Merge remote-tracking branch 'upstream/dev' into new_code

Author: tomballgithub

.github/workflows/docs.yml

@@ -20,7 +20,7 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ github.event.workflow_run.head_sha || github.sha }}
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.x'
       - name: Install docs dependencies

.github/workflows/publish.yml

@@ -23,7 +23,7 @@ jobs:
     steps:
     - uses: actions/checkout@v7
     - name: Set up Python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@v7
       with:
         python-version: "3.x"
     - name: Install build

.github/workflows/stale.yml

@@ -12,7 +12,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v10
+      - uses: actions/stale@v11
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-stale: 30

.github/workflows/tests.yml

@@ -23,7 +23,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -46,15 +46,60 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: "3.13"
 
       - name: Install dependencies
         run: python -m pip install -e ".[test]"
 
       - name: Run setup wizard smoke tests
-        run: python -m pytest tests/test_setup_wizard.py tests/test_install_method_commands.py tests/test_config_generation.py tests/test_webhook_delivery.py
+        run: python -m pytest tests/test_setup_wizard.py tests/test_install_method_commands.py tests/test_config_generation.py tests/test_webhook_delivery.py tests/test_packaging.py
+
+  browser-e2e:
+    name: dashboard browser E2E (Chromium)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.13"
+
+      - name: Install test and browser dependencies
+        run: python -m pip install -e '.[test,e2e]'
+
+      - name: Install Chromium
+        run: python -m playwright install --with-deps chromium
+
+      - name: Run browser E2E tests
+        run: python -m pytest tests/test_browser_e2e.py
+
+  docs-check:
+    name: documentation strict build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.13"
+
+      - name: Install documentation dependencies
+        run: python -m pip install -r docs/requirements.txt
+
+      - name: Build documentation with strict validation
+        run: mkdocs build --strict --site-dir local/docs-site
 
   container-smoke:
     name: container smoke checks

.gitleaks.toml

@@ -33,6 +33,13 @@ description = "Skip placeholders and variable references"
 regexTarget = "secret"
 regexes = [
     '''(?i)^legacy-secret$''',
+    '''(?i)^github_pat_private$''',
+    '''(?i)^lastfm-key$''',
+    '''(?i)^lastfm-secret$''',
+    '''(?i)^new-github-token$''',
+    '''(?i)^new-refresh-token$''',
+    '''(?i)^spotify-secret$''',
+    '''^\{api_key\}$''',
     '''(?i)^your_[a-z0-9_]+$''',
     '''(?i)^example(?:_[a-z0-9_]+)?$''',
     '''(?i)^dummy(?:_[a-z0-9_]+)?$''',

README.md

@@ -22,6 +22,8 @@ Powerful, real-time OSINT suite for tracking every activity on Instagram - from
 
 #### Python from PyPI
 
+New to Python or unsure what is installed? Follow the [Python install walkthrough](https://misiektoja.github.io/instagram_monitor/installation/#new-to-python-install-everything) first.
+
 ```sh
 pip install instagram_monitor
 ```
@@ -142,17 +144,18 @@ Use [Quick Install & Run](#-quick-install-run) above for first-time setup. The t
 | I want to... | Run this |
 | --- | --- |
 | Try public monitoring without a login | `instagram_monitor <target_insta_user>` |
-| Start targets saved in `TARGET_USERNAMES` | `instagram_monitor --config-file instagram_monitor.conf` |
+| Monitor a target with a logged in session (see stories, reels and follower details) | Import a [browser session](https://misiektoja.github.io/instagram_monitor/configuration/#option-3-session-login-using-browser-cookies-recommended) then run `instagram_monitor -u <your_insta_user> <target_insta_user>` |
+| Monitor targets saved in `TARGET_USERNAMES` | `instagram_monitor --config-file instagram_monitor.conf` |
 | Start a browser control panel without targets | `instagram_monitor --web-dashboard` |
-| Monitor several accounts | `instagram_monitor target_1 target_2` or `instagram_monitor --targets target_1,target_2` |
+| Monitor several accounts without login | `instagram_monitor target_1 target_2` or `instagram_monitor --targets target_1,target_2` |
 | Check the selected login, connectivity and targets | `instagram_monitor --doctor` |
-| See stories, reels and follower details | Import a [browser session](https://misiektoja.github.io/instagram_monitor/configuration/#option-3-session-login-using-browser-cookies-recommended) then run `instagram_monitor -u <your_insta_user> <target_insta_user>` |
+
 
 Running the tool with no arguments offers the wizard if you have not saved any targets or enabled the Web Dashboard. If targets are already saved, it starts monitoring them.
 
