2026-07-24-r1 - UPDATE ASAP

What Changed since the last release

• fix GHSA-c8f8-6gxh-hf2g

Image tags:

• docker.io/zoeyvid/npmplus:2026-07-24-r1 (fixed to this release)
• ghcr.io/zoeyvid/npmplus:2026-07-24-r1 (fixed to this release)
• docker.io/zoeyvid/npmplus:latest (latest stable)
• ghcr.io/zoeyvid/npmplus:latest (latest stable)
• docker.io/zoeyvid/npmplus:beta (latest beta/stable)
• ghcr.io/zoeyvid/npmplus:beta (latest beta/stable)

Full Changelog: 2026-07-23-r1...2026-07-24-r1

2026-07-23-r1 - UPDATE ASAP

What Changed since the last release

• fix GHSA-wj85-328x-ww6r #3626, thanks to @ValeLyris

Image tags:

• docker.io/zoeyvid/npmplus:2026-07-23-r1 (fixed to this release)
• ghcr.io/zoeyvid/npmplus:2026-07-23-r1 (fixed to this release)
• docker.io/zoeyvid/npmplus:latest (latest stable)
• ghcr.io/zoeyvid/npmplus:latest (latest stable)
• docker.io/zoeyvid/npmplus:beta (latest beta/stable)
• ghcr.io/zoeyvid/npmplus:beta (latest beta/stable)

Full Changelog: 2026-07-15-r1...2026-07-23-r1

2026-07-15-r1

What Changed since the last release

• breaking: always remove Strict-Transport-Security header if not enabled in NPMplus
• nginx: update to 1.31.3 to fix new CVEs
• UI: add host grouping to all host types (via advanced tab) #3519
• UI: merge NginxProxyManager#5681
• UI: allow final "allow all" access rules
• initial startup: change default of APPSEC_DROP_UNREADABLE_BODY in initial crowdsec config file to false since it break DELETE requests with an empty body
• update list of hidden headers (https://raw.githubusercontent.com/OWASP/www-project-secure-headers/refs/heads/master/ci/headers_remove.json)
• dep updates

Image tags:

• docker.io/zoeyvid/npmplus:2026-07-15-r1 (fixed to this release)
• ghcr.io/zoeyvid/npmplus:2026-07-15-r1 (fixed to this release)
• docker.io/zoeyvid/npmplus:latest (latest stable)
• ghcr.io/zoeyvid/npmplus:latest (latest stable)
• docker.io/zoeyvid/npmplus:beta (latest beta/stable)
• ghcr.io/zoeyvid/npmplus:beta (latest beta/stable)

Full Changelog: 2026-06-25-r1...2026-07-15-r1

2026-06-25-r1

What Changed since the last release

• Note: using the openappsec attachment module may break nginx config tests, reloads and cert renewals
• fix: migration issue with mariadb aria storage engine, please note that sqlite is still the only supported database and if you use mysql/mariadb, then preffer innodb
• fix: UI was broken if hosts were never resaved after the UI was rewritten in react
• dep updates

