Rackula

v26.6.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Virtualization

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

av-rack capacity-planning dcim drag-and-drop self-hosted netbox

+11 more

network-infrastructure nice-rack rack rack-diagram rack-layout self-host server-rack svelte sysadmin typescript visualization

Affected surfaces

deps

ReleasePort's take

Moderate signal

editorial:auto 1mo

Release v26.6.0 patches libxml2 CVE-2026-6732 by busting the apk‑upgrade layer cache and updates better-auth & dompurify for security fixes.

Why it matters: CVE‑2026‑6732 (severity 90) in libxml2 is mitigated only after clearing the upgrade cache; all deployments using these dependencies must apply the patch immediately.

Summary

AI summary

Patched libxml2 CVE-2026-6732 and updated dependencies better-auth and dompurify.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Patches libxml2 CVE-2026-6732 by busting the apk-upgrade layer cache. Patches libxml2 CVE-2026-6732 by busting the apk-upgrade layer cache. Source: llm_adapter@2026-06-05 Confidence: high	—
Security	Medium	Hardens release workflow against shell injection by splitting into read‑only build and write‑only publish stages. Hardens release workflow against shell injection by splitting into read‑only build and write‑only publish stages. Source: granite4.1:30b@2026-06-05-audit Confidence: low	—
Feature
Feature	Medium	Adds firewall device category. Adds firewall device category. Source: llm_adapter@2026-06-05 Confidence: high	—
Feature	Medium	Adds port type categorization for network, power, and console ports. Adds port type categorization for network, power, and console ports. Source: llm_adapter@2026-06-05 Confidence: high	—
Feature	Medium	Adds KWS 10‑inch homelab rack brand pack contributed by @ilanKushnir. Adds KWS 10‑inch homelab rack brand pack contributed by @ilanKushnir. Source: llm_adapter@2026-06-05 Confidence: high	—
Feature	Medium	Shows onboarding hint when a rack has no devices. Shows onboarding hint when a rack has no devices. Source: llm_adapter@2026-06-05 Confidence: high	—
Feature	Medium	Adds haptic feedback on touch selection with thicker outline on mobile. Adds haptic feedback on touch selection with thicker outline on mobile. Source: llm_adapter@2026-06-05 Confidence: high	—
Feature	Medium	Adds rack height slider in new‑rack wizards. Adds rack height slider in new‑rack wizards. Source: llm_adapter@2026-06-05 Confidence: high	—
Feature	Medium	Implements API write‑route rate limiting for self‑hosted deployments. Implements API write‑route rate limiting for self‑hosted deployments. Source: llm_adapter@2026-06-05 Confidence: high	—
Feature	Medium	Adds explicit mutating‑request origin policy to the API. Adds explicit mutating‑request origin policy to the API. Source: llm_adapter@2026-06-05 Confidence: high	—
Feature	Low	Introduces LXC deployment with arm64 and x86-64 support, SHA256 tarball verification, and idempotent install script. Introduces LXC deployment with arm64 and x86-64 support, SHA256 tarball verification, and idempotent install script. Source: granite4.1:30b@2026-06-05-audit Confidence: low	—
Feature	Low	Adds API storage abuse guardrails: per-layout quota and retention policies. Adds API storage abuse guardrails: per-layout quota and retention policies. Source: granite4.1:30b@2026-06-05-audit Confidence: low	—
Dependency	Low	Updates dependencies better-auth and dompurify for security fixes. Updates dependencies better-auth and dompurify for security fixes. Source: llm_adapter@2026-06-05 Confidence: high	—
Bugfix
Bugfix	Medium	Fixes device placement images to render correctly in exports, matching the editor view. Fixes device placement images to render correctly in exports, matching the editor view. Source: granite4.1:30b@2026-06-05-audit Confidence: low	—
Bugfix	Low	Prevents auto‑import undo from removing shared device types. Prevents auto‑import undo from removing shared device types. Source: granite4.1:30b@2026-06-05-audit Confidence: low	—
Bugfix	Low	Adds chassis category to device palette and drift‑proofs future omissions. Adds chassis category to device palette and drift‑proofs future omissions. Source: granite4.1:30b@2026-06-05-audit Confidence: low	—

Full changelog

You wanted LXC?! You GOT LXC. The Proxmox VE deployment is production-ready, baby:
Rackula installs as one self-contained Debian 13 container, web frontend and persistence
API riding together, now on arm64 AND x86-64, with a SHA256-verified tarball because we
are not handing you an unverified tarball like some kind of clown. You asked for the
container. We made the container. It's the LXC release.

LXC deployment

arm64 support: the release tarball bundles the arm64 native binary and the install advertises arm64 (#1850, PRs #1852 and #1906)
SHA256 verification for the release tarball (#1891, PR #1894)
update_script rollback hardening and install idempotency (#1851, PR #1854)
Hardened the release workflow against shell injection and split it into read-only build and write-only publish (#1897, PR #1898; #1899, PR #1900)
Corrected notes format in rackula.json (#1213, PR #1831)

Added

Firewall device category (#1833, PR #1835)
Port type categorization for network, power, and console ports (#1836)
KWS 10-inch homelab rack brand pack, contributed by @ilanKushnir (#1837)
Onboarding hint shown when a rack has no devices (#1827)
Haptic feedback on touch selection, with a thicker selection outline on mobile (#1883)
Rack height slider in the new-rack wizards (#756, PR #1865)
API write-route rate limiting for self-hosted deployments (#1778, PR #1828)
API explicit mutating-request origin policy (#1779, PR #1830)
API storage abuse guardrails: per-layout quota and retention (#1780, PR #1875)

Changed

Save confirmation moved from the toolbar indicator to a toast, removing the toolbar layout shift (#1901, PR #1903)
Storage quota rejections surfaced with clear, actionable messaging (#1390, PR #1893)
Mini-PC devices moved from the Generic library into dedicated brand packs (#1840, PR #1844)
API adopts pino structured logging with levels (#1888, PR #1892)

Fixed

Device placement images now render in exports, matching the editor (#1902, PR #1905)
Auto-import undo no longer removes shared device types (#1479, PR #1859)
Device palette: chassis added to category order, drift-proofed against future omissions (#1839, PR #1849)

Security

Patched libxml2 CVE-2026-6732 by busting the apk-upgrade layer cache (#1841, PR #1843)
Dependency security updates: better-auth and dompurify (#1885, #1879)

Technical

OIDC behind a reverse proxy documented and verified (#1832, PR #1845)
arm64 native-dependency load verified on a native arm64 CI runner (#1850, PR #1906)
Automatic per-release contributor acknowledgements (#1876, PR #1889)

Security Fixes

CVE-2026-6732 — libxml2 vulnerability patched by busting the apk‑upgrade layer cache

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Rackula

Get notified when new releases ship.

About Rackula

Open-source drag-and-drop rack layout designer

All releases →

Related context

Related tools

Related CVEs

CVE-2026-6732 NVD KEV EPSS

Earlier breaking changes

v26.7.0 Migrated to pako 3.0, introducing breaking ESM and Inflate API changes.
v26.7.0 Published JSON Schema renamed to rackula-layout.schema.json (evergreen).
v26.5.0 Migrated from SemVer to CalVer versioning scheme