$ git log v1.4.5..v1.4.6 –oneline –stat

Five releases in two days — 1.4.5, sorry! Three patches under it, and 1.4.6 — and they all chase the same thread: things nextDash used to do quietly, on your behalf, without telling you. A bookmark’s preview picture used to be fetched by your browser, which meant the site you were dashboarding for found out you were looking at it. A custom widget’s API key went into the credential file and never came back, so a missing Bearer  prefix looked identical to a wrong key. Both are fixed now, along with a handful of smaller things that had been sitting wrong since 1.4.4.

Preview images stay on your server now — 1.4.6

Hovering a bookmark used to make your browser request that site’s preview image and favicon directly. Convenient, and also a quiet privacy leak: the site learned you were looking at your own dashboard, and a host that blocks cross-origin image requests (claude.ai was one, in a real cache) simply failed to show a picture at all.

nextDash now fetches both images itself, stores them under data/preview-images/, and the card draws from your own address. The first hover shows the card without its picture — the download runs in the background so a slow host can never hold up the card — and the image slots in the moment it arrives, no reload.

None of it is compulsory. Untick Image in the card’s checklist under Config → Appearance → Display and nothing is drawn or fetched — that’s checked server-side, before any download happens. Set preview cards to Off and nothing is contacted at all, icons included. A new Config → Icons & previews screen shows what the cache is using and lets you empty it — nothing is lost, since every image is re-fetched from its original address the next time it’s needed.

One small fix rides along: a grey native tooltip could sit on top of the preview card since 1.4.4, on the row label and even the whole category list. Both now stand aside whenever a card is coming.

Widgets you can actually debug — 1.4.5

1.4.5 is entirely about one complaint: a custom widget that shows — for every figure gives you no way to tell whether the address is wrong, the key is wrong, or the JSON just nests one level deeper than the boxes assume.

• An eye next to the key box. A stored key never came back, so a header missing its Bearer  prefix looked exactly like a wrong key — both answer 401. GET /api/health/credentials/reveal is deliberately narrow: widget keys only, one field per request, behind the write token, every reveal logged by id and field, never by value.
• Services that take their key in the address get a proper box. SABnzbd, Tautulli, Pi-hole v5 and Plex take a query-string key and had no sign-in field at all — you were expected to edit YOUR_KEY into the address by hand. qBittorrent gets its own flow: username and password, a session cookie held in memory, re-authenticated automatically when it expires.
• Paths can name a list entry the way the service does. Home Assistant answers with one flat array, so picking an entity meant guessing its index — which moves the moment a device is added.
• A Found column next to every path, and a search box over the raw response — typing part of a key filters to the matching lines with two lines of context either side.

Four new formats read numbers the way the service actually reports them — Speed in bits per second rather than the raw byte rate a queue widget reports, Power scaling through watts to kW and keeping the sign for a solar meter that’s exporting, Temperature respecting your °C/°F setting without converting a sensor that already reports its own unit, and Data size asking which unit the service counted in, since SABnzbd reports megabytes where most things report bytes. Decimals per figure go from Auto down to a fixed 0–3.

Two testing bugs went with it: trying an address used to send the request anonymously even while you were typing in a key, which produced a 401 indistinguishable from a genuinely wrong one — the key on screen now travels with the test and is written nowhere. And a failed trial used to always blame your write token; the actual status now decides what it says.

Smaller fixes, 1.4.5.1 through 1.4.6

• Deleted bookmarks disappear immediately instead of sitting on screen, unresponsive, until a reload (1.4.5.3) — a chevron lookup that matched too deeply threw an error mid-render and stranded every category after it.
• The keyboard cursor no longer lands on thirteen rows at once. Widget rows spliced into the categories list had no row key of their own, so a stored null matched all of them (1.4.5.1).
• Digits open the page they name again instead of sometimes opening the search palette instead — both listened for the same keystroke, and load order decided the winner (1.4.6).
• Safari accepts the source maps again — they set sourcesContent to null, which the spec requires to be an array or absent (1.4.6).
• The Unraid template now points at Docker Hub so Community Applications can show download counts and a Last Update date — GHCR doesn’t expose that metadata (1.4.5.3).

Full details, as always, in the changelog, and the release itself on GitHub.