What's Changed in the last releases

• feat: Support for Multiple Access Control Lists and Location Specific Access Control Lists by @shopsD in #3101
• nginx: set http3_stream_buffer_size to 1m to improve http3 speed on non perfect connections
• nginx: disable SHA1 and RSA_PKCS1 sigalgs, RSA-PKCS1 can be reenabled using NGINX_TRUST_RSA_PKCS1
• nginx: prefer chacha20 and aes256 over aes128 for tls1.3 by patching aws-lc
• nginx: fix grpc
• nginx: hide more "useless" upstream headers
• nginx: enable mldsa87:mldsa65:mldsa44 sigalgs, I think no browser supports them
• nginx: update openappsec attachment and crowdsec
• nginx: update nginx to fix recent CVEs, see: #3285
• nginx: fix nginx quic gso (#3408) by patching nginx
• nginx: fix $server_port being broken in streams #3149
• nginx: fix loadbalancing, by checking if a hostname is a user provided upstream block based on a prefix #3093
• update aws-lc to v5, NPMplus will follow theier rolling mainline releases, like with nginx
• update alpine to v3.24
• startup: reduce time for 'chown' process when PUID/PGID != 0 by @invario in #3144
• startup: fix disabling ech without container recreation and too early nginx reload
• startup: fix blocked startup if acme server is down
• startup: improve user/group generation for PUID/PGID
• startup: only reload once after regenerating all config files
• UI: diffrent CSPs for NPMplus-UI and swaggerUI
• UI: add Permission Policy
• UI: improve sorting of online/offline/disabled column
• UI: fix button switching in custom location when clicking on the label
• UI: fix OIDC with authelia
• UI: add Button to disable nginx url sanitisation, default false, but true for existing hosts and custom locations
• UI: add Button to spoof host header
• UI: allow overwriting the upstream URL for an auth request provider in the UI per host
• UI: reset button values if they get disabled when the scheme changed, but exclude the "empty" scheme
• UI/nginx: keep uri sanitisation for npmplus itself and goaccess
• UI: allow multiple hosts to share the same domain name if only one of them is enabled #3362
• Build: pin git clone steps against commit shas instead of tags and branches
• Build: verify downloaded patches against a shasum
• Build: harden CFLAGS even more
• Build: remove unused lua rocks (session and openidc)
• merge upstream (mainly lang updates)
• dep and doc updates

Image tags:

• docker.io/zoeyvid/npmplus:2026-06-25-r1 (fixed to this release)
• ghcr.io/zoeyvid/npmplus:2026-06-25-r1 (fixed to this release)
• docker.io/zoeyvid/npmplus:latest (latest stable)
• ghcr.io/zoeyvid/npmplus:latest (latest stable)
• docker.io/zoeyvid/npmplus:beta (latest beta/stable)
• ghcr.io/zoeyvid/npmplus:beta (latest beta/stable)

Full Changelog: 2026-06-22-r1...2026-06-25-r1

2026-06-22-r1

What Changed since the last release

• Note: using the openappsec attachment module may break nginx config tests, reloads and cert renewals
• feat: Support for Multiple Access Control Lists and Location Specific Access Control Lists by @shopsD in #3101
• nginx: set http3_stream_buffer_size to 1m to improve http3 speed on non perfect connections
• nginx: disable SHA1 and RSA_PKCS1 sigalgs, RSA-PKCS1 can be reenabled using NGINX_TRUST_RSA_PKCS1
• nginx: prefer chacha20 and aes256 over aes128 for tls1.3 by patching aws-lc
• nginx: fix grpc
• nginx: hide more "useless" upstream headers
• nginx: enable mldsa87:mldsa65:mldsa44 sigalgs, I think no browser supports them
• nginx: update openappsec attachment and crowdsec
• nginx: update nginx to fix recent CVEs, see: #3285
• nginx: fix nginx quic gso (#3408) by patching nginx
• nginx: fix $server_port being broken in streams #3149
• nginx: fix loadbalancing, by checking if a hostname is a user provided upstream block based on a prefix #3093
• update aws-lc to v5, NPMplus will follow theier rolling mainline releases, like with nginx
• update alpine to v3.24
• startup: reduce time for 'chown' process when PUID/PGID != 0 by @invario in #3144
• startup: fix disabling ech without container recreation and too early nginx reload
• startup: fix blocked startup if acme server is down
• startup: improve user/group generation for PUID/PGID
• startup: only reload once after regenerating all config files
• UI: diffrent CSPs for NPMplus-UI and swaggerUI
• UI: add Permission Policy
• UI: improve sorting of online/offline/disabled column
• UI: fix button switching in custom location when clicking on the label
• UI: fix OIDC with authelia
• UI: add Button to disable nginx url sanitisation, default false, but true for existing hosts and custom locations
• UI: add Button to spoof host header
• UI: allow overwriting the upstream URL for an auth request provider in the UI per host
• UI: reset button values if they get disabled when the scheme changed, but exclude the "empty" scheme
• UI/nginx: keep uri sanitisation for npmplus itself and goaccess
• UI: allow multiple hosts to share the same domain name if only one of them is enabled #3362
• Build: pin git clone steps against commit shas instead of tags and branches
• Build: verify downloaded patches against a shasum
• Build: harden CFLAGS even more
• Build: remove unused lua rocks (session and openidc)
• merge upstream (mainly lang updates)
• dep and doc updates

