesign in #3481
• messages: fix function call by @XhmikosR in #3482
• footer: rename label by @XhmikosR in #3486
• header_authenticated: change documentation icon to solid by @XhmikosR in #3488
• Remove horizontal line in hamburger menu by @yubiuser in #3491
• sidebar: move active class outside of class attribute conditional by @XhmikosR in #3492
• index: use sentence case for queries for consistency by @XhmikosR in #3493
• Add rel="noreferrer" to external hyperlinks by @casperklein in #3495
• settings-level-expert: hide them by default by @XhmikosR in #3487

New Contributors

• @onlyJakob made their first contribution in #3456
• @casperklein made their first contribution in #3495

Full Changelog: v6.1...v6.2

What's Changed

• Fix typo in DHCP settings page by @alexwhitman in #3279
• Live long and prosper by @PromoFaux in #3280
• Fix CPU% by @DL6ER in #3262
• Fix top lists links on the dashboard by @DL6ER in #3283
• Improve HTTPS detection behind reverse proxy by @DL6ER in #3285
• Improve CodeQL action by @XhmikosR in #3289
• package.json: properly configure xo and postcss by @XhmikosR in #3248
• Set default values for each property of versions object by @rdwebdesign in #3268
• Fix the text and icon used to report end-to-end encryption status (TLS/SSL) on the top menu by @rdwebdesign in #3288
• .gitattributes: enforce LF by @XhmikosR in #3282
• Sort IPv4 before IPv6 addresses on the network overview by @DL6ER in #3286
• Add missing img dimensions by @XhmikosR in #3294
• Sort interfaces by @DL6ER in #3284
• Remove the obsolete X-UA-Compatible meta tag by @XhmikosR in #3305
• logout.js: add missing preventDefault call by @XhmikosR in #3301
• Switch to Font Awesome CSS by @XhmikosR in #3300
• Ran autoprefixer by @XhmikosR in #3246
• testpr: run prefix script too by @XhmikosR in #3307
• Updated run gravity message when importing config in Teleporter by @jmui in #3312
• Fix a few CodeQL issues by @XhmikosR in #3290
• Remove trailing slash from void elements by @XhmikosR in #3315
• sidebar: fix missing span end-closing tags by @XhmikosR in #3316
• Fix stray - by @XhmikosR in #3318
• Fix issues found in LCARS theme after recent changes in CSS and HTML by @rdwebdesign in #3327
• Remove a few unused CSS rules from pi-hole.css and LCARS theme by @rdwebdesign in #3329
• Update browserslistc by @XhmikosR in #3322
• Use em instead of i and strong instead of b by @XhmikosR in #3321
• Update fonts by @XhmikosR in #3309
• Add missing rel="noopener" for external links by @XhmikosR in #3333
• Allow path prefix multiplexing the dashboard and API by @DL6ER in #3269
• login.lp: remove mention of sudo by @XhmikosR in #3334
• Refactor assets loading by @XhmikosR in #3295
• queries: switch to a real button by @XhmikosR in #3339
• Logout: fix redirect by @XhmikosR in #3304
• sidebar: switch to a real button by @XhmikosR in #3342
• parseQueryString: switch to URLSearchParams and remove unused param by @XhmikosR in #3340
• Queries: user fieldtext directly by @XhmikosR in #3343
• Queries: escape querystatus.fieldtext by @XhmikosR in #3348
• Fix typo in advanced DNS help text by @yubiuser in #3350
• Set an upper limit on the number of rows returned for the query log by @PromoFaux in #3346
• Use pretty URLs when possible by @XhmikosR in #3351
• Use modernized waitMe plugin by @yubiuser in #3213
• Query Log: Add QUERY_EXTERNAL_BLOCKED_EDE15 rules by @DL6ER in #3347
• index: remove useless empty title attributes by @XhmikosR in #3352
• Remove meta http-equiv="cache-control" by @XhmikosR in #3353
• Regenerate package-lock.json with npm 10.9 by @XhmikosR in #3356

New Contributors

• @alexwhitman made their first contribution in #3279
• @jmui made their first contribution in #3312

