v1.10.0

Highlights

• Add a configurable default response for requests that don't match any proxy host (#241). Unknown Host headers and direct IP access were previously answered by Caddy's built-in behaviour; the response status and body are now configurable under Settings → Default Response and via the /api/v1/settings REST endpoint.
• Add WAF request body limit settings (#252): SecRequestBodyLimit, SecRequestBodyInMemoryLimit and SecRequestBodyLimitAction are now exposed as global and per-host WAF settings, entered in MiB. Out-of-range values are refused at save time instead of failing the whole Caddy config load, and Caddy config errors now name known Coraza rejection causes.
• Fix OAuth account linking (#247): the per-provider auto-link switch and OAUTH_ALLOW_AUTO_LINKING never reached Better Auth, so every link attempt returned account_not_linked. Linking now works from the profile page, which also explains why a given provider cannot be linked. Better Auth 1.7 account issuer identity is adopted and the OAuth callback URL is exposed via the API.
• Harden API security boundaries.
• Add netcup DNS provider for ACME DNS-01 challenges (#258).
• Fix WAF events being dropped unless the request was actually blocked (#233).
• Fix stale UI after saves on the L4 proxy hosts page and in the GeoIP settings (#241): rapid successive L4 host creates and enable toggles only appeared after a manual browser refresh, and the GeoIP form appeared to revert to pre-save values until reload.
• Fix the analytics world map rendering as empty ocean for locally built Docker images: the staged maplibre worker could go stale across maplibre-gl upgrades because versions 6.4.1 and 6.6.0 ship worker files of identical size. Worker staging now compares file content, and Docker builds stage the worker from the container's own node_modules so a stale host copy can no longer leak into the image.

Changes

• 1b0b7c3 Fix WAF events dropped unless the request was blocked (#233)
• 28aa9e3 deps(deps-dev): bump the development-dependencies group with 5 updates (#235)
• 0139b7c deps(deps): bump the production-dependencies group with 7 updates (#236)
• 8f7936b deps(deps-dev): bump the development-dependencies group with 5 updates (#238)
• 56aeb62 deps(deps-dev): bump @types/better-sqlite3 from 7.6.13 to 9.6.0 (#240)
• 43814f8 deps(deps): bump the production-dependencies group across 1 directory with 6 updates (#239)
• 74552e4 docker: bump golang from 1.26 to 1.27 in /docker/caddy (#244)
• 41af21e deps(deps-dev): bump the development-dependencies group with 3 updates (#245)
• 15a78b5 deps(deps): bump the production-dependencies group with 5 updates (#246)
• 2467246 Add configurable default Caddy response (#241)
• 3f40c74 Harden API security boundaries
• cf78d20 Fix API hardening regressions
• 049b965 Adopt Better Auth 1.7 account issuer identity
• 0730df4 Wire OAuth account linking into Better Auth (#247)
• 5b5ff0c ci(deps): bump actions/setup-go from 6 to 7 (#248)
• ba954f3 deps(deps-dev): bump the development-dependencies group with 4 updates (#249)
• 94107a0 deps(deps): bump the production-dependencies group with 3 updates (#250)
• e35568a Add WAF request body limit settings
• 230ca11 docker: bump golang from 0ecdc2a to 4013ae0 in /docker/caddy (#253)
• 27ac577 deps(deps-dev): bump the development-dependencies group with 4 updates (#254)
• 3db2e94 caddy: bump github.com/corazawaf/coraza-caddy/v2 (#255)
• 1051be3 deps(deps): bump the production-dependencies group with 4 updates (#256)
• cd00c05 deps(deps): bump apexcharts from 6.10.0 to 7.0.0 (#257)
• a8f5a5f Expose OAuth callback URL in API and drop stale next-auth helper
• 5956e59 Fix flaky certificate delete assertion with toHaveCount(0)
• 61b7da2 caddy: make manifest module a buildable Go package for CodeQL and tidy
• deccd59 Add netcup DNS provider for DNS-01 challenges (#258)
• 402789b Fix stale UI after saves on L4 hosts page and GeoIP settings (#241)
• 14e223a Fix stale maplibre worker staged into Docker builds

Full Changelog: v1.9.1...v1.10.0