feat(updates): in-app update notifications via GitHub releases

Adds an opt-out periodic check for new Docker Dash releases on GitHub.
A subtle pulsing badge appears next to the sidebar version when an
update is available; click opens a modal with the release notes
(rendered from the GitHub Release body) and an admin-only upgrade
command.

- src/services/update-check.js: fetches latest release, semver-compares,
  caches in settings table. 12h cron + 60s post-boot one-shot, both
  leader-gated for HA. Configurable owner/repo via env.
- src/routes/update-check.js: GET status (any auth user), POST refresh
  + setting (admin only), audited.
- public/js/update-notifier.js: fetches at app start, badge + modal,
  inline minimal markdown renderer (no deps).
- public/js/pages/settings.js: General tab gets toggle + check-now.
- 24 new tests (931 total passing). i18n EN + RO.

Privacy: 1 outbound HTTPS call per instance per 12h, can be disabled
in System Settings → General for air-gapped deployments.

Release: v7.3.0

Author: bogdanpricop

CHANGELOG.md

@@ -2,6 +2,62 @@
 
 All notable changes to Docker Dash are documented here.
 
+## [7.3.0] - 2026-04-25 — "Update Notifications"
+
+Periodic, opt-out check for new Docker Dash releases on GitHub. Solves the "user cloned the repo a week ago and has no idea v7.3.0 shipped" gap. Designed to be **quiet**: a tiny pulsing ↑ badge next to the sidebar version, click-to-open modal with the full release notes (rendered from the GitHub Release `body`), and a one-click "show upgrade command" for admins.
+
+### Added — Backend
+
+- **`src/services/update-check.js`** (~165 LOC) — polls `https://api.github.com/repos/<owner>/<repo>/releases/latest`, semver-compares against `src/version.js`, caches the result in the `settings` table. Configurable owner/repo via `DD_UPDATE_CHECK_OWNER` / `DD_UPDATE_CHECK_REPO` env vars (defaults: `bogdanpricop/docker-dash`). 5s timeout, no redirects, custom User-Agent. Network failures are caught + logged + leave the existing cache untouched.
+
+- **`src/routes/update-check.js`** mounted at `/api/system/update-check` (before `/api/system` so it bypasses that router's host-extraction middleware):
+  - `GET /` — read current status. Returns `{ current, latest, hasUpdate, releaseNotes, releaseUrl, publishedAt, lastChecked, enabled }`. Auth required, no role gate (sidebar badge needs to work for operators + viewers).
+  - `POST /refresh` — admin-only force refresh. Service has a 60s anti-abuse throttle.
+  - `POST /setting` — admin-only enable/disable toggle. Audited.
+
+- **Background job** in `src/jobs/index.js` — cron `17 */12 * * *` (every 12h) + a one-shot 60s post-boot run so the badge can light up on first login without waiting half a day. Both gated on `cluster.isLeader()` so HA replicas don't N× the GitHub call. Service short-circuits when disabled (cheap settings.get on each tick).
+
+### Added — Frontend
+
+- **`public/js/update-notifier.js`** (~190 LOC) — self-contained module. Fetches status at app start, renders a 14×14 pulsing ↑ badge inside `#sidebar-version` when an update is available. Click → modal with:
+  - Header: `current → latest` with publish date + last-checked timestamp.
+  - Release notes: minimal markdown→HTML renderer (no external deps) handling headings, **bold**, *italic*, `inline code`, fenced code blocks, lists, links. All inputs HTML-escaped first.
+  - Admin-only `<details>`: copy-pasteable `git pull && APP_VERSION=X.Y.Z docker compose up -d --build app` with a "back up /data first" warning.
+  - Footer: link to the release page on GitHub + Close.
+
+- **System Settings → General** — new card with the toggle, last-checked status, and a "Check now" button (forwards to `POST /refresh`).
+
+- **CSS** in `public/css/app.css` — `.update-badge` with subtle pulse animation. Hidden when sidebar is collapsed (inherits from existing `.sidebar.collapsed .sidebar-version` rule).
+
+- **i18n** — new `updates:` block in EN + RO with 18 keys covering badge tooltip, modal labels, settings card, status messages. Other 9 languages fall back to EN via `_fallback`.
+
+### Privacy + air-gap
+
+- One outbound HTTPS call every 12h, total — not per user. Configurable poll interval is fixed at 12h (no operator footgun).
+- `User-Agent: docker-dash/<version>` — no IP/hostname/install ID leaked beyond what the TCP connection inherently exposes.
+- **Disable in System Settings → General** for fully air-gapped deployments. When disabled: zero outbound calls, badge never appears, modal still opens manually if cached data exists (so operators can still read the last release notes they fetched before air-gapping).
+- Audit log: `update_check_enabled` / `update_check_disabled` on toggle.
+
+### Tests
+
+- **`src/__tests__/update-check.test.js`** — 24 tests covering semver parse/compare, enable/disable round-trip, getStatus state machine (empty cache, equal version, newer version, disabled bypass, corrupt JSON), refresh HTTP behavior (success path, disabled short-circuit, network error preserves cache, non-200, force bypass, missing body field).
+
+- **Suite: 907 → 931 passing / 60 suites.** Lint clean, npm audit clean.
+
+### Files touched
+
+- `src/services/update-check.js` (new)
+- `src/routes/update-check.js` (new)
+- `src/server.js` — mount route before `/api/system`
+- `src/jobs/index.js` — 12h cron + one-shot post-boot refresh (leader-gated)
+- `public/js/update-notifier.js` (new)
+- `public/index.html` — script tag for `update-notifier.js`
+- `public/js/app.js` — `UpdateNotifier.init()` after auth
+- `public/js/pages/settings.js` — General tab gets the toggle card
+- `public/css/app.css` — badge styling + pulse animation
+- `public/js/i18n/en.js` + `ro.js` — `updates:` block
+- `src/__tests__/update-check.test.js` (new)
+
 ## [7.2.1] - 2026-04-23 — Bug fixes
 
