v1.6.14

Documentation : https://docs.bunkerweb.io/1.6.14/

Docker tags :

• All-in-one : bunkerity/bunkerweb-all-in-one:1.6.14 or ghcr.io/bunkerity/bunkerweb-all-in-one:1.6.14
• BunkerWeb : bunkerity/bunkerweb:1.6.14 or ghcr.io/bunkerity/bunkerweb:1.6.14
• Scheduler : bunkerity/bunkerweb-scheduler:1.6.14 or ghcr.io/bunkerity/bunkerweb-scheduler:1.6.14
• Autoconf : bunkerity/bunkerweb-autoconf:1.6.14 or ghcr.io/bunkerity/bunkerweb-autoconf:1.6.14
• UI : bunkerity/bunkerweb-ui:1.6.14 or ghcr.io/bunkerity/bunkerweb-ui:1.6.14
• API : bunkerity/bunkerweb-api:1.6.14 or ghcr.io/bunkerity/bunkerweb-api:1.6.14

Linux packages : https://packagecloud.io/app/bunkerity/bunkerweb/search?q=1.6.14&filter=all&dist=

Changelog :

🔒 Security

• api, ui: reject a configuration or plugin name ending in a newline, which passed validation and became a filename that aborted every configuration push.
• crowdsec: remove the rendered configurations, which hold the Local API bouncer key, when CrowdSec is disabled on the last service.
• db: the database password is no longer written to the logs, where a malformed DATABASE_URI was logged in full before exiting. Connection failures now name the masked target and the reason. (Refs #3361)
• api: a configuration or plugin push no longer empties the target directory on a live instance while it copies the new content in, which made every request to every service fail for the duration of the copy. Entries are now swapped one at a time with a rename, and a push whose content is unchanged is skipped instead of rewriting an identical tree on every Scheduler start.
• core: client-supplied X-SSL-* request headers are stripped before reaching an upstream. With mTLS header forwarding off, or on any PHP-FPM service, a client could spoof X-SSL-Client-Verify: SUCCESS. See the mTLS documentation to re-publish them when another proxy terminates mTLS.
• linux: the API_TOKEN set in /etc/bunkerweb/variables.env is applied to the configuration BunkerWeb starts with, instead of being dropped so that the API accepted untokenized requests until the Scheduler pushed the real configuration.
• ui: a TOTP code can no longer be used more than once. The replay guard never persisted the last accepted time step, leaving a captured code valid for the rest of its 30-second window.
• ui: removed the year-long "remember me" token, which survived logout, password changes and Wipe other sessions and bypassed IP/User-Agent pinning and the absolute session cap. "Remember me" now marks the session cookie permanent, so it still survives a browser restart but is a normal revocable session; raise both SESSION_LIFETIME_HOURS and SESSION_ABSOLUTE_HOURS to stay logged in longer. Existing tokens are rejected and deleted on the next request.
• ui: revoked sessions are recorded in the session store (Redis when enabled) instead of a file outside the persistent volume, where recreating the container forgot every revocation and revocations never reached other replicas. Wipe other sessions and the password-change cleanup now keep the session you are using instead of the newest one.
• api: reject Biscuit tokens carrying more than the single block the product issues. Biscuit blocks can be appended offline without any private key, and the Datalog run limits are only checked between iterations, so a single crafted join inside an appended block could hold an API worker's event loop for tens of seconds whatever the execution budget was set to.
• modsecurity: update the OWASP Core Rule Set, including fixes for [GHSA-6jp8-c2w2-x7wr](GHSA-6jp8-c2w2-x7wr), where XML attribute values were not inspected by the attack-detection rules and could be used to bypass them, and [GHSA-f5qm-3h4p-8qhg](GHSA-f5qm-3h4p-8qhg), catastrophic backtracking in the unix-shell-evasion prefix. The update also removes excessive backtracking from rules 933160, 933161, 933180, 941140 and 942522.
• modsecurity: update Mbed TLS to v4.2.0, which fixes a use-after-free in mbedtls_pkcs7_free(), X.509 CA-bit forgery via an invalid basicConstraints extension, acceptance of weak hash algorithms in PKCS7 signature verification, and unenforced signature-algorithm restrictions on certificate chains. BunkerWeb builds Mbed TLS as ModSecurity's crypto backend only, so the TLS-handshake advisories in that release do not apply.
• docker: update the Alpine python3 and pyc packages to 3.14.7-r0, fixing CVE-2026-7210.

✨ Features & improvements

• crowdsec: every CROWDSEC_* setting is now multisite, so services on one instance can use different Local API and AppSec endpoints, or only one of the two. Set CROWDSEC_API to an empty string for a service to keep AppSec inspection without the decision lookup. Cached decisions are keyed by Local API, so services pointing at different CrowdSec instances no longer read each other's. See the CrowdSec documentation for per-service examples.
• ui: a Validate certificate button on the custom certificate settings checks the pasted or uploaded pair before the service is saved, reporting a mismatched or encrypted key, expiry, and a server name the certificate does not cover. A certificate given as a path is still only checked by the Scheduler, which is the only component that can read it. (Refs #3630)
• metrics: buffer reports during Redis OOM events, make list and facet updates atomic, and add the METRICS_REDIS_TTL setting.
• all-in-one: add DISABLE_ONLINE_API, same name as the official CrowdSec images, to run CrowdSec without registering to the Central API. (Refs #3754)
• headers: deny Chrome built-in AI APIs in the default PERMISSIONS_POLICY.
• misc: allow the QUERY HTTP method by default in ALLOWED_METHODS and bundled service templates.

⚡ Performance

• ui: make the Reports, Logs, and Home pages fast when many blocked-request reports are stored in Redis: fetch a single report by id from the newest end instead of scanning the whole list, share the Home page aggregation across workers through Redis instead of recomputing it in every worker, cache the Logs line count until the file changes or is rotated, and pause the Reports auto-refresh while the browser tab is in the background. Also honor the k/m suffix on METRICS_MAX_BLOCKED_REQUESTS_REDIS when bounding report reads.
• ui: memoize the plugin catalog and rebuild it only when plugins change instead of on every request, cutting the fixed overhead paid on every page load.

