v1.26.0: Papalymo Totolymo

Sorry this took so long. A lot of work was done behind the scenes to do mass testing of Anubis on many versions of Google Chrome. After about 10 attempts failed, the current one seems to work, leading to the confidence of being able to cut this release.

This should support Chrome 69 and newer.

• Add option to disable the honeypot.
• Add (data)/clients/google-user-triggered-fetchers.yaml snippet that allows Google-owned user-triggered fetchers (Google Translate's website translation proxy, Google Read Aloud, Google Messages link previews) by their published IP ranges, fixing the infinite challenge loop for visitors using Google Translate (#444)
• Update QwantBot remote addresses range with latest value
• Migrate check-spelling workflow config to cspell
• Add Anubis Kubernetes Operator to the docs (#1675).
• Bump Playwright browser tooling to 1.61.1 and playwright-go to v0.6100.0.
• Add FreeBSD/Windows binaries to the yeetfile.
• Add systemd system extensions to the yeetfile.
• Set an explicit esbuild --target=chrome66 so modern syntax (e.g. optional chaining) is transpiled down. This lowers the minimum supported browser from Chrome 80 to Chrome 66.
• Patch GHSA-6wcg-mqvh-fcvg by containing subrequest logic to Anubis instances in subrequest mode.
• Implement robot9001 style delays on the honeypot feature so that the first hit takes 1 millisecond, the second takes 2, etc.
• Move metrics server configuration to the policy file.
• Expose pprof endpoints on the metrics listener to enable profiling Anubis in production.
• fix: prevent nil pointer panic in challenge validation when threshold rules match during PassChallenge (#1463)
• Instruct reverse proxies to not cache error pages.
• Fixed mixed tab/space indentation in Caddy documentation code block
• Improve error messages and fix broken REDIRECT_DOMAINS link in docs (#1193)
• Add Bulgarian locale (#1394)
• Fixed case-sensitivity mismatch in geoipchecker.go
• Use Go's native version stamping instead of a handrolled variant.
• Fix CEL internal errors when iterating headers/query map wrappers by implementing map iterators for HTTPHeaders and URLValues (#1465).
• Enable metrics serving via TLS, including mutual TLS (mTLS).
• Enable HTTP basic auth for the metrics server.
• Fix a bug in the dataset poisoning maze that could allow denial of service #1580.
• Add config option to add ASN to logs/metrics.
• Log weight when issuing challenge.
• Block x.ai's crawler for code review training.
• Gate pprof endpoints behind metrics.debug in the policy file.
• Limit naive honeypot r9k delay to one second.
• Fix an obscure case where adding query values to a subrequest match could cause an invalid rule match when using path based matching for protected resources.
• Anubis now requires Go 1.26 to build.
• Fix an edge case where load average expression values could nil pointer dereference when Anubis just started up.
• Fix an obscure case where Anubis in subrequest mode could allow redirects to invalid domains with strange instructions.
• Fix path_regex and CEL path rules not matching when using Traefik forwardAuth middleware. Anubis now checks X-Forwarded-Uri (Traefik) in addition to X-Original-URI (nginx) when resolving the request path in subrequest mode (#1628).
• Validate bounds in the CEL randInt helper so non-positive or platform-overflowing arguments surface a typed CEL error instead of an evaluator panic.
• Fix a race in the bbolt store where the asynchronous cleanup scheduled by an expired read could delete a value that had just been refreshed; the delete now only fires when the key still carries the same expired generation it observed.
• Marginally increase the performances of requests processing
• Marginally improve the performances of PoW validation
• Marginally improve the performances of challenges generation/display
• Significantly improve the performances of the gzip middleware
• Significantly improve the performances of the PoW validation
• Add trimpath option to artifact builds
• Add COOKIE_HTTP_ONLY option to set the HttpOnly flag on Anubis cookies
• Improve the performances of rules validation
• Only compute the JA4H fingerprint when a policy references the X-Http-Fingerprint-JA4H header, taking it off the hot path for configurations that don't use it (#834).
• Migrate the target reverse proxy off the deprecated httputil.ReverseProxy.Director to Rewrite for Go 1.26 compatibility, preserving the inbound Host and X-Forwarded-*/Forwarded headers.

What's Changed

• docs(admin/policy): document ReadWritePaths for logging to files by @Xe in #1469
• docs: fix mixed tab/space indentation in Caddy config example by @pzhlkj6612 in #1506
• ci: purge govulncheck, it's less signal than i hoped by @Xe in #1515
• feat(http): set "Cache-Control: no-store" on error responses by @gucci-on-fleek in #1474
• docs(known-instances): Add missing one. by @p0008874 in #1500
• chore(l10n): update French translation by @HarmfulBreeze in #1496
• docs: remove developer/code-quality by @gucci-on-fleek in #1475
• build(deps): bump the github-actions group across 1 directory with 11 updates by @dependabot[bot] in #1516
• build(deps): bump the npm group across 1 directory with 6 updates by @dependabot[bot] in #1512
• chore: gofix by @JasonLovesDoggo in #1466
• fix: nil deref when solve request lands on a different DIFFICULTY than the original req by @JasonLovesDoggo in #1467
• feat(docs): Add instructions on using Anubis with envoy-gateway by @fhoekstra in #1460
• feat(docs): Update HAProxy Advanced Variant documentation by @rozmansi in #1521
• feat(data): add Citoid to good bots list by @mvolz in #1524
• docs(faq): document that disabling JIT makes Anubis slow by @Xe in #1526
• fix(locales/ja): change the position of the バージョン (version) by @fu-sen in #1527
• fix: add cel iterator by @JasonLovesDoggo in #1465
• fix: Address issued raised in #1193 by @dwhitemv25 in #1519
• feat(anubis): enable pprof endpoints on the metrics server by @Xe in #1530
• feat(i18n): add Bulgarian language translation by @ramromcode in #1394
• chore: update vi.json by @honhatduy in #1459
• fix(locales/de): revise and update German translations by @michi-onl in #1457
• build(deps): bump actions-hub/kubectl from 1.35.2 to 1.35.3 in the github-actions group by @dependabot[bot] in #1532
• chore(sponsors): add embeDD GmbH by @Xe in #1539
• build(deps): bump the npm group with 5 updates by @dependabot[bot] in #1531
• docs(faq): document minimum versions of browsers Anubis supports by @Xe in #1540
• build(deps): bump the npm group across 1 directory with 5 updates by @dependabot[bot] in #1559
• build(deps): bump the github-actions group across 1 directory with 7 updates by @dependabot[bot] in #1560
• feat: move metrics server config to the policy file by @Xe in #1572
• feat(data): add Meta's web indexer used for AI purposes by @bnjbvr in #1573
• feat(metrics): enable TLS/mTLS serving support by @Xe in #1576
• feat(metrics): basic auth support by @Xe in #1579
• fix(honeypot): remove DoS vector by @Xe in #1581
• fix: Thoth geoip compare by @lenny87 in #1564
• fix(metrics): bind to the right network/bindhost by @Xe in #1606
• feat: add ASN data from Thoth to logs/metrics by @lillian-b in #1608
• feat: Log weight when issuing challenge by @tdgroot in #1611
• fix: patch GHSA-6wcg-mqvh-fcvg by @Xe in #1616
• build(deps-dev): bump the npm grou...

v1.26.0-pre2: Papalymo Totolymo

Unless anyone screams, this will be what ships tomorrow.