 ### Fixed

docker-compose.yml

@@ -4,8 +4,8 @@ services:
       context: .
       dockerfile: Dockerfile
       args:
-        APP_VERSION: "${APP_VERSION:-7.2.1}"
-    image: docker-dash:${APP_VERSION:-7.2.1}
+        APP_VERSION: "${APP_VERSION:-7.3.0}"
+    image: docker-dash:${APP_VERSION:-7.3.0}
     container_name: docker-dash
     restart: unless-stopped
     env_file:
@@ -54,7 +54,7 @@ services:
   dd-egress-filter:
     build:
       context: ./docker/egress-filter
-    image: docker-dash-egress-filter:${APP_VERSION:-7.2.1}
+    image: docker-dash-egress-filter:${APP_VERSION:-7.3.0}
     container_name: dd-egress-filter
     restart: unless-stopped
     # Uses the default bridge so target containers on the default bridge can

package.json

@@ -1,6 +1,6 @@
 {
   "name": "docker-dash",
-  "version": "7.2.1",
+  "version": "7.3.0",
   "description": "Full-featured Docker management dashboard",
   "main": "src/server.js",
   "scripts": {

public/css/app.css

@@ -205,7 +205,21 @@ textarea { resize: vertical; min-height: 80px; }
 .sidebar-logo { font-size: 26px; flex-shrink: 0; filter: drop-shadow(0 0 8px rgba(56,139,253,0.3)); }
 .sidebar-title-group { display: flex; flex-direction: column; flex: 1; min-width: 0; }
 .sidebar-title { font-weight: 700; font-size: 16px; color: var(--text-white); white-space: nowrap; }
-.sidebar-version { font-size: 10px; color: var(--text-dim); font-family: var(--mono); letter-spacing: 0.5px; margin-top: -2px; }
+.sidebar-version { font-size: 10px; color: var(--text-dim); font-family: var(--mono); letter-spacing: 0.5px; margin-top: -2px; display: inline-flex; align-items: center; gap: 5px; }
+.sidebar-version .update-badge {
+  display: inline-flex; align-items: center; justify-content: center;
+  width: 14px; height: 14px; border-radius: 50%;
+  background: var(--accent); color: var(--text-white);
+  font-size: 8px; cursor: pointer;
+  box-shadow: 0 0 6px rgba(56,139,253,0.5);
+  animation: update-badge-pulse 2.5s ease-in-out infinite;
+  transition: transform var(--transition);
+}
+.sidebar-version .update-badge:hover { transform: scale(1.15); }
+@keyframes update-badge-pulse {
+  0%, 100% { box-shadow: 0 0 6px rgba(56,139,253,0.5); }
+  50%      { box-shadow: 0 0 10px rgba(56,139,253,0.85); }
+}
 .sidebar-toggle {
   background: none; border: none; color: var(--text-dim); cursor: pointer;
   padding: 6px; font-size: 14px; border-radius: var(--radius-xs);