---

🐛 Bug fixes

Core, configuration & Scheduler

• core: an instance no longer stays on its loading configuration after a restart, where a surviving .bw-applied marker made the Scheduler skip the next push.
• core: an expiry of 0 in the datastore worker cache means no expiry, as in the shared dictionary, instead of expiring at once.
• scheduler: push the configuration before running the jobs on every change, not only on the first start, so a new service already has its server{} when certbot-new asks Let's Encrypt to validate it. (Fixes #3772)
• scheduler: wait for an instance to answer before pushing the initial configuration, instead of leaving it on its loading configuration (no service, no certificate) until the once-jobs finish. (Refs #3773)
• scheduler: refresh the job environment in place instead of replacing it on every reload, so jobs stop reading a snapshot of the configuration taken at startup. A DNS-01 service created or edited in the web UI got no certificate until the container was restarted. (Fixes #3755)
• core: deleting a plugin's cache entry no longer empties that plugin's cache directory on disk. For Let's Encrypt this destroyed the ACME accounts, archives and live certificate links, which is what the Cache page was being recommended for. (Refs #3635)
• core: a setting left empty no longer renders a directive with no argument, such as gzip_proxied ;, real_ip_header ;, proxy_no_cache ; or proxy_cache_bypass ;, which NGINX refuses to start on. An empty SERVER_NAME in single-site mode now renders no server at all, as multisite already did.
• core: KEEP_CONFIG_ON_RESTART is no longer listed as a setting. It is read by the entrypoint before the database is reachable, so setting it from the web UI never had any effect; set it in the environment, or in /etc/bunkerweb/variables.env on Linux, as before.
• core: application-generated upstream 403 responses remain in access logs without appearing as unknown Security Reports or being reported to BunkerNet.
• core: appending to a list in a full shared dictionary evicts only what the append needs instead of overwriting the whole list, and reports a readable error when there is nothing to evict. A saturated antiddos_metrics zone was holding PRO anti-DDoS IPs over the threshold and aborting the logging phase for first-seen ones.
• core: a setting missing from a service's configuration falls back to its global value, and a setting declared by a plugin but absent from the configuration is logged once per minute at warning level instead of at error level on every request. (Refs #3746)

🔐 Let's Encrypt, SSL, mTLS & certificates

• letsencrypt: close Certbot's stderr once its reader finishes, which leaked a descriptor per invocation.
• letsencrypt: an ACME account the certificate authority no longer accepts, or that was removed locally, is replaced instead of leaving every renewal failing forever with AccountNotFound. A deactivated account was not even recognized as the cause, because only one of the two rejections the authority can send was mat...

Testing

The testing version of BunkerWeb should not be used in production, please use the latest stable version instead.

Documentation : https://docs.bunkerweb.io/testing/

Docker tags :

• BunkerWeb : bunkerity/bunkerweb:testing or ghcr.io/bunkerity/bunkerweb:testing
• Scheduler : bunkerity/bunkerweb-scheduler:testing or ghcr.io/bunkerity/bunkerweb-scheduler:testing
• Autoconf : bunkerity/bunkerweb-autoconf:testing or ghcr.io/bunkerity/bunkerweb-autoconf:testing
• UI : bunkerity/bunkerweb-ui:testing or ghcr.io/bunkerity/bunkerweb-ui:testing
• API : bunkerity/bunkerweb-api:testing or ghcr.io/bunkerity/bunkerweb-api:testing
• All-in-one : bunkerity/bunkerweb-all-in-one:testing or ghcr.io/bunkerity/bunkerweb-all-in-one:testing

Linux packages : https://packagecloud.io/app/bunkerity/bunkerweb/search?q=testing&filter=all&dist=

Please note that when using Linux Debian or Ubuntu integration, you will need to add the force-bad-version directive to your /etc/dpkg/dpkg.cfg file before installing the testing version of BunkerWeb.

v1.6.14-rc3

Documentation : https://docs.bunkerweb.io/1.6.14~rc3/

Docker tags :

• All-in-one : bunkerity/bunkerweb-all-in-one:1.6.14-rc3 or ghcr.io/bunkerity/bunkerweb-all-in-one:1.6.14-rc3
• BunkerWeb : bunkerity/bunkerweb:1.6.14-rc3 or ghcr.io/bunkerity/bunkerweb:1.6.14-rc3
• Scheduler : bunkerity/bunkerweb-scheduler:1.6.14-rc3 or ghcr.io/bunkerity/bunkerweb-scheduler:1.6.14-rc3
• Autoconf : bunkerity/bunkerweb-autoconf:1.6.14-rc3 or ghcr.io/bunkerity/bunkerweb-autoconf:1.6.14-rc3
• UI : bunkerity/bunkerweb-ui:1.6.14-rc3 or ghcr.io/bunkerity/bunkerweb-ui:1.6.14-rc3
• API : bunkerity/bunkerweb-api:1.6.14-rc3 or ghcr.io/bunkerity/bunkerweb-api:1.6.14-rc3

Linux packages : https://packagecloud.io/app/bunkerity/bunkerweb/search?q=1.6.14~rc3&filter=all&dist=

Changelog :

