nginx-ui version history

- Protect settings secrets behind 2FA reveal. - Update lego to support the selfhost API URL. - Deduplicate disk totals by filesystem to avoid double-counting. - Support the ACME common name option and allow node synchronization with secure sessions.

- Fixed known issues.

## Features - Import existing certificates via a new CLI command and a discovery UI that scans for certificate/key pairs on disk. (#1716, #1724) - Self-signed certificate support, including dedicated error codes and renewal notifications. (#1655, #1688) - Add a Mattermost external notifier. (#1721) - DNS: support IP version selection for DDNS. (#1695) - Certificate issuance now preserves the existing configuration and retries on failure. (#1694) - Support riscv64 Docker images and OpenWrt installs. (#1551) - Migrate legacy recovery codes to the new format. (#1684) ## Bug Fixes - cert: restore the lego v4 DNS-01 propagation behavior so DNS-01 issuance/renewal no longer times out behind split-horizon or private resolvers after the lego v5 upgrade. (#1711, #1719) - dashboard: count nginx worker processes when nginx runs in a separate container. (#1704) - setup: surface the one-time install secret in the logs for Docker/non-interactive installs, and stop logging the node secret in a way that was mistaken for it. (#1705) - backup: make the "granted access paths" error actionable instead of looking like a missing directory. (#1714) - 2fa: auto-retry the original request after a step-u

## Features - Integrate Atlas Cloud provider (`d87e7785a`) by @lucaszhu-hue. - Add ACME CA directory presets (`0f0fa1c08`) by @0xJacky. - Add batch status actions for sites (`86ba59cbe`) by @0xJacky. - Optimize certificate application operations (`a98bd9216`) by @CarmJos. - Add support for custom Nginx maintenance templates (`4d0dcb92b`) by @enwikuna. ## Bug Fixes - Update the nginx bundled in the Docker image to the latest 1.31.x release, fixing the critical CVE-2026-42945 ("NGINX Rift") heap buffer overflow in `ngx_http_rewrite_module` along with related advisories (CVE-2026-42926, CVE-2026-42946, CVE-2026-42934) (`fc7150c15`) by @0xJacky. - Stabilize realtime chart timestamps on the dashboard (`32c1fadc0`) by @0xJacky. - Inline nginx base image setup for Docker (`5fc038f2e`) by @0xJacky. - Resolve websocket base from page url (`a455e5902`) by @0xJacky. - Allow browserslist database updates (`4f489c123`) by @0xJacky. - Preserve proxy path for websocket urls (`c28fb16d5`) by @0xJacky. - Migrate ACME client to lego v5 (`6859e18d4`) by @0xJacky. - Normalize legacy key types (`98bb8903f`) by @0xJacky. - Configure pnpm build approvals in CI (`c7c67c5a6`) by @0xJacky. - Resolve conc

## Features - None. ## Bug Fixes - Render external notification placeholders before delivery so templated variables display correctly (`030157829`) by @0xJacky. - Refresh translations, including corrected spacing for restricted nginx directive messages in Chinese locales (`432a791ca`) by @0xJacky. ## Contributors @0xJacky

## 🎉 Features * Harden config write paths across config, site, and stream operations to reject unsafe file names and invalid content earlier, improving write-path safety and frontend error reporting (`3e411d38d`, `fd61e8ea6`) by @0xJacky ## 🐛 Bug Fixes * Restrict executable nginx directives in managed config content to reduce the risk of unsafe directives being written through the UI or API (`fd61e8ea6`) by @0xJacky * Require a secure session before allowing backup restore operations (`4e4174d89`) by @0xJacky ## ❤️ Contributors @0xJacky @eeee2345

## 🎉 Features * Protect sensitive settings with a 2FA-gated reveal flow and improve sensitive value masking in the UI (`80a6a7273`, `4d96c3499`) by @0xJacky ## 🐛 Bug Fixes * Harden the first-run installation flow to make setup more reliable (`25dea9f62`) by @0xJacky * Separate HTTP and WebSocket upstream routes to improve proxy behavior (`05e544c8f`) by @0xJacky * Reduce certificate auto-renew retry churn and expose renewal errors more clearly (`899c9f199`) by @0xJacky * Preserve the forwarded host during Docker WebSocket checks (`57b6f982e`) by @0xJacky * Avoid a WebSocket keepalive race in analytics (`d25c9975d`) by @0xJacky * Update the bundled `uuid` dependency to v14 (`171bb5299`) by @renovate[bot] ## ❤️ Contributors @0xJacky @renovate[bot]

## 🎉 Features - Add a WebSocket keepalive mechanism to improve node availability tracking and connection stability (`7ed73f621`) by @0xJacky - Add global site check controls, including enable/disable, concurrency limits, and configurable check intervals (`535c8efb3`) by @0xJacky - Honor the configured health check protocol during both scheduled checks and manual tests (`c38e0a28b`) by @0xJacky ## 🐛 Bug Fixes - Restore the WebSocket connection used during certificate issuance so live progress updates work correctly again (`329e8589e`) by @0xJacky - Reduce outbound connection pressure in site checks by reusing shared HTTP transports, deduplicating requests, and avoiding unnecessary repeated fetches (`535c8efb3`) by @0xJacky - Improve upstream handling reliability and expand test coverage (`89c1fdfb4`) by @sleet0922 - Fix embedding for generated assets whose names contain underscores (`32d5ce001`) by @TemaSmirnov - Update non-major dependencies and release tooling to improve overall reliability (`f73aabb59`, `20538d9c7`, `513d5d6fb`) by @renovate[bot] ## ❤️ Contributors @0xJacky @sleet0922 @TemaSmirnov @renovate[bot]

- Improved WebSocket security and stability with short-lived tokens, stricter authentication, better origin validation, and safer concurrent writes. - Enhanced TLS and certificate workflows by auto-inserting required SSL directives and preventing incomplete TLS configs from being saved. - Improved backup and restore reliability, including support for changed crypto secrets and compatibility with legacy manifest signatures. - Made the Nginx config editor more stable by using unique keys for locations and directives during editing and drag-and-drop. - Fixed an MCP panic on nil tool arguments and improved nginx log service initialization. - Updated non-major frontend and backend dependencies.

This update includes several security patches. It is recommended that all users update their systems immediately.

This update includes several security patches. It is recommended that all users update their systems immediately.