Spitfire 0.5.18 release notes
Released: 2026-10-02
- Forgot password, on the sign-in page and in the mobile app. With e-mail set up (Integrations → E-mail and the public address) the user gets a one-time link valid for 30 minutes; otherwise the request shows on the Users page and an admin sets a temporary password. The reply is the same for every address and never tells whether an account exists.
- A password an admin sets for someone else is now temporary by default: at the next sign-in the user picks their own before anything else (can be turned off on the Users page).
- Users change their own password from Change password in the user menu. Every password change ends all sessions of the account and is written to the audit log.
- When nobody can sign in (the only admin forgot their password), on the controller's host: spitfire-controller reset-password <email> (Docker: docker compose … exec controller, Kubernetes: kubectl exec). Installation guide → Forgotten passwords.
- After an update the UI no longer opens a stale cached page that 404s: index.html is revalidated on every load, versioned files are cached for good.
Updating
Your installation tells you about a new release itself: admins see its notes and the update command for that installation at the top of the UI. The command backs up the database first and keeps the settings (Updating). You can also follow new releases with the RSS feed.