-
v1.16.3
StableAll checks were successfulCI / Rust clippy (push) Successful in 1m32sCI / Rust fmt (push) Successful in 1m5sCI / Rust test (push) Successful in 4m49sCI / UI (SvelteKit) (push) Successful in 1m4sCI / Security Audit (push) Successful in 1m13sRelease / Docker Multi-Arch (push) Successful in 20m0sRelease / Binary aarch64-unknown-linux-gnu (push) Successful in 10m47sRelease / Binary x86_64-unknown-linux-gnu (push) Successful in 9m38sRelease / Linux .deb + .rpm (amd64) (push) Successful in 10m3sRelease / Linux .deb + .rpm (arm64) (push) Successful in 10m55sRelease / Linux AppImage (aarch64) (push) Successful in 10m2sRelease / Linux AppImage (x86_64) (push) Successful in 9m4sdocs / build (push) Successful in 23sRelease / Cosign sign artifacts (push) Successful in 16sRelease / Forgejo Release (push) Successful in 27sreleased this
2026-07-11 17:23:30 +00:00 | 74 commits to main since this releaseLocalisation-completeness release. No behaviour, protocol, API, or schema
changes; the Rust test suite is unchanged (1098 + 3 ignored).Fixed
- The last hardcoded-German UI strings are now fully internationalised in all
8 languages. Three admin pages — API Tokens, Audit Log and Notifications —
rendered German regardless of the selected locale, as did the relative
"just now / 5m ago" timestamps (format.ts), the energy/bitcoin-core/overview
fallbacks, the device auto-scan labels, and several store/runtime error
messages (auth, notifications, profile). All of these now route through
i18n.t()with complete translations in de/en/es/pt-BR/fr/it/ja/zh
(~130 new keys × 8 locales), so selecting a language now translates the
entire interface. The German dual-license and locale files are unchanged
in meaning.
Added
- i18n guard in CI.
ui/scripts/i18n-guard.mjs(wired intopnpm run check)
enforces three invariants on every push: all 8 locale files share the exact
same key set, everyi18n.t('key')reference exists in the base locale, and
no hardcoded German (umlaut) text remains in.svelte/.tssource — so an
untranslated string can no longer regress.
Docs
- Both end-user manuals (general + Umbrel) updated: the "these admin pages are
in German" notes are removed (they render English now), the Bitcoin Core
template-source / IPC flow is documented in depth, every admin sub-page has a
screenshot, and a note clarifies the screenshots use example/test data.
dvb-WarpPool v1.16.3 — Downloads
Docker
git.warppool.org/dvb-projekt/dvb-warppool:v1.16.3(multi-arch amd64+arm64, ohne v-Präfix)Native packages
- Linux .deb: amd64 + arm64 →
apt install ./dvb-warppool_*.deb - Linux .rpm: amd64 + arm64 →
dnf install ./dvb-warppool-*.rpm - Linux AppImage: x86_64 + aarch64 portable
- Linux tarballs: x86_64 + aarch64 for manual installs
- macOS .dmg: added shortly after publish (built separately) — or build from source
- Windows .msi: paused since the forge migration (no Windows runner yet)
Signatures
SHA256SUMS+ cosign bundle (SHA256SUMS.bundle, project key)- SBOM (SPDX) for all dependencies
Verify (project public key
cosign.pubin the repo root):cosign verify-blob \ --key cosign.pub \ --bundle SHA256SUMS.bundle \ SHA256SUMS sha256sum --check SHA256SUMSFirst-time setup: run
dvb-warppool-setupfor the first-run wizard.Downloads
-
Source code (ZIP)
1 download
-
Source code (TAR.GZ)
1 download
- The last hardcoded-German UI strings are now fully internationalised in all
-
v1.16.2
