4.0.5

Design system

One token source for the customer panel (2083) and the admin panel (2087) - static/css/design-system/, byte-identical in both: text, muted text, borders, surfaces and three radii (control, card, overlay) follow the active theme in light and dark. Default 8/12/16px, cPanel 4/4/6px, DirectAdmin 4/6/8px, Plesk 2/2/4px.
Inter is the panel font, served by the panel itself (Latin, Latin Extended and Vietnamese); the stylesheets asked for Inter before but never loaded it, so pages fell back to the system font.
Flat pages: cards, buttons and fields are separated by a hairline border; only floating layers (menus, popovers, modals, toasts) cast a shadow.
The browser's own controls follow the theme: a single <select> has the theme's border, radius and chevron; checkboxes and radios are drawn in the theme's primary colour; scrollbars are 4px and show on hover or while scrolling (a box that scrolls sideways always shows a faint one); date pickers, autofill and select lists follow the panel's light/dark switch instead of the operating system.
Primary actions are one component on both panels - about 470 hand-coloured black buttons converted. In dark mode a primary button no longer turns into a grey, secondary-looking one, a disabled primary button looks disabled, and a busy one keeps its colour.
Webmail (2096): the HiTechCloud theme is the default, in Inter, with the panels' radius scale; no text is smaller than 12px.

Added

Ubuntu 26.04 LTS is supported (#1535): the installer accepts it and names it in every supported-releases message, and CI runs on it. Before adding a vendor's package repository, the installer checks that it publishes your release; if not, it uses Ubuntu's own packages or leaves that component out and says why, so no repository is left that breaks later apt-get update runs. On 26.04 Node.js comes from Ubuntu, SQL Server is not offered, and MongoDB 8.0 is refused with the reason. A fresh install on an Ubuntu release newer than 26.04 stops unless --skip-requirements is given.
Mail on Dovecot 2.4 (Ubuntu 26.04, Debian 13; #1535): the installer, every update (hitechcloudcli mail apply-config), mail tls, mail sync and the webmail sign-on account write Dovecot's settings in the language of the Dovecot installed, with the same mail paths, logins, folders, filters, limits and SMTP answers as on 2.3, so a server whose release moves it to 2.4 keeps its mail; Dovecot 2.3 servers get the same files as before. An update now asks Dovecot to check its new settings before reloading it and puts the panel's previous ones back if it refuses them. Debian 13 is named as a supported release.
2087 Domains > Websites (#1520): one read-only list of every account's websites, showing the account (linked to its page), the domain, the application and its version, with search and sorting. A reseller sees only its own accounts' websites.
User Backups (#1504): the administrator can exclude accounts from the central backup on 2087 > Backups > User Backups > Settings (one account name per line). Scheduled runs and Run Backup Now skip those accounts - the others are still backed up one at a time - and the Runs log has a line for each account skipped. Backups an account schedules for itself are not affected, and the 2083 onboarding wizard no longer tells an excluded account that the server backs it up. A name that is not an account on the server is ignored and marked on the page; the list is kept across updates.
Signing in to 2083 opens the page you asked for - a bookmark, or the page you were on when the session ended - instead of always the dashboard, also through the 2FA code step and passkey sign-in. 2087 "Log in as" links can open a given 2083 page, and the snippet audit's "Log in as ... to edit it" opens that website's override editor. Only pages of the panel are followed; anything else lands on the dashboard as before (#1519).