• [SECURITY] db: the database password is no longer written to the logs, where a malformed DATABASE_URI was logged in full before exiting. Connection failures now name the masked target and the reason. (Refs #3361)
• [SECURITY] api: a configuration or plugin push no longer empties the target directory on a live instance while it copies the new content in, which made every request to every service fail for the duration of the copy. Entries are now swapped one at a time with a rename, and a push whose content is unchanged is skipped instead of rewriting an identical tree on every Scheduler start.
• [SECURITY] core: client-supplied X-SSL-* request headers are stripped before reaching an upstream. With mTLS header forwarding off, or on any PHP-FPM service, a client could spoof X-SSL-Client-Verify: SUCCESS. See the mTLS documentation to re-publish them when another proxy terminates mTLS.
• [SECURITY] linux: the API_TOKEN set in /etc/bunkerweb/variables.env is applied to the configuration BunkerWeb starts with, instead of being dropped so that the API accepted untokenized requests until the scheduler pushed the real configuration.
• [SECURITY] ui: a TOTP code can no longer be used more than once. The replay guard never persisted the last accepted time step, leaving a captured code valid for the rest of its 30 second window.
• [SECURITY] ui: removed the year-long "remember me" token, which survived logout, password changes and Wipe other sessions and bypassed IP/User-Agent pinning and the absolute session cap. "Remember me" now marks the session cookie permanent, so it still survives a browser restart but is a normal revocable session; raise both SESSION_LIFETIME_HOURS and SESSION_ABSOLUTE_HOURS to stay logged in longer. Existing tokens are rejected and deleted on the next request.
• [SECURITY] ui: revoked sessions are recorded in the session store (Redis when enabled) instead of a file outside the persistent volume, where recreating the container forgot every revocation and revocations never reached other replicas. Wipe other sessions and the password-change cleanup now keep the session you are using instead of the newest one.
• [FEATURE] crowdsec: every CROWDSEC_* setting is now multisite, so services on one instance can use different Local API and AppSec endpoints, or only one of the two. Set CROWDSEC_API to an empty string for a service to keep AppSec inspection without the decision lookup. Cached decisions are keyed by Local API, so services pointing at different CrowdSec instances no longer read each other's. See the CrowdSec documentation for per-service examples.
• [FEATURE] ui: a Validate certificate button on the custom certificate settings checks the pasted or uploaded pair before the service is saved, reporting a mismatched or encrypted key, expiry, and a server name the certificate does not cover. A certificate given as a path is still only checked by the scheduler, which is the only component that can read it. (Refs #3630)
• [BUGFIX] letsencrypt: an ACME account the certificate authority no longer accepts, or that was removed locally, is replaced instead of leaving every renewal failing forever with AccountNotFound. A deactivated account was not even recognized as the cause, because only one of the two rejections the authority can send was matched. The account is now retired, a new one registered, and every renewal configuration moved onto it in the same run, on renewal as well as on issuance. The retired account is kept aside for 30 days rather than deleted, so its key stays available. No certificate is re-issued and the repair itself costs no request. (Fixes #3783)
• [BUGFIX] letsencrypt: DNS credential items are split on any whitespace and the key is no longer taken verbatim, so a leading space or a quoted key stops silently discarding the credential; an invalid one now names the missing setting instead of logging [('', 'value_error')]. (Refs #3783)
• [BUGFIX] letsencrypt: one service no longer ends the job for all the others, whether its renewal configuration is missing, unreadable, or it fails unexpectedly in the default non-concurrent mode, which also skipped the cache save. Certbot output is logged in full instead of being cut short whenever certbot writes faster than the job reads, which hid the failure reason, and a renewal that stops responding is killed after 15 minutes; the timeout existed but could never fire. (Refs #3783)
• [BUGFIX] letsencrypt: skip services whose only names are IP addresses or single-label hosts, which no public CA can issue for, instead of asking for a certificate on every run and keeping the job red for every other service. (Refs #3772)
• [BUGFIX] letsencrypt: when listing the existing certificates fails, keep the ones already on disk instead of deleting and re-issuing every certificate, which burned the ACME rate limits on each restart. (Refs #3773)
• [BUGFIX] scheduler: push the configuration before running the jobs on every change, not only on the first start, so a new service already has its server{} when certbot-new asks Let's Encrypt to validate it. (Fixes #3772)
• [BUGFIX] scheduler: wait for an instance to answer before pushing the initial configuration, instead of leaving it on its loading configuration (no service, no certificate) until the once-jobs finish. (Refs #3773)
• [BUGFIX] ssl: AUTO_REDIRECT_HTTP_TO_HTTPS and REDIRECT_HTTP_TO_HTTPS no longer redirect the ACME challenge, which made an HTTP-01 validation depend on port 443 being reachable. (Refs #3772)
• [BUGFIX] core: deleting a plugin's cache entry no longer empties that plugin's cache directory on disk. For Let's Encrypt this destroyed the ACME accounts, archives and live certificate links, which is what the Cache page was being recommended for. (Refs #3635)
• [BUGFIX] core: a setting left empty no longer renders a directive with no argument, such as gzip_proxied ;, real_ip_header ;, proxy_no_cache ; or proxy_cache_bypass ;, which nginx refuses to start on. An empty SERVER_NAME in single-site mode now renders no server at all, as multisite already did.
• [BUGFIX] core: KEEP_CONFIG_ON_RESTART is no longer listed as a setting. It is read by the entrypoint before the database is reachable, so setting it from the web UI never had any effect; set it in the environment, or in /etc/bunkerweb/variables.env on Linux, as before.
• [BUGFIX] core: application-generated upstream 403 responses remain in access logs without appearing as unknown Security Reports or being reported to BunkerNet.
• [BUGFIX] core: appending to a list in a full shared dictionary evicts only what the append needs instead of overwriting the whole list, and reports a readable error when there is nothing to evict. A saturated antiddos_metrics zone was holding PRO anti-DDoS IPs over the threshold and aborting the logging phase for first-seen ones.
• [BUGFIX] metrics: MAX_LRU_HISTORY really caps the per-worker metrics cache: it is applied in every worker instead of a single one, the Redis sync no longer reverses the cache ordering on every pass (which evicted the busiest counters first), and an evicted counter is deleted from Redis instead of being left there with its last value forever. (Refs #3758)
• [BUGFIX] metrics: badbehavior, authbasic and limit no longer build metric keys from request data, where one cache slot per client IP, username or URI let a scan flood evict every other plugin's metrics. Blocked requests are counted per path instead of per full URI, and the limit top URLs chart shows the matched rule instead of the raw URI. (Refs #3475, #3758)
• [BUGFIX] limit: the local copy of the rate-limit counters written when Redis is enabled now expires with its window instead of never, where one permanent entry per client and URL filled the shared memory zone and evicted other plugins' data.
• [BUGFIX] modsecurity: a request declaring an XML Content-Type with no body is no longer denied with a 400. Rule 200000 arms the XML processor from the header alone, so the empty body failed to parse and 200002/200005 blocked it, which broke WebDAV and SOAP clients. Genuine parse failures, including chunked bodies, are still blocked. (Refs #3682)
• [BUGFIX] modsecurity: USE_MODSECURITY_GLOBAL_CRS no longer breaks the configuration when no service is defined yet, where an empty allowed-methods list surfaced as a syntax error in the CRS setup file. (Fixes #3761)
• [BUGFIX] customcert: validate the private key and its pairing with the certificate. Only the certificate was parsed, so a malformed, encrypted or mismatched key was shipped and the service silently served the default certificate instead. Expiry only warns. (Refs #3630)
• [BUGFIX] reverseproxy: a REVERSE_PROXY_URL starting with ^ or ending with $ renders as a regex location instead of a prefix that broke the configuration or matched nothing. (Fixes #3768)
• [BUGFIX] ui: settings on a service created by the setup wizard can be edited again. Every change was silently discarded, with no error and the old value redrawn, because the wizard's ...

v1.6.14-rc2

Documentation : https://docs.bunkerweb.io/1.6.14~rc2/

Docker tags :

• All-in-one : bunkerity/bunkerweb-all-in-one:1.6.14-rc2 or ghcr.io/bunkerity/bunkerweb-all-in-one:1.6.14-rc2
• BunkerWeb : bunkerity/bunkerweb:1.6.14-rc2 or ghcr.io/bunkerity/bunkerweb:1.6.14-rc2
• Scheduler : bunkerity/bunkerweb-scheduler:1.6.14-rc2 or ghcr.io/bunkerity/bunkerweb-scheduler:1.6.14-rc2
• Autoconf : bunkerity/bunkerweb-autoconf:1.6.14-rc2 or ghcr.io/bunkerity/bunkerweb-autoconf:1.6.14-rc2
• UI : bunkerity/bunkerweb-ui:1.6.14-rc2 or ghcr.io/bunkerity/bunkerweb-ui:1.6.14-rc2
• API : bunkerity/bunkerweb-api:1.6.14-rc2 or ghcr.io/bunkerity/bunkerweb-api:1.6.14-rc2

Linux packages : https://packagecloud.io/app/bunkerity/bunkerweb/search?q=1.6.14~rc2&filter=all&dist=

Changelog :

