arrow_back All releases
0.13.172

v0.13.172

Released 27 March 2025.

Highlights

Snapshot metadata system

Every stored snapshot now has a corresponding metadata record with source tracking (live check, import, or calibration), content kind, byte size, and a cached diff summary. The history API reads metadata first for O(1) listing performance, falling back to legacy inference only for old snapshots. Snapshot deletion cascades to metadata automatically.

Extended import formats

DeltaWatch now supports six import sources:

  • changedetection.io — ZIP backup with watches, tags, snapshots, and notification settings.
  • DeltaWatch native backup — full-fidelity restore from a DeltaWatch export (manifest.json v2).
  • CSV — bulk-create watches from a spreadsheet with URL, title, interval, and method columns.
  • JSON — array of watch objects with full field mapping.
  • Distill.io — structured JSON export.
  • URL list — plain text, one URL per line.

All imports show a preview before committing and enforce billing limits (watch count, interval clamping). Large imports run as background jobs.

Backend-specific repositories

The repository layer now provides native query optimisations per storage backend:

  • Directus — native REST filters and pagination.
  • PostgreSQL — native SQL with JSONB operators and connection pooling.
  • Generic — KV fallback with JavaScript filtering for all other backends.

Workspace switching improvements

Switching workspaces no longer rotates the session. The same JWT and CSRF token persist, eliminating CSRF mismatches and enabling instant switching without page reload. Routes are keyed by workspace ID so pages remount with fresh data.

HTTP caching

Authenticated routes now use private, no-cache headers, preventing stale data from being served after workspace switches. Only the health endpoint uses public caching.

Platform admin notifications

Platform owners can configure notification URLs for platform events: user signups, plan changes, workspace creation/deletion, and user invitations.

Security improvements

  • Import field allowlist (28 explicitly permitted fields) prevents arbitrary field injection from native imports.
  • Import preview endpoint capped at 64 MB with decompression bomb guards.
  • Import archives include SHA-256 checksums for integrity verification.
  • Per-request context cache reduces redundant store reads on authenticated routes.

Bug fixes

  • Fixed cache poisoning when switching between workspaces with HTTP max-age caching.
  • Fixed CSRF token mismatch after workspace switching (session reuse instead of rotation).
  • Fixed dashboard not refreshing data on workspace switch (routes now keyed by workspace ID).
  • Fixed Directus 403 errors on filtered queries when encryption key was set.
  • Fixed snapshot content being parsed as object instead of string on Directus backend.
  • Fixed duplicate PostgreSQL connection pools with inconsistent SSL configuration.
  • Fixed store name desync for new stores across migration endpoints.
  • Fixed rate limit test expectations after threshold change.