Fixed

Backups, central and scheduled (#1521): after any backup run - central, scheduled or Run Now - the 2083 Restore page re-indexes on its next visit and reads only the new archives, and a re-index that fails shows its error instead of polling forever. The shipped "Backup for all users" cron line now runs the backup (it called a command that backs up nothing when the services run on the host); the update re-points existing lines.
Web server config editors (#1512): the website override editor checks the web engine's real configuration (it checked the distribution's, so a snippet such as location / {} was saved and broke the next reload or restart of every site on that engine). Both the override and the VirtualHost editor now put the previous file back and reload again when the engine's test or reload fails, and say so instead of reporting success. A failed test shows only the lines about the site's own files.
n8n (#1512, #1518, #1526): installing on a domain no longer deletes or breaks the website's front-end entry; if the front end refuses the change every file is put back and the install fails instead of reporting success; uninstalling gives the domain back to its website. The Path setting is honoured: under any path other than "/" n8n is served inside the website's entry and the website keeps the rest of the domain; a second instance on the same domain and path is refused. An instance that takes a whole domain keeps the site's front-end add-ons (IP blocks, Cloudflare-only, redirects, threat feeds) and listens on the account's dedicated addresses.
Moodle (#1530): installs and updates fetch a current copy of the release (a cached "latest" archive is reused for at most a day). Sites on 4.5 LTS or 5.0, which have no public/ folder, get a working web root and show the right version in Site Manager and on the manager page; a link an earlier install pointed at a missing folder is repaired on the site's next update. Updates stay on the site's release line, and a major upgrade (for example 4.5 to 5.x) is offered on its own button; before changing anything they check the PHP version and that a newer release exists, and if the upgrade stops before touching the database the previous release is put back.
Removing an app (app uninstall, WordPress uninstall from the page or the API, website delete) also deletes the app's database login on every host (#1528); it used to stay behind, still able to sign in with the removed site's password. Only the account's own names are removed, and anything kept is reported.
Backups to SSH destinations that sign in with a password work with the repository (restic) engine (#1527), through rclone's SFTP backend with the password kept out of command lines; key-based destinations are unchanged.
Resource Engine recommendations reset when an account's CPU or RAM limit changes, old weeks expire, and memory-pressure/OOM evidence covers only the last 8 weeks, so raising a limit no longer brings a recommendation to raise it again (#1529).
ImunifyAV (#1515, #1516, #1517): servers set up by the installer get the malware-found notification hook and the scan resource limits imunify install already set; malware alerts have their own "Malware found" toggle, and admin notifications update adds a known setting an older notifications.ini lacks instead of ignoring it (which also lets the Telegram fields save). The ImunifyAV page no longer loops on "not running, run imunify start" when its web interface is missing: it says the interface is not installed and offers a reinstall.
2087 domain traffic report: the page finds the reports where hitechcloudcli domains-stats writes them (it looked in a folder nothing writes to on the native stack and said "not found"); ADMIN_GOACCESS_STATS_DIR still overrides it.
Usage rings on the 2087 Users list and account page stay full above 100% (130% used to look like 70%); the account page takes the inode percentage from the inode limit (#1495).
The 2FA setup QR code keeps a white border in dark mode - on the 2087 2FA page and on the 2083 account security page and onboarding wizard - so phones scan it (#1540).
Onboarding wizard (#1531): when the administrator manages an account's backups (server-managed destination, the central schedule, or the provider on Enterprise), the Backups step shows the destination and schedule and saves nothing, instead of asking for a destination and replacing the server's; a Community account can still choose a destination of its own from there.
2087 Users list: the Login and Actions columns are right-aligned, headers included, so each header sits over its buttons (#1501).
2087 reseller edit page: the allowed features and plans lists work for a reseller that has none, and choosing a plan saves it (it added a duplicate).
server-migrate (#1541) moves a server that runs its services on the host in full: every account through the same transfer as user-transfer (files, databases, mail, DNS zones, cron jobs), the administrator's own first and then each reseller's, plus the panel's settings - plans, permission groups, administrators and resellers, feature sets, branding, notification, backup and mail-relay settings, defaults for new sites. The destination keeps its own hostname, IP addresses, license, TLS certificate, database credentials and SSH host keys. A failed account does not stop the rest; the summary names every account not moved and why, the run exits non-zero, and running it again skips what already moved. It refuses before copying anything when the destination has accounts of its own or lacks a PHP version or web server the sites use (--force overrides). Copied DNS zones are re-pointed at the destination address by address (SPF included), with a serial bump and a zone check; DNSSEC-signed domains are signed there with the same keys. server-migrate and user-transfer no longer edit root's known_hosts, work with IPv6 destinations and remap clashing UIDs/GIDs. The 2087 Server migration page and its API report how a run ended - succeeded, or failed with its exit code and the last lines it printed; the migration log and pid moved from /tmp to /var/log/hitechcloud/admin/migrations.
2083, cPanel and DirectAdmin themes: every page scrolled sideways on a phone (the header search had a fixed minimum width); the header fits 375px in every theme, with a one-line, truncated breadcrumb. "Search Tools" is one control in every theme - a field with its / shortcut from tablet width, an icon on phones.
2083 dashboard: tool labels no longer wrap at desktop width; the tool icon is no longer a button inside the link; the admin's custom dashboard section no longer throws an error per item and keeps its layout in icon view.
2083 and 2087 dark mode: about 175 light texts on dark surfaces, and surfaces hard-coded to one near-black, follow the theme's dark colours; grey helper text meets 4.5:1 contrast on every theme's dark surfaces.
2083 and 2087: text under 12px raised to 12px (the 2087 Backups pages had 75 of them).
The 2083 sign-in page uses the panel's own stylesheet instead of a script from a CDN.
2087 at phone width: the e-mail queue and domain-limit toolbars, backup tabs, the new account's web server grid, the defaults page, SSL rows and the snippet and web-server editor headers wrap or scroll instead of being cut off; long paths in those editor headers no longer overflow at 1024px.
The committed 2083 stylesheet was out of date with the templates (the dashboard rendered as one column at 1440px); it is rebuilt and the CI --check passes again.
Cloudflare only (#1537): a website switched to Cloudflare only also answers the server it runs on - loopback and the server's own IPv4/IPv6 addresses - so cron jobs, cache purges and the server's own DNS answers for its domains reach it instead of getting 403. A request that a proxy on the server (the HAProxy or Traefik edge router) relays from elsewhere is still refused. The list follows the server's addresses: it is rewritten when an address is added or removed, after config update server_ip, after a server migration and on every update.
2087: a reseller's top bar shows its accounts and disk against its limits again; it read <no value> GB / ∞ on every page. A figure that can't be read is left out instead.
2087 User Backups: saving the local storage folder on the Destinations tab no longer resets the central backup's time and day to Sunday 03:00.

