Spitfire 0.5.12 release notes
Released: 2026-09-30
- Behaviour changes (read before updating): a threshold that measured nothing now fails the run (a CI gate no longer turns green on a step that never ran); SSO sessions end after 24 hours and password sessions after 30 days, however often they are refreshed; a password inside a Mongo/AMQP/MQTT URL is refused (use the encrypted password field); gRPC steps use 8 connections per runner by default ('connections' on the connection); a user sees only the data files their groups' tests use.
- Results: a data binding draws rows only for the scenarios that use it, and exhausted unique data stops only the scenarios that read it. A Host header set on a step is sent. A redirected request's duration covers every hop. SQL reads include the wait for a pooled connection. A value that could not be extracted falls back to its default instead of keeping the previous iteration's. A run's final rows are never lost, and a run no longer stays 'running'.
- Robustness: a crash inside a step fails that iteration, not the runner. A runner that reconnects during a run has its measurements merged in full. WebSocket ask takes only messages after the request, and the buffer is capped at 32 MB; a WebSocket/Kafka address that changes every iteration no longer piles up connections. The ramping-vus chart counts VUs still finishing an iteration.
- Security: a stored secret (SMTP/LDAP password, OIDC secret, webhook secret and headers, OTLP headers) must be entered again when its destination host changes. CSV exports are protected against formula injection. /metrics shows non-admins only their groups' runs. SSO sign-in starts are rate limited per address.
- Interface: a series hidden in a live chart's legend and the tooltip stay put. Leaving the test editor with unsaved changes asks first. If someone saved the test after you opened it, your save is refused instead of overwriting theirs. A failed background refresh keeps the last data. Signing out clears the cache. Editing a schedule keeps its location split and labels. The group, compare and notification test pickers list more than 200 tests.
- Other: a schedule whose owner is disabled or whose test is archived fails once and is turned off (an archived test's schedule never fires). A connection that tests use cannot be renamed (change the tests first). Webhook delivery history is kept to the last 200 per webhook.
Updating
Your installation tells you about a new release itself: admins see its notes and the update command for that installation at the top of the UI. The command backs up the database first and keeps the settings (Updating). You can also follow new releases with the RSS feed.