Proxy update checks through the panel to avoid CORS failures.

Co-authored-by: Cursor <cursoragent@cursor.com>

app.py

@@ -102,6 +102,8 @@ else:
 
 DATA_FILE = os.path.join(application_path, 'data.json')  # legacy JSON; used only for one-shot import / export
 CURRENT_VERSION = "v1.6.0"
+RELEASES_REPO_URL = "https://git.evilfox.cc/test2/Amnezia-Web-Panel-main"
+RELEASES_API_LATEST = "https://git.evilfox.cc/api/v1/repos/test2/Amnezia-Web-Panel-main/releases/latest"
 BIN_DIR = os.environ.get('TUNNEL_BIN_DIR', os.path.join(application_path, 'bin'))
 TUNNEL_STATE_FILE = os.environ.get('TUNNEL_STATE_FILE', os.path.join(application_path, 'tunnels_state.json'))
 
@@ -5253,6 +5255,39 @@ async def api_get_settings(request: Request):
     return data.get('settings', {})
 
 
+@app.get('/api/settings/check_updates', tags=["Settings"])
+async def api_check_updates(request: Request):
+    """Proxy latest release lookup to avoid browser CORS blocks on git.evilfox.cc."""
+    if not _check_admin(request):
+        return JSONResponse({'error': 'Forbidden'}, status_code=403)
+    try:
+        async with httpx.AsyncClient(timeout=15.0, follow_redirects=True) as client:
+            resp = await client.get(
+                RELEASES_API_LATEST,
+                headers={'Accept': 'application/json'},
+            )
+        if resp.status_code >= 400:
+            return JSONResponse(
+                {'error': f'Release API returned HTTP {resp.status_code}'},
+                status_code=502,
+            )
+        data = resp.json() if resp.content else {}
+        latest = (data.get('tag_name') or data.get('name') or '').strip()
+        html_url = (data.get('html_url') or f'{RELEASES_REPO_URL}/releases').strip()
+        current = CURRENT_VERSION
+        update_available = bool(latest) and latest != current
+        return {
+            'current_version': current,
+            'latest_version': latest,
+            'update_available': update_available,
+            'html_url': html_url,
+            'releases_url': f'{RELEASES_REPO_URL}/releases',
+        }
+    except Exception as e:
+        logger.exception('Error checking for updates')
+        return JSONResponse({'error': str(e)}, status_code=502)
+
+
 @app.get('/api/settings/tunnels/status', tags=["Settings"])
 async def api_tunnels_status(request: Request):
     if not _check_admin(request):

templates/settings.html

@@ -1425,19 +1425,14 @@
         downloadBtn.classList.add('hidden');
 
         try {
-            const response = await fetch('https://git.evilfox.cc/api/v1/repos/test2/Amnezia-Web-Panel-main/releases/latest');
+            const data = await apiCall('/api/settings/check_updates');
-            if (!response.ok) throw new Error('API Error');
+            const latestVersion = data.latest_version || '';
-            const data = await response.json();
-            
-            const latestVersion = data.tag_name;
-            const currentVersion = '{{ current_version }}';
-            
             statusDiv.classList.remove('hidden');
             
-            if (latestVersion !== currentVersion && latestVersion) {
+            if (data.update_available && latestVersion) {
                 statusDiv.innerHTML = `<span style="color: var(--success); font-weight: bold;">{{ _('update_available')|default('Update available') }}: ${latestVersion}</span>`;
                 statusDiv.style.border = '1px solid var(--success)';
-                downloadBtn.href = data.html_url || 'https://git.evilfox.cc/test2/Amnezia-Web-Panel-main/releases';
+                downloadBtn.href = data.html_url || data.releases_url || 'https://git.evilfox.cc/test2/Amnezia-Web-Panel-main/releases';
                 downloadBtn.classList.remove('hidden');
             } else {
                 statusDiv.innerHTML = `<span style="color: var(--text-muted);">{{ _('up_to_date')|default('Up to date') }}</span>`;