refresh nginx and vulnerable stack dependencies

.github/workflows/dependency-updates.yml

@@ -176,9 +176,6 @@ jobs:
           - name: nginx
             repo: nginx/nginx
             pull: 1333
-          - name: nginx
-            repo: nginx/nginx
-            pull: 1430
           - name: fancyindex
             repo: aperezdc/ngx-fancyindex
             pull: 176

.github/workflows/lint-and-format.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-slim
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: lts/*
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0

.github/workflows/spellcheck.yml

@@ -22,4 +22,4 @@ jobs:
           # These animated SVGs embed raster frames as base64. Random binary
           # runs trip the dictionary, but there is no prose to spellcheck.
           skip: pnpm-lock.yaml,./frontend/translations,./frontend/public/images/crowdsec-logo-animated.svg,./docs/animated-logo.svg
-          ignore_words_list: afterAll,alog,clen
+          ignore_words_list: afterAll,alog,clen,hasTable

.trivy/npmplus.yaml

@@ -1,19 +1,24 @@
-# Packaging-tool exceptions; reviewed on 2026-10-04, all expire 2026-10-11.
-# Scanned with Trivy 0.74.0 on 2026-10-04: ghcr.io/mangyan1/npmplus@sha256:e9e90bc214ff757290e4b929f68ea12bc2afc724bb0efc7ae6abb9c08a601bff
+# Packaging-tool exceptions; reviewed on 2026-10-16, all expire 2026-10-23.
+# Re-scanned with Trivy 0.74.0; Python imports and pip's vendor manifest verified:
+# ghcr.io/mangyan1/npmplus@sha256:87f65d1c9297c87d6b6eed6b740266d1835f643b5303da33a77956bd0c49fd06
 vulnerabilities:
   - id: CVE-2025-47273
-    expired_at: 2026-10-11
-    statement: "Rechecked 2026-10-04: setuptools 70.3.0 metadata finding persists, but no installed setuptools distribution is listed by Python; pip 26.2.1 is still the latest release. Keep upstream-compatible Certbot runtime plugin support; reassess with the next pip image update."
+    purls:
+      - pkg:pypi/setuptools@70.3.0
+    expired_at: 2026-10-23
+    statement: "Rechecked 2026-10-16: pip 26.2.1's vendor manifest lists setuptools 70.3.0, while importlib.metadata finds no installed setuptools distribution. PyPI still reports pip 26.2.1 as latest. This is a bundled packaging-tool inventory finding, not proof of an importable vulnerable setuptools runtime. Preserve Certbot DNS-plugin installation and reassess the vendor manifest with the next pip release or by expiry."
   - id: GHSA-6v7p-g79w-8964
-    expired_at: 2026-10-11
-    statement: "Rechecked 2026-10-04: pip 26.2.1 vendors msgpack 1.1.2; scanner lists 1.2.1 as fixed; pip 26.2.1 is still the latest release. Runtime Certbot plugin installation remains intentional; await a reviewed pip vendor update rather than modifying its bundled modules."
+    purls:
+      - pkg:pypi/msgpack@1.1.2
+    expired_at: 2026-10-23
+    statement: "Rechecked 2026-10-16: importing pip._vendor.msgpack confirms 1.1.2; the scanner lists 1.2.1 as fixed. PyPI still reports pip 26.2.1 as latest. The packaging cache remains an accepted risk, not universally unreachable. Keep runtime Certbot DNS-plugin installation; await a reviewed pip vendor update rather than modifying bundled modules, and reassess by expiry."
   - id: CVE-2026-97687
     purls:
       - pkg:pypi/urllib3@2.7.0
-    expired_at: 2026-10-11
-    statement: "Rechecked 2026-10-04: pip 26.2.1 is still the latest release and still embeds urllib3 2.7.0 in its vendor bundle/SBOM; the separately installed Certbot urllib3 remains pinned to patched 2.8.0 and pip check passes. Accept the remaining packaging-tool HTTPS-proxy TLS risk temporarily under the owner decision preserving runtime DNS-plugin installation; not universally unreachable. Await a fixed pip release, retain suppressed findings in artifacts, and reassess by expiry. Advisory: https://github.com/advisories/GHSA-8988-9cw3-xx77"
+    expired_at: 2026-10-23
+    statement: "Rechecked 2026-10-16: imports confirm pip._vendor.urllib3 2.7.0 and separate Certbot urllib3 2.8.0. PyPI still reports pip 26.2.1 as latest. Accept the packaging-tool HTTPS-proxy TLS risk temporarily under the owner decision preserving runtime DNS-plugin installation; not universally unreachable. Retain suppressed findings in artifacts and reassess by expiry. Advisory: https://github.com/advisories/GHSA-8988-9cw3-xx77"
   - id: CVE-2026-97689
     purls:
       - pkg:pypi/urllib3@2.7.0
-    expired_at: 2026-10-11
-    statement: "Rechecked 2026-10-04: pip 26.2.1 is still the latest release and still embeds urllib3 2.7.0; installed Certbot urllib3 is patched at 2.8.0. Malicious chunked responses during pip downloads remain a packaging-tool availability risk, not a false positive. Keep runtime DNS-plugin installation per the owner decision, do not modify pip's bundled modules, retain suppressed findings in artifacts, and reassess by expiry. Advisory: https://github.com/advisories/GHSA-vxq7-64xx-v4gw"
+    expired_at: 2026-10-23
+    statement: "Rechecked 2026-10-16: imports confirm pip._vendor.urllib3 2.7.0 and separate Certbot urllib3 2.8.0; pip 26.2.1 remains latest on PyPI. Malicious chunked responses during pip downloads remain an accepted packaging-tool availability risk, not a false positive. Preserve runtime DNS-plugin installation, do not modify bundled modules, retain suppressed findings in artifacts, and reassess by expiry. Advisory: https://github.com/advisories/GHSA-vxq7-64xx-v4gw"

CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to the NPMplus Security Fork are documented here. The fork u
 
 ## Unreleased
 
+- Reconcile upstream through October 16: migrate custom locations and their ordered access lists into relational storage, adopt host hard-deletion and mTLS auth-request controls, and update navigation and translations. Keep the fork's session revocation, replay protection, ACL rollback, bounded fetches, setup gate, certificate pipeline, and reviewed dependency versions. Adapt Anubis coverage and ACL recovery to the new relations, with a populated-database upgrade and snapshot regression test. Template version 23 regenerates existing nginx configurations. Database rollback requires restoring the matching pre-upgrade snapshot.
+
+- Refresh nginx to 1.31.7 with matching OpenResty patches and njs 1.0.2. Update the Caddy, CrowdSec, and Anubis security builds to Go 1.26.9 and patched networking dependencies; update CrowdSec's OpenAPI parser and Caddy to 2.11.7. Override vulnerable proxy-addr and source-map-js transitive dependencies. Reassess the pinned pip vendor inventory and scope the remaining packaging-tool exceptions to exact package versions until October 23, preserving runtime Certbot DNS-plugin installation.
+
 - Installer v1.69 adds the admin-only **Disable CRS observation** action under CrowdSec → WAF, the mirror of the v1.66 enable button: it removes the observation policy, restores the default acquisition list, strips the bouncer marker, and leaves the installed CRS rules inert while high-confidence blocking keeps running. Both verbs now write a persistent pre-change snapshot to `/var/lib/npmplus/crs-control/snapshot/` — kept after success and after rollback failure as the known-good instance for manual recovery — and the host helper gained a `DISABLE` socket verb behind the same audit, cooldown, and transactional rollback as enable. Uninstall removes the snapshot with the rest of the helper state.
 
