CoolerControl v4 adds new security features, brings hardware support and more

Monitor and manage various different cooling devices on Linux with CoolerControl. Version 4.0.0 brings a bunch more advanced features for you. For those of you who just love to tinker with your system to get the most out of it, CoolerControl rocks.

There was already a lot of features supported, but now it has expanded. Especially when it comes to security with new Access Token Authorization support for API clients and integrations/plugins and TLS/SSL enabled by default for all new installs. On the subject of feature additions they added GPD_FAN device support, support for Lian Li Uni Sync fan controllers, the ability to mix profiles and various UI improvements to make using the app easier to adjust various parts of it.

The full list of changes:

Security

• TLS/SSL enabled by default for all new installs using auto-generated self-signed certificates (!403 (merged))
• Access Token Authorization support for API clients and integrations/plugins
• Authentication is now required for almost all endpoints
• Persistent sessions with 30-day expiry
• Login attempt blocking after repeated failures
• Password strength meter and requirement to provide existing password when changing it
• Default password is no longer accepted; users are prompted to change it on first use
• Web security headers added to all API responses
• Restricted file permissions for TLS key and plugin config files
• HTML escaping in the log viewer to prevent injection
• Alert command inputs are now sanitized
• CORS origin and related settings are now configurable
• OpenAPI spec is only exposed in debug builds

Added

• New cc-detect tool, improved sensors-detect for Super-IO hardware detection and diagnostics, integrated into the project as a workspace crate (!424 (merged))
• New Controls page with clickable, interactive Control Flow charts showing the full pipeline from sensors through functions and profiles to device channels (!418 (merged))
• LCD and Lighting channel nodes added to the Controls overview and Control Flow charts (!418 (merged))
• Controls and minimap navigation for Control Flow charts (!418 (merged))
• Animated time charts (toggleable via eye candy setting) (!422 (merged))
• LCD shutdown image support: configure a custom image to display on LCD screens when the daemon shuts down, with API endpoints and persistence (!417 (merged))
• Sum Mix Function: combine multiple profile outputs by summing their values (#535 (closed), !421 (merged))
• Mix Profiles now support a single-level parent-child relationship for more flexible composition (#535 (closed), !421 (merged))
• Points table overlay on the profile editor for precise numeric entry of curve points, including in the wizard and on Overlay Profiles (#294 (closed), !412 (merged))
• Plugin restart button in the plugin UI (!409 (merged))
• OpenRC user-level services and permission handling (!425 (merged))
• OpenRC support in Docker images (!423 (merged))
• gRPC reflection support
• Lian Li Uni Hub device fan control mode application (!405 (merged))
• More liquidctl Aquacomputer sensors supported with improved handling and validation (#539 (closed), !419 (merged))
• GPD_FAN device support (#547 (closed), #549 (closed), !420 (merged))
• Increased hit area for clicking and adding points on profile lines
• Lock icon in the UI indicating when the default password is still in use
• Extended maximum sensor and channel name length limits
• CLI option to force usage of NVIDIA CLI tools when NVML is not available
• Environment variable overrides for TLS certificate and key paths
• Extra Chromium flags can be passed to the Qt desktop app (!415 (merged))

Changed

• Devices are now listed first in the navigation menu by default (!426 (merged))
• API servers run on a dedicated thread (!411 (merged))
• Hot hwmon sysfs paths are cached to reduce repeated string formatting overhead (!411 (merged))
• Desktop app connection retry count increased; retries added for transient daemon unavailability at startup
• UI reloads immediately after the system resumes from suspension (!406 (merged))
• Plugin version and URL are now shown in the plugin settings UI (!397 (merged))
• Session expiry extended to 30 days
• Various safety and minor performance improvements throughout the daemon (!426 (merged))
• Log levels adjusted for various API errors and session store messages
• Various dependency updates (npm and Cargo)

Fixed

• 24-hour time format now respected throughout the UI (!416 (merged))
• KDE persistent notifications fixed
• GPD_FAN device pwm mode handling corrected when device is in auto mode (#547 (closed), #549 (closed), !420 (merged))
• Live duty and RPM values now shown correctly for manually controlled fans without causing viewport shift (!426 (merged))
• UI no longer fails to reload after the system wakes from sleep (!408 (merged))
• Negative zero no longer displayed in metric values in some cases
• Copy to clipboard now works correctly in the Qt desktop app (#551, !413 (merged))
• Plugin iframes from the same origin are now properly allowed (#551, !413 (merged))
• Session validation correctly fails when the default password is in use (#551, !413 (merged))
• Password change now triggers the UI window to appear when required (#551, !413 (merged))
• Persistent cookies now correctly synchronized for the Qt network manager (#551, !413 (merged))
• Custom sensor node names now use the user-defined name in Control Flow views (!418 (merged))
• Enter key now saves for name-only entity dialogs
• Lian Li Uni Sync channel names corrected (!405 (merged))

See more about it on the GitLab page.