 For browser choices, saved targets, configuration backups and setup recovery, see the [full Setup & First Run guide](https://misiektoja.github.io/instagram_monitor/setup-and-first-run/).
 
-For container operation, browser profiles, email alerts, Discord, ntfy and advanced settings, see [Configuration](https://misiektoja.github.io/instagram_monitor/configuration/) and [Usage](https://misiektoja.github.io/instagram_monitor/usage/). Keep private webhook URLs in `.env` or enter them through the setup wizard. See [Webhook Notifications](https://misiektoja.github.io/instagram_monitor/usage/#webhook-notifications) for complete setup and testing instructions.
+For container operation, browser profiles, email alerts, Discord, ntfy and advanced settings, see [Configuration](https://misiektoja.github.io/instagram_monitor/configuration/) and [Usage](https://misiektoja.github.io/instagram_monitor/usage/). Keep private webhook URLs in `.env` by using `instagram_monitor --set-webhook-url` or enter them through the setup wizard. See [Webhook Notifications](https://misiektoja.github.io/instagram_monitor/usage/#webhook-notifications) for complete setup and testing instructions.
 
 <a id="documentation"></a>
 ## Documentation

RELEASE_NOTES.md

@@ -1,5 +1,29 @@
 # instagram_monitor release notes
 
+This is a high-level summary of the most important changes.
+
+# Changes in 3.8 (30 Jul 2026)
+
+Version **3.8** strengthens **Discord and ntfy webhook delivery**, adds safer **private URL setup**, improves **proxy IP detection** and brings better notification controls.
+
+**Features and improvements**:
+
+- **IMPROVE:** Added ordered **proxy IP lookup fallback endpoints** with backward-compatible single-URL configuration, IPv4 and IPv6 validation plus documented privacy controls (thanks [@tomballgithub](https://github.com/tomballgithub), from [#113](https://github.com/misiektoja/instagram_monitor/pull/113))
+- **NEW:** Added private **webhook URL setup** through `--set-webhook-url` with hidden entry and complete HTTPS destination validation
+- **IMPROVE:** Added stricter **webhook request validation** for destinations, avatars, templates, transforms and expanded headers plus Discord mention suppression
+- **IMPROVE:** Added **bounded webhook delivery** with isolated requests, capped rate-limit delays, one retry for temporary failures and automatic provider correction across CLI, Doctor and Web Dashboard flows
+- **IMPROVE:** Added **native ntfy image attachments** with a 5 MiB limit and automatic text-only fallback when image preparation or upload fails
+- **IMPROVE:** Made the **status, follower and error webhook controls** enable webhook delivery for the current run
+- **IMPROVE:** Split the startup notification summary into compact **email and webhook rows** across concise, verbose and logged views
+
+**Bug fixes**:
+
+- **BUGFIX:** Stopped startup summaries and Web Dashboard setting-change logs from writing private webhook URLs to logs
+- **BUGFIX:** Kept long ntfy messages below its 4 KB attachment boundary, added a visible truncation explanation and preserved complete UTF-8 characters
+- **BUGFIX:** Restored green `On` and red `Off` status cues in compact notification rows without coloring category text
+- **BUGFIX:** Made `SIGHUP` apply rotated proxy credentials to active Instaloader sessions and redetect Discord or ntfy when the private webhook destination changes
+- **BUGFIX:** Made proxy IP failover try every configured endpoint before the long retry delay, reject invalid successful responses without crashing and preserve custom endpoint lists in generated configuration
+
 # Changes in 3.7.1 (24 Jul 2026)
 
 **Bug fixes**:

docs/configuration.md

@@ -42,6 +42,22 @@ If the same setting appears in more than one place, the item later in this list
 
 The `.env` and process environment layer applies only to `SESSION_PASSWORD`, `SMTP_PASSWORD`, `WEBHOOK_URL`, `PROXY_URL` and `NTFY_ACCESS_TOKEN`. For these keys, a value in the selected `.env` file replaces a value that was already exported in the shell. Use `--config-file PATH` and `--env-file PATH` if you do not want automatic file discovery.
 
