Changelog

1.1.0 (2026-09-07)

✨ Features

• 802.11ax (HE) support via HE_ENABLED/HE_CAPAB (#296) (e095da1)
• add –version flag to wlanstart.sh (#178) (33984f1)
• add AP_ISOLATION env var to isolate wireless clients (#56) (201ede0)
• add DHCP_RANGE env var for explicit control (#40) (#47) (6738670)
• add HEALTHCHECK to Dockerfile (#36) (#60) (a1296c4)
• add HIDE_SSID env var to suppress SSID broadcast (#55) (0c4b424), closes #32
• add leveled logging library (#181) (474efd2)
• add MAX_STATIONS env var to limit connected clients (#54) (691970d)
• assistant: add band & country selection (#413) (#427) (6c23f78)
• assistant: add dynamic channel selector (#414) (#428) (53fee34)
• assistant: docker run output generator (10f6648), closes #420
• bootstrap: add circular dependency detection (#350) (f18b825)
• channel: support CHANNEL=acs automatic channel selection (#203) (4105bcf)
• channel: validate 5GHz channels for hw_mode=a with DFS warning (#89) (#99) (a91d928)
• clients.sh leases subcommand showing dnsmasq DHCP leases (#297) (a07fb21)
• clients: add –json machine-readable station output (#202) (9258831), closes #198
• clients: add deauth subcommand (#166) (#180) (1b4cb29)
• clients: clear error when control interface disabled (#161) (#169) (737838b)
• clients: opt-in ctrl_interface and clients.sh for listing connected stations (#134) (925eec9)
• clients: station count command and optional min-stations healthcheck (#247) (29257e4), closes #234
• config-assistant: add advanced options section (643f4da)
• config-assistant: add advanced options section (#432) (97f6f4e)
• dhcp: validate AP_ADDR lies inside SUBNET/mask (#211) (1bcb6a8), closes #189
• dhcp: validate DHCP range order, subnet bounds and AP overlap (#210) (df14903), closes #190
• docs-site: add custom favicon for branding (#383) (#398) (30cd6c1)
• docs-site: add form validation and reset to defaults (#421) (#447) (b2cd345)
• docs-site: add network settings section to configuration assistant (b9b069e)
• docs-site: add radio capabilities section to configuration assistant (3a45a0f)
• docs-site: add security settings to configuration assistant (06c16b9)
• docs-site: add site logo to header (#384) (#396) (c0da5cd)
• docs-site: configure logo to replace site title text (#401) (#402) (ea196b7)
• docs-site: improve logo visibility and readability (#399) (d613f55)
• docs-site: override Footer with light RPi-style footer (#395) (c7fd1fb)
• docs-site: override Header with RPi-style navigation (#393) (d420bbc)
• docs-site: restyle code blocks for cleaner light appearance (#382) (#405) (48c27c8)
• docs-site: style nav links like Raspberry Pi site (#394) (148bd6a)
• docs: add CardGrid with Starlight components (#446) (fb1a7cb)
• docs: add configuration assistant page (#412) (#426) (0a76b95)
• docs: add docs-check smoke test for site build (#355) (03d92fc)
• docs: add env file output generator to configuration assistant (98ad34c)
• docs: add link checking for markdown files (#356) (e3e2792)
• docs: disable pagination links globally (#404) (f144ecd)
• docs: increase navigation bar height (#372) (#391) (8169cc9)