public/index.html

@@ -323,6 +323,7 @@
   <script src="/js/components/context-menu.js?v=__VERSION__"></script>
   <script src="/js/components/taskbar.js?v=__VERSION__"></script>
   <script src="/js/components/remediate-wizard.js?v=__VERSION__"></script>
+  <script src="/js/update-notifier.js?v=__VERSION__"></script>
   <script src="/js/pages/dashboard.js?v=__VERSION__"></script>
   <script src="/js/pages/containers.js?v=__VERSION__"></script>
   <script src="/js/pages/images.js?v=__VERSION__"></script>

public/js/app.js

@@ -379,6 +379,13 @@ const App = {
       versionEl.addEventListener('click', () => this.navigate('/whatsnew'));
     }
 
+    // v7.3.0: check GitHub for newer version (cached server-side, ~1 call/12h
+    // total across all users). Adds an unobtrusive ↑ badge next to the
+    // sidebar version when an update is available.
+    if (window.UpdateNotifier) {
+      window.UpdateNotifier.init().catch(() => { /* silent */ });
+    }
+
     // Restore host context
     Api.restoreHost();
 

public/js/i18n/en.js

@@ -77,6 +77,26 @@ i18n.register('en', 'EN', 'English', {
     title: 'Notifications', markAllRead: 'Mark all read',
     empty: 'No notifications', failedToLoad: 'Failed to load',
   },
+  updates: {
+    badgeTooltip: 'New version available: {{version}} — click for details',
+    modalTitle: 'Update available',
+    publishedOn: 'Published {{date}}',
+    lastChecked: 'Last checked',
+    never: 'never',
+    noNotes: '_(No release notes provided.)_',
+    openOnGithub: 'View on GitHub',
+    showUpgradeCmd: 'Show upgrade command',
+    upgradeCmdHint: 'Run on the host where Docker Dash is deployed:',
+    upgradeCmdWarn: 'Read the release notes above before upgrading. Always back up /data first.',
+    settingTitle: 'Update notifications',
+    settingDesc: 'Periodically check GitHub for new Docker Dash releases (one HTTPS call every 12 hours). Disable for fully air-gapped deployments.',
+    settingEnabled: 'Check for updates',
+    checkNow: 'Check now',
+    checking: 'Checking...',
+    checkFailed: 'Check failed',
+    upToDate: "You're on the latest version",
+    refreshed: 'Update check refreshed',
+  },
   time: {
     justNow: 'just now', minutesAgo: '{{n}}m ago', hoursAgo: '{{n}}h ago', daysAgo: '{{n}}d ago',
     days: 'd', hours: 'h', minutes: 'm', seconds: 's',

public/js/i18n/ro.js

@@ -53,6 +53,26 @@ i18n.register('ro', 'RO', 'Română', {
     title: 'Notificari', markAllRead: 'Marcheaza toate citite',
     empty: 'Fara notificari', failedToLoad: 'Eroare la incarcare',
   },
+  updates: {
+    badgeTooltip: 'Versiune noua disponibila: {{version}} — click pentru detalii',
+    modalTitle: 'Actualizare disponibila',
+    publishedOn: 'Publicat {{date}}',
+    lastChecked: 'Ultima verificare',
+    never: 'niciodata',
+    noNotes: '_(Nu sunt note de release.)_',
+    openOnGithub: 'Deschide pe GitHub',
+    showUpgradeCmd: 'Arata comanda de upgrade',
+    upgradeCmdHint: 'Ruleaza pe host-ul unde e instalat Docker Dash:',
+    upgradeCmdWarn: 'Citeste notele de release inainte de upgrade. Fa intotdeauna backup la /data.',
+    settingTitle: 'Notificari de actualizare',
+    settingDesc: 'Verifica periodic GitHub pentru versiuni noi de Docker Dash (un singur HTTPS la 12 ore). Dezactiveaza pentru deploy-uri complet izolate.',
+    settingEnabled: 'Verifica actualizari',
+    checkNow: 'Verifica acum',
+    checking: 'Se verifica...',
+    checkFailed: 'Verificare esuata',
+    upToDate: 'Esti pe ultima versiune',
+    refreshed: 'Verificare actualizare reusita',
+  },
   time: {
     justNow: 'acum', minutesAgo: '{{n}}m in urma', hoursAgo: '{{n}}h in urma', daysAgo: '{{n}}z in urma',
     days: 'z', hours: 'h', minutes: 'm', seconds: 's',

