What's Changed since last beta
- dep updates
- nginx: prefer chacha20 and aes256 over aes128 for tls1.3 by patching aws-lc
- Build: remove unused lua rocks (session and openidc)
- UI: add Button to disable nginx url sanitisation, defaulkt false, but true for existing hosts and custom locations
- UI: add Button to spoof host header
- UI: allow overwriting the upstream URL for an auth request provider in the UI per host
- nginx: fix $server_port being broken in streams #3149
- nginx: fix loadbalancing, by checking if a hostname is a user provided upstream block based on a prefix #3093
- Note: if no new issues are reported then this will be released within the next few days
- ToDo: Update Nextcloud AIO Reverse Proxy Example Screenshots and Hints
What else Changed since last release
- feat: Support for Multiple Access Control Lists and Location Specific Access Control Lists by @shopsD in #3101
- nginx: set http3_stream_buffer_size to 1m to improve http3 speed on non perfect connections
- nginx: disable SHA1 and RSA_PKCS1 sigalgs, RSA-PKCS1 cna be reenabled using NGINX_TRUST_RSA_PKCS1
- nginx: hide more "useless" upstream headers
- nginx: enable mldsa87:mldsa65:mldsa44 sigalgs, I think no browser supports them
- nginx: update openappsec attachment and crowdsec
- nginx: update nginx to fix recent CVEs, see: #3285
- nginx: fix nginx quic gso (#3408) by patching nginx
- update aws-lc to v5, NPMplus will follow theier rolling mainline releases, like with nginx
- startup: reduce time for 'chown' process when PUID/PGID != 0 by @invario in #3144
- startup: fix disabling ech without container recreation and too early nginx reload
- startup: fix blocked startup if acme server is down
- startup: disable oepnappsec attachment during host regeneration
- UI: diffrent CSPs for NPMplus-UI and swaggerUI
- UI: add Permission Policy
- UI: improve sorting of online/offline/disabled column
- UI: fix button switching in custom location when clicking on the label
- UI: fix OIDC with authelia
- Build: pin git clone steps against commit shas instead of tags and branches
- Build: verify downloaded patches against a shasum
- Build: harden CFLAGS even more
- merge upstream (mainly lang updates)
- dep and doc updates
Image tags:
docker.io/zoeyvid/npmplus:2026-06-05-b1(fixed to this release)ghcr.io/zoeyvid/npmplus:2026-06-05-b1(fixed to this release)docker.io/zoeyvid/npmplus:beta(latest beta/stable)ghcr.io/zoeyvid/npmplus:beta(latest beta/stable)
New Contributors
Full Changelog: 2026-06-03-b1...2026-06-05-b1