2026-06-10-b1

[Zoey2936]

What's Changed since last beta

• update alpine to v3.24
• Note: if no new issues are reported then this will be released within the next few days
• ToDo: Update Nextcloud AIO Reverse Proxy Example Screenshots and Hints

What else Changed since last release

• feat: Support for Multiple Access Control Lists and Location Specific Access Control Lists by @shopsD in [feature] Support for Multiple Access Control Lists and Location Specific Access Control Lists #3101
• nginx: set http3_stream_buffer_size to 1m to improve http3 speed on non perfect connections
• nginx: disable SHA1 and RSA_PKCS1 sigalgs, RSA-PKCS1 cna be reenabled using NGINX_TRUST_RSA_PKCS1
• nginx: prefer chacha20 and aes256 over aes128 for tls1.3 by patching aws-lc
• nginx: fix grpc
• nginx: hide more "useless" upstream headers
• nginx: enable mldsa87:mldsa65:mldsa44 sigalgs, I think no browser supports them
• nginx: update openappsec attachment and crowdsec
• nginx: update nginx to fix recent CVEs, see: Yesterdays nginx CVEs #3285
• nginx: fix nginx quic gso (ERR_QUIC_PROTOCOL_ERROR on large files via HTTP/3 / Incomplete page loads #3408) by patching nginx
• nginx: fix $server_port being broken in streams [bug] Stream $server_port does not work anymore #3149
• nginx: fix loadbalancing, by checking if a hostname is a user provided upstream block based on a prefix [bug] Load balancing not working anymore #3093
• update aws-lc to v5, NPMplus will follow theier rolling mainline releases, like with nginx
• startup: reduce time for 'chown' process when PUID/PGID != 0 by @invario in (feat) reduce time for 'chown' process when PUID/PGID != 0 #3144
• startup: fix disabling ech without container recreation and too early nginx reload
• startup: fix blocked startup if acme server is down
• startup: disable openappsec attachment during host regeneration
• startup: improve user/group generation for PUID/PGID
• startup: only reload once after regenerating all config files
• UI: diffrent CSPs for NPMplus-UI and swaggerUI
• UI: add Permission Policy
• UI: improve sorting of online/offline/disabled column
• UI: fix button switching in custom location when clicking on the label
• UI: fix OIDC with authelia
• UI: add Button to disable nginx url sanitisation, default false, but true for existing hosts and custom locations
• UI: add Button to spoof host header
• UI: allow overwriting the upstream URL for an auth request provider in the UI per host
• UI: reset button values if they get disabled when the scheme changed, but exclude the "empty" scheme
• UI/nginx: keep uri sanitisation for npmplus itself and goaccess
• UI: allow multiple hosts to share the same domain name if only one of them is enabled [feature] Hosts with Same Domain As Long As Not Enabled #3362
• Build: pin git clone steps against commit shas instead of tags and branches
• Build: verify downloaded patches against a shasum
• Build: harden CFLAGS even more
• Build: remove unused lua rocks (session and openidc)
• merge upstream (mainly lang updates)
• dep and doc updates

Image tags:

• docker.io/zoeyvid/npmplus:2026-06-10-b1 (fixed to this release)
• ghcr.io/zoeyvid/npmplus:2026-06-10-b1 (fixed to this release)
• docker.io/zoeyvid/npmplus:beta (latest beta/stable)
• ghcr.io/zoeyvid/npmplus:beta (latest beta/stable)

New Contributors

• @shopsD made their first contribution in [feature] Support for Multiple Access Control Lists and Location Specific Access Control Lists #3101
• @invario made their first contribution in (feat) reduce time for 'chown' process when PUID/PGID != 0 #3144

Full Changelog: 2026-06-07-b2...2026-06-10-b1

---

This discussion was created from the release 2026-06-10-b1.

[UncleNet41]

Hey Zoey, sorry to report the openappsec module is once again broken.

With 2026-06-07-b2 it's working just fine except for the webui hang.

Trying this latest beta with the openappsec module loaded gives this startup log:

-------------------------------------
 _ _  ___  __ __       _
| \ || . \|  \  \ ___ | | _ _  ___
|   ||  _/|     || . \| || | |[_-[
|_\_||_|  |_|_|_||  _/|_| \__|/__/
                 |_|
-------------------------------------
Version:  2026-06-10-b1-15df12c-2.15.1
Date:     Thu Jun 11 10:05:43 CEST 2026
-------------------------------------

'/usr/local/nginx/conf/conf.d/crowdsec.conf.disabled' -> '/usr/local/nginx/conf/conf.d/crowdsec.conf'
no DEFAULT_CERT_ID set, using dummycerts.
'/usr/local/nginx/conf/conf.d/goaccess.conf.disabled' -> '/usr/local/nginx/conf/conf.d/goaccess.conf'

-------------------------------------
PUID:     0
User ID:  0
PGID:     0
Group ID: 0
-------------------------------------

Running in stand-alone mode...

npm-5  	updated	
npm-6  	updated	
npm-8  	updated	
npm-9  	updated	
LINEAGE	RESULT 	REASON

nginx: [emerg] dlopen() "/usr/local/nginx/modules/libngx_module.so" failed (Error loading shared library libc++.so.1: No such file or directory (needed by /usr/local/lib/libosrc_nginx_attachment_util.so)) in /usr/local/nginx/conf/nginx.conf:10
nginx: configuration file /usr/local/nginx/conf/nginx.conf test failed

END OF LINE

Commenting out the loading of the module let NPMplus start and work successfully.

[Zoey2936]

please try the new beta in 5 minutes

[UncleNet41]

with the latest beta is up and running again (still with the known bugs, ofc, but it's working nevertheless).

thanks!

[opsben]

Hey Zoey, love the project!

Please could you point me to a step-by-step upgrade guide?

[Zoey2936]

1. Read the changelog, to make adjustments now to the compose.yaml or later in the ui
2. stop the container
3. make a backup of the datafolder, for example using cp -a /opt/npmplus /opt/npmplus-backup
4. edit the image tag if needed
5. start the compose.yaml again docker compose pull and docker compose up -d
6. check the logs: docker logs -f npmplus