 - Installer v1.68 / safe-update wrapper v8 make every aborting update path loud instead of silent. The wrapper traps unguarded failures: an aborted run logs the failing command and wrapper line, writes `aborted-{ps,logs}.txt` diagnostics beside the last-good snapshot, and ends correctly for its phase — no revert before deployment (the running stack is untouched), revert after it. The rollback database snapshot retries its container exec three times before aborting, because an exec can transiently lose a race against a container being stopped or recreated by another actor; a stack whose rollback database cannot be created is never updated. The interactive `--update` path installs the same abort naming, so a bare failure always reports the command and script line that killed the run.

Dockerfile

@@ -7,9 +7,9 @@ ARG LUAJIT_LIB=/usr/lib
 
 ARG AWSLC_VER=fa9bc8d6f7cfb2cf849b247fb06bbbfc41ecc9d6 # v5.11.0
 
-ARG NGINX_VER=45a318d05a0fd23f57ffe9579f7f0969c0fe402a # release-1.31.6
+ARG NGINX_VER=aaecf65316bb4af1e4f12f6a8746da2ab278c967 # release-1.31.7
 ARG DTR_VER=1.29.2
-ARG ORP_VER=1.31.6
+ARG ORP_VER=1.31.7
 ARG ZNP_VER=1.30.0
 
 ARG NB_VER=0b5a99975de43d0261b8fa8bb66f49e7dcaf7030 # master
@@ -21,7 +21,7 @@ ARG HMNM_VER=0bf283ff92017acd616814b0e5153e0ccf93e2c9 # v0.40
 ARG NDK_VER=bd44d16302273052d6005d7bdb55f74e23813de3 # v0.3.4
 ARG LNM_VER=58ece96055227399bbffa5e06cb5b54ebeeacef9 # v0.10.32rc5
 
