Nightscout 15.0.9 "Cinnamon Muffin" - An Update Worth Installing
Nightscout 15.0.9 focuses on security and bug fixes. You won't find new screens or features that change how you use Nightscout every day. Instead, the developers have patched several security vulnerabilities, improved how different apps handle shared data, and fixed alarms that haven't worked properly for a long time. If your Nightscout instance is accessible from the internet, I strongly recommend taking this update seriously.
What's Included in This Release?
In simple terms, this is a substantial maintenance update. More than 100 fixes and changes have been introduced since version 15.0.8. The most important improvements cover three areas: security, data consistency across applications, and alarms.
This matters because Nightscout often works with several applications at once - AndroidAPS, Loop, Trio, xDrip+, and careportal. Each sends and receives data slightly differently. When these processes don't stay in sync, you can end up with duplicate records, missing entries, or incorrect insulin on board calculations. Version 15.0.9 addresses many of these problems.
Security Improvements
Security is the strongest reason to install this release. Several vulnerabilities affecting version 15.0.8 and earlier have been fixed. You'll find the technical details in the official changelog, but the main improvements are:
Live data updates now check permissions before sending data, alarms, and notifications.
Silencing an alarm requires the appropriate permission.
The administration page no longer stores access tokens in readable form.
Error messages no longer reveal sensitive details to unauthorized users.
The server is protected against requests that could previously cause it to stop responding.
In practice, these fixes reduce the number of security risks that instance administrators need to manage manually. That's particularly good news for publicly accessible instances.
New TRUST_PROXY Setting
This release introduces the TRUST_PROXY setting, which tells Nightscout which proxy servers it should trust when determining a visitor's IP address.
If you leave it unset, Nightscout behaves as it did in version 15.0.8, so nothing changes by default. However, without proper configuration, the delay applied after failed login attempts can be bypassed. Nightscout now displays a warning about this in its startup logs.
If your instance runs behind a reverse proxy, such as nginx or Cloudflare, I recommend configuring this setting. It's optional, but it's a sensible security improvement.
Better Data Consistency Across Applications
People using automated insulin delivery systems will probably benefit the most from these changes.
Entries from careportal and caregivers now reach AndroidAPS. Records deleted in AndroidAPS are excluded from statistics, charts, and reports. Late or edited AndroidAPS entries are correctly included in insulin on board and carbohydrates on board calculations. Two entries created at exactly the same time are also treated as separate records instead of being merged.
These fixes should reduce discrepancies between Nightscout and automated insulin delivery apps. That's especially important when the data is used to inform insulin dosing decisions.
Alarms That Finally Work as Intended
Several alarms were described in the documentation but never behaved as specified. Version 15.0.9 finally addresses these issues.
Insulin age alarms now support the URGENT severity level instead of remaining at warning level. Low glucose thresholds configured in mmol/L now work correctly on pages where only some thresholds used those units. The suspended pump warning behaves as documented, and AndroidAPS loop alerts resume after the loop is re-enabled.
These are fixes I consider particularly valuable. Alarms are supposed to provide reliable warnings without constant manual checking. When they fail silently, users may discover the problem only when it's too late.
Less Noise in the Logs
The built-in CGM connector (nightscout-connect) has also been updated. It no longer writes CGM account information to logs and now recovers in a controlled manner after temporary service outages. Default logging is quieter, too, with detailed logging requiring explicit activation.
What Does This Mean for Users?
If you only use Nightscout to monitor glucose data and your instance isn't publicly accessible, the alarm and data consistency fixes will likely be the most relevant improvements.
For internet-facing instances, I would treat this as an important security update. Some of the vulnerabilities could previously cause server outages or expose sensitive information, making the fixes especially worthwhile.
If you use diab.ninja, the new version is available in the control panel. You don't need to perform a manual installation.
Known Issues to Watch Out For
The developers have also documented several known issues. Two deserve particular attention.
First, if your site uses mg/dL and you enter an alarm threshold of 3.9 assuming it's in mmol/L, Nightscout will interpret it as 3.9 mg/dL. As a result, the alarm will never trigger. Always enter thresholds using the units configured for your site.
Second, the careportal bolus wizard has mixed-unit issues that can produce significantly inaccurate estimates in certain configurations. This problem isn't new to version 15.0.9, but it's important to keep in mind.
Should You Update?
In my opinion, absolutely. Nightscout 15.0.9 doesn't introduce disruptive interface changes or force you to learn a new workflow. It strengthens security and fixes bugs that could cause problems at the worst possible moment.
If you use diab.ninja, simply select the new version in the User Panel.