• docs: update sidebar to clean white style (#373) (#392) (5c38691)
• docs: widen content area for desktop (#371) (#390) (fa30b05)
• entrypoint: add –validate dry-run mode with CI env matrix (#135) (6afcec1)
• fail healthcheck when HEALTHCHECK_MIN_STATIONS set but control interface missing (#283) (#300) (fc0ddc0)
• healthcheck: add opt-in deep AP beacon check via hostapd_cli (#123) (#136) (f4877b9)
• healthcheck: verify AP IP assigned to interface (#105) (66d241d), closes #91
• hostapd: HOSTAPD_EXTRA_OPTS passthrough for extra config lines (#204) (5759ed6)
• logging: retain timestamped failure logs with rotation (#199) (#200) (9ac178a)
• logging: tag daemon output and report failing service on multirun exit (#119) (#133) (72d19ca)
• MAC address filtering (allowlist/denylist) (#103) (4da0787), closes #93
• modernize stack - alpine 3.24, dnsmasq, GitHub Actions, release-please (77b5fd6)
• modernize stack - alpine 3.24, dnsmasq, GitHub Actions, release-please (40c96e4)
• nat: validate OUTGOINGS interfaces exist before applying rules (#227) (#253) (c8c57aa)
• npm: add supply chain attack hardening to .npmrc (#358) (13f99b6)
• optional IPv6 support (RA/DHCPv6 via dnsmasq) (#102) (c8667ab), closes #94
• pages: add GitHub Actions workflow for Pages deployment (#343) (4ea2a3f)
• pages: prebuild script to copy markdown into content collections (#342) (6ac4865)
• pages: scaffold Astro Starlight project in docs-site/ (#341) (0ac7bd8), closes #336
• radio: add TX_POWER env var for transmit power control (#236) (#246) (f5c0422)
• region-aware channel validation with COUNTRY_CODE (default EU) (#68) (df5cee6)
• reject unknown HW_MODE in validate mode (#163) (#176) (2866361)
• retain daemon failure log on non-zero exit (#175) (122fdd6)
• secrets: add SSID_FILE and WPA_PASSPHRASE_FILE inputs (#232) (#248) (d670759)
• support configurable subnet mask (#165) (#179) (e9dfea0)
• tests: end-to-end system test with mac80211_hwsim (#108) (7830f5e)
• theme-1-core: add Roboto font from Google Fonts (#388) (513d0f9), closes #369
• theme-1-core: set light mode as default theme (#386) (611efb7), closes #367
• theme-1-core: update accent color to Raspberry Pi red (#385) (ad91abe), closes #366
• theme-1-core: update body text color to match RPi style (#389) (1488f1e), closes #370
• theme-1-core: update grayscale palette to warmer tones (#387) (79c4e46), closes #368
• theme-4-polish: add consistent border-radius across components (#381) (#407) (5a814c7)
• theme-4-polish: add hero section to homepage (#377) (#406) (eb7db5b)
• theme-4-polish: add reusable Card component for content links (#378) (#408) (8202581)
• theme-4-polish: restyle admonitions to match RPi muted palette (#379) (#409) (949b0eb)
• theme-4-polish: update box shadows to softer diffused values (#380) (#410) (487d603)
• use multirun to manage hostapd/dnsmasq processes (#106) (3204bd6)
• validate CHANNEL against HW_MODE (#38) (#58) (ed21c27)
• wlanstart.sh –check runtime state audit (#288) (#294) (c2ea720)
• wpa: add PMF (802.11w) toggle env var (#235) (#272) (a891db1)
• wpa: add WPA3/SAE support via WPA_VERSION env var (#74) (15f1ab8)