StableAll checks were successfulCI / Rust clippy (push) Successful in 1m32sCI / Rust fmt (push) Successful in 1m2sCI / Rust test (push) Successful in 4m37sCI / UI (SvelteKit) (push) Successful in 59sCI / Security Audit (push) Successful in 1m8sRelease / Docker Multi-Arch (push) Successful in 19m37sRelease / Binary aarch64-unknown-linux-gnu (push) Successful in 10m43sRelease / Binary x86_64-unknown-linux-gnu (push) Successful in 9m56sRelease / Linux .deb + .rpm (amd64) (push) Successful in 10m39sRelease / Linux .deb + .rpm (arm64) (push) Successful in 11m27sRelease / Linux AppImage (aarch64) (push) Successful in 10m33sRelease / Linux AppImage (x86_64) (push) Successful in 9m30sdocs / build (push) Successful in 20sRelease / Cosign sign artifacts (push) Successful in 14sRelease / Forgejo Release (push) Successful in 24sreleased this
2026-07-10 20:03:35 +00:00 | 78 commits to main since this releaseBugfix + docs-accuracy release. No behaviour, protocol, or API changes; the
Rust test suite is unchanged (1098 + 3 ignored).Fixed
- Umbrel "IPC interface is off" warning now clears after a good probe. On
Umbrel theAPP_BITCOIN_IPC_ENABLEDenv var is injected at container start, so
enabling the toggle later left the admin banner stale even though IPC was live.
The banner is now gated on the socket-probe result — it disappears the moment
the template-source test returns OK. (Workaround on older builds: restart the
WarpPool app so the env is re-read.)
Changed
- macOS
.dmgis now built withhdiutilinstead ofcreate-dmg, which
failed non-interactively on Finder TCC. Packaging only. - Benchmark workflow is manual-dispatch only — decoupled from tag pushes so
the fat-LTO bench build can't OOM the CI box. CI only.
Docs
- Post-migration accuracy sweep across all user-facing prose: supply-chain claims
corrected to the project Cosign key (keyless-OIDC / SLSA-3 applied only to
GitHub-era releases ≤ v1.15.0), residual GitHub→Forgejo terminology, feature
drift (shipped hardening no longer listed as gaps), and Bitcoin Core's IPC
interface marked experimental. Block-explorer docs corrected — it is shipped
and chain-aware, not a gap or a config key.
dvb-WarpPool v1.16.2 — Downloads
Docker
git.warppool.org/dvb-projekt/dvb-warppool:v1.16.2(multi-arch amd64+arm64, ohne v-Präfix)Native packages
- Linux .deb: amd64 + arm64 →
apt install ./dvb-warppool_*.deb - Linux .rpm: amd64 + arm64 →
dnf install ./dvb-warppool-*.rpm - Linux AppImage: x86_64 + aarch64 portable
- Linux tarballs: x86_64 + aarch64 for manual installs
- macOS .dmg: added shortly after publish (built separately) — or build from source
- Windows .msi: paused since the forge migration (no Windows runner yet)
Signatures
SHA256SUMS+ cosign bundle (SHA256SUMS.bundle, project key)- SBOM (SPDX) for all dependencies
Verify (project public key
cosign.pubin the repo root):cosign verify-blob \ --key cosign.pub \ --bundle SHA256SUMS.bundle \ SHA256SUMS sha256sum --check SHA256SUMSFirst-time setup: run
dvb-warppool-setupfor the first-run wizard.Downloads
-
Source code (ZIP)
1 download
-
Source code (TAR.GZ)
1 download
- Umbrel "IPC interface is off" warning now clears after a good probe. On
-
v1.16.1
StableAll checks were successfulCI / Rust clippy (push) Successful in 1m30sCI / Rust fmt (push) Successful in 1m4sCI / Rust test (push) Successful in 4m57sCI / UI (SvelteKit) (push) Successful in 57sCI / Security Audit (push) Successful in 1m9sdocs / build (push) Successful in 21sbenches / Criterion benches (push) Non-gating baseline; the bench compile OOM-killed on the 8GB CI box (infra, not a bench/code failure). benches are now manual-dispatch only.Release / Docker Multi-Arch (push) Successful in 20m54sRelease / Binary aarch64-unknown-linux-gnu (push) Successful in 10m30sRelease / Binary x86_64-unknown-linux-gnu (push) Successful in 9m13sRelease / Linux .deb + .rpm (amd64) (push) Successful in 9m59sRelease / Linux .deb + .rpm (arm64) (push) Successful in 10m58sRelease / Linux AppImage (aarch64) (push) Successful in 10m0sRelease / Linux AppImage (x86_64) (push) Successful in 9m4sRelease / Cosign sign artifacts (push) Successful in 14sRelease / Forgejo Release (push) Successful in 24sreleased this