• [PERF] ui: make the Reports, Logs, and Home pages fast when many blocked-request reports are stored in Redis: fetch a single report by id from the newest end instead of scanning the whole list, share the Home page aggregation across workers through Redis instead of recomputing it in every worker, cache the Logs line count until the file changes or is rotated, and pause the Reports auto-refresh while the browser tab is in the background. Also honor the k/m suffix on METRICS_MAX_BLOCKED_REQUESTS_REDIS when bounding report reads.
• [PERF] ui: memoize the plugin catalog and rebuild it only when plugins change instead of on every request, cutting the fixed overhead paid on every page load.
• [BUGFIX] metrics: when the metrics memory zone fills up, shed the oldest blocked-request reports instead of silently discarding a worker's whole history, and warn that METRICS_MEMORY_SIZE needs raising.
• [BUGFIX] metrics: stop storing the literal string nil in Redis for a counter evicted from a worker's LRU mid-sync, which made the misc, blacklist and greylist plugin pages return a 500.
• [BUGFIX] ui: an unreadable counter no longer breaks a whole plugin page, and no longer hides the workers that reported real counts.
• [BUGFIX] scheduler: refresh the job environment in place instead of replacing it on every reload, so jobs stop reading a snapshot of the configuration taken at startup. A DNS-01 service created or edited in the web UI got no certificate until the container was restarted. (Fixes #3755)
• [BUGFIX] letsencrypt: fail the certbot-new job when a service cannot get the certificate it asked for instead of reporting success, and write each job's output to certbot-new.log and certbot-renew.log so the Jobs and Logs pages show why.
• [BUGFIX] whitelist: whitelisting a banned IP now lifts the block on HTTP and stream services, and manually configured WHITELIST_* values are honored by the default server and badbehavior checks instead of only the entries downloaded from WHITELIST_*_URLS. (Refs #3708)
• [BUGFIX] core: a setting missing from a service's configuration falls back to its global value, and a setting declared by a plugin but absent from the configuration is logged once per minute at warning level instead of at error level on every request. (Refs #3746)
• [BUGFIX] autoconf: a Kubernetes watch that exhausts its retries now backs off and marks the container unhealthy instead of silently restarting forever while reporting healthy, and the Kubernetes manifests give the controller a liveness probe so it gets restarted. (Refs #3750)
• [BUGFIX] api, ui: raise the Biscuit Datalog authorizer's wall-clock budget from biscuit's 1 ms default to 100 ms, so a CPU-saturated host stops rejecting valid tokens with 401/403 in the API and stops logging the session out in the web UI. The fact and iteration limits keep their defaults, so a token whose own Datalog is hostile is still denied immediately, and a genuine policy denial keeps its original status.
• [BUGFIX] crowdsec: enabling CrowdSec on individual services while it stays off globally now works. The bouncer was never initialized in that configuration, so every request logged attempt to index field 'conf' (a nil value) and was let through unchecked.
• [FEATURE] all-in-one: add DISABLE_ONLINE_API, same name as the official CrowdSec images, to run CrowdSec without registering to the Central API. (Refs #3754)
• [DOCS] all-in-one: document what CrowdSec Central API registration transmits, and correct the parser opt-out variable to CROWDSEC_DISABLE_PARSERS.
• [BUGFIX] ui: a form submitted after the session ended now reports that the change was not saved, instead of redirecting to the login page and redrawing the old values as if nothing had happened. (Refs #3751, #3752)
• [UI] Reports page: document the retention model, a rolling buffer capped per worker that is cleared on restart unless Redis is enabled.
• [SECURITY] api: reject Biscuit tokens carrying more than the single block the product issues. Biscuit blocks can be appended offline without any private key, and the Datalog run limits are only checked between iterations, so a single crafted join inside an appended block could hold an API worker's event loop for tens of seconds whatever the execution budget was set to.
• [SECURITY] modsecurity: update the OWASP Core Rule Set to v4.28.0 and v3.3.10, fixing GHSA-6jp8-c2w2-x7wr, where XML attribute values were not inspected by the attack-detection rules and could be used to bypass them, and GHSA-f5qm-3h4p-8qhg, catastrophic backtracking in the unix-shell-evasion prefix. v4.28.0 also removes excessive backtracking from rules 933160, 933161, 933180, 941140 and 942522.
• [SECURITY] modsecurity: update Mbed TLS to v4.2.0, which fixes a use-after-free in mbedtls_pkcs7_free(), X.509 CA-bit forgery via an invalid basicConstraints extension, acceptance of weak hash algorithms in PKCS7 signature verification, and unenforced signature-algorithm restrictions on certificate chains. BunkerWeb builds Mbed TLS as ModSecurity's crypto backend only, so the TLS-handshake advisories in that release do not apply.
• [MODSECURITY] CRS v4.28.0 enables crs_validate_utf8_encoding by default. Requests carrying non-UTF8 data that previously passed may now be flagged; raise the anomaly threshold or disable rule 920250 if this causes false positives.
• [DEPS] Updated Coreruleset version to v4.28.0 (v4) and v3.3.10 (v3)
• [DEPS] Updated Mbed TLS version to v4.2.0
• [DEPS] Updated lua-nginx-module version to v0.10.29R2, lua-resty-core to v0.1.32R1 and stream-lua-nginx-module to v0.0.17R4 (these three share a compile-time version handshake and are bumped together)
• [DEPS] Updated lua-resty-http version to v0.18.0
• [DEPS] Updated lua-cjson version to v2.1.0.19
• [DEPS] Updated LuaJIT version to v2.1-20260724
• [DEPS] Updated postcss version to 8.5.24
• [DEPS] Updated the web UI vendored libraries: DOMPurify to 3.4.12, ApexCharts to 6.6.1, i18next to 26.3.6 and i18next-http-backend to 4.0.1
• [DEPS] Removed the unused nginx 1.28.0 source tree, which nothing built since the FreeBSD packaging was dropped, and the obsolete stream-lua-nginx-module patch, which upstream applied in v0.0.17R4
• [UI] Removed vendored front-end assets that were never loaded: 28 unused ACE extensions, keybindings and themes, the ACE stylesheet directory, the 45 ApexCharts locale files, and the unminified topojson-client build.
• [CONTRIBUTION] Thank you xabru for your contribution regarding wildcard SNI fallback for custom certificates. (#3745)

v1.6.14-rc1

Documentation : https://docs.bunkerweb.io/1.6.14~rc1/

Docker tags :

• All-in-one : bunkerity/bunkerweb-all-in-one:1.6.14-rc1 or ghcr.io/bunkerity/bunkerweb-all-in-one:1.6.14-rc1
• BunkerWeb : bunkerity/bunkerweb:1.6.14-rc1 or ghcr.io/bunkerity/bunkerweb:1.6.14-rc1
• Scheduler : bunkerity/bunkerweb-scheduler:1.6.14-rc1 or ghcr.io/bunkerity/bunkerweb-scheduler:1.6.14-rc1
• Autoconf : bunkerity/bunkerweb-autoconf:1.6.14-rc1 or ghcr.io/bunkerity/bunkerweb-autoconf:1.6.14-rc1
• UI : bunkerity/bunkerweb-ui:1.6.14-rc1 or ghcr.io/bunkerity/bunkerweb-ui:1.6.14-rc1
• API : bunkerity/bunkerweb-api:1.6.14-rc1 or ghcr.io/bunkerity/bunkerweb-api:1.6.14-rc1

Linux packages : https://packagecloud.io/app/bunkerity/bunkerweb/search?q=1.6.14~rc1&filter=all&dist=

Changelog :

