Highlights Security fixes

Two security vulnerabilities in the web interface have been patched in this release.

https://github.com/pi-hole/web/security/advisories/GHSA-6xp4-jw73-f4qp: fixed with d328f14
https://github.com/pi-hole/web/security/advisories/GHSA-8rw8-vjgp-rwj6: fixed with 1a0c6f4

Performance improvements

Faster startup (FTL #2725)

FTL now imports historical queries from the database asynchronously on startup. Previously, DNS resolution was blocked until the entire query history had been loaded into memory. Now, FTL begins accepting DNS queries immediately and imports history in a dedicated background thread. The garbage collector is held off until the import is complete to ensure data consistency.

Low-memory hardware optimizations (FTL #2757)

A new database.forceDisk configuration option forces FTL’s in-memory SQLite3 database to live on disk instead of in RAM. This can notably reduce FTL’s memory footprint, which is beneficial on resource-constrained hardware such as older Raspberry Pi models. On NVMe-backed systems no measurable performance difference was observed, though some slowdown may be seen on slower storage.

Faster gravity updates (FTL #2710)

Several cumulative efficiency gains have been applied to the main domain validation loop that runs during pihole -g. While each individual improvement is modest, they add up across every entry in your blocklists and allowlists:

A lookup table now validates domain characters using a single comparison per character, replacing multiple branching comparisons
IP address testing is short-circuited: IPv4 tests only run if the token starts with a digit, and IPv6 tests only run if a colon is present within the first 5 characters
The unicode BOM check is now performed once per file rather than once per line

In testing with ~5 million domains across several lists, gravity update time dropped from ~27s to ~23s (roughly a 16% reduction in real time, and ~22% reduction in CPU time).