Hummingbot Connector v6.0.5

Release Date: August 2, 2026 Tags: ADMIN, API KEYS, TRANSLATIONS, PERMISSIONS, ACCESS CONTROL, KILL-SWITCH, RATE LIMITS, AUDIT LOG, BOT INSTANCES, LICENSING, LOADING STATES, INTERFACE

Overview

An admin release. Nothing in the connector, the exchange API or the bot-facing paths changed — a bot that trades today trades identically after updating, and there is no connector to reinstall.

What changed is the screen an operator uses to stop a bot. The Hummingbot API keys registry was hardcoded English throughout — 88 strings in a product that ships in 90 languages — and it has been put through the platform's translation system and moved onto the standard admin frame. Rebuilding it surfaced three faults on the page, including a bulk kill-switch that fired the moment it was clicked, with no confirmation.

Separately, the route gate on the Hummingbot admin section was still demanding a permission the platform retires and deletes on upgrade, which has been closing the whole section to everyone but Super Admin.

Two headline figures change meaning and one section becomes reachable again — read Upgrade Notes before comparing anything against what you recorded last week.

Requires Core v6.6.1 or later.

Update Instructions

pnpm updator

No connector reinstall is required this time, and no database migration. Nothing in the connector kit, the installer or the signed API changed, so your Hummingbot checkouts can be left alone.

One thing does need checking. Bot Commands, Bot Instances and Strategy Presets now each gate on their own view-level permission rather than sharing one, and the Hummingbot section root gates on a key that works. Confirm the section still opens for a normal admin role, not from the owner account — Super Admin bypasses permission checks entirely, so an upgrade tested as the owner will look fine either way. The list is in Upgrade Notes.

Upgrade Notes

The Hummingbot admin section becomes reachable again

The route gate on /admin/hb demanded a permission called access.hummingbot. The platform's permission rename carries that key's grants onto access.hb and then deletes the old key and every grant pointing at it — so from the moment that ran, no role on the installation could hold what the section was asking for. The gate and the rest of the platform disagreed. The section's own permission contract, the admin menu and the permission registry all said access.hb; only the route gate was still on the retired spelling, and it is the one artifact no build step regenerates.

• Changed: the gate asks for access.hb, which the rename has already carried the old grants onto — so access is restored to exactly the roles that had it, and to no one else.

Bot Commands, Bot Instances and Strategy Presets gate on their own permissions

• Changed: these three screens moved from the section-wide access key onto a view-level permission of their own, so being able to see the Hummingbot menu no longer implies being able to open all three.

The bulk kill-switch now asks first, and the reason is yours

Disable selected keys ran the instant it was clicked. There was no confirmation of any kind, over any number of selected keys, and every bot stopped that way was told its key was disabled because of "Bulk admin action" — a canned sentence written into each rejection, because the reason recorded on a key is the message its bot receives when the next signed request is refused.

• Changed: the action opens the same confirmation the single-key kill-switch uses. It names the exact count and carries your own reason, and that reason is what each bot is told.
• Changed: leaving the reason blank now records nothing rather than a sentence nobody wrote — the audit row falls back to the endpoint's own default.

"Expired" counts a different set of keys — do not compare it against your notes

The old Expired tile counted every expired key, including ones already switched off, so a key that was both disabled and expired was counted twice across two tiles.

• Changed: the figure is now labelled Expired (enabled) and counts only keys that are switched on and past their expiry — the ones that are being refused while their owners believe they are live, and the only expired keys anyone can act on. On most installations it will read lower than the old figure.

"Enabled" is not the old "Active" figure

• Changed: the posture band splits the fleet into Enabled and Disabled, and Enabled means nobody has switched it off — which includes keys that have since expired. It therefore reads higher than the old Active tile.
• Where the old number went: it is stated in words above the band, as "N of M accepting requests" — switched on and inside its expiry, which is the count of credentials that can sign a request right now.

Added

Fleet posture, in one band, above the first row

The nine stat tiles are gone. In their place the page leads with one statement of where the fleet stands, at Admin → Hummingbot → API Keys.