Full Changelog: v6.0.2...v6.1

What's Changed

• Accept tabs inside dns.hosts and strip possible trailing comments by @DL6ER in #3241
• Regenerate package-lock.json with npm 10.8.2 by @XhmikosR in #3247
• Improve image compression by @XhmikosR in #3244
• Improve info text on Settings > DNS by @yubiuser in #3245
• Save the state of the query log table infinitely by @yubiuser in #3253
• Update hammer.min.js and include map by @yubiuser in #3254
• Remove the hard-coded time range from graphic titles by @rdwebdesign in #3256
• Softens the insecure warning on the HTTP login page a bit by @yubiuser in #3258
• Show the interface name in Settings > DNS page by @rdwebdesign in #3265
• Add a hidden column to the network table to allow filtering by hostnames by @rdwebdesign in #3264
• Fix total query tooltip on dahboard by @yubiuser in #3266
• Fix the insertion of multiple domains as wildcard by @rdwebdesign in #3259
• Use margin-right instead of spaces after dnssec icon in Query Log by @rdwebdesign in #3267
• Improve memory unit selection for devices with less than 1 GB of RAM by @DL6ER in #3270
• Use singular if we have one core by @XhmikosR in #3276

Full Changelog: v6.0.1...v6.0.2

What's Changed

• Add a link to the docker tag on the footer by @rdwebdesign in #3230

Full Changelog: v6.0...v6.0.1

What's Changed

• Fix donate button by @rdwebdesign in #2613
• Fix the size of the "key icon" on the login page by @rdwebdesign in #2617
• Change the load order of some CSS files to fix a few visual issues by @rdwebdesign in #2616
• Fix "Save & Apply" button by @rdwebdesign in #2623
• No PHP, no phpstan, no composer by @yubiuser in #2632
• Stickler is gone by @yubiuser in #2633
• Fix running gravity from the web UI by @DL6ER in #2639
• Fix check of ticked non-custom DNS servers by @DL6ER in #2640
• replaceAll() requires a global regex by @DL6ER in #2651
• Fix Search Adlists layout by @rdwebdesign in #2649
• Group search results by adlist by @DL6ER in #2652
• Fix login page rediction by @DL6ER in #2655
• Tweak advenced filtering box (Query log page) by @rdwebdesign in #2658
• Tweak Query Log by @DL6ER in #2663
• Remove "Power off" and "Restart System" buttons by @yubiuser in #2664
• Revert "Fix login page rediction" by @DL6ER in #2668
• Fix Dashboard link to blocked queries by @yubiuser in #2665
• Replace some php references with their correct lp counterparts by @PromoFaux in #2666
• Show direct link to domainlist on REGEX blocked entries by @DL6ER in #2667
• Fix: set theme "High contrast dark" as dark by @rdwebdesign in #2669
• Fix gravity link from adlist page by @yubiuser in #2673
• Add UI-related antigravity changes by @DL6ER in #2700
• Simplify theme handling by @DL6ER in #2718
• Improve settings level select location by @DL6ER in #2720
• Settings page - Fix spellcheck: accordignly => accordingly by @rdwebdesign in #2727
• Fix HTTPS link on login page by @DL6ER in #2729
• Fix the gravity output to use the ${OVER} sequence by @rdwebdesign in #2725
• Conditional HTTPS hint on login page by @DL6ER in #2730
• Change old -a -p parameters to setpassword by @rdwebdesign in #2735
• AdminLTE > web by @yubiuser in #2736
• Tweak/settings by @yubiuser in #2740
• Fix AJAX JSON data by @DL6ER in #2742
• Fix update logic for custom branches by comparing hashes by @yubiuser in #2737
• Fix AJAX JSON data by @DL6ER in #2744
• Tweak and fix the update footer by @yubiuser in #2745
• Fix broken multi-delete of adlists by @DL6ER in #2751
• Improve rendering of search results by @DL6ER in #2750
• Use the final message from gravity to attest it was completed successfully by @rdwebdesign in #2759
• Do not show extra N/A when no ABP-style domains are in a list by @DL6ER in #2761
• Do not load default-light.css file when using Auto theme, if dark mode is preferred by @rdwebdesign in #2764