• [BUGFIX] mtls: the Scheduler now validates the client CA bundle and CRL, caches them, and distributes them to every instance instead of shipping the raw configured path straight into the NGINX configuration, so a Scheduler-only mount works as documented instead of causing "cannot load certificate" errors on instances that cannot read that path. Adds MTLS_CA_CERTIFICATE_DATA and MTLS_CRL_DATA to supply either file inline as base64 or plaintext PEM.
• [BUGFIX] backup: support MySQL 9 and MariaDB 12 backup/restore with current authentication, TLS, and privilege defaults while preserving compatibility with older servers; refresh the documented database compatibility matrix, including PostgreSQL 18.
• [BUGFIX] ui: fix plugin hook loading and chaining, and purge unavailable PRO plugin pages after license loss.
• [BUGFIX] letsencrypt: quarantine broken renewal lineages and persist the cleaned cache before Certbot runs. (Fixes #3733)
• [FEATURE] metrics: buffer reports during Redis OOM events, make list and facet updates atomic, and add the METRICS_REDIS_TTL setting.
• [FEATURE] headers: deny Chrome built-in AI APIs in the default PERMISSIONS_POLICY.
• [FEATURE] misc: allow the QUERY HTTP method by default in ALLOWED_METHODS and bundled service templates.
• [LINUX] Updated the NGINX version to v1.30.4 for Fedora 43 and 44 now that it is available in their repositories.
• [UI] Reports and Bans pages: show unknown countries as not applicable, and make exports and bulk actions honor active filters. (Fixes #3683, #3685)

v1.6.13

Documentation : https://docs.bunkerweb.io/1.6.13/

Docker tags :

• All-in-one : bunkerity/bunkerweb-all-in-one:1.6.13 or ghcr.io/bunkerity/bunkerweb-all-in-one:1.6.13
• BunkerWeb : bunkerity/bunkerweb:1.6.13 or ghcr.io/bunkerity/bunkerweb:1.6.13
• Scheduler : bunkerity/bunkerweb-scheduler:1.6.13 or ghcr.io/bunkerity/bunkerweb-scheduler:1.6.13
• Autoconf : bunkerity/bunkerweb-autoconf:1.6.13 or ghcr.io/bunkerity/bunkerweb-autoconf:1.6.13
• UI : bunkerity/bunkerweb-ui:1.6.13 or ghcr.io/bunkerity/bunkerweb-ui:1.6.13
• API : bunkerity/bunkerweb-api:1.6.13 or ghcr.io/bunkerity/bunkerweb-api:1.6.13

Linux packages : https://packagecloud.io/app/bunkerity/bunkerweb/search?q=1.6.13&filter=all&dist=

Changelog :

Security

• [SECURITY] nginx: update NGINX to 1.30.4, except on Fedora, which remains on 1.30.3 until the new version is available in its repositories. This fixes:

  • CVE-2026-42533, a heap buffer overflow in regex matching used by the map directive.
  • CVE-2026-60005, an uninitialized memory access in the slice directive with background cache updates, which could disclose worker-process memory or crash a worker.
  • CVE-2026-56434, a use-after-free in ngx_http_ssi_filter_module.

• [SECURITY] blacklist, greylist, antibot: forward-confirm reverse DNS results before honoring an IGNORE_RDNS or GREYLIST_RDNS suffix match. An attacker can no longer bypass blocking, gain greylist access, or skip an antibot challenge by configuring a PTR record that ends with a trusted suffix such as .googlebot.com without controlling that domain. (Fixes GHSA-q54j-5484-pvjm) Thanks to @kule500 for the report.

• [SECURITY] letsencrypt: validate ACME challenge tokens against the base64url character set. This prevents ../ payloads from writing, overwriting, or deleting files outside the challenge directory as the nginx user through the internal API. (Fixes GHSA-79fm-4xj6-pp5g) Thanks to @xyptonize and @kule500 for the report.

• [SECURITY] instances: validate registered destinations as IPv4 or IPv6 literals, or as IDNA-normalized DNS hostnames, at every input and outbound-client boundary. Trailing-dot FQDNs remain supported, while URL user information, paths, queries, fragments, malformed ports, and non-HTTP(S) schemes are rejected with a validation error instead of causing an internal server error. (Refs GHSA-rwch-jhxx-cx5f) Thanks to @adilkhan7546 for the report.

• [SECURITY] ui: enforce TOTP verification using the exact validation endpoint instead of matching any path containing /totp. This prevents password-only sessions from accessing /profile/totp-refresh and rotating recovery codes before completing the second authentication factor. (Fixes GHSA-j63f-j59c-q626) Thanks to @de3erve-hunter for the report.

• [SECURITY] api: document that fine-grained permissions allowing writes to configurations, services, plugins, or global settings are equivalent to administrator access. Their payloads are rendered into raw NGINX or OpenResty Lua configuration and can therefore execute code as the BunkerWeb process user. A warning is now logged when one of these permissions is granted to a non-administrator API user. (Refs GHSA-5xh4-hfr2-jm9m, GHSA-4xv6-4mw6-34m7, GHSA-cc8g-89qq-j9vm)

Features

• [FEATURE] limit: add USE_LIMIT_REQ_GLOBAL and LIMIT_REQ_GLOBAL_RATE to cap the total aggregate request rate for a service across all clients and URLs. The global limit is evaluated before the existing per-IP and per-URL limits, allowing origin or backend capacity to be protected independently. Disabled by default.

• [FEATURE] country: add COUNTRY_IGNORE_URI to skip country whitelist and blacklist checks for URIs matching a list of PCRE expressions. Matching is performed against both the request path and the complete request URI, including its query string, consistently with ANTIBOT_IGNORE_URI.

• [FEATURE] antibot: add ANTIBOT_SUCCESS_URI to redirect clients to a fixed URI after they successfully complete a challenge. Leaving the setting empty preserves the existing behavior and returns clients to the originally requested page. (Fixes #3704)

Bug fixes

• [BUGFIX] authbasic: fix an error occurring after every successful basic-auth login. The plugin attempted to write to the undeclared $auth_user variable and to the read-only $remote_user core variable, resulting in variable "remote_user" not changeable. Both unnecessary writes have been removed. NGINX continues to populate $remote_user automatically from the authenticated request.

• [BUGFIX] ui, api: delete custom configurations using their exact keys. Removing the final UI-managed or API-managed configuration no longer requires replacing every configuration belonging to the same method, avoiding races with concurrent updates.

• [BUGFIX] headers: make KEEP_UPSTREAM_HEADERS recognize and preserve Content-Security-Policy-Report-Only. Upstream report-only policies are now kept by default and are no longer silently overwritten when CONTENT_SECURITY_POLICY_REPORT_ONLY=yes.

v1.6.13-rc1

Documentation : https://docs.bunkerweb.io/1.6.13~rc1/

Docker tags :

• All-in-one : bunkerity/bunkerweb-all-in-one:1.6.13-rc1 or ghcr.io/bunkerity/bunkerweb-all-in-one:1.6.13-rc1
• BunkerWeb : bunkerity/bunkerweb:1.6.13-rc1 or ghcr.io/bunkerity/bunkerweb:1.6.13-rc1
• Scheduler : bunkerity/bunkerweb-scheduler:1.6.13-rc1 or ghcr.io/bunkerity/bunkerweb-scheduler:1.6.13-rc1
• Autoconf : bunkerity/bunkerweb-autoconf:1.6.13-rc1 or ghcr.io/bunkerity/bunkerweb-autoconf:1.6.13-rc1
• UI : bunkerity/bunkerweb-ui:1.6.13-rc1 or ghcr.io/bunkerity/bunkerweb-ui:1.6.13-rc1
• API : bunkerity/bunkerweb-api:1.6.13-rc1 or ghcr.io/bunkerity/bunkerweb-api:1.6.13-rc1