Security

2083 and 2087: values a page put inside Alpine.js attributes (x-data, x-show, :class, @click...) were escaped for HTML only, which the browser undoes before the script runs, so a domain name, file name, log line or request path containing a quote could run script in the panel. About 100 places on 2083 and 131 on 2087 now emit them as JSON (stored and reflected script injection). On 2087 the account usage-history table and transfer log - fed from files in the account's own home - and toast messages are written as text, never as HTML.
Backups to destinations an account names (both engines, and the archive push): every SSH value (host, port, user, key file, path) is checked before anything runs, so none can add an option to the ssh, scp or sftp command; the key must be the account's own file inside its home and is used through a root-only copy taken from the same open file the check looked at; root's own SSH keys are never offered to such a host; a WebDAV push takes http(s) addresses only; an sftp: repository URL is refused (use the SSH settings), an rclone: URL must name a plain remote, and a folder on this server cannot be named as a repository. With the server-managed destination the account's settings can no longer redirect the repository or mix their values into the server's, and DR replication of it is refused. The administrator's rclone remote allow-list now applies to the repository engine's Rclone, Google Drive and OneDrive destinations too. The administrator's own destination is unchanged.
"Store Emails" copies (which can include a new account's password) are private to root: the directory is 0700 and the files 0600, copies left readable by older releases are locked down on the next e-mail sent, and they are never written through symbolic links (#1540).
user-password refuses a username with no panel account instead of reporting success, and changes the system (FTP/SFTP) password of hosting accounts only, never root's or a service account's.
2087: the domain traffic report checks the account name and that the website belongs to that account, and is served in a sandbox; Live Chat opens, reads and answers existing accounts only; the plan-apply log view serves only the logs plan edits write, always as plain text. The 2083 traffic report is served in a sandbox too.
hitechcloudcli admin update refuses a reseller name that is not a login name before writing anything, and --logo_url accepts only an empty value, an https:// address or a /static/ path - the rule the admin panel already applied.
2087 sign-in: the page to return to after signing in can no longer point to another site through /\host, a tab, or encoded slashes; 2083 and 2087 apply one rule for it.

Things that behave differently after this update

Web server override editor: a change the web engine refuses, or that stops it from reloading, is undone instead of being kept.
Backups to an SSH destination the account chose: it needs a key file of the account's own inside its home directory (a key path under /var/www/html is refused), or a password. In an account's backup settings, RESTIC_REPOSITORY / DR_REPOSITORY must name a network backend (sftp: excepted - set the SSH host, user and key instead); a folder on this server is refused. With the server-managed destination the account's RESTIC_REPOSITORY is ignored and DR replication is refused.
n8n installed under a path before this release: reinstall it to move it inside the website's entry.
Moodle updates stay on the site's release line (4.5 stays 4.5); a major upgrade is its own button on the Update tab (?major=1 in the API).
server-migrate from a server that runs its services on the host needs a freshly installed destination on the same version, with the PHP versions and web servers the sites use, and replaces its administrators and resellers with this server's. Suspended accounts and accounts on hosting nodes are not moved; the summary names them.
A 2087 /login/token/{user}?next=... link whose next is not a page of the customer panel opens the customer's dashboard instead of answering 400.
A fresh install on an Ubuntu release newer than 26.04 stops unless --skip-requirements is given.
A server upgraded in place to Ubuntu 26.04 or Debian 13: run hitechcloudcli mail apply-config, then hitechcloudcli mail sync (or hitechcloudcli update --repair), right after the release upgrade. Dovecot 2.4 does not start on 2.3's settings, and hitechcloudcli mail check says so.
hitechcloudcli admin update --logo_url=http://... is refused; use https://.