Skip to main content

Release notes

These are the notes each release of Antelao Fail2Ban ships with, newest first: 22 releases, the latest 1.7.1. To see which release you run, open the console's Release notes page, which marks it as Current, or read the tag of the image in your compose file (see Installing Fail2Ban). Changes that alter nothing you see or do are left out here.

1.7.1​

Released 7 November 2026.

Bugfixes​

  • Fixed an issue where a long line in a code block widened a card's details past the edge of the page.
  • Fixed an issue where a session trace kept the console's account names and addresses, the license holder and license keys in its recorded pages and actions.
  • Fixed an issue where a session trace could keep the user name and password written into an address.

Known Issues​

  • Session traces recorded before this update are not scrubbed; delete them on the Support page before handing any trace over.
  • Activate every perpetual license on the license portal before updating: from this release a perpetual license applies only once it is activated, and an offline license is refused in the container, which has no TPM.

1.7.0​

Released 4 November 2026.

Bugfixes​

  • Fixed an issue where the license of any product that offered attack blocking could license the service as its sponsor; only the Odoo Host Manager can now.

1.6.1​

Released 3 November 2026.

Bugfixes​

  • Fixed an issue where, with several API replicas, the one-time mail about an untrusted proxy could be sent once per replica and proxy counts could be lost.
  • Fixed an issue where an unexpected error while reporting untrusted proxies could stop the console.
  • Fixed an issue where a crafted sign-in name could add misleading lines to the log when an audit entry could not be written.

1.6.0​

Released 2 November 2026.

Improvements​

  • Added Cc and Bcc to the notifications on the SMTP page, so copies can go to more people without every address being visible to all.
  • Added a daily summary to the SMTP page, with a world map of where the banned addresses come from and a table of the day's bans, sent on the Daily ban summary schedule on the Maintenance page.
  • Improved the ban messages, which now name each address's country and arrive as a table, with a plain-text version for mail programs that show no formatting.

1.5.1​

Released 1 November 2026.

Nothing in this release changes what you see or do: it changed only the product's internals.

1.5.0​

Released 31 October 2026.

Improvements​

  • Changed the first administrator password: with none configured, the generated one now goes to a file only the service can read, and no longer to the log.

Known Issues​

  • On a new installation with no administrator password configured, read the generated one with docker exec fail2ban cat /config/first-admin-password; the file goes once the password is changed.
  • A password generated by an earlier release stays in the container's log until the container is recreated, so change it on My account if you still use it.

1.4.7​

Released 30 October 2026.

Bugfixes​

  • Fixed an issue where the service and the console stopped with a crash code instead of a clean error when they could not start.

1.4.6​

Released 30 October 2026.

Bugfixes​

  • Fixed an issue where the robot check on the sign-in page touched the password field and stood out past it.
  • Fixed an issue where the robot check on the sign-in page sat closer to the password field than the fields sit to each other.
  • Fixed an issue where the console and the service stopped with a crash code instead of a clean error when a trusted proxy entry was invalid.

1.4.5​

Released 29 October 2026.

Bugfixes​

  • Fixed an issue where list column headings were cut off in a narrow window; the handle for moving a column now shows at the left of a heading when you point at it, and never covers its sort arrow.
  • Fixed an issue where the console's top bar broke the Trace button onto two lines and cut off the account name in a narrow window.

1.4.4​

Released 28 October 2026.

Bugfixes​

  • Fixed an issue where the Under the hood expander on the Release notes page showed a missing-character box.

1.4.3​

Released 27 October 2026.

Bugfixes​

  • Fixed an issue where creating a support bundle could use so much memory that the server became unresponsive.

1.4.2​

Released 27 October 2026.

Bugfixes​

  • Fixed an issue where Never ban this host did not cover the server's own network addresses, so the server could ban itself through its container networks.

1.4.1​

Released 26 October 2026.

Bugfixes​

  • Fixed an issue where, without a trusted proxy configured, the console and the API believed the address a caller claimed for itself.

Known Issues​

  • A reverse proxy in front of the console or the API must be listed in Ui__TrustedProxies or Api__TrustedProxies; until it is, every visitor is judged as the proxy and the untrusted proxy notice names it.

1.4.0​

Released 26 October 2026.

Improvements​

  • Added a notice for administrators on every console page, and a one-time mail to the SMTP notification recipients when the proxy is on loopback, while a proxy that is not trusted forwards requests to the console or the API and every visitor is judged as that proxy.
  • Added trusted proxies for the API (Api__TrustedProxies), with the same meaning as the console's: behind a trusted proxy the API's limits and the audit log see the real caller.

Known Issues​

  • If the console shows the untrusted proxy notice after the update, add the address it names to Ui__TrustedProxies__0 on the console (or Api__TrustedProxies__0 on the API, as it says) and restart that container; the notice goes 24 hours after the proxy was last seen.

1.3.1​

Released 26 October 2026.

Nothing in this release changes what you see or do: it changed only the product's internals.

1.3.0​

Released 25 October 2026.

Improvements​

  • Changed the Revoke button on API keys to its own icon.
  • Improved the readability of links in the console's dark theme.
  • Added Delete for revoked and expired keys on the API keys page.
  • Improved the audit log: a revoked or deleted API key is named by its description.

Bugfixes​

  • Fixed an issue where the read-only hint on the API keys page described the GeoIP service instead of Fail2Ban.

1.2.0​

Released 23 October 2026.

Improvements​

  • Added an optional authenticator seed for the built-in administrator (FAIL2BAN_SEED_ADMIN_TOTP): set, the administrator signs in with a code from it and cannot switch two-factor off, and My account and the Users page show it as required.

1.1.0​

Released 23 October 2026.

Improvements​

  • Renamed the bot check to Turnstile.

Bugfixes​

  • Fixed an issue where error messages had no space after "Error:".

1.0.3​

Released 22 October 2026.

Improvements​

  • Added an optional Cloudflare Turnstile check to the console sign-in, switched on by setting a site key and a secret key.

Bugfixes​

  • Fixed an issue where a jail started from the Odoo: failed logins template counted no failed sign-ins on Odoo 19 and 20.

Known Issues​

  • A jail already saved from the Odoo: failed logins template keeps its old filter, so edit it on the Jails page and replace the failregex line in its Filter with the template's new one, or remove the jail and add it again from the template.
  • With Turnstile on, the console must reach challenges.cloudflare.com; if sign-in is blocked by the check, start the console with Turnstile__Bypass=true (or --Turnstile:Bypass=true) and remove it once fixed.

1.0.2​

Released 21 October 2026.

Bugfixes​

  • Fixed an issue where the service's log said it ran unlicensed at start-up while a stored sponsorship licensed it.

1.0.1​

Released 21 October 2026.

Improvements​

  • Changed the spelling to license, in American English, everywhere in the console and the service's messages.

1.0.0​

Released 16 October 2026.

Improvements​

  • Added the first official release.