v4.1.3 Changelog

Release date: August 31, 2026

New features

OpenID Connect single sign-on

Kener now supports login through an external identity provider (Keycloak, Authentik, Azure AD, Okta, and others) using the OIDC Authorization Code Flow with PKCE. Configure it under Manage → OpenID Connect: set the issuer, client credentials, and optional group-to-role mappings so provider groups map to Kener admin, editor, or member roles. OIDC users stay separate from local accounts. See OpenID Connect. Thanks to @Plattenspatz.

Prometheus monitors

A new Prometheus monitor type queries a Prometheus server, evaluates the returned value against thresholds, and maps it to UP, DEGRADED, or DOWN. Two options control failure semantics: noDataStatus decides what an empty query result means, and errorStatus decides what an unreachable server or unusable response means — useful when the metric measures capacity or lag rather than liveness, so a lost scrape does not show up as an outage. See Prometheus Monitor. Thanks to @123FLO321.

OpenPanel analytics

OpenPanel joins the list of supported analytics providers. Add your client ID in site settings and Kener injects the tracker on the status page. See Analytics.

Filter monitoring data by status

The Monitoring Data admin page gained a status dropdown. Pick a status (UP, DOWN, DEGRADED, …) to filter the table and the row count, and deletion respects the same filter — so you can remove, say, only the DOWN rows a misconfigured monitor wrote. Thanks to @lokiee0.

Improvements

Faster status pages on large databases

The latest-status lookup used a MAX(timestamp) self-join that PostgreSQL planned as a full scan of monitoring_data (~500ms per page load at 1.7M rows). It now runs one indexed descent per monitor on every supported database. A migration also tunes PostgreSQL autovacuum on monitoring_data so the nightly retention cleanup no longer leaves the table bloated. Existing large PostgreSQL installs should run a one-time VACUUM (ANALYZE) — see Database Setup.

Inline event labels

Incidents and maintenances rendered inline on the status page now carry a localized INCIDENT or MAINTENANCE tag, so the two event types are distinguishable at a glance.

Validation hardening

IP address validation now goes through one shared validator with correct octet and IPv6 checks, backing both DNS resolver and nameserver validation. API and Prometheus monitors guard against malformed stored configuration instead of crashing, and Prometheus responses with mismatched scalar/vector shapes are rejected. The axios dependency floor rose to 1.13.5.

Updated translations

Turkish translations were refreshed.

Bug fixes

• Admin timestamps show your timezone. Admin pages (alert logs, API keys, subscriptions, users) parsed naive UTC strings as local time, so timestamps were off by your UTC offset on SQLite. They now render in the browser timezone with a GMT offset, and hovering shows the UTC value.
• Mixed-case emails can sign up. Signup stored emails lowercased but looked them up with the original casing, so addresses like Timothy.Pace@example.com failed with "Failed to create user". Lookups are now case-insensitive.
• Sparse monthly maintenance rules expand. RRULEs with an ordinal weekday, such as FREQ=MONTHLY;BYDAY=1WE (first Wednesday), now generate the right occurrences, and the maintenance preview no longer skips them. See RRULE Patterns.
• Monitor secrets work in headers. Secret placeholders inside header fields are now substituted, and secret values containing $ characters are inserted literally instead of being mangled by replacement-pattern expansion.
• Affected-monitor badges wrap. Incident and maintenance cards with many affected monitors overflowed or hid badges behind a scrollbar; badges now wrap inside the card.
• Analytics values are escaped. Provider IDs are escaped before injection into /capture.js, so a malformed value cannot break or script the tracker bootstrap.