• Always point "Pi-hole" top bar link to pihole.webhome by @rdwebdesign in #2772
• Show active instead of clients-ever-seen on the dashboard by @DL6ER in #2769
• Add ability to specify domains, lists, clients and group names as arrays by @DL6ER in #2707
• Add "Delay" column to Query Log by @DL6ER in #2757
• Fix sorting on Settings -> Local DNS Records table by @DL6ER in #2777
• Restore Teleporter functionality by @DL6ER in #2738
• Fix dashboard when no queries are present by @yubiuser in #2780
• temp.limit needs to be data-type="integer" by @yubiuser in #2785
• Fix mass-deletion of sessions on the settings -> API page by @DL6ER in #2765
• Update chart.js to 4.4.0 by @yubiuser in #2781
• Fix how Bootstrap-Notfy is used by Pi-hole by @DL6ER in #2786
• Mark variables set by environment variable as read only in the web interface by @PromoFaux in #2787
• Add app password support by @DL6ER in #2793
• Nicely format error toasts by @DL6ER in #2791
• Fix TOTP input field not being shown when enabled by @DL6ER in #2783
• Add 404 error page by @DL6ER in #2746
• Use class attribute only for styles by @rdwebdesign in #2798
• Fix notification animation by @yubiuser in #2802
• Update nodejs to 20 by @yubiuser in #2794
• Tweak All Settings page by @rdwebdesign in #2799
• Finalize renaming adlists -> lists by @DL6ER in #2756
• Tweak processing/render time by @yubiuser in #2803
• Tweak teleporter success message by @DL6ER in #2796
• Fix notification icon and add details for Local DNS/CNAME records by @yubiuser in #2809
• Defer chartjs animation until they are in viewport by @yubiuser in #2810
• Fix chart legend flickering by @DL6ER in #2811
• Add zooming on the dashboard's two main graphs by @DL6ER in #2807
• Add tooltip explaining you can zoom and pan the graphs by @DL6ER in #2812
• Show Reset Zoom button when zoomed in by @DL6ER in #2813
• Improve TOTP field by @DL6ER in #2795
• fix(login): typo by @wdhdev in #2819
• Fix error displaying when editing groups/clients/domains/lists by @DL6ER in #2808
• Fix query logs "all time" option by @DL6ER in #2820
• Add missing data-configkey dhcp.hosts by @yubiuser in #2821
• Fix inital date/time by @yubiuser in #2828
• Use upstream names instead of IP when available by @DL6ER in #2827
• Prevent multi-login due to slow password hashing by @DL6ER in #2826
• Move dhcp.domain -> dns.domain by @DL6ER in #2825
• Move comment about CNAME limitations to the CNAME box by @DL6ER in #2806
• Shorten animation delay by @yubiuser in #2815
• Privacy Settings - Keep the text on the same line, even in smaller screens by @rdwebdesign in #2830
• Add DHCP netmask field and nicely format API errors by @DL6ER in #2805
• Allow open details only on normal rows by @rdwebdesign in #2842
• Add word break for clients column to avoid horizontal scrollbar (v6) by @rdwebdesign in #2839
• Clear input fields after successfully adding new Clients, Domains or Lists by @rdwebdesign in #2832
• Use row background colors in Query Log table by @rdwebdesign in #2840
• Do not accept comma to separate regex by @DL6ER in #2835
• Fix Upstreams Query Log links by @DL6ER in #2843
• Add hint about dnsmasq default lease time by @yubiuser in #2844
• Fix possible race-collision by @DL6ER in #2846
• Devcontainer by @yubiuser in #2847
• [DevContainer] Mount external ssh directory in the correct place by @PromoFaux in #2850
• Add HTTP 403 error page by @DL6ER in #2853
• Fix deleting sessions via red trash icon by @yubiuser in #2856
• Show Unicode domains (if domain is punycode-encoded) by @DL6ER in #2857
• Improve escaping on the web interface by @DL6ER in #2851
• Add pagination controls to Local records pages by @rdwebdesign in #2859
• Remove test leftover by @rdwebdesign in #2863
• Emphasize whole row for current client in API session table by @yubiuser in #2865
• Update dat...