From 2db71b37d7755790c31a49e31749817f41b53660 Mon Sep 17 00:00:00 2001 From: Adnan Mazharuddin Shaikh Date: Mon, 9 Feb 2026 22:29:55 -0800 Subject: [PATCH 01/21] Remove misleading TODO comment for SetWebPassword The TODO suggested removing SetWebPassword in favor of direct pihole-FTL config commands, but this would be a security regression. The wrapper function provides important benefits: - Interactive password entry with hidden input - Password confirmation to prevent typos - No password exposure in shell history - User-friendly error messages - Safe Ctrl+C handling The function should be maintained, not removed. Signed-off-by: Adnan Mazharuddin Shaikh --- pihole | 1 - 1 file changed, 1 deletion(-) diff --git a/pihole b/pihole index 5af46fa6..0353129b 100755 --- a/pihole +++ b/pihole @@ -38,7 +38,6 @@ if [ -f "${versionsfile}" ]; then source "${versionsfile}" fi -# TODO: We can probably remove the reliance on this function too, just tell people to pihole-FTL --config webserver.api.password "password" SetWebPassword() { if [ -n "$2" ] ; then readonly PASSWORD="$2" From c8ff8b747f19285ba6be5c6f896a65015881562a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 21 Feb 2026 10:02:39 +0000 Subject: [PATCH 02/21] Bump tox from 4.35.0 to 4.44.0 in /test in the python-dependencies group Bumps the python-dependencies group in /test with 1 update: [tox](https://github.com/tox-dev/tox). Updates `tox` from 4.35.0 to 4.44.0 - [Release notes](https://github.com/tox-dev/tox/releases) - [Changelog](https://github.com/tox-dev/tox/blob/main/docs/changelog.rst) - [Commits](https://github.com/tox-dev/tox/compare/4.35.0...4.44.0) --- updated-dependencies: - dependency-name: tox dependency-version: 4.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-dependencies ... Signed-off-by: dependabot[bot] --- test/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/requirements.txt b/test/requirements.txt index 61f18c4e..1b32121d 100644 --- a/test/requirements.txt +++ b/test/requirements.txt @@ -2,5 +2,5 @@ pyyaml == 6.0.3 pytest == 9.0.2 pytest-xdist == 3.8.0 pytest-testinfra == 10.2.2 -tox == 4.35.0 +tox == 4.44.0 pytest-clarity == 1.0.1 From f2af7c8970bf6f2f7f1a477f32ae542ef8661e0b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 21 Feb 2026 10:02:51 +0000 Subject: [PATCH 03/21] Bump the github-actions-dependencies group with 2 updates Bumps the github-actions-dependencies group with 2 updates: [github/codeql-action](https://github.com/github/codeql-action) and [actions/stale](https://github.com/actions/stale). Updates `github/codeql-action` from 4.32.3 to 4.32.4 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/9e907b5e64f6b83e7804b09294d44122997950d6...89a39a4e59826350b863aa6b6252a07ad50cf83e) Updates `actions/stale` from 10.1.1 to 10.2.0 - [Release notes](https://github.com/actions/stale/releases) - [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/stale/compare/997185467fa4f803885201cee163a9f38240193d...b5d41d4e1d5dceea10e7104786b73624c18a190f) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.32.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions-dependencies - dependency-name: actions/stale dependency-version: 10.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-dependencies ... Signed-off-by: dependabot[bot] --- .github/workflows/codeql-analysis.yml | 6 +++--- .github/workflows/stale.yml | 2 +- .github/workflows/stale_pr.yml | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index ee923724..1abe38e6 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -29,12 +29,12 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@9e907b5e64f6b83e7804b09294d44122997950d6 #v4.32.3 + uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e #v4.32.4 with: languages: 'python' - name: Autobuild - uses: github/codeql-action/autobuild@9e907b5e64f6b83e7804b09294d44122997950d6 #v4.32.3 + uses: github/codeql-action/autobuild@89a39a4e59826350b863aa6b6252a07ad50cf83e #v4.32.4 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@9e907b5e64f6b83e7804b09294d44122997950d6 #v4.32.3 + uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e #v4.32.4 diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index 1e044ec9..bb646a3e 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -17,7 +17,7 @@ jobs: issues: write steps: - - uses: actions/stale@997185467fa4f803885201cee163a9f38240193d #v10.1.1 + - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f #v10.2.0 with: repo-token: ${{ secrets.GITHUB_TOKEN }} days-before-stale: 30 diff --git a/.github/workflows/stale_pr.yml b/.github/workflows/stale_pr.yml index 6dfcbe99..44605aab 100644 --- a/.github/workflows/stale_pr.yml +++ b/.github/workflows/stale_pr.yml @@ -17,7 +17,7 @@ jobs: pull-requests: write steps: - - uses: actions/stale@997185467fa4f803885201cee163a9f38240193d #v10.1.1 + - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f #v10.2.0 with: repo-token: ${{ secrets.GITHUB_TOKEN }} # Do not automatically mark PR/issue as stale From f28233729cf6fcd963669faa2c01748d986b256b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christian=20K=C3=B6nig?= Date: Tue, 24 Feb 2026 08:51:07 +0100 Subject: [PATCH 04/21] Remove additional ':' from debug log system time output MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Christian König --- advanced/Scripts/piholeDebug.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/advanced/Scripts/piholeDebug.sh b/advanced/Scripts/piholeDebug.sh index 964fff9b..baf75d24 100755 --- a/advanced/Scripts/piholeDebug.sh +++ b/advanced/Scripts/piholeDebug.sh @@ -169,7 +169,7 @@ initialize_debug() { # Display that the debug process is beginning log_write "${COL_PURPLE}*** [ INITIALIZING ]${COL_NC}" # Timestamp the start of the log - log_write "${INFO} $(date "+%Y-%m-%d:%H:%M:%S") debug log has been initialized." + log_write "${INFO} $(date "+%Y-%m-%d %H:%M:%S") debug log has been initialized." # Uptime of the system # credits to https://stackoverflow.com/questions/28353409/bash-format-uptime-to-show-days-hours-minutes system_uptime=$(uptime | awk -F'( |,|:)+' '{if ($7=="min") m=$6; else {if ($7~/^day/){if ($9=="min") {d=$6;m=$8} else {d=$6;h=$8;m=$9}} else {h=$6;m=$7}}} {print d+0,"days,",h+0,"hours,",m+0,"minutes"}') From 6dc67a48e92c81449c829111c6b7ad03621efd70 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 28 Feb 2026 10:02:45 +0000 Subject: [PATCH 05/21] Bump tox from 4.44.0 to 4.46.3 in /test in the python-dependencies group Bumps the python-dependencies group in /test with 1 update: [tox](https://github.com/tox-dev/tox). Updates `tox` from 4.44.0 to 4.46.3 - [Release notes](https://github.com/tox-dev/tox/releases) - [Changelog](https://github.com/tox-dev/tox/blob/main/docs/changelog.rst) - [Commits](https://github.com/tox-dev/tox/compare/4.44.0...4.46.3) --- updated-dependencies: - dependency-name: tox dependency-version: 4.46.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-dependencies ... Signed-off-by: dependabot[bot] --- test/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/requirements.txt b/test/requirements.txt index 1b32121d..0d55b839 100644 --- a/test/requirements.txt +++ b/test/requirements.txt @@ -2,5 +2,5 @@ pyyaml == 6.0.3 pytest == 9.0.2 pytest-xdist == 3.8.0 pytest-testinfra == 10.2.2 -tox == 4.44.0 +tox == 4.46.3 pytest-clarity == 1.0.1 From 36601eef3a36ca86bd85d9e438b8b4ea51be2cf2 Mon Sep 17 00:00:00 2001 From: RD WebDesign Date: Sun, 1 Mar 2026 17:26:20 -0300 Subject: [PATCH 06/21] Remove `readonly` from piholeNetworkFlush.sh to avoid error message This is a quick fix to avoid the error when api.sh tries to set the variable again. Signed-off-by: RD WebDesign --- advanced/Scripts/piholeNetworkFlush.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/advanced/Scripts/piholeNetworkFlush.sh b/advanced/Scripts/piholeNetworkFlush.sh index a8721476..a156362d 100755 --- a/advanced/Scripts/piholeNetworkFlush.sh +++ b/advanced/Scripts/piholeNetworkFlush.sh @@ -15,7 +15,7 @@ if [[ -f ${coltable} ]]; then source ${coltable} fi -readonly PI_HOLE_SCRIPT_DIR="/opt/pihole" +PI_HOLE_SCRIPT_DIR="/opt/pihole" utilsfile="${PI_HOLE_SCRIPT_DIR}/utils.sh" # shellcheck source=./advanced/Scripts/utils.sh source "${utilsfile}" From 752273f4000198a4ed426ade7c4d0b4acd4354fd Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 7 Mar 2026 10:02:46 +0000 Subject: [PATCH 07/21] Bump tox from 4.46.3 to 4.49.0 in /test in the python-dependencies group Bumps the python-dependencies group in /test with 1 update: [tox](https://github.com/tox-dev/tox). Updates `tox` from 4.46.3 to 4.49.0 - [Release notes](https://github.com/tox-dev/tox/releases) - [Changelog](https://github.com/tox-dev/tox/blob/main/docs/changelog.rst) - [Commits](https://github.com/tox-dev/tox/compare/4.46.3...4.49.0) --- updated-dependencies: - dependency-name: tox dependency-version: 4.49.