• Add (data)/clients/google-user-triggered-fetchers.yaml snippet that allows Google-owned user-triggered fetchers (Google Translate's website translation proxy, Google Read Aloud, Google Messages link previews) by their published IP ranges, fixing the infinite challenge loop for visitors using Google Translate (#444)
• Update QwantBot remote addresses range with latest value
• Migrate check-spelling workflow config to cspell
• Add Anubis Kubernetes Operator to the docs (#1675).
• Bump Playwright browser tooling to 1.61.1 and playwright-go to v0.6100.0.
• Add FreeBSD/Windows binaries to the yeetfile.
• Add systemd system extensions to the yeetfile.
• Set an explicit esbuild --target=chrome66 so modern syntax (e.g. optional chaining) is transpiled down. This lowers the minimum supported browser from Chrome 80 to Chrome 66.

What's Changed

• feat(qwantbot): update remote addresses by @mhardy-qwant in #1719
• ci: add cspell to replace check-spelling by @Xe in #1722
• chore: set up golangci-lint by @Xe in #1720
• chore: add golangci words to the spelling dictionary by @Xe in #1724
• build(deps): bump the npm group across 1 directory with 8 updates by @dependabot[bot] in #1723
• docs: add anubis-kubernetes-operator as another option by @eznix86 in #1675
• chore: update playwright dependencies by @JasonLovesDoggo in #1279
• build(deps): bump the gomod group across 1 directory with 16 updates by @dependabot[bot] in #1727
• build(deps): bump the github-actions group across 1 directory with 14 updates by @dependabot[bot] in #1725
• build(deps): bump the gomod group with 2 updates by @dependabot[bot] in #1730
• build(deps-dev): bump prettier from 3.8.5 to 3.9.1 in the npm group by @dependabot[bot] in #1729
• chore(data): fix google translate bug #444 by @Xe in #1734
• fix(web): lower chrome support floor to Chrome 66 by @Xe in #1738
• feat(yeetfile): build freebsd and windows binaries by @Xe in #1735

New Contributors

• @mhardy-qwant made their first contribution in #1719
• @eznix86 made their first contribution in #1675

Full Changelog: v1.26.0-pre1...v1.26.0-pre2

v1.26.0-pre1

Sorry it's been so long between releases. Recovering from surgery sucks.

This release's title will be Papalymo Totolymo.

• Patch GHSA-6wcg-mqvh-fcvg by containing subrequest logic to Anubis instances in subrequest mode.
• Implement robot9001 style delays on the honeypot feature so that the first hit takes 1 millisecond, the second takes 2, etc.
• Move metrics server configuration to the policy file.
• Expose pprof endpoints on the metrics listener to enable profiling Anubis in production.
• fix: prevent nil pointer panic in challenge validation when threshold rules match during PassChallenge (#1463)
• Instruct reverse proxies to not cache error pages.
• Fixed mixed tab/space indentation in Caddy documentation code block
• Improve error messages and fix broken REDIRECT_DOMAINS link in docs (#1193)
• Add Bulgarian locale (#1394)
• Fixed case-sensitivity mismatch in geoipchecker.go
• Use Go's native version stamping instead of a handrolled variant.
• Fix CEL internal errors when iterating headers/query map wrappers by implementing map iterators for HTTPHeaders and URLValues (#1465).
• Enable metrics serving via TLS, including mutual TLS (mTLS).
• Enable HTTP basic auth for the metrics server.
• Fix a bug in the dataset poisoning maze that could allow denial of service #1580.
• Add config option to add ASN to logs/metrics.
• Log weight when issuing challenge.
• Block x.ai's crawler for code review training.
• Gate pprof endpoints behind metrics.debug in the policy file.
• Limit naive honeypot r9k delay to one second.
• Fix an obscure case where adding query values to a subrequest match could cause an invalid rule match when using path based matching for protected resources.
• Anubis now requires Go 1.26 to build.
• Fix an edge case where load average expression values could nil pointer dereference when Anubis just started up.
• Fix an obscure case where Anubis in subrequest mode could allow redirects to invalid domains with strange instructions.
• Fix path_regex and CEL path rules not matching when using Traefik forwardAuth middleware. Anubis now checks X-Forwarded-Uri (Traefik) in addition to X-Original-URI (nginx) when resolving the request path in subrequest mode (#1628).
• Validate bounds in the CEL randInt helper so non-positive or platform-overflowing arguments surface a typed CEL error instead of an evaluator panic.
• Fix a race in the bbolt store where the asynchronous cleanup scheduled by an expired read could delete a value that had just been refreshed; the delete now only fires when the key still carries the same expired generation it observed.
• Marginally increase the performances of requests processing
• Marginally improve the performances of PoW validation
• Marginally improve the performances of challenges generation/display
• Significantly improve the performances of the gzip middleware
• Significantly improve the performances of the PoW validation
• Add trimpath option to artifact builds
• Add COOKIE_HTTP_ONLY option to set the HttpOnly flag on Anubis cookies
• Improve the performances of rules validation
• Only compute the JA4H fingerprint when a policy references the X-Http-Fingerprint-JA4H header, taking it off the hot path for configurations that don't use it (#834).
• Migrate the target reverse proxy off the deprecated httputil.ReverseProxy.Director to Rewrite for Go 1.26 compatibility, preserving the inbound Host and X-Forwarded-*/Forwarded headers.

