NEWS.rst
Bug corrected:
Enhancements:
Security patches:
Continious integration and documentation:
Thanks to all the contributors for this version: csvke, Christian Rishøj, duriantaco, Julio César Suástegui, Paul and morimori-dev.
Bug corrected:
Enhancements:
Security patches:
Continious integration and documentation:
Thanks to all the contributors for this version: Christian Rishøj, Jeongwoo Kim, Ofek Gabay, Steve Kowalik, Tanishq Shah, Mithun M.
Bug corrected:
Security patches:
Breaking changes: This release addresses 8 security vulnerabilities (see below).
Several of the mitigations change observable behaviour. Users who run Glances in
web server or API mode (-w / --enable-webserver) should read the items below before upgrading.
[CVE-2026-32632] Host header validation is now enforced on the
built-in web server. Requests whose Host header does not match
localhost or 127.0.0.1 will be rejected with HTTP 400 by
default. Users accessing Glances through a reverse proxy, a custom
hostname, or a non-loopback IP address must declare the allowed
values with the new allowed_hosts key in the [outputs]
section of glances.conf (comma-separated list). This was
already required for the MCP server since 4.5.1; it now also
applies to the main REST/WebUI server.
[CVE-2026-32610] The default CORS policy is now restrictive.
Previously, the server replied with Access-Control-Allow-Origin: *
which allowed any web page to issue credentialed cross-origin requests
against the API. The wildcard is removed. Users running third-party
web dashboards or custom front-ends on a different origin must
explicitly list allowed origins with the cors_origins key in the
[outputs] section of glances.conf.
[CVE-2026-32609] Sensitive fields are now redacted on unauthenticated
API responses. The /api/4/args and /api/4/config endpoints no
longer return password hashes, SSL key paths, or SNMP community
strings to callers that have not authenticated. Scripts and
integrations that relied on reading these values from the API must
now authenticate (token or password) to receive them.
[CVE-2026-32633, CVE-2026-32634] The Browser (multi-server mode)
no longer forwards configured credentials to remote Glances servers,
whether discovered via Zeroconf or listed in the [serverlist]
section. Credentials are only sent after the user explicitly logs in
to an individual server. Automated setups that relied on transparent
credential propagation must switch to per-server authentication.
[CVE-2026-32596] A WARNING is now printed to stdout at startup when
the REST API is running without authentication (no --password and
no API token configured). This is an informational message; the
unauthenticated mode itself is unchanged and remains the default for
private-network deployments. Startup scripts or monitoring pipelines
that treat any stderr/stdout output as a failure may need to be
updated.
[CVE-2026-32611] The DuckDB export module now uses parameterized DDL statements. Table names derived from plugin or metric names are sanitized before use. Existing DuckDB databases whose table names contained characters that were previously interpolated verbatim may need to be recreated.
[CVE-2026-32608] Process names used in [action] command templates
are now shell-escaped before substitution. Templates that relied on
unescaped special characters in process names to construct compound
shell expressions will no longer behave as before.
Thanks to @psyberck for the UI patch and @DhiyaneshGeek / @restriction for CVEs reports.
Bug corrected:
Enhancements:
Security patches:
Code quality:
Thanks to all the contributors for this version: @YamiYukiSenpai, @amzon-ex, @axodentally, @fpusan, @janusn, @kleinmatic, @lcheylus, @lubomir-moric, @mark-rahal, @mikemhenry, @Ambika-Patidar, @AbdelhamidKhald, @Julietmgbole, @sdoshi2061, @cjlindem, @theamanrawat
Bugs corrected:
Continious integration:
Bugs corrected:
Bugs corrected:
Enhancements:
Bugs corrected:
Continious integration and documentation:
Thanks to all contributors and bug reporters !
Special thanks to:
Bug corrected:
Breaking changes:
Enhancements:
Bug corrected:
Continious integration and documentation:
Thanks to all contributors and bug reporters !
Special thanks to:
Bug corrected:
Thanks to the FastAPI and Home Assistant community for the support.
Enhancements:
Bug corrected:
Continious integration and documentation:
Thanks to all contributors and bug reporters !
Special thanks to:
Enhancements:
Bug corrected:
Continious integration:
Thanks to all contributors and bug reporters !
Special thanks to:
Bug corrected:
Bug corrected:
Bug corrected:
Continuous integration and documentation:
Bug corrected:
Continuous integration and documentation:
Continuous integration and documentation:
Enhancements:
Enhancements:
Bug corrected:
Enhancements:
Bug corrected:
Continuous integration and documentation:
Thanks to all contributors and bug reporters !
Special thanks to:
Enhancements:
Bug corrected:
Continuous integration and documentation:
Thanks to all contributors and bug reporters !
Special thanks to:
Enhancements:
Bug corrected:
Continuous integration and documentation:
Improve code quality (thanks to Ariel Otilibili !):
Thanks to all contributors and bug reporters !