2026-07-10 11:02:08 +00:00 | 84 commits to main since this releaseA UI fix so the v1.16.0 IPC feature is actually discoverable. No behaviour or
protocol changes.Fixed
- Admin → Bitcoin Core is now in the navigation. The
/admin/bitcoin-core
page (thebitcoin.confeditor and the GBT/IPC template-source switch shipped
in v1.16.0) existed but was never linked in the admin sub-navigation, so the
IPC toggle could only be reached by typing the URL. Added the "Bitcoin Core"
tab (with the label in all 8 UI languages).
dvb-WarpPool v1.16.1 — Downloads
Docker
git.warppool.org/dvb-projekt/dvb-warppool:v1.16.1(multi-arch amd64+arm64, ohne v-Präfix)Native packages
- Linux .deb: amd64 + arm64 →
apt install ./dvb-warppool_*.deb - Linux .rpm: amd64 + arm64 →
dnf install ./dvb-warppool-*.rpm - Linux AppImage: x86_64 + aarch64 portable
- Linux tarballs: x86_64 + aarch64 for manual installs
- macOS .dmg: added shortly after publish (built separately) — or build from source
- Windows .msi: paused since the forge migration (no Windows runner yet)
Signatures
SHA256SUMS+ cosign bundle (SHA256SUMS.bundle, project key)- SBOM (SPDX) for all dependencies
Verify (project public key
cosign.pubin the repo root):cosign verify-blob \ --key cosign.pub \ --bundle SHA256SUMS.bundle \ SHA256SUMS sha256sum --check SHA256SUMSFirst-time setup: run
dvb-warppool-setupfor the first-run wizard.Downloads
-
Source code (ZIP)
1 download
-
Source code (TAR.GZ)
1 download
- Admin → Bitcoin Core is now in the navigation. The
-
v1.16.0
StableAll checks were successfulCI / Rust clippy (push) Successful in 1m28sCI / Rust fmt (push) Successful in 1m2sCI / Rust test (push) Successful in 4m35sCI / UI (SvelteKit) (push) Successful in 56sCI / Security Audit (push) Successful in 1m7sRelease / Docker Multi-Arch (push) Successful in 19m59sRelease / Binary aarch64-unknown-linux-gnu (push) Successful in 10m59sRelease / Binary x86_64-unknown-linux-gnu (push) Successful in 9m50sRelease / Linux .deb + .rpm (amd64) (push) Successful in 10m32sRelease / Linux .deb + .rpm (arm64) (push) Successful in 11m27sRelease / Linux AppImage (aarch64) (push) Successful in 10m43sRelease / Linux AppImage (x86_64) (push) Successful in 9m44sdocs / build (push) Successful in 23sRelease / Cosign sign artifacts (push) Successful in 15sRelease / Forgejo Release (push) Successful in 25sbenches / Criterion benches (push) Benchmarks pass; the upload-artifact step (Forgejo infra) was fixed in benches.ymlreleased this
2026-07-09 20:26:06 +00:00 | 93 commits to main since this releaseAdds an opt-in low-latency block-template source over Bitcoin Core's IPC
interface and hardens concurrent admin config saves. No breaking changes —
GBT remains the default template source, so existing setups are unaffected.Added
- Bitcoin Core IPC template backend (opt-in, Core >= 31). A new
warppool-bitcoin-ipccrate speaks Bitcoin Core's Cap'n Proto mining
interface to pull block templates directly, bypassing the GBT+ZMQ round
trip. A sharedTemplateSourcetrait keeps the GBT and IPC paths
interchangeable. Select it via[node] template_source = "ipc"(default
"gbt") with[node] ipc_socket_pathpointing at Core's-ipcbindUNIX
socket, or from Admin → Bitcoin Core with a live GBT/IPC switch that
probes the socket before committing and fails safe back to GBT if the
socket is unreachable. On Umbrel the Bitcoin app has exposed the IPC socket
since its v1.3.0 (requires Bitcoin Core v31.0). Measured template latency
~5–12 ms (IPC) versus ~90–100 ms (GBT+ZMQ, under Core's ZMQ queue lag).