What's Changed

• docs(admin/policy): document ReadWritePaths for logging to files by @Xe in #1469
• docs: fix mixed tab/space indentation in Caddy config example by @pzhlkj6612 in #1506
• ci: purge govulncheck, it's less signal than i hoped by @Xe in #1515
• feat(http): set "Cache-Control: no-store" on error responses by @gucci-on-fleek in #1474
• docs(known-instances): Add missing one. by @p0008874 in #1500
• chore(l10n): update French translation by @HarmfulBreeze in #1496
• docs: remove developer/code-quality by @gucci-on-fleek in #1475
• build(deps): bump the github-actions group across 1 directory with 11 updates by @dependabot[bot] in #1516
• build(deps): bump the npm group across 1 directory with 6 updates by @dependabot[bot] in #1512
• chore: gofix by @JasonLovesDoggo in #1466
• fix: nil deref when solve request lands on a different DIFFICULTY than the original req by @JasonLovesDoggo in #1467
• feat(docs): Add instructions on using Anubis with envoy-gateway by @fhoekstra in #1460
• feat(docs): Update HAProxy Advanced Variant documentation by @rozmansi in #1521
• feat(data): add Citoid to good bots list by @mvolz in #1524
• docs(faq): document that disabling JIT makes Anubis slow by @Xe in #1526
• fix(locales/ja): change the position of the バージョン (version) by @fu-sen in #1527
• fix: add cel iterator by @JasonLovesDoggo in #1465
• fix: Address issued raised in #1193 by @dwhitemv25 in #1519
• feat(anubis): enable pprof endpoints on the metrics server by @Xe in #1530
• feat(i18n): add Bulgarian language translation by @ramromcode in #1394
• chore: update vi.json by @honhatduy in #1459
• fix(locales/de): revise and update German translations by @michi-onl in #1457
• build(deps): bump actions-hub/kubectl from 1.35.2 to 1.35.3 in the github-actions group by @dependabot[bot] in #1532
• chore(sponsors): add embeDD GmbH by @Xe in #1539
• build(deps): bump the npm group with 5 updates by @dependabot[bot] in #1531
• docs(faq): document minimum versions of browsers Anubis supports by @Xe in #1540
• build(deps): bump the npm group across 1 directory with 5 updates by @dependabot[bot] in #1559
• build(deps): bump the github-actions group across 1 directory with 7 updates by @dependabot[bot] in #1560
• feat: move metrics server config to the policy file by @Xe in #1572
• feat(data): add Meta's web indexer used for AI purposes by @bnjbvr in #1573
• feat(metrics): enable TLS/mTLS serving support by @Xe in #1576
• feat(metrics): basic auth support by @Xe in #1579
• fix(honeypot): remove DoS vector by @Xe in #1581
• fix: Thoth geoip compare by @lenny87 in #1564
• fix(metrics): bind to the right network/bindhost by @Xe in #1606
• feat: add ASN data from Thoth to logs/metrics by @lillian-b in #1608
• feat: Log weight when issuing challenge by @tdgroot in #1611
• fix: patch GHSA-6wcg-mqvh-fcvg by @Xe in #1616
• build(deps-dev): bump the npm group across 1 directory with 6 updates by @dependabot[bot] in #1621
• build(deps): bump github.com/go-jose/go-jose/v3 from 3.0.4 to 3.0.5 by @dependabot[bot] in #1629
• fix(policy): correctly wire subrequest mode through CEL/path checkers by @Xe in #1630
• fix(honeypot/naive): apply robot9001 style delays by @Xe in #1632
• build(deps): bump the npm group across 1 directory with 6 updates by @dependabot[bot] in #1646
• perf(lib): iterate s.policy.Bots by index to drop per-call heap copy by @jvoisin in #1639
• fix: small security fixes by @Xe in #1651
• perf(internal/gzip): pool *gzip.Writer per middleware instance by @jvoisin in #1654
• perf: enable uuid randomness pool and minor cleanups by @jvoisin in #1652
• perf(challenge/proofofwork): stream sha256 into stack buffer in Validate by @jvoisin in #1653
• chore: use Go stdlib version stamping by @Xe in #1665
• chore: ban x.ai by @Xe in https://github.com/TecharoHQ/anub...

v1.25.0: Necron

Hey all,

I'm sure you've all been aware that things have been slowing down a little with Anubis development, and I want to apologize for that. A lot has been going on in my life lately (my blog will have a post out on Friday with more information), and as a result I haven't really had the energy to work on Anubis in publicly visible ways. There are things going on behind the scenes, but nothing is really shippable yet, sorry!

I've also been feeling some burnout in the wake of perennial waves of anger directed towards me. I'm handling it, I'll be fine, I've just had a lot going on in my life and it's been rough.

I've been missing the sense of wanderlust and discovery that comes with the artistic way I playfully develop software. I suspect that some of the stresses I've been through (setting up a complicated surgery in a country whose language you aren't fluent in is kind of an experience) have been sapping my energy. I'd gonna try to mess with things on my break, but realistically I'm probably just gonna be either watching Stargate SG-1 or doing unreasonable amounts of ocean fishing in Final Fantasy 14. Normally I'd love to keep the details about my medical state fairly private, but I'm more of a public figure now than I was this time last year so I don't really get the invisibility I'm used to for this.

I've also had a fair amount of negativity directed at me for simply being much more visible than the anonymous threat actors running the scrapers that are ruining everything, which though understandable has not helped.

Anyways, it all worked out and I'm about to be in the hospital for a week, so if things go really badly with this release please downgrade to the last version and/or upgrade to the main branch when the fix PR is inevitably merged. I hoped to have time to tame GPG and set up full release automation in the Anubis repo, but that didn't work out this time and that's okay.

If I can challenge you all to do something, go out there and try to actually create something new somehow. Combine ideas you've never mixed before. Be creative, be human, make something purely for yourself to scratch an itch that you've always had yet never gotten around to actually mending.

At the very least, try to be an example of how you want other people to act, even when you're in a situation where software written by someone else is configured to require a user agent to execute javascript to access a webpage.

Be well,

Xe

PS: if you're well-versed in FFXIV lore, the release title should give you an idea of the kind of stuff I've been going through mentally.

• Add iplist2rule tool that lets admins turn an IP address blocklist into an Anubis ruleset.
• Add Polish locale (#1292)
• Fix honeypot and imprint links missing BASE_PREFIX when deployed behind a path prefix (#1402)
• Add ANEXIA Sponsor logo to docs (#1409)
• Improve idle performance in memory storage
• Add HAProxy Configurations to Docs (#1424)

