NeySlim/ultimate-ca-manager v2.176

on GitHub

[2.175] - 2026-06-17

Fixed

• Manual DNS-01 is usable again — the ACME client no longer waits a fixed 10s then auto-submits. For a Manual DNS provider the order stays pending so you can add the TXT record and click Verify Challenge (which self-checks DNS before submitting, so it never burns the token; a force option bypasses the check). For automated providers the client self-checks propagation (configurable DNS propagation timeout in ACME → Let's Encrypt settings) and runs validation in the background so the request never blocks (#140).

Fixed

• Duplicate webhook notifications — certificate.expiring (and other events) could be delivered twice with an identical payload while the delivery log showed a single event. Webhook deliveries are now claimed atomically (exactly-once) and the background scheduler runs in a single process, so each delivery is sent once even under concurrent workers (#139).

Security

• Updated cryptography to 48.0.1 (GHSA-537c-gmf6-5ccf, vulnerable OpenSSL in wheels) and forced ws to 8.21.0 (CVE-2026-48779, WebSocket DoS).

[2.173] - 2026-06-17

Changed

• SSO identity is now the directory's stable identifier, never the email — OIDC sub, SAML persistent NameID, or LDAP entryUUID/objectGUID (configurable per provider, auto-detected by default). Accounts are recognised across username/email changes, and the email is never an authentication key (removes account-takeover risk). An SSO login whose email matches a local account now provisions a separate SSO account instead of erroring; an administrator can still merge them via Link to SSO, which no longer renames the local username (#136, #138).
• Backups — the backup list is paginated, searchable and sortable, with multi-select bulk delete, a usage summary (count, total size, free disk) and a Clean up now action. Retention is always visible (no longer hidden behind the automatic-backup toggle) and is enforced daily even when automatic backups are off.

Fixed

• Backups could fill the disk — pre-migration database snapshots are now capped to the most recent few, and backup retention runs as its own scheduled task (previously it only ran after a scheduled backup, so manual backups accumulated indefinitely).

Full history: CHANGELOG.md