Special thanks to:
Bug corrected:
Bug corrected:
Enhancements:
Bug corrected:
Continuous integration and documentation:
Thanks to all contributors and bug reporters !
Special thanks to:
Use Ruff as default Linter.
Hostfix release for support sensors plugin on python 3.8
Additional fixes for Sensor plugin
Thanks to RazCrimson for the sensors patch !
Correct issue with CI (miss pydantic dep).
See release note in Wiki format: https://github.com/nicolargo/glances/wiki/Glances-4.0-Release-Note
BREAKING CHANGES:
Glances version 3.x and lower:
sda1_alias=InternalDisk
sdb1_alias=ExternalDisk
Glances version 4.x and higher:
alias=sda1:InternalDisk,sdb1:ExternalDisk
Special notes for package maintainers:
Minimal requirements for Glances version 4 are:
Majors changes between Glances version 3 and version 4:
Enhancements:
Bug corrected:
CI and documentation:
Many thinks to the contributors:
Correct issue with GPU plugin in Docker images #2705
Cyber security patch (update some deps in the WebUI and Docker image)
Bugs corrected:
Bugs corrected:
Bug corrected:
Enhancements:
Bug corrected:
Documentation and CI:
Cyber security update:
Refactor the Docker images factory, from now, Alpine and Ubuntu images will be provided (nicolargo/glances):
Contributors for this version:
Hard patch on the master branch.
Bug corrected:
Enhancements:
Bug corrected:
Documentation and CI:
Cyber security update:
Contributors for this version:
And also a big thanks to @RazCrimson (https://github.com/RazCrimson) for the support to the Glances community !
Refactor the Docker images factory, from now, only Alpine image will be provided.
The following Docker images (nicolargo/glances) are availables:
Bug corrected:
Just a version to rebuild the Docker images.
Enhancements:
Bug corrected:
Documentation and CI:
Contributors for this version:
Enhancements:
Bug corrected:
Documentation and CI:
Contributors for this version:
Enhancement requests:
Bug corrected:
A big thanks to @RazCrimson for his contribution !
Thanks for others contributors:
Enhancement requests:
Bugs corrected:
Thanks for the bug report and the patch: @RazCrimson, @Karthikeyan Singaravelan, @Moldavite, @ledwards
Bugs corrected:
Bugs corrected:
Enhancement requests:
Contributors for this version:
Patch to correct issue (regression) #1922:
Bugs corrected:
Enhancement requests:
Bugs corrected:
Documentation: The "make docs" generate RestFul/API documentation file.
Bugs corrected:
Enhancement requests:
This release is a major version (but minor number because the API did not change). It focus on
CPU consumption. I use Flame profiling https://github.com/nicolargo/glances/wiki/Glances-FlameGraph_
and code optimization to reduce CPU consumption from 20% to 50% depending on your system.
Enhancement and development requests:
Bugs corrected:
Contributors for this version:
Enhancements and bug corrected:
Contributors for this version:
- Nicolargo
- Deosrc
- dependabot[bot]
- Michael J. Cohen
- Rui Chen
- Stefan Eßer
- Tuux
Bugs corrected:
Bugs corrected:
Enhancements and new features:
Bugs corrected:
Enhancements and new features:
Bugs corrected:
Enhancements and new features:
Bugs corrected:
Enhancements and new features:
Bugs corrected:
Others:
Enhancements and new features:
Bugs corrected:
Others:
Enhancements and new features:
Bugs corrected:
l keypress (hide alert log) not working after some time #1449Others:
Enhancements and new features:
Bugs corrected:
Others:
Bug corrected:
Bug corrected:
See the release note here: https://github.com/nicolargo/glances/wiki/Glances-3.0-Release-Note
Enhancements and new features:
Make the left side bar width dynamic in the Curse UI #1177
Add threads number in the process list #1259
A way to have only REST API available and disable WEB GUI access #1149
Refactor graph export plugin (& replace Matplolib by Pygal) #697
Docker module doesn't export details about stopped containers #1152
Add dynamic fields in all sections of the configuration file #1204
Make plugins and export CLI option dynamical #1173
Add a light mode for the console UI #1165
Refactor InfluxDB (API is now stable) #1166
Add deflate compression support to the RestAPI #1182
Add a code of conduct for Glances project's participants #1211
Context switches bottleneck identification #1212
Take advantage of the psutil issue #1025 (Add process_iter(attrs, ad_value)) #1105
Nice Process Priority Configuration #1218
Display debug message if dep lib is not found #1224
Add a new output mode to stdout #1168
Huge refactor of the WebUI packaging thanks to @spike008t #1239
Add time zone to the current time #1249
Use HTTPs URLs to check public IP address #1253
Add labels support to Promotheus exporter #1255
Overlap in Web UI when monitoring a machine with 16 cpu threads #1265
Support for exporting data to a MQTT server #1305
One more thing ! A new Grafana Dash is available with:
Network interface variable
Disk variable
Container CPU
Bugs corrected:
Backward-incompatible changes:
News command line options:
--disable-webui Disable the WebUI (only RESTful API will respond)
--enable-light Enable the light mode for the UI interface
--modules-list Display plugins and exporters list
--disable-plugin plugin1,plugin2
Disable a list of comma separated plugins
--export exporter1,exporter2
Export stats to a comma separated exporters
--stdout plugin1,plugin2.attribute
Display stats to stdout
News configuration keys in the glances.conf file:
Graph:
[graph]