+### Proxy IP Lookup Endpoints
+
+When proxy routing is enabled, Instagram Monitor checks the proxy exit address through `IP_ADDRESS_URL`. The setting accepts one complete HTTP or HTTPS URL or an ordered non-empty list:
+
+```ini
+IP_ADDRESS_URL = [
+    "https://checkip.amazonaws.com",
+    "https://api.ipify.org?format=json",
+    "https://api.my-ip.io/v2/ip.json",
+]
+```
+
+Each retry cycle tries every configured endpoint in order before the long retry delay. A response is accepted only when a recognized JSON field or plain-text body contains a valid IPv4 or IPv6 address. Empty lists, incomplete URLs and URLs with embedded credentials are rejected with an unavailable status instead of crashing monitoring.
+
+Each public lookup service can observe the proxy exit IP. Set one trusted endpoint or a self-hosted service if you do not want fallback requests sent to multiple providers. These lookup requests do not include Instagram session credentials.
+
 Save one or more monitoring targets through setup or set `TARGET_USERNAMES` yourself:
 
 ```ini
@@ -175,10 +191,10 @@ Every supported browser can have several profiles with separate cookies. Use one
 
 - **Pick by name** with `--browser-profile`. Use the Firefox profile name (e.g. `default-release`) or the Chromium profile directory (e.g. `Default`, `Profile 1`):
 
-  ```sh
-  instagram_monitor --import-browser-session --browser chrome --browser-profile "Profile 1"
-  instagram_monitor --import-browser-session --browser firefox --browser-profile "default-release"
-  ```
+    ```sh
+    instagram_monitor --import-browser-session --browser chrome --browser-profile "Profile 1"
+    instagram_monitor --import-browser-session --browser firefox --browser-profile "default-release"
+    ```
 
 - **Let it prompt you.** If you do not pass `--browser-profile` and several profiles exist, the tool lists them so you can choose.
 - **On the [Web Dashboard](view-modes.md#web-dashboard-mode)**, pick the browser, click **Import** and select a profile if prompted.
@@ -240,6 +256,14 @@ instagram_monitor --send-test-email
 
 A `.env` file is a plain text file that holds private values separately from regular configuration. Store `SESSION_PASSWORD`, `SMTP_PASSWORD`, `WEBHOOK_URL`, `NTFY_ACCESS_TOKEN` and `PROXY_URL` there. Do not commit this file or share it.
 
+The recommended way to save a Discord or ntfy destination is:
+
+```sh
+instagram_monitor --set-webhook-url
+```
+
+Paste the complete HTTPS URL at the hidden prompt. Instagram Monitor validates it then updates only `WEBHOOK_URL` in `.env` without displaying the value. Standard Discord and public `ntfy.sh` URLs select the matching request format automatically. Configure `WEBHOOK_PROVIDER` in `instagram_monitor.conf` for a self-hosted or compatible endpoint. Use `--env-file PATH` with this command to select another dotenv destination.
+
 You can use operating system environment variables instead of a file. Set them with `export` on Linux, Unix, macOS or WSL:
 
 ```sh

docs/index.md

@@ -22,6 +22,8 @@ Powerful, real-time OSINT suite for tracking every activity on Instagram - from
 
 #### Python from PyPI
 
+New to Python or unsure what is installed? Follow the [Python install walkthrough](https://misiektoja.github.io/instagram_monitor/installation/#new-to-python-install-everything) first.
+
 ```sh
 pip install instagram_monitor
 ```