Fixed
- Concurrent admin config saves no longer lose updates. Overlapping writes
toconfig.tomlfrom the admin API now share a write lock, so two saves
racing at the same time can no longer clobber each other (lost-update race).
Internal
- Deterministic
lowdiff_diagcapture tests (Stratum V1 + V2). The opt-in
low-difficulty diagnostic tests captured tracing output via a thread-local
subscriber, which could be gated out under parallel test load when a
neighbouring test's first-hit callsite registration recomputed the global
tracingmax-level against the (off) global default. The tests now pin the
max-level floor, so they pass deterministically; no production behaviour
changed.
dvb-WarpPool v1.16.0 — Downloads
Docker
git.warppool.org/dvb-projekt/dvb-warppool:v1.16.0(multi-arch amd64+arm64, ohne v-Präfix)Native packages
- Linux .deb: amd64 + arm64 →
apt install ./dvb-warppool_*.deb - Linux .rpm: amd64 + arm64 →
dnf install ./dvb-warppool-*.rpm - Linux AppImage: x86_64 + aarch64 portable
- Linux tarballs: x86_64 + aarch64 for manual installs
- macOS .dmg: added shortly after publish (built separately) — or build from source
- Windows .msi: paused since the forge migration (no Windows runner yet)
Signatures
SHA256SUMS+ cosign bundle (SHA256SUMS.bundle, project key)- SBOM (SPDX) for all dependencies
Verify (project public key
cosign.pubin the repo root):cosign verify-blob \ --key cosign.pub \ --bundle SHA256SUMS.bundle \ SHA256SUMS sha256sum --check SHA256SUMSFirst-time setup: run
dvb-warppool-setupfor the first-run wizard.Downloads
-
Source code (ZIP)
2 downloads
-
Source code (TAR.GZ)
1 download
- Bitcoin Core IPC template backend (opt-in, Core >= 31). A new
-
v1.15.0
Stablereleased this
2026-07-09 15:50:21 +00:00 | 96 commits to main since this releaseA full internal security/correctness audit (25 confirmed findings, all fixed and
adversarially re-reviewed) plus a user-facing feature. No breaking changes.Added
- Suppressible dashboard health warnings (GitHub #76). The Bitcoin Core
health banner now has a per-warning "Hide permanently" button (visible when
logged in as admin), and a new Admin → Health page lists suppressed
warnings so they can be brought back. Persistent and operator-controlled;
also seedable via a new[server] suppress_health_warningsconfig option.
Especially useful for a deliberately pruned node whose "pruned" notice
otherwise reappeared on every reload.
