Changelog

Version 1.2.7

🔄 Upgrade Notes

For Existing Installations:

  1. Database Migration: Run npx prisma db push to add the new user_sessions table
  2. Environment Variables: Add the new JWT configuration variables to your .env file
  3. Generate JWT Secret: Use openssl rand -hex 64 to generate a secure secret
  4. Agent Updates: All agents will automatically update to v1.2.7 on their next check-in (if auto-update is enabled)
  5. Crontab: Agents will automatically fix any duplicate crontab entries on next execution

Breaking Changes:

-Existing .env files: A recent change has made it mandatory for certain variables to be be present before the server.js starts up.

JWT_SECRET:
DATABASE_URL

These are now needed, you may create your own JWT Secret by running openssl rand -hex 64

  • Existing Agents: If the agent doesn't communicate after the update, then you most likely need to re-run the curl installation command for that host. Go to the host -> Deploy Agent -> Copy the curl one-liner command -> Run it on your host.

🚀 Agent & Agent Installation Improvements

Enhanced Linux Distribution Support

  • Fixed RHEL/CentOS/Fedora compatibility: Resolved critical issues with dnf and yum package managers affecting RHEL-derived distributions
  • Improved JSON parsing: Fixed agent installer and agent script JSON parsing issues on RHEL-based systems
  • New dependency: Added bc (basic calculator) as a prerequisite alongside jq and curl for proper floating-point calculations
  • SELinux detection fix: Corrected SELinux status detection logic to properly map "enforcing" to "enabled" state
  • <1GB ram fix: Hosts that had less than 1GB ram were throwing an error due to minimum integer on the server not being in decimal so minimum was "1" and as the command was pulling the information from the host in GB rather than MB it was causing issues.

Crontab Management Improvements

  • Smart duplicate detection: Installer now checks for existing PatchMon crontab entries before adding new ones, preventing duplicate entries
  • Intelligent time conversion: Update intervals are now correctly converted to cron format (e.g., 120 minutes → 0 */2 * * *)
  • Preserved existing entries: Installation no longer overwrites unrelated crontab entries

SSL Certificate Handling

  • Dynamic curl flags: Implemented a toggle in Agent Settings that allows administrators to enable/disable SSL certificate validation
  • Setting: "Ignore SSL Self-Signed Certificates": When enabled, curl commands use -sk flags instead of -s
  • Dynamic injection: The curl flags are injected into both the installer script and agent script at download time based on server settings
  • Improved deployments: Particularly useful for on-premises installations with self-signed certificates

Enhanced Security

  • API authentication required: The following endpoints now require API authentication:

    • /api/v1/hosts/agent/install
    • /api/v1/hosts/agent/download
  • Reduced attack surface: Agent scripts and installation commands are no longer publicly accessible without valid API credentials

Proxmox Compatibility Fix

  • Dependency installation visibility: Removed output suppression (> /dev/null) from dependency installation commands
  • Better error handling: Installer now displays important system messages (e.g., dpkg --configure -a prompts) that were previously hidden
  • Interactive fixes: Allows users to resolve system state issues during installation

Agent File Management Refactor

  • File-based storage: Agent script is now stored in the filesystem (/agents/patchmon-agent.sh) instead of the database
  • Simplified management: Centralized location makes updates and customization easier
  • Download/replace capability: Frontend GUI in Settings provides ability to download and replace the agent script

  • Timestamp-based updates: Agent now checks both version number AND file timestamp to determine if updates are needed

    • Enables custom modifications to agent script with automatic distribution to all hosts

🎨 UI/UX Improvements

Consolidated Settings Interface

  • Unified settings page: Merged three separate settings pages (Profile, PatchMon Options, Server Settings) into a single Settings interface
  • Secondary sidebar navigation: New collapsible sidebar within Settings for easier navigation

  • Organized sections:

