Spitfire 0.5.17 release notes
Released: 2026-10-01
- Mobile notification groundwork (Infrastructure → Mobile & Gate, admin): run events such as started, finished and failed reach the phones of users who may see the test. Each notification is encrypted per phone (X25519 + AES-256-GCM) and carries only the test name, result and status, no measurements or targets. The spitfire.tr relay in between cannot read it. Off by default and free.
- Spitfire Gate: where the controller cannot reach the internet, another machine that can carries the notifications. The gate only connects outward (to the controller and the relay), installs like a runner with install-gate.sh and stops when its token is revoked. A controller with internet access needs no gate and sends the notifications itself (honouring HTTPS_PROXY).
- SSO for the mobile app: OIDC sign-in returns to the app (spitfire://auth). The code is bound to the PKCE verifier of the app that started the sign-in, so another app that catches it cannot use it.
- The mobile app itself (live runs, Stop, results, findings) will be announced when it is in the stores; this release prepares the server side.
Updating
Your installation tells you about a new release itself: admins see its notes and the update command for that installation at the top of the UI. The command backs up the database first and keeps the settings (Updating). You can also follow new releases with the RSS feed.