🩹 Fixes

• add exit-on-error for dnsmasq and hostapd startup (#49) (00f8405), closes #30
• always regenerate /etc/hostapd.conf so env var changes apply (#62) (#67) (ca571fc)
• atomic: clean up temp files on failure via trap (#323) (da2507d)
• change release-please type from docker to simple (6f9ac70)
• channel: allow channel 14 only for JP + hw_mode=b (#207) (714bdab), closes #193
• channel: normalize COUNTRY_CODE / HW_MODE case before validation (#222) (#258) (7095777)
• channel: validate 5 GHz channels against COUNTRY_CODE (#221) (#259) (ed2ad8f)
• check nat_apply_rules/ipv6_apply_rules exit status (#279) (#304) (f3ff8d7)
• ci: add prebuild step and scope deploy permissions (#364) (3778cc7), closes #360
• clients.sh reports error when hostapd_cli fails (#281) (#302) (d6e9ee1)
• commands: close issues after merge in loop-issues command (#411) (6ce06ce)
• config: require HW_MODE=a when VHT_ENABLED is set (#209) (2e70381), closes #191
• core: replace external commands with pure bash (#325) (f6562ab)
• correct ‘Througput’ typo in wlanstart.sh comments (#66) (8d2c81f)
• COUNTRY_CODE set-but-empty skips regulatory default warning (#301) (09f66b1)
• deep healthcheck now honors CTRL_IFACE_DIR (#280) (#303) (9cd5d1f)
• dhcp: add bind-dynamic to avoid host DHCP conflicts (#223) (#257) (1f557d5)
• dhcp: declare local variables in explicit DHCP_RANGE path (#326) (cc9123e)
• dhcp: validate DHCP_RANGE fields and SUBNET instead of comma-count only (#113) (#128) (d032fa7)
• docker: pin libssl3/libcrypto3 in apk install (#271) (#273) (5b7e943)
• docs-site: ensure home.mdx and configuration-assistant.mdx are preserved during prebuild (#441) (7a38b81)
• docs-site: flatten multiline input/button tags for MDX compatibility (7e44684)
• docs-site: generate README.mdx with hero and CardGrid in copy-content.sh (#425) (73b601f)
• docs-site: use x-bind/x-on syntax for MDX compatibility (545c608)
• docs: add is:inline to Alpine.js script tags (#436) (b38c954)
• docs: correct script path for config-assistant.js (3435a49)
• docs: guard against duplicate starlight-menu-button registration (#442) (4e65060)
• docs: load config-assistant.js before Alpine.js to ensure function is defined (47aab41)
• docs: place config form labels and inputs on same line (#444) (bf680c5)
• docs: remove duplicate heading in configuration-assistant.mdx (#440) (4e1b4e6)
• docs: use correct base path for config-assistant.js and ensure correct load order (#435) (a632c34)
• entrypoint: handle signals received before multirun starts (#125) (ba15dea)
• entrypoint: validate AP_ADDR/SUBNET and abort on IP setup failure (#114) (#127) (532d34e)
• flush interface address and bring link down in cleanup() (#88) (#100) (d74fbd7)
• generate configs atomically via temp file (#173) (8f707f7)
• handle missing/non-numeric sysctl in nat setup (#174) (74ab1c2)
• healthcheck passes forever when started-time file is missing (#261) (9fad925)
• healthcheck: anchor IP match and require interface state UP (#112) (#129) (c63012b)
• healthcheck: explicit error when HEALTHCHECK_DEEP lacks INTERFACE (#215) (1b4733f)
• healthcheck: guard HEALTHCHECK_START_PERIOD against non-numeric values (#208) (8b8b199), closes #192
• healthcheck: measure grace period from container start time, not host uptime (#111) (#130) (56f0d33)
• interface: teardown removes only configured AP_ADDR, not all addresses (#188) (#212) (636e76e)
• ipv6: handle sysctl failure in enable_ipv6_forwarding gracefully (#225) (#255) (9202fdf)
• MAC_FILTER=2 denylist emits macaddr_acl=0 (#278) (#305) (837904d)
• mac_filter: make disabled path a silent no-op returning success (#116) (#131) (ccf01a5)
• make ipv6 rule functions self-contained (#159) (#171) (e95da21)
• pages: add docs-site artifacts to .gitignore (#348) (001cece)
• pages: add frontmatter to copied docs for Starlight schema (#346) (0f6e66f)
• pages: strip markdown heading to prevent duplicated page titles (#352) (2685110)
• passphrase: compute length after locale pin (#327) (4c0fa2e)
• quote remaining expansions and use arrays for OUTGOINGS parsing (#72) (07d4d7d)
• replace deprecated ifconfig with ip commands on Linux (#51) (585dc4e), closes #28
• security: prevent config injection via WPA_PASSPHRASE/PRI_DNS/SEC_DNS (#216) (91b08d1), closes #184
• signals: defer teardown until multirun children have exited (#217) (bb1b032), closes #183
• stations: make invalid MAX_STATIONS fatal at validation (#213) (991271a), closes #187
• sync Dockerfile VERSION with release-please manifest (#70) (6c50cda)
• upgrade alpine packages at image build to clear CVE-2026-14456 (#267) (55939d6)
• use DOCKERHUB_USER secret name (a497462)
• use iptables probe for privileged-mode check (#228) (#252) (6521fbc)
• validate SSID before writing hostapd.conf (#170) (a4fdafb)
• validate WPA_PASSPHRASE length (8-63 chars) before starting daemons (#97) (6bd6c01), closes #90
• wlanstart: add bats tests for graceful shutdown cleanup (50c6043)
• wlanstart: add graceful shutdown with proper daemon cleanup (bfbed79), closes #37
• wpa: emit ieee80211w PMF for WPA3-SAE and mixed mode (#220) (#260) (f29d1cc)