    • User Management (Users, Roles, My Profile)
    • Hosts Management (Host Groups, Agent Updates, Agent Version)
    • Alert Management (Alert Channels, Notifications)
    • Patch Management (Policies - Coming Soon)
    • Integrations (Coming Soon)
    • Server (URL Config, Server Version)
  • Permission-aware: Navigation items dynamically shown based on user permissions

Enhanced Roles Page

  • Tabular layout: Improved Roles page with table view for better readability
  • Clearer permissions display: Easier to understand role assignments and permissions

New Dashboard Visualizations

  • OS Distribution Doughnut Chart: Added new chart type option for visualizing host operating system distribution
  • Customizable charts: Users can choose between Pie, Doughnut, and Bar chart formats for OS distribution
  • Future reporting module: Foundation laid for user-customizable dashboard cards in the upcoming reporting feature
  • Host count badge: The Hosts navigation item now displays the total number of managed hosts as a badge
  • Real-time updates: Badge updates dynamically as hosts are added or removed

🔐 Authentication & Security Enhancements

JWT Token Management

  • Session timeouts: Implemented automatic session expiration with configurable timeouts

    • Default: Access tokens expire after 1 hour
    • Refresh tokens: 7 days (configurable)
    • Inactivity timeout: 30 minutes (configurable)
  • Session tracking: All user sessions stored in database with metadata (IP address, user agent, last activity)
  • Session revocation: Users can view and revoke active sessions individually or all at once
  • Automatic cleanup: Expired sessions automatically cleaned up on an hourly schedule

MFA (Two-Factor Authentication) Fixes

  • Fixed blank page redirect: Resolved issue where MFA verification was redirecting to a blank page after successful authentication
  • Improved flow: MFA authentication now properly redirects users to the dashboard after successful verification
  • Better error handling: Enhanced TFA error messages and user feedback

Environment Configuration

  • New environment variables in env.example:

    JWT_SECRET=your-secure-random-secret-key-change-this-in-production
JWT_EXPIRES_IN=1h
JWT_REFRESH_EXPIRES_IN=7d
SESSION_INACTIVITY_TIMEOUT_MINUTES=30
  • Backward compatible: Existing installations continue to work with default values (24 hours if not specified)

🐳 Docker & DevOps (Special Thanks to @tigattack)

Code Quality Integration

  • Lefthook integration: Pre-commit hooks automatically enforce code quality standards
  • Biome linting: Automatic code formatting and linting on commit using Biome
  • CI/CD workflow: GitHub Actions automatically check code quality on all commits and pull requests

Docker Improvements

  • Automated Docker image builds: CI/CD workflows for building and publishing Docker images
  • Better Dockerfile structure: Optimized multi-stage builds for smaller image sizes
  • Improved .dockerignore: Reduced build context for faster builds

🔧 Technical Improvements

Agent Version Checking

  • Dual-check system: Agent updates now verified by both:

    • Version number comparison
    • File timestamp comparison
  • Custom modifications supported: Allows administrators to make custom tweaks to the agent script
  • Auto-distribution: Modified agents automatically distributed to all hosts

API Enhancements

  • New session management endpoints:

    • POST /api/v1/auth/refresh-token - Refresh expired access token
    • POST /api/v1/auth/logout - Logout current session
    • POST /api/v1/auth/logout-all - Logout all user sessions
    • GET /api/v1/auth/sessions - Get user's active sessions
    • DELETE /api/v1/auth/sessions/:id - Revoke specific session

Security Hardening

  • Hashed refresh tokens: Refresh tokens are SHA-256 hashed before database storage
  • IP and user agent tracking: All sessions track client metadata for security auditing
  • Rate limiting: Enhanced rate limiting on authentication endpoints
  • Brute force protection: Token-based authentication helps prevent credential stuffing attacks

🙏 Special Recognition

@tigattack - Extensive work on Docker infrastructure, lefthook integration, code quality workflows, and automated Docker image building. Your contributions have significantly improved the development workflow and deployment process!