Linux packages : https://packagecloud.io/app/bunkerity/bunkerweb/search?q=1.6.13~rc1&filter=all&dist=

Changelog :

• [SECURITY] blacklist, greylist, antibot: forward-confirm reverse DNS (FCrDNS) before honoring an IGNORE_RDNS/GREYLIST_RDNS suffix match, so an attacker who sets their own PTR to a trusted suffix (e.g. .googlebot.com) can no longer bypass the block, gain greylist access, or skip the challenge without controlling the domain. (Fixes GHSA-q54j-5484-pvjm) Thanks to @kule500 for the report.
• [SECURITY] letsencrypt: validate the ACME challenge token against the base64url charset so a ../ payload can no longer write, overwrite, or delete files outside the challenge directory as the nginx user through the internal API. (Fixes GHSA-79fm-4xj6-pp5g) Thanks to @xyptonize and @kule500 for the report.
• [SECURITY] api: document that the config, service, plugin, and global-settings write permissions granted through the fine-grained API ACL are admin-equivalent — their payload is rendered verbatim into raw NGINX/OpenResty Lua configuration, so a scoped non-admin token holding one can execute code as the BunkerWeb process user — and log a warning when such a permission is granted to a non-admin API user. (Refs GHSA-5xh4-hfr2-jm9m, GHSA-4xv6-4mw6-34m7, GHSA-cc8g-89qq-j9vm)
• [FEATURE] antibot: add ANTIBOT_SUCCESS_URI to redirect clients to a fixed URI after they solve the challenge instead of the page they originally requested (leave empty to keep returning to the original page). (Fixes #3704)
• [BUGFIX] headers: KEEP_UPSTREAM_HEADERS now honors Content-Security-Policy-Report-Only, which it silently ignored, and keeps it by default — an upstream report-only header is no longer overwritten when CONTENT_SECURITY_POLICY_REPORT_ONLY=yes.

v1.6.12

Documentation : https://docs.bunkerweb.io/1.6.12/

Docker tags :

• All-in-one : bunkerity/bunkerweb-all-in-one:1.6.12 or ghcr.io/bunkerity/bunkerweb-all-in-one:1.6.12
• BunkerWeb : bunkerity/bunkerweb:1.6.12 or ghcr.io/bunkerity/bunkerweb:1.6.12
• Scheduler : bunkerity/bunkerweb-scheduler:1.6.12 or ghcr.io/bunkerity/bunkerweb-scheduler:1.6.12
• Autoconf : bunkerity/bunkerweb-autoconf:1.6.12 or ghcr.io/bunkerity/bunkerweb-autoconf:1.6.12
• UI : bunkerity/bunkerweb-ui:1.6.12 or ghcr.io/bunkerity/bunkerweb-ui:1.6.12
• API : bunkerity/bunkerweb-api:1.6.12 or ghcr.io/bunkerity/bunkerweb-api:1.6.12

Linux packages : https://packagecloud.io/app/bunkerity/bunkerweb/search?q=1.6.12&filter=all&dist=

Changelog :

v1.6.12 - 2026/06/??

Security

• nginx: updated NGINX to 1.30.3 to fix:

  • CVE-2026-42055: heap buffer overflow in ngx_http_proxy_v2_module / ngx_http_grpc_module
  • CVE-2026-48142: heap buffer overread in ngx_http_charset_module

• api: hardened Biscuit token generation by binding Host header, client IP and username as typed terms, preventing signed Datalog fact injection. Added optional API_ALLOWED_HOSTS.

• api: API_ACL_BOOTSTRAP_FILE now validates supplied bcrypt hashes and rejects weak or malformed values.

• antibot: Cap.js challenge now uses a strict per-request CSP nonce and sends Cache-Control: no-store.

• antibot: fixed an open redirect in the post-challenge redirect flow by enforcing same-origin relative paths.

• ui: fixed session fixation on login by rotating the session ID on every authentication.

• ui: fixed open redirect via the post-login next parameter.

• ui: password changes now revoke the user’s other active sessions.

• ui: cache deletion routes now enforce Biscuit authorization.

• ui: improved hostname and ban-scope validation.

• ui: extended CSV/XLSX formula-injection protection to tab and carriage-return-prefixed cells.

• linux: uninstall hooks now preserve logs, configs, databases and backups unless purge is explicitly requested; upgrade backups moved to /var/backups/bunkerweb.

Features & Improvements

• reverseproxy: added upstream HTTPS certificate verification with:

  • REVERSE_PROXY_SSL_VERIFY
  • REVERSE_PROXY_SSL_VERIFY_DEPTH
  • REVERSE_PROXY_SSL_TRUSTED_CERTIFICATE
  • REVERSE_PROXY_SSL_TRUSTED_CERTIFICATE_DATA
  • REVERSE_PROXY_SSL_TRUSTED_CERTIFICATE_PRIORITY

• antibot: ANTIBOT_IGNORE_URI can now match full request URIs, including query strings.

• scheduler: added SCHEDULER_MAX_WORKERS to cap the job-executor thread pool and reduce database pool pressure.

• ui: ADMIN_PASSWORD can now accept pre-hashed bcrypt values.

• ui: logs viewer overhaul:

  • syntax highlighting for BunkerWeb, certbot and NGINX access logs
  • severity filters with counts
  • in-page search and error navigation
  • live-tail with pause and new-line indicator
  • download/copy actions
  • optional local-time display
  • collapsible multi-line entries
  • improved mobile toolbar layout

• ui: RAW config editor can now fold multi-line file settings, such as certificates and keys.

• mtls: added MTLS_URL_n regex setting to enforce mTLS per path instead of site-wide.

• bunkernet UI: improved status reporting with Connected / API unreachable / Not registered states, masked instance ID and disk self-heal.

Bug Fixes

• letsencrypt: fixed cache poisoning that could cause fleet-wide certbot AccountNotFound.
• letsencrypt: fixed scheduler/UI cache-row write race by sharing one fcntl.flock.
• letsencrypt: fixed Route53 auto-renewal when explicit AWS credentials are used.
• letsencrypt: fixed stale ACME account recovery when LETS_ENCRYPT_CONCURRENT_REQUESTS=yes.
• letsencrypt UI: deleting a certificate no longer fails when unrelated orphaned certificates are present.
• antibot: after solving a challenge, Chrome now returns to the originally requested URL instead of /.
• api: malformed API_ALLOWED_HOSTS wildcards no longer brick the API on every request.
• datastore: changing DATASTORE_LRU_SIZE no longer causes worker API HTTP 444 bootstrap deadlocks.
• database: fixed rc1 regression that reset UI/API-saved settings to defaults after scheduler restart.
• database: env vars no longer stay shadowed after a setting was touched in the UI/API.
• database: multisite env settings for DB-created services are no longer dropped as unknown globals.
• ssl: SSL_ECDH_CURVE=auto no longer emits X25519 on FIPS OpenSSL.
• autoconf: service labels are rechecked when valid settings change, such as after PRO plugin or external plugin installation.
• logger: unreachable LOG_SYSLOG_ADDRESS no longer crash-loops scheduler and UI processes.
• installer: testing/dev install script is now idempotent and avoids duplicating force-bad-version.
• ci: Testing release install script now defaults to the testing channel.
• ui: Setup Wizard now shows a Log Out button when reached while already authenticated.
• ui: RAW mode no longer breaks multi-line file settings such as PEM certificates and keys.
• ui: /home, /reports and /bans load much faster on Redis-backed setups.
• ui: static assets no longer trigger the full per-request lifecycle.
• ui: form-builder no longer creates phantom method=ui rows on no-op saves.
• ui / api: fixed possible login lockout with bcrypt 5.0.0 and passwords over 72 bytes.
• ui: fixed dark/light theme flicker and wrong-theme-on-load.
• ui: fixed plugin metrics crashes on Redis-backed setups.
• limit: fixed spurious HTTP/3 429 responses by separating HTTP/1, HTTP/2 and HTTP/3 connection limits.
• customcert: expired or soon-to-expire custom certificates are now accepted if they are valid X.509 certificates.

