flower

Releases

1. ▸▾2.2.022 Sept 2026

   Added CSRF protection for cookie-authenticated sessions

   Security

   • Added CSRF protection for cookie-authenticated sessions
   • Added protection against cross-site state-changing requests
   • Added an OAuth state check to all login handlers
   • Restricted the post-login redirect to local paths
   • Enabled TLS certificate validation for the RabbitMQ management API
   • Escaped all table cells on the tasks and workers pages
   • Escaped load average values in the workers grid
   • Added HttpOnly and SameSite to session cookies
   • Added the X-Content-Type-Options: nosniff header
   • Limited CORS headers to the unauthenticated API
   • Served API error messages as plain text

   Features

   • Added a logout link for OAuth sessions #1074
   • Added a timeout option to the task apply API
   • Added a page size selector to the tasks page #1518
   • Linked task names to a list of all tasks with that name
   • Linked the task counts on the workers page to the matching tasks
   • Honored the column order of the tasks_columns option #1262
   • Added thousands separators to task counts #1374
   • Formatted durations and showed a dash for missing values
   • Added search examples as placeholder text
   • Made wide tables scroll sideways and shortened UUIDs on mobile
   • Limited worker page task lists to 50 entries by default #1087
   • Removed the Retried column from the workers page
   • Named browser tabs by page

   Performance and reliability

   • Made persistent state saves atomic #1403
   • Fixed startup failing on a corrupt persistent state database #1398
   • Added a warning when state saving dominates the save interval
   • Reapplied --max-tasks to restored persistent state #1380
   • Honored the --purge-offline-workers grace period after worker-offline events #1190
   • Inspected a worker lazily on its first page visit #1388
   • Fetched worker task lists only when inspecting a single worker
   • Validated the --broker-api URL at startup
   • Required both --certfile and --keyfile when either is set
   • Validated task API query parameters and publish payloads

   Bug fixes

   • Fixed worker task table column widths #1521 by @ShubhAtWork
   • Fixed the default RabbitMQ management API URL to use the management port #1232
   • Fixed the theme dropdown not closing and stuck navbar tooltips
   • Fixed a server error on the task page for tasks without a name
   • Fixed search queries containing quotes or brackets
   • Fixed Redis Sentinel authentication with a username #1386
   • Fixed GitHub OAuth login on GitHub Enterprise Server #1308
   • Fixed a raw HTTP 400 error after a failed OAuth login #1404
   • Fixed a 404 on the login route with a trailing slash #1322
   • Fixed error messages containing percent signs
   • Fixed the prefetched tasks gauge drifting up for tasks that never start #1364
   • Fixed restoring persistent state that reads options during unpickling #1328

   Documentation

   • Documented how to require basic auth for /metrics #1342
   • Documented how to disable /metrics #1379
   • Documented option precedence
   • Documented the rules for --auth email patterns
   • Fixed the --broker-api example #1425
   • Fixed the format_task example

   Compatibility and packaging

   • Built Docker images from source and rebuilt them weekly #1423
   • Upgraded all base packages in the Docker image
   • Removed pip from the Docker image
   • Fixed the documentation build
   • Removed the stale Swagger spec

   Full changelog: v2.1.0...v2.2.0