What's Changed

• build(deps): bump the github-actions group with 4 updates by @dependabot[bot] in #1355
• feat(localization): add Polish language translation by @btomaev in #1363
• docs(known-instances): Alphabetical order + Add Valve Corporation by @p0008874 in #1352
• test: basic nginx smoke test by @Xe in #1365
• build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in #1369
• build(deps-dev): bump esbuild from 0.27.1 to 0.27.2 in the npm group by @dependabot[bot] in #1368
• fix(test): remove interactive flag from nginx smoke test docker run c… by @JasonLovesDoggo in #1371
• test(nginx): fix tests to work in GHA by @Xe in #1372
• feat: iplist2rule utility command by @Xe in #1373
• Update check-spelling metadata by @JasonLovesDoggo in #1379
• fix: Update SSL Labs IP addresses by @majiayu000 in #1377
• fix: respect Accept-Language quality factors in language detection by @majiayu000 in #1380
• build(deps): bump the gomod group across 1 directory with 3 updates by @dependabot[bot] in #1370
• Revert "build(deps): bump the gomod group across 1 directory with 3 updates" by @JasonLovesDoggo in #1386
• build(deps): bump preact from 10.28.0 to 10.28.1 in the npm group by @dependabot[bot] in #1387
• docs: document how to import the default config by @Xe in #1392
• fix sponsor (Databento) logo size by @ayoung5555 in #1395
• fix: correct typos by @antonkesy in #1398
• fix(web): include base prefix in generated URLs by @Xe in #1403
• docs: clarify botstopper kubernetes instructions by @tarrow in #1404
• Add IP mapped Perplexity user agents by @tdgroot in #1393
• build(deps): bump astral-sh/setup-uv from 7.1.6 to 7.2.0 in the github-actions group by @dependabot[bot] in #1413
• build(deps): bump preact from 10.28.1 to 10.28.2 in the npm group by @dependabot[bot] in #1412
• chore: add comments back to Challenge struct. by @JasonLovesDoggo in #1419
• performance: remove significant overhead of decaymap/memory by @brainexe in #1420
• web: fix spacing/indent by @bjacquin in #1423
• build(deps): bump the github-actions group with 4 updates by @dependabot[bot] in #1425
• Improve Dutch translations by @louwers in #1446
• chore: set up commitlint, husky, and prettier by @Xe in #1451
• Fix a CI warning: "The set-output command is deprecated" by @kurtmckee in #1443
• feat(apps): add updown.io policy by @hyperdefined in #1444
• docs: add AI coding tools policy by @Xe in #1454
• feat(docs): Add ANEXIA Sponsor logo by @Earl0fPudding in #1409
• chore: sync logo submissions by @Xe in #1455
• build(deps): bump the github-actions group across 1 directory with 6 updates by @dependabot[bot] in #1453
• build(deps): bump the npm group across 1 directory with 2 updates by @dependabot[bot] in #1452
• feat(docs): Add HAProxy Configurations to Docs by @Earl0fPudding in #1424

New Contributors

• @majiayu000 made their first contribution in #1377
• @ayoung5555 made their first contribution in #1395
• @antonkesy made their first contribution in #1398
• @tarrow made their first contribution in #1404
• @tdgroot made their first contribution in #1393
• @brainexe made their first contribution in #1420
• @bjacquin made their first contribution in #1423
• @louwers made their first contribution in #1446
• @kurtmckee made their first contribution in #1443

Full Changelog: v1.24.0...v1.25.0

v1.24.0: Y'shtola Rhul

Anubis is back and better than ever! Lots of minor fixes with some big ones interspersed.

• Fix panic when validating challenges after privacy-mode browsers strip headers and the follow-up request matches an ALLOW threshold.
• Expose WEIGHT rule matches as Prometheus metrics.
• Allow more OCI registry clients based on feedback.
• Expose services directory in the embedded (data) filesystem.
• Add Ukrainian locale (#1044).
• Allow Renovate as an OCI registry client.
• Properly handle 4in6 addresses so that IP matching works with those addresses.
• Add support to simple Valkey/Redis cluster mode
• Open Graph passthrough now reuses the configured target Host/SNI/TLS settings, so metadata fetches succeed when the upstream certificate differs from the public domain. (1283)
• Stabilize the CVE-2025-24369 regression test by always submitting an invalid proof instead of relying on random POW failures.
• Refine the check that ensures the presence of the Accept header to avoid breaking docker clients.
• Removed rules intended to reward actual browsers due to abuse in the wild.

Dataset poisoning

Anubis has the ability to engage in dataset poisoning attacks using the dataset poisoning subsystem. This allows every Anubis instance to be a honeypot to attract and flag abusive scrapers so that no administrator action is required to ban them.

There is much more information about this feature in the dataset poisoning subsystem documentation. Administrators that are interested in learning how this feature works should consult that documentation.

Deprecate report_as in challenge configuration

Previously Anubis let you lie to users about the difficulty of a challenge to interfere with operators of malicious scrapers as a psychological attack:

bots:
  # Punish any bot with "bot" in the user-agent string
  # This is known to have a high false-positive rate, use at your own risk
  - name: generic-bot-catchall
    user_agent_regex: (?i:bot|crawler)
    action: CHALLENGE
    challenge:
      difficulty: 16 # impossible
      report_as: 4 # lie to the operator
      algorithm: slow # intentionally waste CPU cycles and time

This has turned out to be a bad idea because it has caused massive user experience problems and has been removed. If you are using this setting, you will get a warning in your logs like this:

{
  "time": "2025-11-25T23:10:31.092201549-05:00",
  "level": "WARN",
  "source": {
    "function": "github.com/TecharoHQ/anubis/lib/policy.ParseConfig",
    "file": "/home/xe/code/TecharoHQ/anubis/lib/policy/policy.go",
    "line": 201
  },
  "msg": "use of deprecated report_as setting detected, please remove this from your policy file when possible",
  "at": "config-validate",
  "name": "mild-suspicion"
}

To remove this warning, remove this setting from your policy file.

Logging customization

Anubis now supports the ability to log to multiple backends ("sinks"). This allows you to have Anubis log to a file instead of just logging to standard out. You can also customize the logging level in the policy file:

logging:
  level: "warn" # much less verbose logging
  sink: file # log to a file
  parameters:
    file: "./var/anubis.log"
    maxBackups: 3 # keep at least 3 old copies
    maxBytes: 67108864 # each file can have up to 64 Mi of logs
    maxAge: 7 # rotate files out every n days
    oldFileTimeFormat: 2006-01-02T15-04-05 # RFC 3339-ish
    compress: true # gzip-compress old log files
    useLocalTime: false # timezone for rotated files is UTC

Additionally, information about how Anubis uses each logging level has been added to the documentation.

DNS Features

• CEL expressions for:
  • FCrDNS checks
  • Forward DNS queries
  • Reverse DNS queries
  • arpaReverseIP to transform IPv4/6 addresses into ARPA reverse IP notation.
  • regexSafe to escape regex special characters (useful for including remoteAddress or headers in regular expressions).
• DNS cache and other optimizations to minimize unnecessary DNS queries.

The DNS cache TTL can be changed in the bots config like this:

dns_ttl:
  forward: 600
  reverse: 600

The default value for both forward and reverse queries is 300 seconds.

The verifyFCrDNS CEL function has two overloads:

• (addr)
  Simply verifies that the remote side has PTR records pointing to the target address.
• (addr, ptrPattern)
  Verifies that the remote side refers to a specific domain and that this domain points to the target IP.

