head	1.1;
access;
symbols;
locks; strict;
comment	@ * @;


1.1
date	2026.10.19.07.36.19;	author tm;	state Exp;
branches;
next	;
commitid	FA4v9w7ktdNPH30H;


desc
@@


1.1
log
@goaccess: update to 1.12

Changes to GoAccess 1.12 - Wednesday, September 16, 2026

  - Added a dedicated "AI Crawlers" browser category, separating AI assistants
    and model training bots from traditional search engine crawlers.
  - Added a Fediverse browser category for identifiable ActivityPub server
    traffic, separating it from traditional web crawlers.
  - Added a live requests-per-second rate alongside total requests in the
    terminal and HTML reports while following logs, and exposed it through the
    WebSocket JSON output.
  - Added a warning when restoring databases that predate request-grouping
    metadata, and rejected restores whose `--http-method` or `--http-protocol`
    settings no longer match the ones the database was created with.
  - Added `--exclude-asn` to exclude requests whose client address resolves to
    a given Autonomous System Number. It can be repeated, accepts either 8075
    or AS8075, and requires a GeoIP2 ASN database.
  - Added resolved, total and pending hostname metrics to the progress display
    when resolving IP addresses for static output.
  - Added the negotiated TLS key exchange group via `%g`, nested beneath its
    cipher suite in the TLS panel.
  - Added `VCOMBINED_PORT` and `VCOMMON_PORT` predefined log formats for
    virtual host logs that carry a colon-delimited port.
  - Documented `--concat-vhost-req` and `--unix-socket`, which were accepted
    but missing from the man page and the `--help` output.
  - Fixed a shutdown race that could leave WebSocket server threads running.
  - Fixed crawler filtering skipping bots whose operating system could not be
    determined.
  - Fixed panel sorting not being initialized for panels rendered after the
    initial load of the HTML report.
  - Fixed the globe projection not centering on an expanded continent, while
    preserving the current zoom level and manual rotation.
  - Fixed the printf format used for `size_t` values in bin2c, which warned on
    32-bit platforms.
  - Fixed the same log source being processed twice when it was passed more
    than once through different paths.
  - Fixed the spinner falling out of sync with the progress output while
    resolving hostnames.
  - Fixed user agent classification, correcting the Applebot spelling and
    giving HTTP library and uptime signatures precedence over broader fallback
    tokens.
  - Fixed `VCOMBINED` and `VCOMMON` requiring a port after the virtual host,
    which prevented logs without one from being parsed.
  - Fixed WebSocket text frames being parsed as null-terminated strings rather
    than by payload length.
  - Hardened WebSocket authentication by tracking the verified JWT `exp` claim
    and closing the connection once the token expires, and by clearing browser
    credentials when a token refresh fails or returns an unusable token.
  - Refined subitem indentation in the HTML report with a more compact layout
    and subtle tree guides.
  - Removed the deprecated `--no-column-names` from the `--help` output and
    the sample configuration, where it lingered after being dropped in v1.10.
  - Replaced the keyphrases panel with a UTM Campaigns panel reporting
    `utm_source`, `utm_medium`, `utm_campaign`, `utm_content` and `utm_term`.
  - Updated operating system detection, adding iPadOS, visionOS, watchOS,
    tvOS, KaiOS, Fuchsia, Xbox and Windows Phone.
  - Updated the Caddy predefined format to match the current JSON access log
    structure.
  - Updated the CloudFront predefined format to the current standard log
    schema, capturing the query string, virtual host and TLS fields while
    safely ignoring newer trailing fields.