Linux & Packaging

• Fedora 43 and 44 now use NGINX 1.30.3.
• Ubuntu Pro/ESM installs now use the upstream CrowdSec engine instead of the outdated ESM build.
• Added Ubuntu 26.04 Resolute Raccoon package target.
• Ubuntu 24.04 Noble moved to the ubuntu-noble identifier.
• Ubuntu 22.04 Jammy remains available as ubuntu-jammy.

Dependencies

• Updated headers-more-nginx-module to 0.40.

• Updated lua-cjson to 2.1.0.18.

• Updated lua-resty-signal to 0.05.

• Updated lua-resty-string to 0.19.

• Updated lua-upstream-nginx-module to 0.08.

• Updated LuaJIT to 2.1-20260701.

• Updated ModSecurity to 3.0.16.

• Updated lua-resty-openssl to 1.8.0.

• Updated coreruleset-v4 to 4.27.0.

• Updated UI dependencies:

  • jQuery 4.0.0
  • Bootstrap 5.3.8
  • DataTables 2.3.8
  • Ace editor 1.44.0
  • ApexCharts.js 5.15.0
  • DOMPurify 3.4.11
  • i18next 26.3.1
  • i18next-http-backend 4.0.0
  • Perfect Scrollbar 1.5.6
  • lottie-player 2.0.12
  • canvas-confetti 1.9.4
  • ipaddr.js 2.4.0

• Updated build tooling:

  • cssnano 8.0.2
  • domino 2.1.7
  • removed unused root jquery dependency

Contributions

• Thanks to @cleverguns for the Filipino / Tagalog web UI translation.
• Thanks to @ray910408 for refreshing src/deps npm build-tool dependencies.
• Thanks to @immanuwell for parsing the DEBUG environment variable as a boolean in the Gunicorn configuration.

v1.6.12-rc3

Documentation : https://docs.bunkerweb.io/1.6.12~rc3/

Docker tags :

• All-in-one : bunkerity/bunkerweb-all-in-one:1.6.12-rc3 or ghcr.io/bunkerity/bunkerweb-all-in-one:1.6.12-rc3
• BunkerWeb : bunkerity/bunkerweb:1.6.12-rc3 or ghcr.io/bunkerity/bunkerweb:1.6.12-rc3
• Scheduler : bunkerity/bunkerweb-scheduler:1.6.12-rc3 or ghcr.io/bunkerity/bunkerweb-scheduler:1.6.12-rc3
• Autoconf : bunkerity/bunkerweb-autoconf:1.6.12-rc3 or ghcr.io/bunkerity/bunkerweb-autoconf:1.6.12-rc3
• UI : bunkerity/bunkerweb-ui:1.6.12-rc3 or ghcr.io/bunkerity/bunkerweb-ui:1.6.12-rc3
• API : bunkerity/bunkerweb-api:1.6.12-rc3 or ghcr.io/bunkerity/bunkerweb-api:1.6.12-rc3

Linux packages : https://packagecloud.io/app/bunkerity/bunkerweb/search?q=1.6.12~rc3&filter=all&dist=

Changelog :

• [SECURITY] nginx: update nginx to 1.30.3 (except for Fedora, which stays on 1.30.2 until it is available in its repositories) to fix CVE-2026-42055 — a heap buffer overflow in ngx_http_proxy_v2_module/ngx_http_grpc_module — and CVE-2026-48142 — a heap buffer overread in ngx_http_charset_module.
• [FEATURE] antibot: ANTIBOT_IGNORE_URI can now match full request URIs including query strings. (Fixes #3374)
• [SECURITY] antibot: validate the post-challenge redirect target as a same-origin relative path (closes an open redirect via crafted Referer/request URI), keep the original query string out of the redirect URL, and reject malformed challenge submissions instead of erroring.
• [BUGFIX] antibot: solving the challenge now returns to the originally requested URL instead of / on Chrome. (Fixes #3650)
• [BUGFIX] api: a malformed API_ALLOWED_HOSTS wildcard (e.g. foo.*.com) no longer bricks the API on every request — the patterns are now validated at startup and a bad entry is logged and skipped, instead of tripping Starlette's TrustedHostMiddleware assertion lazily on the first request (which the add_middleware try/except could not catch) or being silently accepted under python -O.
• [BUGFIX] letsencrypt: stale-ACME-account recovery now works under LETS_ENCRYPT_CONCURRENT_REQUESTS=yes — the JWS-rejection purge targeted the per-service temporary scratch dir (discarded on the failed run, merged back only on success) instead of the canonical account store, so a server-pruned account was restored on every retry and issuance kept failing identically. It now purges DATA_PATH/accounts.
• [BUGFIX] letsencrypt (UI): deleting a certificate no longer fails with a 500 (leaving the cache row stale so the cert reappears on the next scheduler sync) when an unrelated orphaned certificate is present in the cache — the delete now bypasses the global consistency gate like the Heal flow, since removing one certificate cannot introduce a new orphan reference (the scheduler-side gate still guards against runtime poisoning).
• [BUGFIX] datastore: setting DATASTORE_LRU_SIZE to any value other than the default (1k) no longer bricks every BunkerWeb worker API with HTTP 444 (a full scheduler↔worker bootstrap deadlock). The lazy per-worker LRU resize replaced the cache with a fresh empty instance mid-init_by_lua, discarding the bootstrap variables (including API_WHITELIST_IP) and plugin metadata it had just stored, so the API rejected every IP. The resize now migrates existing entries into the new cache and only ever grows above the default. (Fixes #3618)
• [FEATURE] reverseproxy: verify the upstream HTTPS certificate with REVERSE_PROXY_SSL_VERIFY, REVERSE_PROXY_SSL_VERIFY_DEPTH, and a trusted CA as a path or base64/PEM data (REVERSE_PROXY_SSL_TRUSTED_CERTIFICATE, _DATA, _PRIORITY), for HTTP and stream. The scheduler caches the CA and distributes it to every instance; fails safe to off when no CA is available. (Fixes #574)
• [FEATURE] ui: overhaul the logs viewer — per-format syntax highlighting (BunkerWeb, certbot and NGINX access logs), severity filter chips with counts, in-page search and next/previous error navigation, live-tail with pause and a "new lines" cue, download/copy, an opt-in local-time toggle, and collapsible multi-line entries (tracebacks and config dumps fold to a labelled ⋯ N lines / Traceback (N lines) pill). Hiding a severity hides the whole multi-line entry, and the toolbar reflows into a tidy, touch-friendly layout on mobile.
• [BUGFIX] ui: editing a service or global config in RAW mode no longer shatters multi-line "file" settings (PEM certificates and keys such as CUSTOM_SSL_CERT_DATA) into bogus variables. The RAW parser now reassembles multi-line values instead of splitting every line as KEY=VALUE, which previously produced a flood of "Variable not valid" errors and silently dropped the certificate, even when only an unrelated setting was edited. (Fixes #3651)
• [FEATURE] ui: the RAW config editor can now fold multi-line file settings (certificates and keys) under their KEY= header into a labelled ⋯ N lines pill, with a collapse/expand-all toolbar toggle.
• [DEPS] ui: update jQuery to v4.0.0.
• [DEPS] ui: update Bootstrap to v5.3.8 and drop the redundant standalone Popper.js (it is already bundled in bootstrap.bundle.min.js).
• [DEPS] ui: update DataTables (and bundled extensions) to v2.3.8.
• [DEPS] ui: update Ace editor to v1.44.0.
• [DEPS] ui: update ApexCharts.js to v5.15.0.
• [DEPS] ui: update DOMPurify to v3.4.11.
• [DEPS] ui: update i18next to v26.3.1 and i18next-http-backend to v4.0.0.
• [DEPS] ui: update Perfect Scrollbar to v1.5.6.
• [DEPS] ui: update lottie-player to v2.0.12, canvas-confetti to v1.9.4, and ipaddr.js to v2.4.0.
• [DEPS] update build tooling — cssnano to v8.0.2 and domino to v2.1.7; remove the unused root jquery dependency.