• Added a posture band splitting every Hummingbot-capable key on the platform into Enabled and Disabled, with the operative figure stated in words beside it: how many of them can accept a signed request right now.
• Added click-to-filter on both bands. Clicking Disabled loads exactly the keys it counted, and it sets the same filter the toolbar's own switch sets — so the band and the filter panel can never disagree, and neither can the count and the result.
• Added a Show all keys control, present only while a band is filtering.
• Added a flag row for the states that sit across the split, because a key can be enabled and expired and throttled at once: Expired (enabled), Throttled, No secret, Auth failures (24h) and Used (24h). Anything that needs looking at is inked as a warning when it is not zero.

The figures say how fresh they are

• Added a last-updated clock and a liveness marker on the figures.
• Added honest behaviour when a refresh fails: the last good numbers stay on screen and the marker turns to stale rather than a green pulse over figures that have stopped advancing, or a blank where a fleet used to be.
• Added a Refresh control that reloads both the figures and the table.

Changed

The API keys screen is no longer hardcoded English

• Changed 88 strings across the registry, its columns, its detail dialog and its three action dialogs to run through the platform's translation system, in all 90 language files. Every one of them was previously English written into the page with no way to change it.
• Changed the shared vocabulary on the screen — status words, owner and email headings, dates, table headings, dialog buttons — onto the platform's own translated terms, so those read in the operator's language immediately: a German operator now sees Aktiv and Aktualisieren rather than Active and Refresh.

The registry looks like the rest of the admin

• Changed the page onto the platform's standard page frame, replacing the addon's own animated header and its emerald-and-teal colour scheme — a per-page hue that carried no meaning on a screen whose only real colour signal is "somebody switched this key off".
• Changed the page to carry one title rather than two competing ones.

Dates on this screen render in one fixed format

• Changed every date and time on the registry, its detail dialog and its audit log to a single pinned format instead of taking one from whatever the viewer's browser reports. The two disagreed, which is a class of fault that shows up as a page repairing itself after it loads.

The audit log stops calling your own kill-switch an authentication failure

• Changed the kill-switch entry in a key's audit trail to be marked as an intervention rather than a rejected signature. It was tinted the same red as a bad signature, a replay block and an IP block — while the "Auth failures (24h)" figure above it has never counted it — so a trail containing nothing but an operator's own deliberate action looked like a key under attack.

Bot Instances keeps its shape while it loads

• Changed the instance list from a spinner box to the real cards, drawn disabled with their values pending. The spinner box stood about 128px tall against instance cards of roughly 250px each, so the diagnostics and everything below the list jumped when the instances arrived — by a different amount depending on how many bots you run.
• Changed the "no instances yet" prompt so it no longer appears for the length of the first request on an installation that does have instances.
• Changed the audit log dialog's loading state, which was a centred "Loading…" that collapsed the dialog to a fraction of its height and then snapped it open again.

Fixed

A bulk kill-switch stopped every selected bot on one unconfirmed click

• Fixed the bulk disable action running the instant it was clicked, with no confirmation step of any kind. Each key it stopped recorded the literal reason "Bulk admin action", and that reason is the message the bot is given when its next signed request is refused — so the explanation every stopped bot received was a placeholder. See Upgrade Notes.

The key details dialog could not be opened

• Fixed viewing being switched off on the key registry. The details dialog was fully built and entirely unreachable, and with it four columns that appear nowhere else in the product: a key's expiry date, its IP whitelist, the reason it was disabled and when it was created.

The Hummingbot admin section was Super Admin only

• Fixed the route gate demanding a permission the platform retires and deletes on upgrade, along with every role grant pointing at it. Every other part of the platform already agreed on the replacement; only the gate was left behind. See Upgrade Notes.

A licence check blanked the entire admin area

• Fixed the licence check wrapping the whole page rather than its content. While it was in flight the Hummingbot admin area was a centred spinner with no header, no section nav and no footer, instead of a page waiting for one panel — and the same treatment applied on every screen in the section.
• Fixed the section not filling the viewport, so the footer sat wherever the amount of data happened to leave it and moved as the page finished loading.