♻️ Code Refactoring

• channel: emit informational warnings at most once per run (#231) (#249) (1d9bd7a)
• declarative module loading via lib/bootstrap.sh (#269) (0a16e33), closes #239
• deduplicate env plumbing in clients.sh and healthcheck.sh (#243) (#262) (417d2db)
• dhcp: compute DHCP range once per startup (#224) (#256) (a8c5f11)
• enforce <module>_<verb> naming convention across lib/ (#264) (f2aff80)
• entrypoint: extract NAT/interface logic into lib/nat.sh and lib/interface.sh (#132) (c2c996b)
• env: centralize environment defaults into lib/env.sh (#237) (#244) (f928f04)
• extract AP_ISOLATION logic to shared lib (#82) (0d824f0)
• extract channel validation to shared lib/channel.sh (#86) (ab13c0b)
• extract config emission from wlanstart.sh into lib/core modules (#270) (1b4cee4)
• extract default-credential warnings to shared lib/warnings.sh (#80) (#81) (7b9cad7)
• extract DHCP_RANGE logic to shared lib/dhcp.sh (fixes #76) (#85) (508e4a8)
• extract HIDE_SSID logic to shared lib/ssid_hidden.sh (#83) (ea2e373), closes #78
• extract MAX_STATIONS logic to shared lib/stations.sh (#77) (#84) (ba76302)
• healthcheck: add set -euo pipefail strict mode (#154) (2a6bcbc), closes #151
• lib: add missing shellcheck source/shell directives (#155) (dc47633), closes #152
• module-prefix private globals in lib/core/channel.sh (#285) (#298) (6a927f0)
• phase-based lifecycle with registered setup/teardown hooks (#265) (a780aa4)
• radio: remove unreachable empty-string case branch (#335) (91c7227), closes #313
• replace ‘true ${VAR:=x}’ idiom with ‘: “${VAR:=x}”’ (#73) (36ae37f)
• scripts: apply shellcheck style-level cleanups (#156) (447f27a), closes #153
• scripts: invoke get-version.sh with bash consistently (#205) (2e6158c), closes #195
• split lib/ into core/ (pure) and sys/ (effectful) layers (#268) (04b8ae8), closes #240

1.0.0 (2026-09-07)

✨ Features

• docs-site: documentation published in GitHub Pages including a tool to generate docker run commands

0.42.0 (2026-09-07)

