v2.5.2

Important

If an installation ever ran NGINX UI 2.3.6 or earlier, or restored a backup from such an installation, upgrading alone does not invalidate credentials that may already have been exposed. Upgrade every instance to v2.5.2 first. In a cluster, use HTTPS for any relationship that still reports Legacy shared secret, and confirm that each node relationship shows Paired signature before rotating the shared secrets. Then:

• Replace [node] Secret (NGINX_UI_NODE_SECRET) on every instance with a new, unique random value and restart the instance.
• Replace [app] JwtSecret (NGINX_UI_APP_JWT_SECRET) and restart NGINX UI to invalidate previously issued JWTs.
• Rotate downstream credentials stored in NGINX UI, and review administrator accounts and access logs for unauthorized activity.

Do not manually replace Crypto.Secret: it protects persisted encrypted data and requires a supported migration. Backup archives use one-time encryption material; rotate the credentials contained in any exposed backup instead.

This hotfix includes all changes and release notes from v2.5.0.

Features

• Introduce signed node requests and automatic migration from the shared node secret to per-controller Ed25519 credentials, with credential status, rotation, recovery grace, and revocation controls.
• Add site traffic and QPS statistics to the dashboard.
• Add Azure DNS and Huawei Cloud DNS providers, AliDNS line selection, DNS record grouping, and multiple site links per DNS record.
• Improve AliDNS, Cloudflare, and Tencent Cloud DNS integration efficiency by replacing heavyweight provider SDKs with focused API clients.
• Add ACME certificate support for IP addresses and configurable renewal based on remaining certificate validity.
• Add scheduled automatic backups with on-demand execution.
• Add support for controlling Nginx in external containers and isolated namespaces.
• Add custom OpenAI-compatible base URLs and improved reasoning-model session titles.

Bug Fixes

• Prevent a site-check initialization race from interrupting Gin route registration and leaving later API and WebSocket endpoints unavailable; log startup panics locally when SLS is not ready (#1766).
• Restore rolling-upgrade connectivity between v2.5.1 controllers and pre-v2.5.0 child nodes by retaining legacy X-Node-Secret authentication until each relationship is automatically upgraded to Ed25519 credentials.
• Fix generated Homebrew formula URLs so Homebrew derives the version consistently from tagged release URLs.
• Verify signed upgrade artifacts before applying an update.
• Preserve destination-owned secrets and instance identity during portable backup restores.
• Enforce passkey-only authentication across login paths and protect privileged Nginx commands.
• Recover successful Nginx restarts when the proxy connection drops before the response is returned.
• Validate TLS certificate and private-key pairs before saving settings or restarting the service.
• Fix dashboard memory leaks and improve node availability and deletion handling.
• Recover unindexed access logs on startup and improve log indexing, storage, and search efficiency (#1757).
• Preserve an explicitly disabled upstream on first creation (#1758).
• Improve WebSocket self-check reliability (#1759), skip-install password handling (#1755), and preference-save error handling (#1753).
• Auto-detect the browser language on first visit and add the Ukrainian date locale (#1754).

Contributors

@0xJacky
@chrstphe
@renovate
@sdjnmxd