Bug: Add note to 3.40.1 release notes about change in Control Server authentication behavior

[gene1wood]

Is this urgent?

No

Host OS

Ubuntu 22.04

CPU arch

x86_64

VPN service provider

ProtonVPN

What are you using to run the container

docker-compose

What is the version of Gluetun

Running version latest built on 2025-11-26T13:47:08.821Z (commit c25c9f6)

What's the problem 🤔

In the Control Server wiki page it mentions

⚠️ all routes will become private by default after the v3.40.0 release ⚠️

But in the Release Notes for 3.40.1 when this breaking change goes live, nothing is mentioned

https://github.com/qdm12/gluetun/releases/tag/v3.40.1

Could you add a bullet point to the release notes so folks know that starting with v3.40.1 all Control Server API routes require authentication? This will save users some troubleshooting time when they upgrade and unauthenticated access stops working.

[github-actions]

@qdm12 is more or less the only maintainer of this project and works on it in his free time.
Please:

• do not ask for updates, be patient
• 👍 the issue to show your support instead of commenting
  @qdm12 usually checks issues at least once a week, if this is a new urgent bug,
  revert to an older tagged container image

[qdm12]

Nothing changed. The last digit in semver is for bugfixes, so v3.40.x all have the same features, just more fixes as the last digit goes up. I'll change the warning though. Actually in another place I said after v3.41.0 so the auth change will come after v3.41.*

[gene1wood]

Actually in another place I said after v3.41.0 so the auth change will come after v3.41.*

Oh! Ok, so after v3.41.* would mean the new behavior would show up in v3.42.0? I'd misunderstood and thought the change had already happened and was just missing from the CHANGELOG, got it.

[qdm12]

It would show in the :latest image first and yes then in v3.42.*