What's Changed

• feat: Add thai language. by @karorogunso in #900
• Update is.json by @sveinki in #1241
• fix(data/docker-client): allow some more OCI clients through by @Xe in #1258
• fix(data): add services folder to embedded filesystem by @Xe in #1259
• feat(localization): Add Ukrainian language translation by @nykula in #1044
• build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in #1262
• Add Renovate to Docker clients by @DrJosh9000 in #1267
• fix(docs): use node:lts by @Xe in #1274
• fix(run): mark openrc service script as executable by @kouhaidev in #1272
• test: ipv4 in v6 address checking by @SlyEcho in #1271
• (feat) Add cluster support to redis/vaultkey store by @egimbernat in #1276
• feat(lib): expose WEIGH matches as prometheus metrics by @Xe in #1277
• Fix challenge validation panic when follow-up hits ALLOW by @JasonLovesDoggo in #1278
• feat(internal/headers): extend debug logging of X-Forwarded-For middlewares by @DerRockWolf in #1269
• test: Valkey test improvements for testcontainers by @SlyEcho in #1280
• docs: use nginx http2 directive instead of deprecated http2 listen parameter by @kouhaidev in #1251
• perf: field-align struct definitions to cut padding by @JasonLovesDoggo in #1284
• fix(tests): make CVE-2025-24369 regression deterministic by @JasonLovesDoggo in #1285
• build(deps): bump go deps by @JasonLovesDoggo in #1287
• build(deps): bump github.com/testcontainers/testcontainers-go from 0.39.0 to 0.40.0 in the gomod group across 1 directory by @dependabot[bot] in #1288
• test(deps): update dependencies to latest versions by @JasonLovesDoggo in #1289
• build(deps-dev): bump esbuild from 0.25.12 to 0.27.0 in the npm group by @dependabot[bot] in #1260
• fix(ogtags): respect target host/SNI/insecure flags in OG passthrough by @JasonLovesDoggo in #1283
• docs: clarify usage of PUBLIC_URL and REDIRECT_DOMAINS in installatio… by @JasonLovesDoggo in #1286
• feat(store/valkey): Add Redis(R) Sentinel support by @Xe in #1294
• Pass the remote IP to the proxied application by @eXpl0it3r in #1298
• ci: add go mod tidy check workflow by @Xe in #1300
• feat: writing logs to the filesystem with rotation support by @Xe in #1299
• chore: add dependabot cooldown by @Xe in #1302
• add Polish language translation by @bplajzer in #1309
• fix(config): deprecate the report_as field for challenges by @Xe in #1311
• Implement FCrDNS and other DNS features by @btomaev in #1308
• Show how to use subrequest auth with Caddy by @tbodt in #1312
• build(deps): bump actions-hub/kubectl from 1.34.1 to 1.34.2 in the github-actions group by @dependabot[bot] in #1303
• fix: pin Node.js and Go versions in CI configuration files by @JasonLovesDoggo in #1318
• build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in #1317
• build(deps): bump the gomod group with 5 updates by @dependabot[bot] in #1316
• build(deps): bump the npm group with 2 updates by @dependabot[bot] in #1339
• build(deps): bump the github-actions group across 1 directory with 4 updates by @dependabot[bot] in #1340
• build(deps): bump the gomod group across 1 directory with 6 updates by @dependabot[bot] in #1341
• feat: first implementation of honeypot logic by @Xe in #1342
• i18n(de): improve consistency and wording by @mi...

v1.24.0-pre1: Y'shtola Rhul Prerelease 1

Anubis is back and better than ever! Lots of minor fixes with some big ones interspersed.

• Fix panic when validating challenges after privacy-mode browsers strip headers and the follow-up request matches an ALLOW threshold.
• Expose WEIGHT rule matches as Prometheus metrics.
• Allow more OCI registry clients based on feedback.
• Expose services directory in the embedded (data) filesystem.
• Add Ukrainian locale (#1044).
• Allow Renovate as an OCI registry client.
• Properly handle 4in6 addresses so that IP matching works with those addresses.
• Add support to simple Valkey/Redis cluster mode
• Open Graph passthrough now reuses the configured target Host/SNI/TLS settings, so metadata fetches succeed when the upstream certificate differs from the public domain. (1283)
• Stabilize the CVE-2025-24369 regression test by always submitting an invalid proof instead of relying on random POW failures.

Deprecate report_as in challenge configuration

Previously Anubis let you lie to users about the difficulty of a challenge to interfere with operators of malicious scrapers as a psychological attack:

bots:
  # Punish any bot with "bot" in the user-agent string
  # This is known to have a high false-positive rate, use at your own risk
  - name: generic-bot-catchall
    user_agent_regex: (?i:bot|crawler)
    action: CHALLENGE
    challenge:
      difficulty: 16 # impossible
      report_as: 4 # lie to the operator
      algorithm: slow # intentionally waste CPU cycles and time

This has turned out to be a bad idea because it has caused massive user experience problems and has been removed. If you are using this setting, you will get a warning in your logs like this:

{
  "time": "2025-11-25T23:10:31.092201549-05:00",
  "level": "WARN",
  "source": {
    "function": "github.com/TecharoHQ/anubis/lib/policy.ParseConfig",
    "file": "/home/xe/code/TecharoHQ/anubis/lib/policy/policy.go",
    "line": 201
  },
  "msg": "use of deprecated report_as setting detected, please remove this from your policy file when possible",
  "at": "config-validate",
  "name": "mild-suspicion"
}

To remove this warning, remove this setting from your policy file.

Logging customization

Anubis now supports the ability to log to multiple backends ("sinks"). This allows you to have Anubis log to a file instead of just logging to standard out. You can also customize the logging level in the policy file:

logging:
  level: "warn" # much less verbose logging
  sink: file # log to a file
  parameters:
    file: "./var/anubis.log"
    maxBackups: 3 # keep at least 3 old copies
    maxBytes: 67108864 # each file can have up to 64 Mi of logs
    maxAge: 7 # rotate files out every n days
    oldFileTimeFormat: 2006-01-02T15-04-05 # RFC 3339-ish
    compress: true # gzip-compress old log files
    useLocalTime: false # timezone for rotated files is UTC

Additionally, information about how Anubis uses each logging level has been added to the documentation.

DNS Features

• CEL expressions for:
  • FCrDNS checks
  • Forward DNS queries
  • Reverse DNS queries
  • arpaReverseIP to transform IPv4/6 addresses into ARPA reverse IP notation.
  • regexSafe to escape regex special characters (useful for including remoteAddress or headers in regular expressions).
• DNS cache and other optimizations to minimize unnecessary DNS queries.

The DNS cache TTL can be changed in the bots config like this:

dns_ttl:
  forward: 600
  reverse: 600

The default value for both forward and reverse queries is 300 seconds.

The verifyFCrDNS CEL function has two overloads:

• (addr)
  Simply verifies that the remote side has PTR records pointing to the target address.
• (addr, ptrPattern)
  Verifies that the remote side refers to a specific domain and that this domain points to the target IP.