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-dependencies ... Signed-off-by: dependabot[bot] --- test/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/requirements.txt b/test/requirements.txt index 0d55b839..9c56f0ec 100644 --- a/test/requirements.txt +++ b/test/requirements.txt @@ -2,5 +2,5 @@ pyyaml == 6.0.3 pytest == 9.0.2 pytest-xdist == 3.8.0 pytest-testinfra == 10.2.2 -tox == 4.46.3 +tox == 4.49.0 pytest-clarity == 1.0.1 From 8834b49fd342d7e50d1bd76b192bdb6deaaca8b9 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 7 Mar 2026 10:02:47 +0000 Subject: [PATCH 08/21] Bump the github-actions-dependencies group with 2 updates Bumps the github-actions-dependencies group with 2 updates: [github/codeql-action](https://github.com/github/codeql-action) and [psf/black](https://github.com/psf/black). Updates `github/codeql-action` from 4.32.4 to 4.32.6 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/89a39a4e59826350b863aa6b6252a07ad50cf83e...0d579ffd059c29b07949a3cce3983f0780820c98) Updates `psf/black` from 26.1.0 to 26.3.0 - [Release notes](https://github.com/psf/black/releases) - [Changelog](https://github.com/psf/black/blob/main/CHANGES.md) - [Commits](https://github.com/psf/black/compare/6305bf1ae645ab7541be4f5028a86239316178eb...35ea67920b7f6ac8e09be1c47278752b1e827f76) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.32.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions-dependencies - dependency-name: psf/black dependency-version: 26.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-dependencies ... Signed-off-by: dependabot[bot] --- .github/workflows/codeql-analysis.yml | 6 +++--- .github/workflows/test.yml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 1abe38e6..242a9de5 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -29,12 +29,12 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e #v4.32.4 + uses: github/codeql-action/init@0d579ffd059c29b07949a3cce3983f0780820c98 #v4.32.6 with: languages: 'python' - name: Autobuild - uses: github/codeql-action/autobuild@89a39a4e59826350b863aa6b6252a07ad50cf83e #v4.32.4 + uses: github/codeql-action/autobuild@0d579ffd059c29b07949a3cce3983f0780820c98 #v4.32.6 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e #v4.32.4 + uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 #v4.32.6 diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 6482e242..7ece91fe 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -49,7 +49,7 @@ jobs: run: editorconfig-checker - name: Check python code formatting with black - uses: psf/black@6305bf1ae645ab7541be4f5028a86239316178eb #26.1.0 + uses: psf/black@35ea67920b7f6ac8e09be1c47278752b1e827f76 #26.3.0 with: src: "./test" options: "--check --diff --color" From ed3f72958b1b11da10fbc3ed840437549640f985 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 14 Mar 2026 10:02:24 +0000 Subject: [PATCH 09/21] Bump psf/black in the github-actions-dependencies group Bumps the github-actions-dependencies group with 1 update: [psf/black](https://github.com/psf/black). Updates `psf/black` from 26.3.0 to 26.3.1 - [Release notes](https://github.com/psf/black/releases) - [Changelog](https://github.com/psf/black/blob/main/CHANGES.md) - [Commits](https://github.com/psf/black/compare/35ea67920b7f6ac8e09be1c47278752b1e827f76...c6755bb741b6481d6b3d3bb563c83fa060db96c9) --- updated-dependencies: - dependency-name: psf/black dependency-version: 26.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions-dependencies ... Signed-off-by: dependabot[bot] --- .github/workflows/test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 7ece91fe..bab7e036 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -49,7 +49,7 @@ jobs: run: editorconfig-checker - name: Check python code formatting with black - uses: psf/black@35ea67920b7f6ac8e09be1c47278752b1e827f76 #26.3.0 + uses: psf/black@c6755bb741b6481d6b3d3bb563c83fa060db96c9 #26.3.1 with: src: "./test" options: "--check --diff --color" From 47de7d5913b34fd36c612d4db65b0f9a43273580 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 14 Mar 2026 10:02:46 +0000 Subject: [PATCH 10/21] Bump tox from 4.49.0 to 4.49.1 in /test in the python-dependencies group Bumps the python-dependencies group in /test with 1 update: [tox](https://github.com/tox-dev/tox). Updates `tox` from 4.49.0 to 4.49.1 - [Release notes](https://github.com/tox-dev/tox/releases) - [Changelog](https://github.com/tox-dev/tox/blob/main/docs/changelog.rst) - [Commits](https://github.com/tox-dev/tox/compare/4.49.0...4.49.1) --- updated-dependencies: - dependency-name: tox dependency-version: 4.49.