What's Changed since the last beta

• dep updates
• access-list password hashes are now mask for custom locations

Image tags:

• docker.io/zoeyvid/npmplus:2026-06-22-r1 (fixed to this release)
• ghcr.io/zoeyvid/npmplus:2026-06-22-r1 (fixed to this release)
• docker.io/zoeyvid/npmplus:latest (latest stable)
• ghcr.io/zoeyvid/npmplus:latest (latest stable)
• docker.io/zoeyvid/npmplus:beta (latest beta/stable)
• ghcr.io/zoeyvid/npmplus:beta (latest beta/stable)

New Contributors

• @shopsD made their first contribution in #3101
• @invario made their first contribution in #3144

Full Changelog: 2026-04-21-r2...2026-06-22-r1

2026-06-17-b1

What's Changed since last beta

• update nginx version to release-1.31.2 in #3476, this fixes new CVEs
• dep updates
• Note: using the openappsec attachment module may break nginx config tests and reloads
• Note: if no new issues are reported then this will be released within the next few days
• ToDo: Update Nextcloud AIO Reverse Proxy Example Screenshots and Hints

What else Changed since last release

• feat: Support for Multiple Access Control Lists and Location Specific Access Control Lists by @shopsD in #3101
• nginx: set http3_stream_buffer_size to 1m to improve http3 speed on non perfect connections
• nginx: disable SHA1 and RSA_PKCS1 sigalgs, RSA-PKCS1 cna be reenabled using NGINX_TRUST_RSA_PKCS1
• nginx: prefer chacha20 and aes256 over aes128 for tls1.3 by patching aws-lc
• nginx: fix grpc
• nginx: hide more "useless" upstream headers
• nginx: enable mldsa87:mldsa65:mldsa44 sigalgs, I think no browser supports them
• nginx: update openappsec attachment and crowdsec
• nginx: update nginx to fix recent CVEs, see: #3285
• nginx: fix nginx quic gso (#3408) by patching nginx
• nginx: fix $server_port being broken in streams #3149
• nginx: fix loadbalancing, by checking if a hostname is a user provided upstream block based on a prefix #3093
• update aws-lc to v5, NPMplus will follow theier rolling mainline releases, like with nginx
• update alpine to v3.24
• startup: reduce time for 'chown' process when PUID/PGID != 0 by @invario in #3144
• startup: fix disabling ech without container recreation and too early nginx reload
• startup: fix blocked startup if acme server is down
• startup: disable openappsec attachment during host regeneration
• startup: improve user/group generation for PUID/PGID
• startup: only reload once after regenerating all config files
• UI: diffrent CSPs for NPMplus-UI and swaggerUI
• UI: add Permission Policy
• UI: improve sorting of online/offline/disabled column
• UI: fix button switching in custom location when clicking on the label
• UI: fix OIDC with authelia
• UI: add Button to disable nginx url sanitisation, default false, but true for existing hosts and custom locations
• UI: add Button to spoof host header
• UI: allow overwriting the upstream URL for an auth request provider in the UI per host
• UI: reset button values if they get disabled when the scheme changed, but exclude the "empty" scheme
• UI/nginx: keep uri sanitisation for npmplus itself and goaccess
• UI: allow multiple hosts to share the same domain name if only one of them is enabled #3362
• Build: pin git clone steps against commit shas instead of tags and branches
• Build: verify downloaded patches against a shasum
• Build: harden CFLAGS even more
• Build: remove unused lua rocks (session and openidc)
• merge upstream (mainly lang updates)
• dep and doc updates

Image tags:

• docker.io/zoeyvid/npmplus:2026-06-17-b1 (fixed to this release)
• ghcr.io/zoeyvid/npmplus:2026-06-17-b1 (fixed to this release)
• docker.io/zoeyvid/npmplus:beta (latest beta/stable)
• ghcr.io/zoeyvid/npmplus:beta (latest beta/stable)

New Contributors

• @shopsD made their first contribution in #3101
• @invario made their first contribution in #3144

