Cockpit Releases

Latest: v2.14.1 · 26 Aug 2026 - Refactor session state management and event stream handling in admin module Replace App.utils.$interpolate / App.utils.interpolate Function -based evaluation with sandboxed JSLite execution to reduce browser-side code execution risk while preserving display template behavior Sanitize Set field and tree display template output to prevent stored XSS while preserving safe HTML formatting Sanitize asset titles on save and escape asset metadata when rendering Asset fields to prevent stored XSS Add manual admin account input on installation MongoLite: Refactor document encoding in Collection class to improve error handling Prevent users to update their active status without needed permissios Breaking: JWT HS256 signing now requires keys to be at least 32 bytes long; update short sec-key before upgrading Fix Set field options retaining fields from the previously created Set field Fix path traversal in PHP built-in server space storage file handler @geo-chen Harden bucket upload and rename filtering to block executable/HTML file types and PHP/HTML MIME types Add dummy password check to prevent timing attacks in login method Refactor URL construction in cron.php for better readability and security Enhance argument normalization and validation un Ffmpeg/Vips helpers Fix state validation for unpublished singleton items