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-dependencies ... Signed-off-by: dependabot[bot] --- test/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/requirements.txt b/test/requirements.txt index 9c56f0ec..c8feda47 100644 --- a/test/requirements.txt +++ b/test/requirements.txt @@ -2,5 +2,5 @@ pyyaml == 6.0.3 pytest == 9.0.2 pytest-xdist == 3.8.0 pytest-testinfra == 10.2.2 -tox == 4.49.0 +tox == 4.49.1 pytest-clarity == 1.0.1 From e001c8747965a73737bd5c4a5e7c57420e06b698 Mon Sep 17 00:00:00 2001 From: Adam Warner Date: Wed, 18 Mar 2026 21:37:54 +0000 Subject: [PATCH 11/21] Refactor version loading to enhance security and prevent shell injection Signed-off-by: Adam Warner --- advanced/Scripts/piholeDebug.sh | 6 ++-- advanced/Scripts/utils.sh | 51 +++++++++++++++++++++++++++++++++ advanced/Scripts/version.sh | 13 +++++---- pihole | 10 ++----- 4 files changed, 65 insertions(+), 15 deletions(-) diff --git a/advanced/Scripts/piholeDebug.sh b/advanced/Scripts/piholeDebug.sh index baf75d24..1ca5ae3c 100755 --- a/advanced/Scripts/piholeDebug.sh +++ b/advanced/Scripts/piholeDebug.sh @@ -41,8 +41,10 @@ else #OVER="\r\033[K" fi -# shellcheck source=/dev/null -. /etc/pihole/versions +# shellcheck source=./advanced/Scripts/utils.sh +source /opt/pihole/utils.sh + +loadVersionFile /etc/pihole/versions # Read the value of an FTL config key. The value is printed to stdout. get_ftl_conf_value() { diff --git a/advanced/Scripts/utils.sh b/advanced/Scripts/utils.sh index d000a6db..3a09a980 100755 --- a/advanced/Scripts/utils.sh +++ b/advanced/Scripts/utils.sh @@ -42,6 +42,57 @@ addOrEditKeyValPair() { fi } +####################### +# Safely loads key=value pairs from the Pi-hole versions cache file. +# Unlike `source`, this function never executes file content as shell code. +# Only known keys are assigned, and values are validated against a strict +# character allowlist to prevent shell injection. +# +# Takes one argument: path to the versions file +# Returns 1 if the file does not exist, 0 otherwise. +# Example loadVersionFile "/etc/pihole/versions" +####################### +loadVersionFile() { + local file="${1}" + local line key value + + [ -f "${file}" ] || return 1 + + while IFS= read -r line || [ -n "${line}" ]; do + # Skip blank lines and comments + case "${line}" in + ''|\#*) continue ;; + esac + + # Require KEY=VALUE format (key must be non-empty) + key="${line%%=*}" + value="${line#*=}" + [ -z "${key}" ] && continue + [ "${key}" = "${line}" ] && continue # no '=' found + + # Allowlist: only assign known version-file keys + case "${key}" in + CORE_VERSION|CORE_BRANCH|CORE_HASH|\ + GITHUB_CORE_VERSION|GITHUB_CORE_HASH|\ + WEB_VERSION|WEB_BRANCH|WEB_HASH|\ + GITHUB_WEB_VERSION|GITHUB_WEB_HASH|\ + FTL_VERSION|FTL_BRANCH|FTL_HASH|\ + GITHUB_FTL_VERSION|GITHUB_FTL_HASH|\ + DOCKER_VERSION|GITHUB_DOCKER_VERSION) ;; + *) continue ;; + esac + + # Validate value: allow only characters safe in version strings and branch names. + # Permits: letters, digits, dot, hyphen, underscore, slash, plus sign, and empty string. + case "${value}" in + *[!a-zA-Z0-9._/+\-]*) continue ;; + esac + + # Safe to assign: key is from the allowlist, value contains no shell metacharacters + eval "${key}=\${value}" + done < "${file}" +} + ####################### # returns FTL's PID based on the content of the pihole-FTL.pid file # diff --git a/advanced/Scripts/version.sh b/advanced/Scripts/version.sh index e932fe63..95f0f583 100755 --- a/advanced/Scripts/version.sh +++ b/advanced/Scripts/version.sh @@ -8,17 +8,18 @@ # This file is copyright under the latest version of the EUPL. # Please see LICENSE file for your rights under this license. -# Source the versions file populated by updatechecker.sh +# shellcheck source=./advanced/Scripts/utils.sh +. /opt/pihole/utils.sh + +# Load the versions file populated by updatechecker.sh cachedVersions="/etc/pihole/versions" -if [ -f ${cachedVersions} ]; then - # shellcheck source=/dev/null - . "$cachedVersions" +if [ -f "${cachedVersions}" ]; then + loadVersionFile "${cachedVersions}" else echo "Could not find /etc/pihole/versions. Running update