public/js/pages/settings.js

@@ -1560,13 +1560,81 @@ const SettingsPage = {
           </table>
         </div>
       </div>
+
+      <div class="card" style="max-width:600px;margin-top:16px">
+        <div class="card-header"><h3><i class="fas fa-arrow-up" style="color:var(--accent);margin-right:8px"></i>${i18n.t('updates.settingTitle')}</h3></div>
+        <div class="card-body">
+          <p class="text-muted text-sm" style="margin-bottom:14px">${i18n.t('updates.settingDesc')}</p>
+          <label style="display:flex;align-items:center;gap:10px;cursor:pointer;margin-bottom:14px">
+            <input type="checkbox" id="upd-enabled">
+            <span>${i18n.t('updates.settingEnabled')}</span>
+          </label>
+          <div id="upd-status-row" style="display:flex;justify-content:space-between;align-items:center;gap:12px;flex-wrap:wrap;font-size:12px;color:var(--text-dim)">
+            <span id="upd-status-text">…</span>
+            <button class="btn btn-sm" id="upd-check-now"><i class="fas fa-sync"></i> ${i18n.t('updates.checkNow')}</button>
+          </div>
+        </div>
+      </div>
     `;
 
     // Fetch version dynamically
     Api.get('/health').then(h => {
       const vEl = el.querySelector('#settings-version');
       if (vEl && h.version) vEl.innerHTML = `v${h.version} <i class="fas fa-bullhorn" style="font-size:10px"></i>`;
     }).catch(() => {});
+
+    // Update-check section (v7.3.0)
+    const renderUpdStatus = (status) => {
+      const text = el.querySelector('#upd-status-text');
+      if (!text || !status) return;
+      const last = status.lastChecked
+        ? new Date(status.lastChecked).toLocaleString()
+        : i18n.t('updates.never');
+      if (status.hasUpdate) {
+        text.innerHTML = `<a href="#" id="upd-open-modal" style="color:var(--accent)"><i class="fas fa-arrow-up"></i> ${i18n.t('updates.modalTitle')}: ${Utils.escapeHtml(status.latest)}</a> · ${i18n.t('updates.lastChecked')}: ${Utils.escapeHtml(last)}`;
+        text.querySelector('#upd-open-modal')?.addEventListener('click', (e) => {
+          e.preventDefault();
+          window.UpdateNotifier?.openModal();
+        });
+      } else if (status.enabled) {
+        text.innerHTML = `<i class="fas fa-check" style="color:var(--green)"></i> ${i18n.t('updates.upToDate')} · ${i18n.t('updates.lastChecked')}: ${Utils.escapeHtml(last)}`;
+      } else {
+        text.innerHTML = `<i class="fas fa-pause" style="color:var(--text-dim)"></i> ${i18n.t('common.disabled')}`;
+      }
+    };
+
+    try {
+      const status = await Api.get('/system/update-check');
+      el.querySelector('#upd-enabled').checked = !!status.enabled;
+      renderUpdStatus(status);
+    } catch { /* anonymous-only? unlikely on a settings page */ }
+
+    el.querySelector('#upd-enabled').addEventListener('change', async (e) => {
+      const enabled = e.target.checked;
+      try {
+        await window.UpdateNotifier.setEnabled(enabled);
+        Toast.success(enabled ? i18n.t('common.enabled') : i18n.t('common.disabled'));
+        const status = await Api.get('/system/update-check');
+        renderUpdStatus(status);
+      } catch (err) { Toast.error(err.message); }
+    });
+
+    el.querySelector('#upd-check-now').addEventListener('click', async (e) => {
+      const btn = e.currentTarget;
+      const original = btn.innerHTML;
+      btn.disabled = true;
+      btn.innerHTML = `<i class="fas fa-spinner fa-spin"></i> ${i18n.t('updates.checking')}`;
+      try {
+        const result = await window.UpdateNotifier.forceRefresh();
+        renderUpdStatus(result.status);
+        Toast.success(i18n.t('updates.refreshed'));
+      } catch (err) {
+        Toast.error(`${i18n.t('updates.checkFailed')}: ${err.message}`);
+      } finally {
+        btn.disabled = false;
+        btn.innerHTML = original;
+      }
+    });
   },
 
   _showHelp() {