-ARG NJS_VER=1b648f8805596c95368f8fa428a5c38c5d279857 # 1.0.1
+ARG NJS_VER=72e6a980b9bf2a28ae2d568bbc3b6830a5d7c39e # 1.0.2
 ARG NAL_VER=241200eac8e4acae74d353291bd27f79e5ca3dc4 # master
 ARG VTS_VER=38b8612527ecb003ea15cefe934f302cf1a7c27e # v0.2.7
 ARG NNTLM_VER=3da77b0cb30e517dfee01d7e7f7d649144d24051 # master
@@ -63,34 +63,28 @@ RUN git-clone-commit.sh https://github.com/nginx/nginx "$NGINX_VER" /src/nginx &
     wget -q https://patch-diff.githubusercontent.com/raw/nginx/nginx/pull/689.patch -O /src/nginx/1.patch && \
     echo "73fdee62748f1624f87015a951a2480fd0d4fe566a81d92b852b51536d954b91  /src/nginx/1.patch" | sha256sum -c - && \
     git apply /src/nginx/1.patch && \
-    wget -q https://patch-diff.githubusercontent.com/raw/nginx/nginx/pull/1756.patch -O /src/nginx/2.patch && \
-    echo "1f720c05c166e15f41d78fbd598561745591847ba1b892bae42a2f47758b1fc6  /src/nginx/2.patch" | sha256sum -c - && \
+    wget -q https://patch-diff.githubusercontent.com/raw/nginx/nginx/pull/1333.patch -O /src/nginx/2.patch && \
+    echo "01bf75b130b8f91075ec913a400a8debfab6da0ac609711c7d412ddbe59dd898  /src/nginx/2.patch" | sha256sum -c - && \
     git apply /src/nginx/2.patch && \
-    wget -q https://patch-diff.githubusercontent.com/raw/nginx/nginx/pull/1333.patch -O /src/nginx/3.patch && \
-    echo "01bf75b130b8f91075ec913a400a8debfab6da0ac609711c7d412ddbe59dd898  /src/nginx/3.patch" | sha256sum -c - && \
+    wget -q https://raw.githubusercontent.com/nginx-modules/ngx_http_tls_dyn_size/master/nginx__dynamic_tls_records_"$DTR_VER"%2B.patch -O /src/nginx/3.patch && \
+    echo "0aa9c73e7515dbbd48ecc798f7894412c1a50e96e98aee25847e823059faf821  /src/nginx/3.patch" | sha256sum -c - && \
     git apply /src/nginx/3.patch && \
-    wget -q https://raw.githubusercontent.com/nginx-modules/ngx_http_tls_dyn_size/master/nginx__dynamic_tls_records_"$DTR_VER"%2B.patch -O /src/nginx/4.patch && \
-    echo "0aa9c73e7515dbbd48ecc798f7894412c1a50e96e98aee25847e823059faf821  /src/nginx/4.patch" | sha256sum -c - && \
+    wget -q https://raw.githubusercontent.com/openresty/openresty/master/patches/nginx/"$ORP_VER"/nginx-"$ORP_VER"-resolver_conf_parsing.patch -O /src/nginx/4.patch && \
+    echo "4fd457ee6aa7629bc10e24595a992f47babdc4bb78b353527c5136cd9ae0e47c  /src/nginx/4.patch" | sha256sum -c - && \
     git apply /src/nginx/4.patch && \
-    wget -q https://raw.githubusercontent.com/openresty/openresty/master/patches/nginx/"$ORP_VER"/nginx-"$ORP_VER"-resolver_conf_parsing.patch -O /src/nginx/5.patch && \
-    echo "354bb2c05a41357efe3ea9d28a2fc8ff2a5fe6482e0fdda61a237d6bb5a96d51  /src/nginx/5.patch" | sha256sum -c - && \
+    wget -q https://raw.githubusercontent.com/zlib-ng/patches/master/nginx/"$ZNP_VER"-zlib-ng.patch -O /src/nginx/5.patch && \
+    echo "bcd0f2fb9723fc1f251f94cead8d5160e767f7d4a04365331396a72a9ba54c6b  /src/nginx/5.patch" | sha256sum -c - && \
