Spitfire 0.62.6 release notes
Released: 2026-10-31
- Every run request (HTTP, GraphQL, SSE, WebSocket) carries headers that name the run: X-Spitfire-Run (the run's id) and spitfire.run in W3C Baggage. APM and logs can tell test traffic from real traffic; a header the test sets itself wins.
- A secret traffic key per installation so a firewall/WAF doesn't take the load test for a DoS attack: turned on on the Runners page, header name can be changed, value copied and rotated when needed. The key is stored encrypted and only install admins see it.
- The Runners page shows the connected runners' public IP addresses with a copy button; each runner's address is also under its name (with a note when it's private).
- New docs section "Firewall, WAF and APM": example rules for Cloudflare WAF, nginx, AWS WAF and the OpenTelemetry Collector; tag test requests in the APM instead of dropping them.
- Synthetic monitor checks carry the same mark.
Updating
Your installation tells you about a new release itself: admins see its notes and the update command for that installation at the top of the UI. The command backs up the database first and keeps the settings (Updating). You can also follow new releases with the RSS feed.