v1.6.12-rc2

Documentation : https://docs.bunkerweb.io/1.6.12~rc2/

Docker tags :

• All-in-one : bunkerity/bunkerweb-all-in-one:1.6.12-rc2 or ghcr.io/bunkerity/bunkerweb-all-in-one:1.6.12-rc2
• BunkerWeb : bunkerity/bunkerweb:1.6.12-rc2 or ghcr.io/bunkerity/bunkerweb:1.6.12-rc2
• Scheduler : bunkerity/bunkerweb-scheduler:1.6.12-rc2 or ghcr.io/bunkerity/bunkerweb-scheduler:1.6.12-rc2
• Autoconf : bunkerity/bunkerweb-autoconf:1.6.12-rc2 or ghcr.io/bunkerity/bunkerweb-autoconf:1.6.12-rc2
• UI : bunkerity/bunkerweb-ui:1.6.12-rc2 or ghcr.io/bunkerity/bunkerweb-ui:1.6.12-rc2
• API : bunkerity/bunkerweb-api:1.6.12-rc2 or ghcr.io/bunkerity/bunkerweb-api:1.6.12-rc2

Linux packages : https://packagecloud.io/app/bunkerity/bunkerweb/search?q=1.6.12~rc2&filter=all&dist=

Changelog :

• [SECURITY] api: build the Biscuit auth token through the parameter API so the Host header, client IP and username are bound as typed terms and cannot inject signed Datalog facts (token issuance and verification); a malicious Host header is now an inert domain string rather than escapable Datalog. Adds an opt-in API_ALLOWED_HOSTS TrustedHost allowlist.
• [SECURITY] ui: fix session fixation on login (CWE-384) — session.clear() ran before the session-id regeneration, and flask-session only rotates a non-empty session, so the id never changed across the authentication boundary and a pre-planted session id could be reused post-login. The id is now rotated on every login (the new state is seeded before regeneration).
• [SECURITY] ui: fix an open redirect via the post-login next parameter (CWE-601) — /..//host (and /.//host, /\host, and percent-encoded variants) normalized to a protocol-relative URL in the browser and navigated cross-origin. _sanitize_internal_next now rejects protocol-relative, backslash, scheme and ./.. path-segment values on both the raw and once-decoded forms, and loading.js/unauthorized.js collapse leading slashes and enforce same-origin before navigating.
• [SECURITY] ui: a password change now revokes the user's other active sessions (previously only the current session was ended), so a parallel or stolen session cannot outlive the credential it was authenticated with.
• [SECURITY] ui: cache routes no longer bypass Biscuit authorization — POST /cache/delete is now evaluated as a write operation, so a non-admin (reader) role can no longer purge the job cache (read access to cache views is unchanged).
• [SECURITY] ui: validate the instance hostname as a real IPv4/IPv6 literal (stdlib ipaddress) or DNS hostname instead of a permissive character blocklist that accepted ;, @, % and other metacharacters; ban scope is clamped to global/service.
• [BUGFIX] ui: bound REVOKED_SESSIONS growth — the revoked-session set is now a TTL-pruned map (retained only for the maximum session lifetime) and is persisted across workers from the password-change/wipe paths, instead of an ever-growing list.
• [BUGFIX] database: fix 1.6.12~rc1 regression that reset UI/API-saved settings to defaults on scheduler restart — the scheduler now overrides method=ui/api rows only for settings explicitly declared in variables.env / the container environment (per-service via the service-prefixed key). Affected installs can restore lost settings with bwcli plugin backup restore.
• [BUGFIX] ssl: SSL_ECDH_CURVE=auto no longer emits X25519 on FIPS OpenSSL (NGINX failed to start with group 'X25519' cannot be set, blocking the Setup Wizard). Auto-detection now probes the same SSL_CTX_set1_groups_list call NGINX makes, falls back to FIPS-approved prime256v1:secp384r1, and the internal API listener honors SSL_ECDH_CURVE instead of a hardcoded curve.
• [BUGFIX] autoconf: re-check service labels when the set of valid settings changes (e.g. a valid PRO license installs PRO plugins, or an external plugin is added) — labels referencing a not-yet-valid setting were dropped and never re-applied until an unrelated label change or restart. A background worker now re-applies on settings change (interval via AUTOCONF_SETTINGS_RECHECK_INTERVAL, default 300s, 0 disables).
• [BUGFIX] logger: an unreachable LOG_SYSLOG_ADDRESS no longer crash-loops the scheduler and UI — building the SysLogHandler is now guarded, so a syslog host that does not resolve or refuses the connection (Python 3.14 resolves DNS eagerly in the handler constructor) logs a warning and falls back to stderr instead of raising out of module import and killing every BunkerWeb Python process.
• [DEPS] Updated LuaJIT version to v2.1-20260606
• [DEPS] Updated lua-resty-openssl version to v1.8.0
• [CONTRIBUTION] Thank you Cleverguns for your contribution regarding the Filipino (Tagalog) translation of the web UI. (#3607)
• [CONTRIBUTION] Thank you ray910408 for your contribution regarding the refresh of the src/deps npm build-tool dependencies. (#3623)
• [CONTRIBUTION] Thank you immanuwell for your contribution regarding parsing the DEBUG environment variable as a boolean in the Gunicorn configuration (UI and API), so a string value no longer always enables debug logging. (#3589)