Changes to GoAccess 1.11 - Sunday, July 19, 2026

  - Added automatic, crash-safe migration of persisted databases to storage
    format version 3.
  - Added configured zlib and AddressSanitizer options to the version output.
  - Added fullscreen expand and collapse controls to geolocation maps in the
    HTML report.
  - Added Traditional Chinese translation.
  - Expanded Debian package builds to Ubuntu 26.04 and additional
    architectures, and updated the packaging workflow actions.
  - Fixed a heap buffer overflow when parsing malformed Opera user agents.
  - Fixed an infinite loop while writing log parsing errors from multiple input
    files.
  - Fixed city lookups ignoring the City database when a Country database was
    listed first.
  - Fixed geolocation maps appearing grey after restoring persisted city data.
    New databases preserve the exact country-to-continent mapping, while older
    databases use a compatible built-in fallback.
  - Fixed `.gz` file extensions being interpreted as macros in the man page.
  - Fixed iOS version parsing from user-agent strings.
  - Fixed unique visitor undercounting caused by collisions between reversed
    data and visitor key pairs.
  - Fixed WebSocket payload size checks for large and fragmented messages.
  - Grouped Lynx, Links, ELinks, w3m and Chawan under a new "Text-based"
    browser category.
  - Reduced storage memory usage by about 20% and parsing time by about 35%.

Changes to GoAccess 1.10.2 - Tuesday, March 31, 2026

  - Added detection for Arc and Zen browsers in the HTML report.
  - Added Georgian translation.
  - Fixed a crash caused by invalid country/city parsing from the GeoIP
    database.
  - Fixed empty string data field crashing the HTML report on initial page
    load when entries contain no Referer, unknown UA strings, missing Host
    headers, or unresolvable GeoIP locations.
  - Fixed relative paths not being resolved to absolute paths while ingesting
    data.
  - Fixed old local stored preference objects not being validated on load,
    preventing corrupted localStorage from breaking the UI.

Changes to GoAccess 1.10.1 - Saturday, February 14, 2026

  - Fixed a crash when restoring persisted data via `--restore` that contained
    GEOLOCATION data generated in versions ≤ v1.9.4 and loaded with v1.10.

Changes to GoAccess 1.10 - Wednesday, February 11, 2026

  - Added new bar charts to the terminal UI for a quicker visual read of
    metrics.
  - Added city-level entries to the GEOLOCATION panel.
  - Added optional zlib support to parse compressed log files.
  - Added panel reordering in the TUI, letting you customize the dashboard
    layout.
  - Added sorting for panels in the HTML report.
  - Added the ability to expand and collapse subitems within TUI panels for
    easier navigation of large datasets.
  - Added a TX Amount percent column to the TUI for clearer traffic share
    insight.
  - Added the ability to prepend the virtual host to a request via
    --concat-vhost-req
  - Deprecated `--no-column-names` in favor of a unified TUI dashboard.
  - Fixed log tailing edge cases, including empty reads and date specificity
    overrides from the CLI.
  - Fixed stability issues in multi-threaded parsing and during Ctrl+C with
    multiple jobs.
  - Fixed inability to override date specificity from the CLI.
  - Fixed dry-run lines being counted as processed during config format
    testing.
  - Improved the TUI spinner and progress display for smoother, clearer
    feedback during parsing.
  - Refreshed the HTML dashboard styling and theme visuals.
  - Updated browser and OS detection lists, including macOS 26 (Tahoe) and
    Alibaba Cloud Linux.
  - Updated packaging targets, adding Debian Trixie while dropping Debian
    Buster and i386 builds.
  - Updated Swedish, Chinese and Japanese translations
  - Updated Dockerfile to use openssl-dev for compatibility with
    SSL_CIPHER_standard_name(3ssl).