Fixed — money path (critical/high)
- Found blocks are submitted with the exact winning header. A block found
by a version-rolling miner (overt ASICBoost — practically every modern ASIC,
plus NerdAxe/NerdQaxe) was reassembled with the un-rolled block version, so
Bitcoin Core rejected it (high-hash) and the reward was lost. The
block-found event now carries the exact rolled version and reconstructs the
block from the job it was actually mined on. Fixed for both Stratum V1 and V2. - Stratum V2 initial
SetNewPrevHashsentprev_hashin display (BE) order
on channel open instead of internal LE, so the first shares after a channel
opened were scored low-difficulty until the next broadcast. Now matches the
broadcast path and the pool's own PoW check. - Transient Bitcoin Core RPC errors (proxy 502/503/504, non-JSON 5xx bodies)
are now retried instead of being misclassified as a fatal auth error, so a
brief gateway hiccup atsubmitblocktime no longer drops the retry.
Security
- 2FA can no longer be reset without a valid code.
POST /api/auth/2fa/setup
now requires a current TOTP when 2FA is already enabled. - Read-only API tokens can no longer read node RPC credentials via
GET /api/admin/bitcoin-core/conf(now requires a full-privilege identity). - The LAN miner active-scan (
/api/miners/active-scan?cidr=) now requires
authentication and is restricted to private RFC1918 ranges (SSRF/port-scan
hardening). - The setup wizard no longer passes the bitcoind RPC password as a
command-line argument (was visible in the process table); it authenticates
via-conf. The non-unix fallback RPC password now uses a CSPRNG. - Opt-in cosign verification for the macOS DMG updater (symmetric with the
Linux path). - Push unsubscribe requires proof-of-possession (the subscription's auth
secret) so knowing only the endpoint URL can't cancel someone's alerts. - Telegram/Slack notifications escape miner- and operator-controlled fields
(MarkdownV2), so a crafted worker name or the default brand can no longer
break the block-found notification. - The desktop launcher verifies process identity before killing a stale
PID fromdaemon.pid, so a recycled PID can't take down an unrelated process.
Fixed — data & UI
import_backupdeduplicates block records by content (block hash) instead of
a surrogate id, so restoring a backup no longer silently drops a historical
block.- Lifetime-energy accounting is now atomic (single transaction, fixed cutoff)
and reset/eviction are serialized, so a crash or a mid-eviction reset can no
longer double-count or lose kWh; historical/lifetime cost is grid-priced
instead of collapsing to ~0 during a solar-excess window. - The share dedup set is now bounded (FIFO) and only cleared on a new block, so
replayed shares are rejected without unbounded memory growth. - Diff-ETA math is hardened against non-finite/zero RPC values.
- UI: the hashrate-chart tooltip is out-of-bounds safe, a transient network/5xx
error no longer logs the operator out, and the bitcoin.conf editor now writes
rpcallowip/networkcorrectly (no longer silently dropped) and edits
section-based configs without creating duplicates.
dvb-WarpPool v1.15.0 — Downloads
Docker
git.warppool.org/dvb-projekt/dvb-warppool:v1.15.0(multi-arch amd64+arm64, ohne v-Präfix)Native packages
- Linux .deb: amd64 + arm64 →
apt install ./dvb-warppool_*.deb - Linux .rpm: amd64 + arm64 →
dnf install ./dvb-warppool-*.rpm - Linux AppImage: x86_64 + aarch64 portable
- Linux tarballs: x86_64 + aarch64 for manual installs
- macOS .dmg: added shortly after publish (built separately) — or build from source
- Windows .msi: paused since the forge migration (no Windows runner yet)
Signatures
SHA256SUMS+ cosign bundle (SHA256SUMS.bundle, project key)- SBOM (SPDX) for all dependencies
Verify (project public key
cosign.pubin the repo root):cosign verify-blob \ --key cosign.pub \ --bundle SHA256SUMS.bundle \ SHA256SUMS sha256sum --check SHA256SUMSFirst-time setup: run
dvb-warppool-setupfor the first-run wizard.Downloads
-
Source code (ZIP)
1 download
-
Source code (TAR.GZ)
1 download
- Suppressible dashboard health warnings (GitHub #76). The Bitcoin Core