What's Changed

• feat: Add thai language. by @karorogunso in #900
• Update is.json by @sveinki in #1241
• fix(data/docker-client): allow some more OCI clients through by @Xe in #1258
• fix(data): add services folder to embedded filesystem by @Xe in #1259
• feat(localization): Add Ukrainian language translation by @nykula in #1044
• build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in #1262
• Add Renovate to Docker clients by @DrJosh9000 in #1267
• fix(docs): use node:lts by @Xe in #1274
• fix(run): mark openrc service script as executable by @kouhaidev in #1272
• test: ipv4 in v6 address checking by @SlyEcho in #1271
• (feat) Add cluster support to redis/vaultkey store by @egimbernat in #1276
• feat(lib): expose WEIGH matches as prometheus metrics by @Xe in #1277
• Fix challenge validation panic when follow-up hits ALLOW by @JasonLovesDoggo in #1278
• feat(internal/headers): extend debug logging of X-Forwarded-For middlewares by @DerRockWolf in #1269
• test: Valkey test improvements for testcontainers by @SlyEcho in #1280
• docs: use nginx http2 directive instead of deprecated http2 listen parameter by @kouhaidev in #1251
• perf: field-align struct definitions to cut padding by @JasonLovesDoggo in #1284
• fix(tests): make CVE-2025-24369 regression deterministic by @JasonLovesDoggo in #1285
• build(deps): bump go deps by @JasonLovesDoggo in #1287
• build(deps): bump github.com/testcontainers/testcontainers-go from 0.39.0 to 0.40.0 in the gomod group across 1 directory by @dependabot[bot] in #1288
• test(deps): update dependencies to latest versions by @JasonLovesDoggo in #1289
• build(deps-dev): bump esbuild from 0.25.12 to 0.27.0 in the npm group by @dependabot[bot] in #1260
• fix(ogtags): respect target host/SNI/insecure flags in OG passthrough by @JasonLovesDoggo in #1283
• docs: clarify usage of PUBLIC_URL and REDIRECT_DOMAINS in installatio… by @JasonLovesDoggo in #1286
• feat(store/valkey): Add Redis(R) Sentinel support by @Xe in #1294
• Pass the remote IP to the proxied application by @eXpl0it3r in #1298
• ci: add go mod tidy check workflow by @Xe in #1300
• feat: writing logs to the filesystem with rotation support by @Xe in #1299
• chore: add dependabot cooldown by @Xe in #1302
• add Polish language translation by @bplajzer in #1309
• fix(config): deprecate the report_as field for challenges by @Xe in #1311
• Implement FCrDNS and other DNS features by @btomaev in #1308
• Show how to use subrequest auth with Caddy by @tbodt in #1312
• build(deps): bump actions-hub/kubectl from 1.34.1 to 1.34.2 in the github-actions group by @dependabot[bot] in #1303
• fix: pin Node.js and Go versions in CI configuration files by @JasonLovesDoggo in #1318
• build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in #1317
• build(deps): bump the gomod group with 5 updates by @dependabot[bot] in #1316

New Contributors

• @karorogunso made their first contribution in #900
• @nykula made their first contribution in #1044
• @DrJosh9000 made their first contribution in #1267
• @kouhaidev made their first contribution in #1272
• @egimbernat made their first contribution in #1276
• @DerRockWolf made their first contribution in #1269
• @eXpl0it3r made their first contribution in #1298
• @bplajzer made their first contribution in #1309
• @btomaev made their first contribution in #1308
• @tbodt made their first contribution in #1312

Full Changelog: v1.23.1...v1.24.0-pre1

v1.23.1: Lyse Hext - Echo 1

• Fix SERVE_ROBOTS_TXT setting after the double slash fix broke it.

Potentially breaking changes

Remove default Tencent Cloud block rule

v1.23.0 added a default rule to block Tencent Cloud. After an email from their abuse team where they promised to take action to clean up their reputation, I have removed the default block rule. If this network causes you problems, please contact abuse@tencent.com and supply the following information:

• Time of abusive requests.
• IP address, User-Agent header, or other unique identifiers that can help the abuse team educate the customer about their misbehaving infrastructure.
• Does the abusive IP address request robots.txt? If not, be sure to include that information.
• A brief description of the impact to your system such as high system load, pages not rendering, or database system crashes. This helps the provider establish the fact that their customer is causing you measurable harm.
• Context as to what your service is, what it does, and why they should care.

Mention that you are using Anubis or BotStopper to protect your services. If they do not respond to you, please contact me as soon as possible.

Docker / OCI registry clients

Anubis v1.23.0 accidentally blocked Docker / OCI registry clients. In order to explicitly allow them, add an import for (data)/clients/docker-client.yaml:

bots:
  - import: (data)/meta/default-config.yaml
  - import: (data)/clients/docker-client.yaml

This is technically a regression as these clients used to work in Anubis v1.22.0, however it is allowable to make this opt-in as most websites do not expect to be serving Docker / OCI registry client traffic.

What's Changed

• fix: SERVE_ROBOTS_TXT works again by @Xe in #1229
• chore(default-config): remove Tencent Cloud block rule by @Xe in #1227
• feat(blog): a short post on how to file abuse reports by @Xe in #1230
• build(deps-dev): bump the npm group across 1 directory with 3 updates by @dependabot[bot] in #1238
• build(deps): bump github/codeql-action from 4.31.0 to 4.31.2 in the github-actions group by @dependabot[bot] in #1239
• build(deps): bump the gomod group across 1 directory with 18 updates by @dependabot[bot] in #1237
• fix(data): add ruleset to explicitly allow Docker / OCI clients by @Xe in #1253
• ci: add asset build verification workflow by @Xe in #1254

Full Changelog: v1.23.0...v1.23.1

v1.23.0: Lyse Hext

Sorry this took so long, work has been wiping me out. If you know of any companies that are hiring for someone of my skillset, please let me know.

