1.5.83: log access controls, concurrent operation safety, and npm audit fixes
Posted by tomspark
SparkBox 1.5.83 ships four critical security fixes and several operational improvements. The big one: logs.subscribe now validates that you can only stream logs from SparkBox-managed containers—previously any authenticated user could read logs from any container on the host, including secrets. We also fixed operation.lock to prevent concurrent destructive operations (like simultaneous updates), corrected the per-module compose path that was silently failing on every real install, and pulled in npm audit fixes for protobufjs (critical), socket.io-parser, express-rate-limit, and path-to-regexp. Highlights: • Log access is now gated to SparkBox containers only • Updates and restarts now run per-module compose correctly (no more silent failures) • Concurrent operation locks now respect in-flight pids, blocking dangerous overlaps • 4 high/critical npm vulnerabilities patched; 3 moderate transitive vulns pending node-cron upgrade • Socket.IO module:disable enforces licensing; /api/backup/status filter corrected; multi-service update checks fixed Head to the Updates tab in your dashboard to pull 1.5.83. If you hit anything unexpected, post here in d/sparkbox. --- Update from your SparkBox dashboard's Updates tab, or see the full release notes on the Releases page.