Changes to GoAccess 1.9.4 - Monday, March 31, 2025

  - Added an azimuthal (globe) projection to the HTML report for geolocation,
    providing a less distorted view of the global map.
  - Added 'apple-touch-icon' for improved iPhone home screen support, enabling
    quick access to reports directly from the home screen.
  - Added 'aria-*' attributes to HTML report for better accessibility, ensuring
    that the report is more inclusive for screen readers and other assistive
    technologies.
  - Added 'theme-color' '<meta>' tag to the HTML report for better integration
    with mobile devices, allowing the browser's address bar to match the
    report's theme color.
  - Added additional validation checks to ensure the existence of file paths
    provided in CLI options, preventing errors.
  - Added WebSocket authentication to support both local-generated JSON Web
    Tokens (JWT) and external verification methods. This enhancement enables
    easy integration with external authentication systems while ensuring CSRF
    protection for token refresh requests.
  - Changed WebSocket server to avoid swapping bytes on big-endian platforms,
    fixing compatibility issues on AIX systems.
  - Fixed the issue where zooming/panning the map would unexpectedly skip or
    jump back, providing a smoother user experience.
  - Fixed the issue where the same mime types were displayed as duplicates due
    to different casing by normalizing mime types before adding them to the
    storage, ensuring consistent reporting.
  - Replaced div elements with more semantic HTML elements like <section>,
    <header>, and <article>, improving the structure and accessibility of the
    report.
  - Updated the list of supported browsers and operating systems to ensure more
    accurate tracking and reporting.
  - Updated the method of parsing the browser list for bots/crawlers, enabling
    the capture of previously difficult-to-parse bots, allowing for more
    precise targeting and better analytics.

Changes to GoAccess 1.9.3 - Friday, May 31, 2024

  - Added additional common bots to the list.
  - Added Address Sanitizer via '--enable-asan' to the configure options for
    debugging purposes.
  - Fixed inability to parse JSON keys containing dots.
  - Fixed out-of-bounds access for invalid HTTP status codes.
  - Fixed out-of-bounds access when parsing a log in serial processing mode.
  - Fixed regression introduced in 8f570c, which caused duplicate counts upon
    restoring from disk via '--restore'.

Changes to GoAccess 1.9.2 - Friday, April 12, 2024

  - Added World Map to the Geo Location panel on the HTML report.
  - Added additional non-official/standard HTTP status codes such as Caddy's 0
    HTTP status among others.
  - Added support for '%z' on strptime for non-glibc systems, such as musl libc
    in Alpine Linux (Docker container), enabling the use of '--tz'
  - Changed the '--hide/ignore-referrer' options to filter by hostname directly
    without the use of wildcards, e.g., '--ignore-referrer=wiki.google.com'.
  - Fixed inability to parse duplicate specifiers during log format parsing.
  - Fixed regression which previously hindered the ability to modify log, date,
    and time formats within the TUI dialog. i.e., '# goaccess access.log -c'.
  - Replaced 'remote_ip' with 'client_ip' for Caddy's JSON format, allowing the
    use of trusted proxies.
  - Updated Caddy JSON example log format to handle headers correctly.
  - Updated Swedish i18n.

Changes to GoAccess 1.9.1 - Tuesday, February 05, 2024

  - Added support for macOS to the OS detection.
  - Fixed C99 mode issue with initial declarations [CentOS7].
  - Fixed minor typographical, orthographic, and grammatical errors in the
    German translation.
  - Fixed a regression issue wherein parsing would halt at the first empty log
    file.
@
text
@$NetBSD$

--- src/wsauth.c.orig	2026-10-16 11:33:37.615001854 +0000
+++ src/wsauth.c
@@@@ -141,7 +141,7 @@@@ generate_ws_auth_secret (void) {
 static char *
 create_jwt_payload (const char *sub, long iat, long exp) {
   char *payload = NULL;
-  char hostname[HOST_NAME_MAX + 1] = { 0 };
+  char hostname[_POSIX_HOST_NAME_MAX + 1] = { 0 };
 
   if (gethostname (hostname, sizeof (hostname)) != 0) {
     perror ("gethostname");
@@@@ -438,7 +438,7 @@@@ static int
 validate_jwt_claims (const char *payload_json, size_t payload_len, time_t *expires_at) {
   json_stream json;
   JWTClaims claims = { 0 };
-  char hostname[HOST_NAME_MAX + 1] = { 0 };
+  char hostname[_POSIX_HOST_NAME_MAX + 1] = { 0 };
   time_t now = 0;
   int parsed = 0, verify_only = 0;
 
@