✨ Features

• assistant: add band & country selection (#413) (#427) (6c23f78)
• assistant: add dynamic channel selector (#414) (#428) (53fee34)
• assistant: docker run output generator (10f6648), closes #420
• bootstrap: add circular dependency detection (#350) (f18b825)
• config-assistant: add advanced options section (643f4da)
• config-assistant: add advanced options section (#432) (97f6f4e)
• docs-site: add custom favicon for branding (#383) (#398) (30cd6c1)
• docs-site: add form validation and reset to defaults (#421) (#447) (b2cd345)
• docs-site: add network settings section to configuration assistant (b9b069e)
• docs-site: add radio capabilities section to configuration assistant (3a45a0f)
• docs-site: add security settings to configuration assistant (06c16b9)
• docs-site: add site logo to header (#384) (#396) (c0da5cd)
• docs-site: configure logo to replace site title text (#401) (#402) (ea196b7)
• docs-site: improve logo visibility and readability (#399) (d613f55)
• docs-site: override Footer with light RPi-style footer (#395) (c7fd1fb)
• docs-site: override Header with RPi-style navigation (#393) (d420bbc)
• docs-site: restyle code blocks for cleaner light appearance (#382) (#405) (48c27c8)
• docs-site: style nav links like Raspberry Pi site (#394) (148bd6a)
• docs: add CardGrid with Starlight components (#446) (fb1a7cb)
• docs: add configuration assistant page (#412) (#426) (0a76b95)
• docs: add docs-check smoke test for site build (#355) (03d92fc)
• docs: add env file output generator to configuration assistant (98ad34c)
• docs: add link checking for markdown files (#356) (e3e2792)
• docs: disable pagination links globally (#404) (f144ecd)
• docs: increase navigation bar height (#372) (#391) (8169cc9)
• docs: update sidebar to clean white style (#373) (#392) (5c38691)
• docs: widen content area for desktop (#371) (#390) (fa30b05)
• npm: add supply chain attack hardening to .npmrc (#358) (13f99b6)
• pages: add GitHub Actions workflow for Pages deployment (#343) (4ea2a3f)
• pages: prebuild script to copy markdown into content collections (#342) (6ac4865)
• pages: scaffold Astro Starlight project in docs-site/ (#341) (0ac7bd8), closes #336
• theme-1-core: add Roboto font from Google Fonts (#388) (513d0f9), closes #369
• theme-1-core: set light mode as default theme (#386) (611efb7), closes #367
• theme-1-core: update accent color to Raspberry Pi red (#385) (ad91abe), closes #366
• theme-1-core: update body text color to match RPi style (#389) (1488f1e), closes #370
• theme-1-core: update grayscale palette to warmer tones (#387) (79c4e46), closes #368
• theme-4-polish: add consistent border-radius across components (#381) (#407) (5a814c7)
• theme-4-polish: add hero section to homepage (#377) (#406) (eb7db5b)
• theme-4-polish: add reusable Card component for content links (#378) (#408) (8202581)
• theme-4-polish: restyle admonitions to match RPi muted palette (#379) (#409) (949b0eb)
• theme-4-polish: update box shadows to softer diffused values (#380) (#410) (487d603)

🩹 Fixes

• ci: add prebuild step and scope deploy permissions (#364) (3778cc7), closes #360
• commands: close issues after merge in loop-issues command (#411) (6ce06ce)
• docs-site: ensure home.mdx and configuration-assistant.mdx are preserved during prebuild (#441) (7a38b81)
• docs-site: flatten multiline input/button tags for MDX compatibility (7e44684)
• docs-site: generate README.mdx with hero and CardGrid in copy-content.sh (#425) (73b601f)
• docs-site: use x-bind/x-on syntax for MDX compatibility (545c608)
• docs: add is:inline to Alpine.js script tags (#436) (b38c954)
• docs: correct script path for config-assistant.js (3435a49)
• docs: guard against duplicate starlight-menu-button registration (#442) (4e65060)
• docs: load config-assistant.js before Alpine.js to ensure function is defined (47aab41)
• docs: place config form labels and inputs on same line (#444) (bf680c5)
• docs: remove duplicate heading in configuration-assistant.mdx (#440) (4e1b4e6)
• docs: use correct base path for config-assistant.js and ensure correct load order (#435) (a632c34)
• pages: add docs-site artifacts to .gitignore (#348) (001cece)
• pages: add frontmatter to copied docs for Starlight schema (#346) (0f6e66f)
• pages: strip markdown heading to prevent duplicated page titles (#352) (2685110)

