Dev 1.6.9 as Next Stable Release

.github/dependabot.yml

@@ -3,17 +3,6 @@
 # Please see the documentation for all configuration options:
 # https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
 
-version: 2
-updates:
-  - package-ecosystem: "github-actions" # See documentation for possible values
-    directory: "/" # Location of package manifests
-    schedule:
-      interval: "weekly"
-    groups:
-      all-actions:
-        patterns: [ "*" ]
-    target-branch: "main"
-
 version: 2
 updates:
   - package-ecosystem: "github-actions" # See documentation for possible values

.github/workflows/Check-PRsource.yml

@@ -6,13 +6,15 @@ on:
       - reopened
       - synchronize
       - edited
+
+permissions: {}
+
 jobs:
   check-branches:
     runs-on: ubuntu-latest
     steps:
-      - name: Check branches
+      - name: Reject non-dev pull requests to main
+        if: github.base_ref == 'main' && github.head_ref != 'dev'
         run: |
-          if [ ${{ github.head_ref }} != "dev" ] && [ ${{ github.base_ref }} == "main" ]; then
-            echo "Merge requests to main branch are only allowed from dev branch."
-            exit 1
-          fi
+          echo "Merge requests to main branch are only allowed from dev branch."
+          exit 1

MerlinAU.asp

@@ -304,7 +304,7 @@ input[value="Uninstall"] {
 <script language="JavaScript" type="text/javascript">
 
 /**----------------------------**/
-/** Last Modified: 2026-May-16 **/
+/** Last Modified: 2026-Sep-25 **/
 /**----------------------------**/
 
 // Separate variables for shared and AJAX settings //
@@ -1228,7 +1228,7 @@ function FetchChangelog(startTime)
         timeout: 1500, // each attempt times out after 9 seconds //
         success: function(data)
         {
-            $('#changelogData').html('<pre>' + data + '</pre>');
+            $('#changelogData').empty().append($('<pre>').text(data));
         },
         error: function()
         {
@@ -2337,8 +2337,9 @@ function GetConfigSettings()
                         keyName = tokenStr.substring(0, splitIndex).trim();
                         keyValue = tokenStr.substring(splitIndex + 1).trim();
 
-                        // Remove surrounding quotes if present //
-                        if (keyValue.startsWith('"') && keyValue.endsWith('"'))
+                        // Remove surrounding single or double quotes if present //
+                        if ((keyValue.startsWith('"') && keyValue.endsWith('"')) ||
+                            (keyValue.startsWith("'") && keyValue.endsWith("'")))
                         { keyValue = keyValue.substring(1, keyValue.length - 1); }
 
                         AssignAjaxSetting(keyName, keyValue);
@@ -2354,8 +2355,9 @@ function GetConfigSettings()
                         {
                             keyValue = tokenList[kIndx + 1].trim();
 
-                            // Remove surrounding quotes if present //
-                            if (keyValue.startsWith('"') && keyValue.endsWith('"'))
+                            // Remove surrounding single or double quotes if present //
+                            if ((keyValue.startsWith('"') && keyValue.endsWith('"')) ||
+                                (keyValue.startsWith("'") && keyValue.endsWith("'")))
                             { keyValue = keyValue.substring(1, keyValue.length - 1); }
 
                             AssignAjaxSetting(keyName, keyValue);
@@ -2456,7 +2458,8 @@ function AssignAjaxSetting (keyName, keyValue)
            try
            {
                var decoded = atob(keyValue);
-               var password = decoded.split(':')[1] || '';
+               var splitIndex = decoded.indexOf(':');
+               var password = (splitIndex > 0) ? decoded.slice(splitIndex + 1) : '';
                ajax_custom_settings.routerPassword = password;
            }
            catch (e)