bunkerity/bunkerweb v1.6.14-rc2

on GitHub

Documentation : https://docs.bunkerweb.io/1.6.14~rc2/

Docker tags :

• All-in-one : bunkerity/bunkerweb-all-in-one:1.6.14-rc2 or ghcr.io/bunkerity/bunkerweb-all-in-one:1.6.14-rc2
• BunkerWeb : bunkerity/bunkerweb:1.6.14-rc2 or ghcr.io/bunkerity/bunkerweb:1.6.14-rc2
• Scheduler : bunkerity/bunkerweb-scheduler:1.6.14-rc2 or ghcr.io/bunkerity/bunkerweb-scheduler:1.6.14-rc2
• Autoconf : bunkerity/bunkerweb-autoconf:1.6.14-rc2 or ghcr.io/bunkerity/bunkerweb-autoconf:1.6.14-rc2
• UI : bunkerity/bunkerweb-ui:1.6.14-rc2 or ghcr.io/bunkerity/bunkerweb-ui:1.6.14-rc2
• API : bunkerity/bunkerweb-api:1.6.14-rc2 or ghcr.io/bunkerity/bunkerweb-api:1.6.14-rc2

Linux packages : https://packagecloud.io/app/bunkerity/bunkerweb/search?q=1.6.14~rc2&filter=all&dist=

Changelog :

• [PERF] ui: make the Reports, Logs, and Home pages fast when many blocked-request reports are stored in Redis: fetch a single report by id from the newest end instead of scanning the whole list, share the Home page aggregation across workers through Redis instead of recomputing it in every worker, cache the Logs line count until the file changes or is rotated, and pause the Reports auto-refresh while the browser tab is in the background. Also honor the k/m suffix on METRICS_MAX_BLOCKED_REQUESTS_REDIS when bounding report reads.
• [PERF] ui: memoize the plugin catalog and rebuild it only when plugins change instead of on every request, cutting the fixed overhead paid on every page load.
• [BUGFIX] metrics: when the metrics memory zone fills up, shed the oldest blocked-request reports instead of silently discarding a worker's whole history, and warn that METRICS_MEMORY_SIZE needs raising.
• [BUGFIX] metrics: stop storing the literal string nil in Redis for a counter evicted from a worker's LRU mid-sync, which made the misc, blacklist and greylist plugin pages return a 500.
• [BUGFIX] ui: an unreadable counter no longer breaks a whole plugin page, and no longer hides the workers that reported real counts.
• [BUGFIX] scheduler: refresh the job environment in place instead of replacing it on every reload, so jobs stop reading a snapshot of the configuration taken at startup. A DNS-01 service created or edited in the web UI got no certificate until the container was restarted. (Fixes #3755)
• [BUGFIX] letsencrypt: fail the certbot-new job when a service cannot get the certificate it asked for instead of reporting success, and write each job's output to certbot-new.log and certbot-renew.log so the Jobs and Logs pages show why.
• [BUGFIX] whitelist: whitelisting a banned IP now lifts the block on HTTP and stream services, and manually configured WHITELIST_* values are honored by the default server and badbehavior checks instead of only the entries downloaded from WHITELIST_*_URLS. (Refs #3708)
• [BUGFIX] core: a setting missing from a service's configuration falls back to its global value, and a setting declared by a plugin but absent from the configuration is logged once per minute at warning level instead of at error level on every request. (Refs #3746)
• [BUGFIX] autoconf: a Kubernetes watch that exhausts its retries now backs off and marks the container unhealthy instead of silently restarting forever while reporting healthy, and the Kubernetes manifests give the controller a liveness probe so it gets restarted. (Refs #3750)
• [BUGFIX] api, ui: raise the Biscuit Datalog authorizer's wall-clock budget from biscuit's 1 ms default to 100 ms, so a CPU-saturated host stops rejecting valid tokens with 401/403 in the API and stops logging the session out in the web UI. The fact and iteration limits keep their defaults, so a token whose own Datalog is hostile is still denied immediately, and a genuine policy denial keeps its original status.
• [BUGFIX] crowdsec: enabling CrowdSec on individual services while it stays off globally now works. The bouncer was never initialized in that configuration, so every request logged attempt to index field 'conf' (a nil value) and was let through unchecked.
• [FEATURE] all-in-one: add DISABLE_ONLINE_API, same name as the official CrowdSec images, to run CrowdSec without registering to the Central API. (Refs #3754)
• [DOCS] all-in-one: document what CrowdSec Central API registration transmits, and correct the parser opt-out variable to CROWDSEC_DISABLE_PARSERS.
• [BUGFIX] ui: a form submitted after the session ended now reports that the change was not saved, instead of redirecting to the login page and redrawing the old values as if nothing had happened. (Refs #3751, #3752)
• [UI] Reports page: document the retention model, a rolling buffer capped per worker that is cleared on restart unless Redis is enabled.
• [SECURITY] api: reject Biscuit tokens carrying more than the single block the product issues. Biscuit blocks can be appended offline without any private key, and the Datalog run limits are only checked between iterations, so a single crafted join inside an appended block could hold an API worker's event loop for tens of seconds whatever the execution budget was set to.
• [SECURITY] modsecurity: update the OWASP Core Rule Set to v4.28.0 and v3.3.10, fixing GHSA-6jp8-c2w2-x7wr, where XML attribute values were not inspected by the attack-detection rules and could be used to bypass them, and GHSA-f5qm-3h4p-8qhg, catastrophic backtracking in the unix-shell-evasion prefix. v4.28.0 also removes excessive backtracking from rules 933160, 933161, 933180, 941140 and 942522.
• [SECURITY] modsecurity: update Mbed TLS to v4.2.0, which fixes a use-after-free in mbedtls_pkcs7_free(), X.509 CA-bit forgery via an invalid basicConstraints extension, acceptance of weak hash algorithms in PKCS7 signature verification, and unenforced signature-algorithm restrictions on certificate chains. BunkerWeb builds Mbed TLS as ModSecurity's crypto backend only, so the TLS-handshake advisories in that release do not apply.
• [MODSECURITY] CRS v4.28.0 enables crs_validate_utf8_encoding by default. Requests carrying non-UTF8 data that previously passed may now be flagged; raise the anomaly threshold or disable rule 920250 if this causes false positives.
• [DEPS] Updated Coreruleset version to v4.28.0 (v4) and v3.3.10 (v3)
• [DEPS] Updated Mbed TLS version to v4.2.0
• [DEPS] Updated lua-nginx-module version to v0.10.29R2, lua-resty-core to v0.1.32R1 and stream-lua-nginx-module to v0.0.17R4 (these three share a compile-time version handshake and are bumped together)
• [DEPS] Updated lua-resty-http version to v0.18.0
• [DEPS] Updated lua-cjson version to v2.1.0.19
• [DEPS] Updated LuaJIT version to v2.1-20260724
• [DEPS] Updated postcss version to 8.5.24
• [DEPS] Updated the web UI vendored libraries: DOMPurify to 3.4.12, ApexCharts to 6.6.1, i18next to 26.3.6 and i18next-http-backend to 4.0.1
• [DEPS] Removed the unused nginx 1.28.0 source tree, which nothing built since the FreeBSD packaging was dropped, and the obsolete stream-lua-nginx-module patch, which upstream applied in v0.0.17R4
• [UI] Removed vendored front-end assets that were never loaded: 28 unused ACE extensions, keybindings and themes, the ACE stylesheet directory, the 45 ApexCharts locale files, and the unminified topojson-client build.
• [CONTRIBUTION] Thank you xabru for your contribution regarding wildcard SNI fallback for custom certificates. (#3745)