0.41.1 (2026-09-04)

🩹 Fixes

• atomic: clean up temp files on failure via trap (#323) (da2507d)
• core: replace external commands with pure bash (#325) (f6562ab)
• dhcp: declare local variables in explicit DHCP_RANGE path (#326) (cc9123e)
• passphrase: compute length after locale pin (#327) (4c0fa2e)

♻️ Code Refactoring

• radio: remove unreachable empty-string case branch (#335) (91c7227), closes #313

0.41.0 (2026-08-26)

✨ Features

• 802.11ax (HE) support via HE_ENABLED/HE_CAPAB (#296) (e095da1)
• clients.sh leases subcommand showing dnsmasq DHCP leases (#297) (a07fb21)
• fail healthcheck when HEALTHCHECK_MIN_STATIONS set but control interface missing (#283) (#300) (fc0ddc0)
• wlanstart.sh –check runtime state audit (#288) (#294) (c2ea720)

🩹 Fixes

• check nat_apply_rules/ipv6_apply_rules exit status (#279) (#304) (f3ff8d7)
• clients.sh reports error when hostapd_cli fails (#281) (#302) (d6e9ee1)
• COUNTRY_CODE set-but-empty skips regulatory default warning (#301) (09f66b1)
• deep healthcheck now honors CTRL_IFACE_DIR (#280) (#303) (9cd5d1f)
• MAC_FILTER=2 denylist emits macaddr_acl=0 (#278) (#305) (837904d)

♻️ Code Refactoring

• module-prefix private globals in lib/core/channel.sh (#285) (#298) (6a927f0)

0.40.0 (2026-08-26)

✨ Features

• wpa: add PMF (802.11w) toggle env var (#235) (#272) (a891db1)

🩹 Fixes

• docker: pin libssl3/libcrypto3 in apk install (#271) (#273) (5b7e943)
• upgrade alpine packages at image build to clear CVE-2026-14456 (#267) (55939d6)

♻️ Code Refactoring

• declarative module loading via lib/bootstrap.sh (#269) (0a16e33), closes #239
• deduplicate env plumbing in clients.sh and healthcheck.sh (#243) (#262) (417d2db)
• enforce <module>_<verb> naming convention across lib/ (#264) (f2aff80)
• extract config emission from wlanstart.sh into lib/core modules (#270) (1b4cee4)
• phase-based lifecycle with registered setup/teardown hooks (#265) (a780aa4)
• split lib/ into core/ (pure) and sys/ (effectful) layers (#268) (04b8ae8), closes #240

0.39.0 (2026-08-26)

✨ Features

• clients: station count command and optional min-stations healthcheck (#247) (29257e4), closes #234
• nat: validate OUTGOINGS interfaces exist before applying rules (#227) (#253) (c8c57aa)
• radio: add TX_POWER env var for transmit power control (#236) (#246) (f5c0422)
• secrets: add SSID_FILE and WPA_PASSPHRASE_FILE inputs (#232) (#248) (d670759)

🩹 Fixes

• channel: normalize COUNTRY_CODE / HW_MODE case before validation (#222) (#258) (7095777)
• channel: validate 5 GHz channels against COUNTRY_CODE (#221) (#259) (ed2ad8f)
• dhcp: add bind-dynamic to avoid host DHCP conflicts (#223) (#257) (1f557d5)
• healthcheck passes forever when started-time file is missing (#261) (9fad925)
• ipv6: handle sysctl failure in enable_ipv6_forwarding gracefully (#225) (#255) (9202fdf)
• use iptables probe for privileged-mode check (#228) (#252) (6521fbc)
• wpa: emit ieee80211w PMF for WPA3-SAE and mixed mode (#220) (#260) (f29d1cc)