now." pihole updatechecker - # shellcheck source=/dev/null - . "$cachedVersions" + loadVersionFile "${cachedVersions}" fi main() { diff --git a/pihole b/pihole index 5af46fa6..d1b2e03b 100755 --- a/pihole +++ b/pihole @@ -30,13 +30,9 @@ readonly apifile="${PI_HOLE_SCRIPT_DIR}/api.sh" source "${apifile}" versionsfile="/etc/pihole/versions" -if [ -f "${versionsfile}" ]; then - # Only source versionsfile if the file exits - # fixes a warning during installation where versionsfile does not exist yet - # but gravity calls `pihole -status` and thereby sourcing the file - # shellcheck source=/dev/null - source "${versionsfile}" -fi +# Load version variables without executing file content as shell code. +# loadVersionFile() only assigns known keys with validated values. +loadVersionFile "${versionsfile}" # TODO: We can probably remove the reliance on this function too, just tell people to pihole-FTL --config webserver.api.password "password" SetWebPassword() { From 811467e8b9b44e7483679b5766aa2b1aeeedb476 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 21 Mar 2026 10:02:41 +0000 Subject: [PATCH 12/21] Bump tox from 4.49.1 to 4.50.3 in /test in the python-dependencies group Bumps the python-dependencies group in /test with 1 update: [tox](https://github.com/tox-dev/tox). Updates `tox` from 4.49.1 to 4.50.3 - [Release notes](https://github.com/tox-dev/tox/releases) - [Changelog](https://github.com/tox-dev/tox/blob/main/docs/changelog.rst) - [Commits](https://github.com/tox-dev/tox/compare/4.49.1...4.50.3) --- updated-dependencies: - dependency-name: tox dependency-version: 4.50.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-dependencies ... Signed-off-by: dependabot[bot] --- test/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/requirements.txt b/test/requirements.txt index c8feda47..0d2d62ac 100644 --- a/test/requirements.txt +++ b/test/requirements.txt @@ -2,5 +2,5 @@ pyyaml == 6.0.3 pytest == 9.0.2 pytest-xdist == 3.8.0 pytest-testinfra == 10.2.2 -tox == 4.49.1 +tox == 4.50.3 pytest-clarity == 1.0.1 From 3b8234d0d3b10b6cd5884ee10047422cdee84fea Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 21 Mar 2026 10:02:45 +0000 Subject: [PATCH 13/21] Bump github/codeql-action in the github-actions-dependencies group Bumps the github-actions-dependencies group with 1 update: [github/codeql-action](https://github.com/github/codeql-action). Updates `github/codeql-action` from 4.32.6 to 4.34.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/0d579ffd059c29b07949a3cce3983f0780820c98...38697555549f1db7851b81482ff19f1fa5c4fedc) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.34.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-dependencies ... Signed-off-by: dependabot[bot] --- .github/workflows/codeql-analysis.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 242a9de5..fd067b87 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -29,12 +29,12 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@0d579ffd059c29b07949a3cce3983f0780820c98 #v4.32.6 + uses: github/codeql-action/init@38697555549f1db7851b81482ff19f1fa5c4fedc #v4.34.1 with: languages: 'python' - name: Autobuild - uses: github/codeql-action/autobuild@0d579ffd059c29b07949a3cce3983f0780820c98 #v4.32.6 + uses: github/codeql-action/autobuild@38697555549f1db7851b81482ff19f1fa5c4fedc #v4.34.1 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 #v4.32.6 + uses: github/codeql-action/analyze@38697555549f1db7851b81482ff19f1fa5c4fedc #v4.34.1 From 300cdb71b858c78fc251d7fb5ff6b74dc03b2d5c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christian=20K=C3=B6nig?= Date: Sun, 22 Mar 2026 09:49:54 +0100 Subject: [PATCH 14/21] Fix return status capture of FTL check_download exists MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Christian König --- advanced/Scripts/piholeCheckout.sh | 11 ++++++----- automated install/basic-install.sh | 5 +++-- 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/advanced/Scripts/piholeCheckout.sh b/advanced/Scripts/piholeCheckout.sh index a6df46f2..8168977b 100755 --- a/advanced/Scripts/piholeCheckout.sh +++ b/advanced/Scripts/piholeCheckout.sh @@ -186,7 +186,10 @@ checkout() { echo -e " ${INFO} Checking for ${COL_YELLOW}${binary}${COL_NC} binary on https://ftl.pi-hole.net" - if check_download_exists "$path"; then + local download_status + check_download_exists "$path" + download_status=$? + if [ $download_status -eq 0 ]; then echo " ${TICK} Binary exists" echo "${2}" > /etc/pihole/ftlbranch chmod 644 /etc/pihole/ftlbranch @@ -210,15 +213,13 @@ checkout() { # Update local and remote versions via updatechecker /opt/pihole/updatecheck.sh else - local status - status=$? - if [ $status -eq 1 ]; then + if [ $download_status -eq 1 ]; then # Binary for requested branch is not available, may still be # int he process of being built or CI build job failed printf " %b Binary for requested branch is not available, please try again later.