Repository navigation
refresh nginx and vulnerable stack dependencies - #81
Merged
Merged
Conversation
The private key of custom certificates was returned in meta by GET /api/nginx/certificates and GET /api/nginx/certificates/{id}. Add meta.certificate_key to omissions(), the same way meta.dns_provider_credentials is hidden. The key stays in the database and is still written to /data/custom_ssl on upload.
fix: only chown /data/keys.json if necessary
…certificate-key fix: omit certificate_key from certificate API responses
Bumps [ip-address](https://github.com/beaugunderson/ip-address) from 10.5.0 to 10.7.2. - [Release notes](https://github.com/beaugunderson/ip-address/releases) - [Commits](beaugunderson/ip-address@v10.5.0...v10.7.2) --- updated-dependencies: - dependency-name: ip-address dependency-version: 10.7.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
…ndabot/npm_and_yarn/backend/ip-address-10.7.2 build(deps): bump ip-address from 10.5.0 to 10.7.2 in /backend
IP_RANGES_FETCH_ENABLED=false only skipped the initial fetch; the renewal timer still fetched the ranges every 6 hours. Fixes NginxProxyManager#5748
…ges-timer Don't start IP ranges renewal timer when fetching is disabled
Bumps [serialize-javascript](https://github.com/yahoo/serialize-javascript) from 7.1.1 to 7.1.2. - [Release notes](https://github.com/yahoo/serialize-javascript/releases) - [Commits](yahoo/serialize-javascript@v7.1.1...v7.1.2) --- updated-dependencies: - dependency-name: serialize-javascript dependency-version: 7.1.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
…ndabot/npm_and_yarn/test/serialize-javascript-7.1.2 build(deps): bump serialize-javascript from 7.1.1 to 7.1.2 in /test
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.7 to 3.1.8. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.7...v3.1.8) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Some paths rendered host configs without fully loading the relations the templates depend on, silently dropping access rules (and SSL): - Enabling a proxy host loaded the access list without its clients or auth items, so the host came back with no access restrictions. - Requesting a Let's Encrypt certificate re-rendered every host sharing its domains from bare rows, dropping access rules and SSL. generateConfig now loads any referenced certificate or access list that isn't fully loaded, so no caller can render a partial config. The two callers above also fetch the relations themselves, and a warning is logged when a host's access list is missing or has no rules. Adds integration tests covering access lists across disable/enable. Fixes NginxProxyManager#5919, NginxProxyManager#4286, NginxProxyManager#5710 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ndabot/npm_and_yarn/backend/fast-uri-3.1.8 build(deps): bump fast-uri from 3.1.7 to 3.1.8 in /backend
Bumps [proxy-addr](https://github.com/jshttp/proxy-addr) from 2.0.7 to 2.0.8. - [Release notes](https://github.com/jshttp/proxy-addr/releases) - [Changelog](https://github.com/jshttp/proxy-addr/blob/master/HISTORY.md) - [Commits](jshttp/proxy-addr@v2.0.7...v2.0.8) --- updated-dependencies: - dependency-name: proxy-addr dependency-version: 2.0.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
…ndabot/npm_and_yarn/backend/proxy-addr-2.0.8 build(deps): bump proxy-addr from 2.0.7 to 2.0.8 in /backend
…e-it-missing Add missing German (de) and Italian (it) translations
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Zoey <zoey@z0ey.de>
Signed-off-by: Zoey <zoey@z0ey.de>
Signed-off-by: Zoey <zoey@z0ey.de>
Signed-off-by: Zoey <zoey@z0ey.de>
…ire-authentication-to-validate-certificates Require authentication to validate certificates
fix(certbot): update Akamai Edge DNS plugin and credentials for v0.3.0
…s lang files Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Mick <crypto@gadget78.uk> Signed-off-by: Zoey <zoey@z0ey.de> Co-Authored-By: Zoey <zoey@z0ey.de>
Signed-off-by: Zoey <zoey@z0ey.de>
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
mangyan1
marked this pull request as ready for review
October 17, 2026 03:56
merge upstream develop while preserving fork security contracts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refresh the vulnerable published stack with nginx/OpenResty 1.31.7, njs 1.0.2, Caddy 2.11.7, Go 1.26.9, patched Go modules and zlib, and scoped proxy-addr/source-map-js overrides. This also includes #82's upstream integration through
5ba8fe1c, preserving the fork's authentication, MFA replay guards, bounded network reads, centralized private errors, and certificate DNS-plugin pipeline.Custom locations now use ordered relational ACLs. The irreversible location/hard-delete migrations require matching database/files and image snapshots for rollback; see
FORK.mdand the upgrade guidance. New regressions verify a populated SQLite upgrade, awaited MFA session refresh, and saving explicit deny-all policies.Verified on merged develop
00945f9e: lint/tests/schema/contracts/types/build, live security/browser flows, boot/enforcement, and all four CodeQL language groups pass. JSON, ShellCheck, spellcheck, Docker lint and Caddy formatting also pass.NPMplus AMD64/ARM64 publication, CrowdSec native runtime/PG/scan gates and publication, and Caddy source tests/scan/publication pass. Follow-up #83 updates Anubis to the latest stable v1.28.1, including its reverse-DNS verification fix, and passes native runtime and scan gates on both architectures. The final published-image Trivy scan passes on develop
a66e725e; all four current Trivy configurations and all four CodeQL language groups have no analysis errors or warnings, with zero open alerts. Previous Trivy alerts are fixed rather than dismissed.Existing vulnerability thresholds remain enforced. Four reviewed, exact-package/version pip packaging exceptions expire October 23; runtime Certbot DNS-plugin installation remains supported.