• Add default tencent cloud DENY rule.
• Added (data)/meta/default-config.yaml for importing the entire default configuration at once.
• Add -custom-real-ip-header flag to get the original request IP from a different header than x-real-ip.
• Add contentLength variable to bot expressions.
• Add COOKIE_SAME_SITE_MODE to force anubis cookies SameSite value, and downgrade automatically from None to Lax if cookie is insecure.
• Fix lock convoy problem in decaymap (#1103).
• Fix lock convoy problem in bbolt by implementing the actor pattern (#1103).
• Remove bbolt actorify implementation due to causing production issues.
• Document missing environment variables in installation guide: SLOG_LEVEL, COOKIE_PREFIX, FORCED_LANGUAGE, and TARGET_DISABLE_KEEPALIVE (#1086).
• Add validation warning when persistent storage is used without setting signing keys.
• Fixed robots2policy to properly group consecutive user agents into any: instead of only processing the last one (#925).
• Make the fast algorithm prefer purejs when running in an insecure context.
• Add the s3api storage backend to allow Anubis to use S3 API compatible object storage as its storage backend.
• Fix a "stutter" in the cookie name prefix so the auth cookie is named techaro.lol-anubis-auth instead of techaro.lol-anubis-auth-auth.
• Make cmd/containerbuild support commas for separating elements of the --docker-tags argument as well as newlines.
• Add the DIFFICULTY_IN_JWT option, which allows one to add the difficulty field in the JWT claims which indicates the difficulty of the token (#1063).
• Ported the client-side JS to TypeScript to avoid egregious errors in the future.
• Fixes concurrency problems with very old browsers (#1082).
• Randomly use the Refresh header instead of the meta refresh tag in the metarefresh challenge.
• Update OpenRC service to truncate the runtime directory before starting Anubis.
• Make the git client profile more strictly match how the git client behaves.
• Make the default configuration reward users using normal browsers.
• Allow multiple consecutive slashes in a row in application paths (#754).
• Add option to set targetSNI to special keyword 'auto' to indicate that it should be automatically set to the request Host name (424).
• The Preact challenge has been removed from the default configuration. It will be deprecated in the future.
• An open redirect when in subrequest mode has been fixed.

Potentially breaking changes

Multiple checks at once has and-like semantics instead of or-like semantics

Anubis lets you stack multiple checks at once with blocks like this:

name: allow-prometheus
action: ALLOW
user_agent_regex: ^prometheus-probe$
remote_addresses:
  - 192.168.2.0/24

Previously, this only returned ALLOW if any one of the conditions matched. This behaviour has changed to only return ALLOW if all of the conditions match. I expect this to have some issues with user configs, however this fix is grave enough that it's worth the risk of breaking configs. If this bites you, please let me know so we can make an escape hatch.

Better error messages

In order to make it easier for legitimate clients to debug issues with their browser configuration and Anubis, Anubis will emit internal error detail in base 64 so that administrators can chase down issues. Future versions of this may also include a variant that encrypts the error detail messages.

Bug Fixes

Sometimes the enhanced temporal assurance in #1038 and #1068 could backfire because Chromium and its ilk randomize the amount of time they wait in order to avoid a timing side channel attack. This has been fixed by both increasing the amount of time a client has to wait for the metarefresh and preact challenges as well as making the server side logic more permissive.

What's Changed

• docs(installation): add SLOG_LEVEL environment variable to configuration by @JasonLovesDoggo in #1086
• docs: document some missing env vars by @JasonLovesDoggo in #1087
• build(deps): bump the github-actions group across 1 directory with 8 updates by @dependabot[bot] in #1071
• fix(robots2policy): handle multiple user agents under one block by @JasonLovesDoggo in #925
• feat(lib/store): add s3api storage backend by @Xe in #1089
• Xe/demote temporal assurance by @Xe in #1090
• feat: Warn on missing signing keys when persisting challenges by @JasonLovesDoggo in #1088
• docs: add reminder for verified signatures in PR template by @JasonLovesDoggo in #1092
• build(deps): bump the github-actions group with 4 updates by @dependabot[bot] in #1093
• security: npm audit fix for GHSA-hfm8-9jrf-7g9w et. al by @Xe in #1098
• fix(cmd/containerbuild): support commas in --docker-tags by @Xe in #1099
• feat(lib): Add option for adding difficulty field to JWT claims by @Earl0fPudding in #1063
• chore: port client-side JS to TypeScript by @Xe in #1100
• fix(decaymap): fix lock convoy by @Xe in #1106
• feat(store/bbolt): implement actor pattern by @Xe in #1107
• feat: allow to set cookie sameSite mode and fallback to Lax mode if cookie is not secure by @vaab in #1105
• docs: add link to preact in challenge list by @agoujot in #1111
• ci: add aarch64 for ssh CI by @Xe in #1112
• ci(ssh): don't print uname -av output by @Xe in #1114
• feat(expressions): add contentLength to bot expressions by @Xe in #1120
• fix(run/openrc): truncate runtime directory before starting Anubis by @CyberTailor in #1122
• build(deps): bump the npm group with 2 updates by @dependabot[bot] in #1117
• build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in #1118
• Update nl.json removing literal translated cookie 'koekje' with 'cookie' by @jieter in #1126
• convert issue templates into issue forms by @NetSysFire in #1115
• build(deps): bump github.com/docker/docker from 28.3.2+incompatible to 28.3.3+incompatible in /test by @dependabot[bot] in #1130
• feat(metarefresh): randomly use the Refresh header by @Xe in #1133
• Add Door43 link to known instances documentation by @richmahn in #1136
• fix: mend auth cookie name stutter by @Xe in #1139
• Update Nynorsk translation by @turtlegarden in #1143
• feat: support reading real client IP from a custom header by @avioletheart in #1138
• enable auto setting of SNI based on host header by @jmcclelland in #1129
• fix(lib): enable multiple consecutive slash support by @Xe in #1155
• build(deps-dev): bump esbuild from 0.25.9 to 0.25.10 in the npm group by @dependabot[bot] in #1147
• build(deps): bump github.com/ulikunitz/xz from 0.5.12 to 0.5.14 by @dependabot[bot] in #1132
• build(deps): bump github.com/docker/docker from 28.3.2+incompatible to 28.3.3+incompatible by @dependabot[bot] in #1131
• fix(lib): serve CSS properly by @Xe in #1158
• fix(default-config): make the default config far less paranoid by @Xe in #1179
• fix(default-config): remove preact challenge by @Xe in #1184
• feat: default config macro by @Xe in #1186
• fix(lib): de-flake package lib tests by @Xe in #1187
• Updated REDIRECT_DOMAINS documentation by @zc-devs in #1171
• fix(default-config): sometimes browsers don't send Upgrade-Insecure-Requests by @Xe in #1189
• fix(algorithms/fast): fix fast challenge on insecure contexts by @Xe in #1198
• Xe/show error state by @Xe in #1203
• locale: Update Nynorsk translation by @turtlegarden in #1204
• docs: point get s...

v1.23.0-pre2: Lyse Hext

What's Changed

• docs: point get started button to the per-environment setup docs by @Xe in #1213
• fix(store/bbolt): remove actorify by @Xe in #1215
• feat(default-config): block tencent cloud by default by @Xe in #1216
• link to docs site from readme by @pushcx in #1214
• fix!(policy/checker): make List and-like by @Xe in #1217
• chore: remove copilot instructions by @Xe in #1218