Full Changelog: 2026-06-11-b1...2026-06-17-b1

2026-06-11-b1

What's Changed since last beta

• fix: missing shared libs
• Note: using the openappsec attachment module may break nginx config tests and reloads
• Note: if no new issues are reported then this will be released within the next few days
• ToDo: Update Nextcloud AIO Reverse Proxy Example Screenshots and Hints

What else Changed since last release

• feat: Support for Multiple Access Control Lists and Location Specific Access Control Lists by @shopsD in #3101
• nginx: set http3_stream_buffer_size to 1m to improve http3 speed on non perfect connections
• nginx: disable SHA1 and RSA_PKCS1 sigalgs, RSA-PKCS1 cna be reenabled using NGINX_TRUST_RSA_PKCS1
• nginx: prefer chacha20 and aes256 over aes128 for tls1.3 by patching aws-lc
• nginx: fix grpc
• nginx: hide more "useless" upstream headers
• nginx: enable mldsa87:mldsa65:mldsa44 sigalgs, I think no browser supports them
• nginx: update openappsec attachment and crowdsec
• nginx: update nginx to fix recent CVEs, see: #3285
• nginx: fix nginx quic gso (#3408) by patching nginx
• nginx: fix $server_port being broken in streams #3149
• nginx: fix loadbalancing, by checking if a hostname is a user provided upstream block based on a prefix #3093
• update aws-lc to v5, NPMplus will follow theier rolling mainline releases, like with nginx
• update alpine to v3.24
• startup: reduce time for 'chown' process when PUID/PGID != 0 by @invario in #3144
• startup: fix disabling ech without container recreation and too early nginx reload
• startup: fix blocked startup if acme server is down
• startup: disable openappsec attachment during host regeneration
• startup: improve user/group generation for PUID/PGID
• startup: only reload once after regenerating all config files
• UI: diffrent CSPs for NPMplus-UI and swaggerUI
• UI: add Permission Policy
• UI: improve sorting of online/offline/disabled column
• UI: fix button switching in custom location when clicking on the label
• UI: fix OIDC with authelia
• UI: add Button to disable nginx url sanitisation, default false, but true for existing hosts and custom locations
• UI: add Button to spoof host header
• UI: allow overwriting the upstream URL for an auth request provider in the UI per host
• UI: reset button values if they get disabled when the scheme changed, but exclude the "empty" scheme
• UI/nginx: keep uri sanitisation for npmplus itself and goaccess
• UI: allow multiple hosts to share the same domain name if only one of them is enabled #3362
• Build: pin git clone steps against commit shas instead of tags and branches
• Build: verify downloaded patches against a shasum
• Build: harden CFLAGS even more
• Build: remove unused lua rocks (session and openidc)
• merge upstream (mainly lang updates)
• dep and doc updates

Image tags:

• docker.io/zoeyvid/npmplus:2026-06-11-b1 (fixed to this release)
• ghcr.io/zoeyvid/npmplus:2026-06-11-b1 (fixed to this release)
• docker.io/zoeyvid/npmplus:beta (latest beta/stable)
• ghcr.io/zoeyvid/npmplus:beta (latest beta/stable)

New Contributors

• @shopsD made their first contribution in #3101
• @invario made their first contribution in #3144

Full Changelog: 2026-06-10-b1...2026-06-11-b1

2026-06-10-b1

What's Changed since last beta

• update alpine to v3.24
• Note: if no new issues are reported then this will be released within the next few days
• ToDo: Update Nextcloud AIO Reverse Proxy Example Screenshots and Hints