     git apply /src/nginx/5.patch && \
-    wget -q https://raw.githubusercontent.com/zlib-ng/patches/master/nginx/"$ZNP_VER"-zlib-ng.patch -O /src/nginx/6.patch && \
-    echo "bcd0f2fb9723fc1f251f94cead8d5160e767f7d4a04365331396a72a9ba54c6b  /src/nginx/6.patch" | sha256sum -c - && \
+    wget -q https://raw.githubusercontent.com/openresty/openresty/master/patches/nginx/"$ORP_VER"/nginx-"$ORP_VER"-resolver_hosts.patch -O /src/nginx/6.patch && \
+    echo "7a3e9ebe4fafaef0a90773ed093bed83c3e753af5983718b0aee50881c32151b  /src/nginx/6.patch" | sha256sum -c - && \
     git apply /src/nginx/6.patch && \
-    wget -q https://patch-diff.githubusercontent.com/raw/nginx/nginx/pull/1430.patch -O /src/nginx/7.patch && \
-    echo "c8e827d50314b6ec027677ae8c70b11f805408af3efb5175bf377071bd2a14a5  /src/nginx/7.patch" | sha256sum -c - && \
-    git apply /src/nginx/7.patch && \
-    wget -q https://raw.githubusercontent.com/openresty/openresty/master/patches/nginx/"$ORP_VER"/nginx-"$ORP_VER"-resolver_hosts.patch -O /src/nginx/8.patch && \
-    echo "7a3e9ebe4fafaef0a90773ed093bed83c3e753af5983718b0aee50881c32151b  /src/nginx/8.patch" | sha256sum -c - && \
-    git apply /src/nginx/8.patch && \
     sed -i "s|ngx_destroy_pool(r->hosts->pool);|r->hosts->pool->log = r->log; &|" /src/nginx/src/core/ngx_resolver.c && \
-    wget -q https://raw.githubusercontent.com/openresty/openresty/master/patches/nginx/"$ORP_VER"/nginx-"$ORP_VER"-upstream_pipelining.patch -O /src/nginx/9.patch && \
-    echo "f147c9724a0ad33084a3cb51acdafbd4dbd2c40ba5840af1684b7b9595b24ae2  /src/nginx/9.patch" | sha256sum -c - && \
-    git apply /src/nginx/9.patch && \
-    wget -q https://raw.githubusercontent.com/openresty/openresty/master/patches/nginx/"$ORP_VER"/nginx-"$ORP_VER"-reuseport_close_unused_fds.patch -O /src/nginx/10.patch && \
-    echo "7f1c3eefcd841502515f529e3a0c0a17492e7e44ba5c47fc50ae6a3123d8937f  /src/nginx/10.patch" | sha256sum -c - && \
-    git apply -C1 /src/nginx/10.patch && \
+    wget -q https://raw.githubusercontent.com/openresty/openresty/master/patches/nginx/"$ORP_VER"/nginx-"$ORP_VER"-upstream_pipelining.patch -O /src/nginx/7.patch && \
+    echo "f147c9724a0ad33084a3cb51acdafbd4dbd2c40ba5840af1684b7b9595b24ae2  /src/nginx/7.patch" | sha256sum -c - && \
+    git apply /src/nginx/7.patch && \
+    wget -q https://raw.githubusercontent.com/openresty/openresty/master/patches/nginx/"$ORP_VER"/nginx-"$ORP_VER"-reuseport_close_unused_fds.patch -O /src/nginx/8.patch && \
+    echo "7f1c3eefcd841502515f529e3a0c0a17492e7e44ba5c47fc50ae6a3123d8937f  /src/nginx/8.patch" | sha256sum -c - && \
+    git apply -C1 /src/nginx/8.patch && \
     git apply /src/nginx-footer.patch && \
     git apply /src/nginx-ip-sni.patch && \
     git apply /src/nginx-buffer-log.patch && \