\\n" "${CROSS}" printf " If the issue persists, please contact Pi-hole Support and ask them to re-generate the binary.\\n" exit 1 - elif [ $status -eq 2 ]; then + elif [ $download_status -eq 2 ]; then printf " %b Unable to download from ftl.pi-hole.net. Please check your Internet connection and try again later.\\n" "${CROSS}" exit 1 else diff --git a/automated install/basic-install.sh b/automated install/basic-install.sh index 9a8a87ad..406569ac 100755 --- a/automated install/basic-install.sh +++ b/automated install/basic-install.sh @@ -2042,8 +2042,9 @@ FTLcheckUpdate() { # Check whether or not the binary for this FTL branch actually exists. If not, then there is no update! local status - if ! check_download_exists "${path}"; then - status=$? + check_download_exists "${path}" + status=$? + if [ "${status}" -ne 0 ]; then if [ "${status}" -eq 1 ]; then printf " %b Branch \"%s\" is not available.\\n" "${INFO}" "${ftlBranch}" printf " %b Use %bpihole checkout ftl [branchname]%b to switch to a valid branch.\\n" "${INFO}" "${COL_GREEN}" "${COL_NC}" From 2f8fa724f2a011b3eb07fd1f1c3e05a2b2dd970b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christian=20K=C3=B6nig?= Date: Sun, 22 Mar 2026 10:01:11 +0100 Subject: [PATCH 15/21] Prevent exiting due to set -e MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Christian König --- advanced/Scripts/piholeCheckout.sh | 3 +-- automated install/basic-install.sh | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/advanced/Scripts/piholeCheckout.sh b/advanced/Scripts/piholeCheckout.sh index 8168977b..bd6facc4 100755 --- a/advanced/Scripts/piholeCheckout.sh +++ b/advanced/Scripts/piholeCheckout.sh @@ -187,8 +187,7 @@ checkout() { echo -e " ${INFO} Checking for ${COL_YELLOW}${binary}${COL_NC} binary on https://ftl.pi-hole.net" local download_status - check_download_exists "$path" - download_status=$? + check_download_exists "$path" && download_status=0 || download_status=$? if [ $download_status -eq 0 ]; then echo " ${TICK} Binary exists" echo "${2}" > /etc/pihole/ftlbranch diff --git a/automated install/basic-install.sh b/automated install/basic-install.sh index 406569ac..bc045b4e 100755 --- a/automated install/basic-install.sh +++ b/automated install/basic-install.sh @@ -2042,8 +2042,7 @@ FTLcheckUpdate() { # Check whether or not the binary for this FTL branch actually exists. If not, then there is no update! local status - check_download_exists "${path}" - status=$? + check_download_exists "${path}" && status=0 || status=$? if [ "${status}" -ne 0 ]; then if [ "${status}" -eq 1 ]; then printf " %b Branch \"%s\" is not available.\\n" "${INFO}" "${ftlBranch}" From d137a8c7fef1876b474e41438db4eb7ec51e3bef Mon Sep 17 00:00:00 2001 From: Dominik Date: Sun, 22 Mar 2026 10:50:50 +0100 Subject: [PATCH 16/21] add antigravity index in the same way we already build the gravity index Signed-off-by: Dominik --- gravity.sh | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/gravity.sh b/gravity.sh index 22e6c742..0c5a65f4 100755 --- a/gravity.sh +++ b/gravity.sh @@ -86,16 +86,17 @@ generate_gravity_database() { # Build gravity tree gravity_build_tree() { + local table="$1" local str - str="Building tree" + str="Building ${table} tree" echo -ne " ${INFO} ${str}..." # The index is intentionally not UNIQUE as poor quality adlists may contain domains more than once - output=$({ pihole-FTL sqlite3 -ni "${gravityTEMPfile}" "CREATE INDEX idx_gravity ON gravity (domain, adlist_id);"; } 2>&1) + output=$({ pihole-FTL sqlite3 -ni "${gravityTEMPfile}" "CREATE INDEX idx_${table} ON ${table} (domain, adlist_id);"; } 2>&1) status="$?" if [[ "${status}" -ne 0 ]]; then - echo -e "\\n ${CROSS} Unable to build gravity tree in ${gravityTEMPfile}\\n ${output}" + echo -e "\\n ${CROSS} Unable to build ${table} tree in ${gravityTEMPfile}\\n ${output}" echo -e " ${INFO} If you have a large amount of domains, make sure your Pi-hole has enough RAM available\\n" return 1 fi @@ -844,11 +845,11 @@ gravity_Table_Count() { local str="${2}" local num num="$(pihole-FTL sqlite3 -ni "${gravityTEMPfile}" "SELECT COUNT(*) FROM ${table};")" - if [[ "${table}" == "gravity" ]]; then + if [[ "${table}" == "gravity" || "${table}" == "antigravity" ]]; then local unique unique="$(pihole-FTL sqlite3 -ni "${gravityTEMPfile}" "SELECT COUNT(*) FROM (SELECT DISTINCT domain FROM ${table});")" echo -e " ${INFO} Number of ${str}: ${num} (${COL_BOLD}${unique} unique domains${COL_NC})" - pihole-FTL sqlite3 -ni "${gravityTEMPfile}" "INSERT OR REPLACE INTO info (property,value) VALUES ('gravity_count',${unique});" + pihole-FTL sqlite3 -ni "${gravityTEMPfile}" "INSERT OR REPLACE INTO info (property,value) VALUES ('${table}_count',${unique});" else echo -e " ${INFO} Number of ${str}: ${num}" fi @@ -858,11 +859,14 @@ gravity_Table_Count() { gravity_ShowCount() { # Here we use the table "gravity" instead of the view "vw_gravity" for speed. # It's safe to replace it here, because right after a gravity run both will show the exactly same number of domains. + echo "" gravity_Table_Count "gravity" "gravity domains" + gravity_Table_Count "antigravity" "antigravity domains" gravity_Table_Count "domainlist WHERE type = 1 AND enabled = 1" "exact denied domains" gravity_Table_Count "domainlist WHERE type = 3 AND enabled = 1" "regex denied filters" gravity_Table_Count "domainlist WHERE type = 0 AND enabled = 1" "exact allowed domains" gravity_Table_Count "domainlist WHERE type = 2 AND enabled = 1" "regex allowed filters" + echo "" } # Trap Ctrl-C @@ -1149,7 +1153,8 @@ update_gravity_timestamp fix_owner_permissions "${gravityTEMPfile}" # Build the tree -timeit gravity_build_tree +timeit gravity_build_tree gravity +timeit gravity_build_tree antigravity # Compute numbers to be displayed (do this after building the tree to get the # numbers quickly from the tree instead of having to scan the whole database) From 2aa38f4fd7aa9d4fe7cc2a2f97a3c42c3c061af1 Mon Sep 17 00:00:00 2001 From: Adam Warner Date: Tue, 24 Mar 2026 18:43:32 +0000 Subject: [PATCH 17/21] Return 0 instead of 1 to make compatibile with set -e Signed-off-by: Adam Warner --- advanced/Scripts/utils.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/advanced/Scripts/utils.sh b/advanced/Scripts/utils.sh index 3a09a980..8ce88c2c 100755 --- a/advanced/Scripts/utils.sh +++ b/advanced/Scripts/utils.sh @@ -49,14 +49,14 @@ addOrEditKeyValPair() { # character allowlist to prevent shell injection. # # Takes one argument: path to the versions file -# Returns 1 if the file does not exist, 0 otherwise. +# Returns 0 in all cases (compatible with set -e) # Example loadVersionFile "/etc/pihole/versions" ####################### loadVersionFile() { local file="${1}" local line key value - [ -f "${file}" ] || return 1 + [ -f "${file}" ] || return 0 while IFS= read -r line || [ -n "${line}" ]; do # Skip blank lines and comments From 12373981a4eeb29a90f586c99a7a6715266c345b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 28 Mar 2026 10:02:40 +0000 Subject: [PATCH 18/21] Bump tox from 4.50.3 to 4.51.0 in /test in the python-dependencies group Bumps the python-dependencies group in /test with 1 update: [tox](https://github.com/tox-dev/tox). Updates `tox` from 4.50.3 to 4.51.0 - [Release notes](https://github.com/tox-dev/tox/releases) - [Changelog](https://github.com/tox-dev/tox/blob/main/docs/changelog.rst) - [Commits](https://github.com/tox-dev/tox/compare/4.50.3...4.51.0) --- updated-dependencies: - dependency-name: tox dependency-version: 4.51.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-dependencies ... Signed-off-by: dependabot[bot] --- test/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/requirements.txt b/test/requirements.txt index 0d2d62ac..dbeef1f0 100644 --- a/test/requirements.txt +++ b/test/requirements.txt @@ -2,5 +2,5 @@ pyyaml == 6.0.3 pytest == 9.0.2 pytest-xdist == 3.8.0 pytest-testinfra == 10.2.2 -tox == 4.50.3 +tox == 4.51.0 pytest-clarity == 1.0.1 From 62bacedac0998a82cfa6ae954f2c1c9c0d39b8ad Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 28 Mar 2026 10:02:41 +0000 Subject: [PATCH 19/21] Bump the github-actions-dependencies group with 2 updates Bumps the github-actions-dependencies group with 2 updates: [github/codeql-action](https://github.com/github/codeql-action) and [editorconfig-checker/action-editorconfig-checker](https://github.com/editorconfig-checker/action-editorconfig-checker). Updates `github/codeql-action` from 4.34.1 to 4.35.