♻️ Code Refactoring

• channel: emit informational warnings at most once per run (#231) (#249) (1d9bd7a)
• dhcp: compute DHCP range once per startup (#224) (#256) (a8c5f11)
• env: centralize environment defaults into lib/env.sh (#237) (#244) (f928f04)

0.38.0 (2026-08-25)

✨ Features

• channel: support CHANNEL=acs automatic channel selection (#203) (4105bcf)
• clients: add –json machine-readable station output (#202) (9258831), closes #198
• dhcp: validate AP_ADDR lies inside SUBNET/mask (#211) (1bcb6a8), closes #189
• dhcp: validate DHCP range order, subnet bounds and AP overlap (#210) (df14903), closes #190
• hostapd: HOSTAPD_EXTRA_OPTS passthrough for extra config lines (#204) (5759ed6)
• logging: retain timestamped failure logs with rotation (#199) (#200) (9ac178a)

🩹 Fixes

• channel: allow channel 14 only for JP + hw_mode=b (#207) (714bdab), closes #193
• config: require HW_MODE=a when VHT_ENABLED is set (#209) (2e70381), closes #191
• healthcheck: explicit error when HEALTHCHECK_DEEP lacks INTERFACE (#215) (1b4733f)
• healthcheck: guard HEALTHCHECK_START_PERIOD against non-numeric values (#208) (8b8b199), closes #192
• interface: teardown removes only configured AP_ADDR, not all addresses (#188) (#212) (636e76e)
• security: prevent config injection via WPA_PASSPHRASE/PRI_DNS/SEC_DNS (#216) (91b08d1), closes #184
• signals: defer teardown until multirun children have exited (#217) (bb1b032), closes #183
• stations: make invalid MAX_STATIONS fatal at validation (#213) (991271a), closes #187

♻️ Code Refactoring

• scripts: invoke get-version.sh with bash consistently (#205) (2e6158c), closes #195

0.37.0 (2026-08-25)

✨ Features

• add –version flag to wlanstart.sh (#178) (33984f1)
• add leveled logging library (#181) (474efd2)
• clients: add deauth subcommand (#166) (#180) (1b4cb29)
• reject unknown HW_MODE in validate mode (#163) (#176) (2866361)
• retain daemon failure log on non-zero exit (#175) (122fdd6)
• support configurable subnet mask (#165) (#179) (e9dfea0)

🩹 Fixes

• generate configs atomically via temp file (#173) (8f707f7)
• handle missing/non-numeric sysctl in nat setup (#174) (74ab1c2)
• make ipv6 rule functions self-contained (#159) (#171) (e95da21)

0.36.0 (2026-08-25)

✨ Features

• clients: clear error when control interface disabled (#161) (#169) (737838b)
• clients: opt-in ctrl_interface and clients.sh for listing connected stations (#134) (925eec9)
• entrypoint: add –validate dry-run mode with CI env matrix (#135) (6afcec1)
• healthcheck: add opt-in deep AP beacon check via hostapd_cli (#123) (#136) (f4877b9)
• logging: tag daemon output and report failing service on multirun exit (#119) (#133) (72d19ca)

🩹 Fixes

• dhcp: validate DHCP_RANGE fields and SUBNET instead of comma-count only (#113) (#128) (d032fa7)
• entrypoint: handle signals received before multirun starts (#125) (ba15dea)
• entrypoint: validate AP_ADDR/SUBNET and abort on IP setup failure (#114) (#127) (532d34e)
• healthcheck: anchor IP match and require interface state UP (#112) (#129) (c63012b)
• healthcheck: measure grace period from container start time, not host uptime (#111) (#130) (56f0d33)
• mac_filter: make disabled path a silent no-op returning success (#116) (#131) (ccf01a5)
• validate SSID before writing hostapd.conf (#170) (a4fdafb)

♻️ Code Refactoring

• entrypoint: extract NAT/interface logic into lib/nat.sh and lib/interface.sh (#132) (c2c996b)
• healthcheck: add set -euo pipefail strict mode (#154) (2a6bcbc), closes #151
• lib: add missing shellcheck source/shell directives (#155) (dc47633), closes #152
• scripts: apply shellcheck style-level cleanups (#156) (447f27a), closes #153

0.35.0 (2026-08-24)

✨ Features

• channel: validate 5GHz channels for hw_mode=a with DFS warning (#89) (#99) (a91d928)
• healthcheck: verify AP IP assigned to interface (#105) (66d241d), closes #91
• MAC address filtering (allowlist/denylist) (#103) (4da0787), closes #93
• optional IPv6 support (RA/DHCPv6 via dnsmasq) (#102) (c8667ab), closes #94
• tests: end-to-end system test with mac80211_hwsim (#108) (7830f5e)
• use multirun to manage hostapd/dnsmasq processes (#106) (3204bd6)

🩹 Fixes

• flush interface address and bring link down in cleanup() (#88) (#100) (d74fbd7)
• validate WPA_PASSPHRASE length (8-63 chars) before starting daemons (#97) (6bd6c01), closes #90

0.34.0 (2026-08-22)

✨ Features

• add AP_ISOLATION env var to isolate wireless clients (#56) (201ede0)
• add HEALTHCHECK to Dockerfile (#36) (#60) (a1296c4)
• add HIDE_SSID env var to suppress SSID broadcast (#55) (0c4b424), closes #32
• add MAX_STATIONS env var to limit connected clients (#54) (691970d)
• region-aware channel validation with COUNTRY_CODE (default EU) (#68) (df5cee6)
• validate CHANNEL against HW_MODE (#38) (#58) (ed21c27)
• wpa: add WPA3/SAE support via WPA_VERSION env var (#74) (15f1ab8)

🩹 Fixes

• always regenerate /etc/hostapd.conf so env var changes apply (#62) (#67) (ca571fc)
• correct ‘Througput’ typo in wlanstart.sh comments (#66) (8d2c81f)
• quote remaining expansions and use arrays for OUTGOINGS parsing (#72) (07d4d7d)
• replace deprecated ifconfig with ip commands on Linux (#51) (585dc4e), closes #28
• sync Dockerfile VERSION with release-please manifest (#70) (6c50cda)
• wlanstart: add bats tests for graceful shutdown cleanup (50c6043)
• wlanstart: add graceful shutdown with proper daemon cleanup (bfbed79), closes #37

♻️ Code Refactoring

• extract AP_ISOLATION logic to shared lib (#82) (0d824f0)
• extract channel validation to shared lib/channel.sh (#86) (ab13c0b)
• extract default-credential warnings to shared lib/warnings.sh (#80) (#81) (7b9cad7)
• extract DHCP_RANGE logic to shared lib/dhcp.sh (fixes #76) (#85) (508e4a8)
• extract HIDE_SSID logic to shared lib/ssid_hidden.sh (#83) (ea2e373), closes #78
• extract MAX_STATIONS logic to shared lib/stations.sh (#77) (#84) (ba76302)
• replace ‘true ${VAR:=x}’ idiom with ‘: “${VAR:=x}”’ (#73) (36ae37f)

0.33.0 (2026-08-21)

Features

• add DHCP_RANGE env var for explicit control (#40) (#47) (6738670)

Bug Fixes

• add exit-on-error for dnsmasq and hostapd startup (#49) (00f8405), closes #30
• use DOCKERHUB_USER secret name (a497462)

0.32.0 (2026-08-09)

Features

• modernize stack - alpine 3.24, dnsmasq, GitHub Actions, release-please (77b5fd6)
• modernize stack - alpine 3.24, dnsmasq, GitHub Actions, release-please (40c96e4)

Bug Fixes

• change release-please type from docker to simple (6f9ac70)