What else Changed since last release

• feat: Support for Multiple Access Control Lists and Location Specific Access Control Lists by @shopsD in #3101
• nginx: set http3_stream_buffer_size to 1m to improve http3 speed on non perfect connections
• nginx: disable SHA1 and RSA_PKCS1 sigalgs, RSA-PKCS1 cna be reenabled using NGINX_TRUST_RSA_PKCS1
• nginx: prefer chacha20 and aes256 over aes128 for tls1.3 by patching aws-lc
• nginx: fix grpc
• nginx: hide more "useless" upstream headers
• nginx: enable mldsa87:mldsa65:mldsa44 sigalgs, I think no browser supports them
• nginx: update openappsec attachment and crowdsec
• nginx: update nginx to fix recent CVEs, see: #3285
• nginx: fix nginx quic gso (#3408) by patching nginx
• nginx: fix $server_port being broken in streams #3149
• nginx: fix loadbalancing, by checking if a hostname is a user provided upstream block based on a prefix #3093
• update aws-lc to v5, NPMplus will follow theier rolling mainline releases, like with nginx
• startup: reduce time for 'chown' process when PUID/PGID != 0 by @invario in #3144
• startup: fix disabling ech without container recreation and too early nginx reload
• startup: fix blocked startup if acme server is down
• startup: disable openappsec attachment during host regeneration
• startup: improve user/group generation for PUID/PGID
• startup: only reload once after regenerating all config files
• UI: diffrent CSPs for NPMplus-UI and swaggerUI
• UI: add Permission Policy
• UI: improve sorting of online/offline/disabled column
• UI: fix button switching in custom location when clicking on the label
• UI: fix OIDC with authelia
• UI: add Button to disable nginx url sanitisation, default false, but true for existing hosts and custom locations
• UI: add Button to spoof host header
• UI: allow overwriting the upstream URL for an auth request provider in the UI per host
• UI: reset button values if they get disabled when the scheme changed, but exclude the "empty" scheme
• UI/nginx: keep uri sanitisation for npmplus itself and goaccess
• UI: allow multiple hosts to share the same domain name if only one of them is enabled #3362
• Build: pin git clone steps against commit shas instead of tags and branches
• Build: verify downloaded patches against a shasum
• Build: harden CFLAGS even more
• Build: remove unused lua rocks (session and openidc)
• merge upstream (mainly lang updates)
• dep and doc updates

Image tags:

• docker.io/zoeyvid/npmplus:2026-06-10-b1 (fixed to this release)
• ghcr.io/zoeyvid/npmplus:2026-06-10-b1 (fixed to this release)
• docker.io/zoeyvid/npmplus:beta (latest beta/stable)
• ghcr.io/zoeyvid/npmplus:beta (latest beta/stable)

New Contributors

• @shopsD made their first contribution in #3101
• @invario made their first contribution in #3144

Full Changelog: 2026-06-07-b2...2026-06-10-b1

2026-06-07-b2

What's Changed since last beta

• dep updates+two small fixes
• Note: if no new issues are reported then this will be released within the next few days
• ToDo: Update Nextcloud AIO Reverse Proxy Example Screenshots and Hints

What else Changed since last release

• feat: Support for Multiple Access Control Lists and Location Specific Access Control Lists by @shopsD in #3101
• nginx: set http3_stream_buffer_size to 1m to improve http3 speed on non perfect connections
• nginx: disable SHA1 and RSA_PKCS1 sigalgs, RSA-PKCS1 cna be reenabled using NGINX_TRUST_RSA_PKCS1
• nginx: prefer chacha20 and aes256 over aes128 for tls1.3 by patching aws-lc
• nginx: fix grpc
• nginx: hide more "useless" upstream headers
• nginx: enable mldsa87:mldsa65:mldsa44 sigalgs, I think no browser supports them
• nginx: update openappsec attachment and crowdsec
• nginx: update nginx to fix recent CVEs, see: #3285
• nginx: fix nginx quic gso (#3408) by patching nginx
• nginx: fix $server_port being broken in streams #3149
• nginx: fix loadbalancing, by checking if a hostname is a user provided upstream block based on a prefix #3093
• update aws-lc to v5, NPMplus will follow theier rolling mainline releases, like with nginx
• startup: reduce time for 'chown' process when PUID/PGID != 0 by @invario in #3144
• startup: fix disabling ech without container recreation and too early nginx reload
• startup: fix blocked startup if acme server is down
• startup: disable openappsec attachment during host regeneration
• startup: improve user/group generation for PUID/PGID
• startup: only reload once after regenerating all config files
• UI: diffrent CSPs for NPMplus-UI and swaggerUI
• UI: add Permission Policy
• UI: improve sorting of online/offline/disabled column
• UI: fix button switching in custom location when clicking on the label
• UI: fix OIDC with authelia
• UI: add Button to disable nginx url sanitisation, default false, but true for existing hosts and custom locations
• UI: add Button to spoof host header
• UI: allow overwriting the upstream URL for an auth request provider in the UI per host
• UI: reset button values if they get disabled when the scheme changed, but exclude the "empty" scheme
• UI/nginx: keep uri sanitisation for npmplus itself and goaccess
• UI: allow multiple hosts to share the same domain name if only one of them is enabled #3362
• Build: pin git clone steps against commit shas instead of tags and branches
• Build: verify downloaded patches against a shasum
• Build: harden CFLAGS even more
• Build: remove unused lua rocks (session and openidc)
• merge upstream (mainly lang updates)
• dep and doc updates