FORK.md

@@ -61,6 +61,34 @@ and a fake GitHub CLI; no real branch or PR is created by the tests.
 
 ## Reviewing an upstream update
 
+The October 16 reconciliation incorporates upstream `5ba8fe1c` while retaining
+the fork's reviewed dependency versions (including Objection 3 during the new
+major release's quarantine), database-backed session/MFA replay guards, and
+certificate implementation. Custom locations now use `npmplus_location` and
+ordered ACL relations. Fork reporting and ACL rollback must fetch those relations;
+reading the legacy `proxy_host.locations` JSON column loses the new data.
+
+The hard-delete and location migrations cannot migrate down. Roll back with the
+safe updater's matching database/files snapshot and image, rather than only
+switching image tags. `backend/test/upstream-location-upgrade.test.js` reconstructs
+a populated pre-migration fork database, verifies ordered ACLs and inherited
+Anubis coverage after upgrade, and checks the pre-upgrade SQLite snapshot. Its
+coverage assertion was first observed failing on the unadapted query.
+
+The fork's fresh-session helper remains asynchronous: MFA enrollment and backup
+code regeneration must await it before setting the replacement cookie. The HTTP
+regression reproduced enrollment's 500 response before restoring both awaits.
+ACL form validation continues to accept explicit `deny all` policies; the browser
+regression first timed out waiting for a save request under upstream's empty-policy
+check, then verified the exact deny-all payload after the correction.
+
+Certificate renewal and downloads remain under the owner's existing restriction:
+do not import upstream's certificate restructuring without deliberate replacement
+pins. The UI continues to offer downloads only for Certbot certificates. Custom
+auth-request upstreams retain the fork's URL-only validation contract; upstream's
+named-upstream extension needs a separate privilege review. These are deliberate
+integration boundaries, not conflicts to erase in a later automated sync.
+
 From a clean checkout, fetch and inspect before changing the working branch:
 
 ```bash

backend/.smoke/access-list-ui.mjs

@@ -85,8 +85,26 @@ try {
 	assert.equal(await dialog.getByRole("button", { name: "Save", exact: true }).isEnabled(), true);
 	await dialog.getByRole("button", { name: "Cancel", exact: true }).click();
 	await dialog.waitFor({ state: "hidden" });
+	fixture.items = [];
+	fixture.clients = [{ directive: "deny", address: "all" }];
+	await page.reload({ waitUntil: "networkidle" });
+	await row.locator("button.dropdown-toggle").click();
+	await row.getByRole("button", { name: "Edit", exact: true }).click();
+	const denyAllSave = page.waitForResponse(
+		(response) =>
+			response.request().method() === "PUT" && response.url().includes("/api/nginx/access-lists/900001"),
+	);
+	await dialog.getByRole("button", { name: "Save", exact: true }).click();
+	const denyAllResponse = await denyAllSave;
+	assert.equal(denyAllResponse.status(), 400, "deny-all policy must reach the API");
+	assert.deepEqual(denyAllResponse.request().postDataJSON().clients, [{ directive: "deny", address: "all" }]);
+	await dialog.getByText(message, { exact: true }).waitFor();
+	await dialog.getByRole("button", { name: "Cancel", exact: true }).click();
+	await dialog.waitFor({ state: "hidden" });
 	assert.deepEqual(errors, [], "rejected creates must not raise a rollback TypeError");
-	console.log("PASS access-list browser validation, masked credentials, and rejected-create recovery");
+	console.log(
+		"PASS access-list browser validation, masked credentials, deny-all policy and rejected-create recovery",
+	);
 } finally {
 	await browser.close();
 }

backend/.smoke/modal-ui.mjs

@@ -137,6 +137,10 @@ try {
 		redirection_hosts: [],
 		dead_hosts: [],
 		streams: [],
+		mtls_proxy_hosts: [],
+		mtls_redirection_hosts: [],
+		mtls_dead_hosts: [],
+		mtls_streams: [],
 	};
 	let renewalRequests = 0;
 	await page.route(certificateRoutes, async (route) => {

backend/biome.json

@@ -42,6 +42,7 @@
 			"style": {
 				"noContinue": "off",
 				"noDefaultExport": "off",
+				"noExcessiveClassesPerFile": "off",
 				"noExcessiveLinesPerFile": "off",
 				"noIncrementDecrement": "off",
 				"noMagicNumbers": "off",

backend/certbot/dns-plugins.json

@@ -168,7 +168,7 @@
     "package_name": "certbot-dns-easydns"
   },
   "edgedns": {
-    "credentials": "edgedns_client_secret = as3d1asd5d1a32sdfsdfs2d1asd5=\nedgedns_host = sdflskjdf-dfsdfsdf-sdfsdfsdf.luna.akamaiapis.net\nedgedns_access_token = kjdsi3-34rfsdfsdf-234234fsdfsdf\nedgedns_client_token = dkfjdf-342fsdfsd-23fsdfsdfsdf",
+    "credentials": "client_token = YOUR_CLIENT_TOKEN\naccess_token = YOUR_ACCESS_TOKEN\nclient_secret = YOUR_CLIENT_SECRET\nhost = YOUR_HOST.luna.akamaiapis.net\n# Optional: account_key = YOUR_ACCOUNT_KEY",
     "full_plugin_name": "edgedns",
     "name": "Akamai Edge DNS",
     "package_name": "certbot-plugin-edgedns"

backend/db.js

@@ -1,15 +1,9 @@
 import knex from "knex";
-import { configGet, configHas } from "./lib/config.js";
+import { configGet } from "./lib/config.js";
 
 let instance = null;
 
 const generateDbConfig = () => {
-	if (!configHas("database")) {
-		throw new Error(
-			"Database config does not exist! Please read the instructions: https://github.com/ZoeyVid/NPMplus",
-		);
-	}
-
 	const cfg = configGet("database");
 
 	if (cfg.engine === "knex-native") {
@@ -33,9 +27,7 @@ const generateDbConfig = () => {
 };
 
 const getInstance = () => {
-	if (!instance) {
-		instance = knex(generateDbConfig());
-	}
+	instance ??= knex(generateDbConfig());
 	return instance;
 };