Features
- None.
Bug Fixes
- Read-only service tokens (
api:read,mcp:read) no longer receive stored secrets. Notifier credentials, health-check headers, request bodies and URL credentials, certificate private keys and other secret files, and DNS credentials nested in domain responses are now redacted or refused by @0xJacky (1f08595a, f531af6e) - The config directive check now splits configuration the way nginx does, reads Lua block bodies the way ngx_lua does, and resolves negated include globs like nginx by @0xJacky (d1359aa7, 417b43eb)
- Certificate path validation no longer reads files outside the Nginx configuration directory, and only reads size-limited regular files inside it by @0xJacky (e6b9f3a0)
- The login lockout applies again after an earlier ban window expires, and secure-session OTP verification now limits failed attempts by @0xJacky (1a645cd4)
- Verifying an OTP no longer corrupts the cached copy of the user's OTP secret by @0xJacky (4556eb09)
- Certificate usage detection follows includes and indexes CA bundles by @0xJacky (15e96541)
- OIDC sign-in accepts authorization codes of any length by @XRafik (2dcff1a2)
- Host CPU usage in analytics is normalized by aggregate CPU time by @cbka (9eff129a)
- Access log lines whose remote user contains spaces are parsed correctly by @jayhemnani9910 (bd8ae28b)
- HTTP-level directives are kept when a site enters maintenance mode by @jayhemnani9910 (5a078434)
- Expected site config lookup misses no longer log "record not found" by @jayhemnani9910 (75a11f0a)
- The site list sorts correctly by the No. column by @jayhemnani9910 (496faec6)