Image tags:

• docker.io/zoeyvid/npmplus:2026-06-07-b2c (fixed to this release)
• ghcr.io/zoeyvid/npmplus:2026-06-07-b2 (fixed to this release)
• docker.io/zoeyvid/npmplus:beta (latest beta/stable)
• ghcr.io/zoeyvid/npmplus:beta (latest beta/stable)

New Contributors

• @shopsD made their first contribution in #3101
• @invario made their first contribution in #3144

2026-06-07-b1

What's Changed since last beta

• UI: allow multiple hosts to share the same domain name if only one of them is enabled #3362
• startup: only reload once after regenerating all config files
• dep updates
• Note: if no new issues are reported then this will be released within the next few days
• ToDo: Update Nextcloud AIO Reverse Proxy Example Screenshots and Hints

What else Changed since last release

• feat: Support for Multiple Access Control Lists and Location Specific Access Control Lists by @shopsD in #3101
• nginx: set http3_stream_buffer_size to 1m to improve http3 speed on non perfect connections
• nginx: disable SHA1 and RSA_PKCS1 sigalgs, RSA-PKCS1 cna be reenabled using NGINX_TRUST_RSA_PKCS1
• nginx: prefer chacha20 and aes256 over aes128 for tls1.3 by patching aws-lc
• nginx: fix grpc
• nginx: hide more "useless" upstream headers
• nginx: enable mldsa87:mldsa65:mldsa44 sigalgs, I think no browser supports them
• nginx: update openappsec attachment and crowdsec
• nginx: update nginx to fix recent CVEs, see: #3285
• nginx: fix nginx quic gso (#3408) by patching nginx
• nginx: fix $server_port being broken in streams #3149
• nginx: fix loadbalancing, by checking if a hostname is a user provided upstream block based on a prefix #3093
• update aws-lc to v5, NPMplus will follow theier rolling mainline releases, like with nginx
• startup: reduce time for 'chown' process when PUID/PGID != 0 by @invario in #3144
• startup: fix disabling ech without container recreation and too early nginx reload
• startup: fix blocked startup if acme server is down
• startup: disable openappsec attachment during host regeneration
• startup: improve user/group generation for PUID/PGID
• UI: diffrent CSPs for NPMplus-UI and swaggerUI
• UI: add Permission Policy
• UI: improve sorting of online/offline/disabled column
• UI: fix button switching in custom location when clicking on the label
• UI: fix OIDC with authelia
• UI: add Button to disable nginx url sanitisation, default false, but true for existing hosts and custom locations
• UI: add Button to spoof host header
• UI: allow overwriting the upstream URL for an auth request provider in the UI per host
• UI: reset button values if they get disabled when the scheme changed, but exclude the "empty" scheme
• UI/nginx: keep uri sanitisation for npmplus itself and goaccess
• Build: pin git clone steps against commit shas instead of tags and branches
• Build: verify downloaded patches against a shasum
• Build: harden CFLAGS even more
• Build: remove unused lua rocks (session and openidc)
• merge upstream (mainly lang updates)
• dep and doc updates

Image tags:

• docker.io/zoeyvid/npmplus:2026-06-07-b1 (fixed to this release)
• ghcr.io/zoeyvid/npmplus:2026-06-07-b1 (fixed to this release)
• docker.io/zoeyvid/npmplus:beta (latest beta/stable)
• ghcr.io/zoeyvid/npmplus:beta (latest beta/stable)

New Contributors

• @shopsD made their first contribution in #3101
• @invario made their first contribution in #3144

Full Changelog: 2026-06-05-b4...2026-06-07-b1