Spitfire 0.5.5 release notes
Released: 2026-09-30security
- Security: a runner whose token is revoked leaves after its run; X-Forwarded-* only from proxies (SPITFIRE_TRUSTED_PROXIES); the UI is served with a CSP; share links are rate-limited.
- An update to another release dumps the database first (backups/*.dump).
- Webhooks and notifications go through a durable queue; a restart loses none.
- Stopping the controller stops active runs and stores their results.
- Kubernetes: non-root, read-only pods with NetworkPolicies.
- A saturated runner puts a warning in the run; /metrics also shows the controller's own health; JSON logs.
Updating
Your installation tells you about a new release itself: admins see its notes and the update command for that installation at the top of the UI. The command backs up the database first and keeps the settings (Updating). You can also follow new releases with the RSS feed.