New Contributors

• @pushcx made their first contribution in #1214

Full Changelog: v1.23.0-pre1...v1.23.0-pre2

v1.23.0-pre1: Lyse Hext

• Added (data)/meta/default-config.yaml for importing the entire default configuration at once.
• Add -custom-real-ip-header flag to get the original request IP from a different header than x-real-ip.
• Add contentLength variable to bot expressions.
• Add COOKIE_SAME_SITE_MODE to force anubis cookies SameSite value, and downgrade automatically from None to Lax if cookie is insecure.
• Fix lock convoy problem in decaymap (#1103).
• Fix lock convoy problem in bbolt by implementing the actor pattern (#1103).
• Document missing environment variables in installation guide: SLOG_LEVEL, COOKIE_PREFIX, FORCED_LANGUAGE, and TARGET_DISABLE_KEEPALIVE (#1086).
• Add validation warning when persistent storage is used without setting signing keys.
• Fixed robots2policy to properly group consecutive user agents into any: instead of only processing the last one (#925).
• Make the fast algorithm prefer purejs when running in an insecure context.
• Add the s3api storage backend to allow Anubis to use S3 API compatible object storage as its storage backend.
• Fix a "stutter" in the cookie name prefix so the auth cookie is named techaro.lol-anubis-auth instead of techaro.lol-anubis-auth-auth.
• Make cmd/containerbuild support commas for separating elements of the --docker-tags argument as well as newlines.
• Add the DIFFICULTY_IN_JWT option, which allows one to add the difficulty field in the JWT claims which indicates the difficulty of the token (#1063).
• Ported the client-side JS to TypeScript to avoid egregious errors in the future.
• Fixes concurrency problems with very old browsers (#1082).
• Randomly use the Refresh header instead of the meta refresh tag in the metarefresh challenge.
• Update OpenRC service to truncate the runtime directory before starting Anubis.
• Make the git client profile more strictly match how the git client behaves.
• Make the default configuration reward users using normal browsers.
• Allow multiple consecutive slashes in a row in application paths (#754).
• Add option to set targetSNI to special keyword 'auto' to indicate that it should be automatically set to the request Host name (424).
• The Preact challenge has been removed from the default configuration. It will be deprecated in the future.

Better error messages

In order to make it easier for legitimate clients to debug issues with their browser configuration and Anubis, Anubis will emit internal error detail in base 64 so that administrators can chase down issues. Future versions of this may also include a variant that encrypts the error detail messages.

Bug Fixes

Sometimes the enhanced temporal assurance in #1038 and #1068 could backfire because Chromium and its ilk randomize the amount of time they wait in order to avoid a timing side channel attack. This has been fixed by both increasing the amount of time a client has to wait for the metarefresh and preact challenges as well as making the server side logic more permissive.

What's Changed

• docs(installation): add SLOG_LEVEL environment variable to configuration by @JasonLovesDoggo in #1086
• docs: document some missing env vars by @JasonLovesDoggo in #1087
• build(deps): bump the github-actions group across 1 directory with 8 updates by @dependabot[bot] in #1071
• fix(robots2policy): handle multiple user agents under one block by @JasonLovesDoggo in #925
• feat(lib/store): add s3api storage backend by @Xe in #1089
• Xe/demote temporal assurance by @Xe in #1090
• feat: Warn on missing signing keys when persisting challenges by @JasonLovesDoggo in #1088
• docs: add reminder for verified signatures in PR template by @JasonLovesDoggo in #1092
• build(deps): bump the github-actions group with 4 updates by @dependabot[bot] in #1093
• security: npm audit fix for GHSA-hfm8-9jrf-7g9w et. al by @Xe in #1098
• fix(cmd/containerbuild): support commas in --docker-tags by @Xe in #1099
• feat(lib): Add option for adding difficulty field to JWT claims by @Earl0fPudding in #1063
• chore: port client-side JS to TypeScript by @Xe in #1100
• fix(decaymap): fix lock convoy by @Xe in #1106
• feat(store/bbolt): implement actor pattern by @Xe in #1107
• feat: allow to set cookie sameSite mode and fallback to Lax mode if cookie is not secure by @vaab in #1105
• docs: add link to preact in challenge list by @agoujot in #1111
• ci: add aarch64 for ssh CI by @Xe in #1112
• ci(ssh): don't print uname -av output by @Xe in #1114
• feat(expressions): add contentLength to bot expressions by @Xe in #1120
• fix(run/openrc): truncate runtime directory before starting Anubis by @CyberTailor in #1122
• build(deps): bump the npm group with 2 updates by @dependabot[bot] in #1117
• build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in #1118
• Update nl.json removing literal translated cookie 'koekje' with 'cookie' by @jieter in #1126
• convert issue templates into issue forms by @NetSysFire in #1115
• build(deps): bump github.com/docker/docker from 28.3.2+incompatible to 28.3.3+incompatible in /test by @dependabot[bot] in #1130
• feat(metarefresh): randomly use the Refresh header by @Xe in #1133
• Add Door43 link to known instances documentation by @richmahn in #1136
• fix: mend auth cookie name stutter by @Xe in #1139
• Update Nynorsk translation by @turtlegarden in #1143
• feat: support reading real client IP from a custom header by @avioletheart in #1138
• enable auto setting of SNI based on host header by @jmcclelland in #1129
• fix(lib): enable multiple consecutive slash support by @Xe in #1155
• build(deps-dev): bump esbuild from 0.25.9 to 0.25.10 in the npm group by @dependabot[bot] in #1147
• build(deps): bump github.com/ulikunitz/xz from 0.5.12 to 0.5.14 by @dependabot[bot] in #1132
• build(deps): bump github.com/docker/docker from 28.3.2+incompatible to 28.3.3+incompatible by @dependabot[bot] in #1131
• fix(lib): serve CSS properly by @Xe in #1158
• fix(default-config): make the default config far less paranoid by @Xe in #1179
• fix(default-config): remove preact challenge by @Xe in #1184
• feat: default config macro by @Xe in #1186
• fix(lib): de-flake package lib tests by @Xe in #1187
• Updated REDIRECT_DOMAINS documentation by @zc-devs in #1171
• fix(default-config): sometimes browsers don't send Upgrade-Insecure-Requests by @Xe in #1189
• fix(algorithms/fast): fix fast challenge on insecure contexts by @Xe in #1198
• Xe/show error state by @Xe in #1203
• locale: Update Nynorsk translation by @turtlegarden in #1204

New Contributors

• @vaab made their first contribution in #1105
• @agoujot made their first contribution in #1111
• @NetSysFire made their first contribution in #1115
• @richmahn made their first contribution in #1136
• @avioletheart made their first contribution in #1138
• @jmcclelland made their first contribution in #1129
• @zc-devs made their first contribution in #1171

Full Changelog: v1.22.0...v1.23.0-pre1