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/38697555549f1db7851b81482ff19f1fa5c4fedc...c10b8064de6f491fea524254123dbe5e09572f13) Updates `editorconfig-checker/action-editorconfig-checker` from 2.1.0 to 2.2.0 - [Release notes](https://github.com/editorconfig-checker/action-editorconfig-checker/releases) - [Commits](https://github.com/editorconfig-checker/action-editorconfig-checker/compare/4b6cd6190d435e7e084fb35e36a096e98506f7b9...840e866d93b8e032123c23bac69dece044d4d84c) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-dependencies - dependency-name: editorconfig-checker/action-editorconfig-checker dependency-version: 2.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-dependencies ... Signed-off-by: dependabot[bot] --- .github/workflows/codeql-analysis.yml | 6 +++--- .github/workflows/test.yml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index fd067b87..bc0c3ddf 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -29,12 +29,12 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@38697555549f1db7851b81482ff19f1fa5c4fedc #v4.34.1 + uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 #v4.35.1 with: languages: 'python' - name: Autobuild - uses: github/codeql-action/autobuild@38697555549f1db7851b81482ff19f1fa5c4fedc #v4.34.1 + uses: github/codeql-action/autobuild@c10b8064de6f491fea524254123dbe5e09572f13 #v4.35.1 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@38697555549f1db7851b81482ff19f1fa5c4fedc #v4.34.1 + uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 #v4.35.1 diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index bab7e036..80cc92dc 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -43,7 +43,7 @@ jobs: ignore_words_file: .codespellignore - name: Get editorconfig-checker - uses: editorconfig-checker/action-editorconfig-checker@4b6cd6190d435e7e084fb35e36a096e98506f7b9 #v2.1.0 + uses: editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c #v2.2.0 - name: Run editorconfig-checker run: editorconfig-checker From ed08269f021c2798d0cc6bf11868008c88b3fc8d Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sun, 29 Mar 2026 16:19:25 +0000 Subject: [PATCH 20/21] Remove broken Stickermule affiliate link from README Agent-Logs-Url: https://github.com/pi-hole/pi-hole/sessions/a6219e2f-6bc6-4fab-ac93-19411149dc04 Co-authored-by: PromoFaux <1998970+PromoFaux@users.noreply.github.com> --- README.md | 1 - 1 file changed, 1 deletion(-) diff --git a/README.md b/README.md index 622ff202..9aa708eb 100644 --- a/README.md +++ b/README.md @@ -84,7 +84,6 @@ If you'd rather not donate (_which is okay!_), there are other ways you can help - [Patreon](https://patreon.com/pihole) - [Hetzner Cloud](https://hetzner.cloud/?ref=7aceisRX3AzA) _affiliate link_ - [Digital Ocean](https://www.digitalocean.com/?refcode=344d234950e1) _affiliate link_ -- [Stickermule](https://www.stickermule.com/unlock?ref_id=9127301701&utm_medium=link&utm_source=invite) _earn a $10 credit after your first purchase_ - [Amazon US](https://www.amazon.com/exec/obidos/redirect-home/pihole09-20) _affiliate link_ - Spreading the word about our software and how you have benefited from it From c4f79bebaa09e65fb14d70bc12006491fb5f1f84 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christian=20K=C3=B6nig?= Date: Thu, 2 Apr 2026 08:59:25 +0200 Subject: [PATCH 21/21] Re-add valid stickermule link MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Christian König --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 9aa708eb..7ec57000 100644 --- a/README.md +++ b/README.md @@ -84,6 +84,7 @@ If you'd rather not donate (_which is okay!_), there are other ways you can help - [Patreon](https://patreon.com/pihole) - [Hetzner Cloud](https://hetzner.cloud/?ref=7aceisRX3AzA) _affiliate link_ - [Digital Ocean](https://www.digitalocean.com/?refcode=344d234950e1) _affiliate link_ +- [Stickermule](https://www.stickermule.com/unlock?ref_id=6055890701&utm_medium=link&utm_source=invite) _earn a $10 credit after your first purchase_ - [Amazon US](https://www.amazon.com/exec/obidos/redirect-home/pihole09-20) _affiliate link_ - Spreading the word about our software and how you have benefited from it