# Configuration for the --export graph option
# Set the path where the graph (.svg files) will be created
# Can be overwrite by the --graph-path command line option
path=/tmp
# It is possible to generate the graphs automatically by setting the
# generate_every to a non zero value corresponding to the seconds between
# two generation. Set it to 0 to disable graph auto generation.
generate_every=60
# See following configuration keys definitions in the Pygal lib documentation
# http://pygal.org/en/stable/documentation/index.html
width=800
height=600
style=DarkStyle
Processes list Nice value:
[processlist]
# Nice priorities range from -20 to 19.
# Configure nice levels using a comma-separated list.
#
# Nice: Example 1, non-zero is warning (default behavior)
nice_warning=-20,-19,-18,-17,-16,-15,-14,-13,-12,-11,-10,-9,-8,-7,-6,-5,-4,-3,-2,-1,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19
#
# Nice: Example 2, low priority processes escalate from careful to critical
#nice_careful=1,2,3,4,5,6,7,8,9
#nice_warning=10,11,12,13,14
#nice_critical=15,16,17,18,19
Docker plugin (related to #1152)
[docker]
# By default, Glances only display running containers
# Set the following key to True to display all containers
all=False
All configuration file values (related to #1204)
[influxdb]
# It is possible to use dynamic system command
prefix=`hostname`
tags=foo:bar,spam:eggs,system:`uname -a`
Enhancements and new features:
Bugs corrected:
OSError: [Errno 19] No such device (issue #1106)UnicodeDecodeError on mountpoints with non-breaking spaces (issue #1128)Installation:
Enhancements and new features:
Bugs corrected:
Installation:
Bugs corrected:
Enhancements and new features:
Bugs corrected:
Bugs corrected:
Bugs corrected:
Bugs corrected:
Bugs corrected:
Bugs corrected:
Enhancements and new features:
Bugs corrected:
Bugs corrected:
Enhancements and new features:
Bugs corrected:
Changes:
Enhancements and new features:
Bugs corrected:
enable setting (issue #932)Bugs corrected:
Backward-incompatible changes:
Deprecated:
Enhancements and new features:
Bugs corrected:
Code quality follow up: from 5.93 to 6.24 (source: https://scrutinizer-ci.com/g/nicolargo/glances)
Bugs corrected:
Enhancements and new features:
Bugs corrected:
Deprecations:
Enhancements and new features:
Bugs corrected:
Others:
Contributors summary:
Bugs corrected:
Enhancements and new features:
Bugs corrected:
Bugs corrected:
Bugs corrected:
Changes:
Enhancements and new features:
Bugs corrected:
Enhancements and new features:
Bugs corrected:
Other enhancement:
Enhancements and new features:
Bugs corrected:
Maintenance version (only needed for Mac OS X).
Bugs corrected:
Enhancement:
Bugs corrected:
Bugs corrected:
Maintenance version.
Bugs corrected:
Glances v2.0 is not a simple upgrade of the version 1.x but a complete code refactoring.
Based on a plugins system, it aims at providing an easy way to add new features.
- Core defines the basics and commons functions.
- all stats are grabbed through plugins (see the glances/plugins source folder).
- also outputs methods (Curse, Web mode, CSV) are managed as plugins.
The Curse interface is almost the same than the version 1.7. Some improvements have been made:
- space optimisation for the CPU, LOAD and MEM stats (justified alignment)
- CPU:
. CPU stats are displayed as soon as Glances is started
. steal CPU alerts are no more logged
- LOAD:
. 5 min LOAD alerts are no more logged
- File System:
. Display the device name (if space is available)
- Sensors:
. Sensors and HDD temperature are displayed in the same block
- Process list:
. Refactor columns: CPU%, MEM%, VIRT, RES, PID, USER, NICE, STATUS, TIME, IO, Command/name
. The running processes status is highlighted
. The process name is highlighted in the command line
Glances 2.0 brings a brand new Web Interface. You can run Glances in Web server mode and
consult the stats directly from a standard Web Browser.
The client mode can now fallback to a simple SNMP mode if Glances server is not found on the remote machine.
Complete release notes: