From f4fa513508d045568499e3cb5a9780f8f083ee65 Mon Sep 17 00:00:00 2001 From: Nicholas Penree Date: Fri, 9 Oct 2026 22:36:26 +0000 Subject: [PATCH] Add 1.7.0-beta.10 release notes --- CHANGELOG.md | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 68 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index f601f21b..5105dfad 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,74 @@ Create a passphrase-sealed application backup before upgrading and keep mixed-version cluster windows short. Cross-version restore and downgrade compatibility are not yet a published contract. +## [1.7.0-beta.10] - 2026-10-09 + +Sable 1.7.0-beta.10 adds per-device blocking. Rule sets give some devices +their own block lists, blocked and allowed domains, and blocked apps, and a +hold blocks everything for one device for a while. + +### Upgrading + +- `blocking.bypass_clients` moves into a rule set called `No Blocking` with + blocking turned off, one `[[clients]]` entry per address or network, the + first time this version loads the config. The key is dropped on the next + save, and the **Bypass Clients** card leaves **Settings**. An address that + already had a rule set moves to `No Blocking`, since a bypass used to win. +- Devices (`[[clients]]`) now replicate to replicas, since a device's rule + set decides how every node blocks for it. Upgrade every node in a cluster + together. +- Coming from 1.6.x, also read the 1.7.0-beta.1 upgrade notes below. + +### Blocking + +- Add rule sets (`[[blocking.rule_sets]]`) on a new **Blocked → Rule Sets** + tab. Each rule set picks its own block lists and keeps its own blocked and + allowed domains, which win over everyone's. Devices without a rule set use + the **Default** rules, whose lists `blocking.default_lists` can narrow. +- Open a rule set to see and change everything about it in one panel: its + devices, addresses, and networks (with suggestions from the devices Sable + has seen), its block lists, and its own blocked and allowed domains. +- Block apps for a rule set. **Choose Apps** opens a grid of app logos by + category with a search, and each app blocks every domain Sable knows it + uses. The grid leaves out device platforms, smart home, cameras, and work + tools so nobody breaks a device by accident. +- Turn blocking off for a rule set with **Turn Off Blocking**. This replaces + Bypass Clients. +- Put a device in a rule set by its hardware address. It applies at every + address Sable ties to that device, from the neighbor table, UniFi, or the + cluster lead, without Sable being the DHCP server. +- Block everything for one device for 30 minutes, an hour, until a time, or + until you turn it off, from its **Blocking** section on **Insights → + Devices**. A live countdown, **Add 30 Minutes**, and **End Now** sit + beside it. A hold outlasts a global pause, and the device's allowed + domains still work. Holds are in `[[blocking.holds]]`, so they replicate + and show in the Change Center. +- Show which rule set a device uses, and why, on its Insights panel, with a + picker to give it another. + +### Query log and Check a Domain + +- Name the rule set and the app behind a block in the query explanation, + such as "Matched tiktokcdn.com, one of TikTok's domains, blocked by the + Warehouse rule set". Held queries say the device is held. +- Check a domain for one device. Once any devices are in rule sets, **Check + a Domain** has a device field, and **Why is this blocked?** in the query + log checks for the device that asked. +- Hide **Allow** when a rule set's own block stopped a query, since allowing + a domain everywhere can't get past it. The rule set's panel can. + +### MCP + +- Give `check_domain` an optional `device`, and return the `rule_set` and + `app` that decided. +- Add `block_device` and `unblock_device` to set and end holds. Both are off + by default. + +### Security + +- Build with Go 1.27.2 and golang.org/x/net 0.60.0, which fix advisories in + `net/http`, its HTTP/2 code, `net/textproto`, and `crypto/tls`. + ## [1.7.0-beta.9] - 2026-10-07 Sable 1.7.0-beta.9 keeps the page behind an open sheet or dialog from