bunkerity/bunkerweb v1.6.16-rc2

on GitHub

Documentation : https://docs.bunkerweb.io/1.6.16~rc2/

Docker tags :

• All-in-one : bunkerity/bunkerweb-all-in-one:1.6.16-rc2 or ghcr.io/bunkerity/bunkerweb-all-in-one:1.6.16-rc2
• BunkerWeb : bunkerity/bunkerweb:1.6.16-rc2 or ghcr.io/bunkerity/bunkerweb:1.6.16-rc2
• Scheduler : bunkerity/bunkerweb-scheduler:1.6.16-rc2 or ghcr.io/bunkerity/bunkerweb-scheduler:1.6.16-rc2
• Autoconf : bunkerity/bunkerweb-autoconf:1.6.16-rc2 or ghcr.io/bunkerity/bunkerweb-autoconf:1.6.16-rc2
• UI : bunkerity/bunkerweb-ui:1.6.16-rc2 or ghcr.io/bunkerity/bunkerweb-ui:1.6.16-rc2
• API : bunkerity/bunkerweb-api:1.6.16-rc2 or ghcr.io/bunkerity/bunkerweb-api:1.6.16-rc2
  GitLab mirror : registry.gitlab.com/bunkerity/bunkerweb/<image>:1.6.16-rc2 (same digests)

Linux packages : https://packagecloud.io/app/bunkerity/bunkerweb/search?q=1.6.16~rc2&filter=all&dist=

Changelog :

• [BUGFIX] db: on SQLite, settings written in the same save as a service rename or removal are no longer deleted by reused row ids, which could leave a renamed service without any settings and make the reload fall back to failover.
• [BUGFIX] ui: renaming a service moves its settings, custom configs and job cache in one transaction, in every editor mode, instead of deleting and recreating the service, which dropped its per-service certificates and job cache.
• [BUGFIX] metrics: a counter whose Redis value cannot be parsed is now discarded and rewritten with the live count instead of being retried forever, ending the Invalid Redis metric counter error logged every 5s on instances upgraded from 1.6.13 or older, where that counter also stopped reaching Redis entirely.
• [BUGFIX] metrics: rebuilding the request filters and trimming the stored reports now read the list in slices, instead of decoding it whole inside Redis, where the script memory counts against maxmemory and made an allkeys-lru Redis evict the reports themselves, typically on the first start after upgrading from 1.6.14.
• [BUGFIX] antibot: no more can't get session data error when an earlier plugin already handled the challenge request.
• [BUGFIX] ui: no startup crash while the database is still migrating (no such column: bw_global_values.is_draft).
• [BUGFIX] A service without its own SERVER_NAME is named by its id instead of inheriting the global value, empty on Linux, which rendered server_name ;, failed every reload and got the service deleted or renamed by the next Web UI save. An empty SERVER_NAME is now refused for a service, still allowed globally.
• [BUGFIX] letsencrypt: a passed-through ACME challenge keeps the client Host instead of a fixed REVERSE_PROXY_CUSTOM_HOST. (Fixes #3957)
• [BUGFIX] whitelist, greylist, antibot, blacklist: rDNS rules now confirm IPv6 clients instead of treating them as spoofing their reverse DNS.
• [BUGFIX] ui: deleting a custom config with a digit-only name no longer deletes other configs of that service and type on MariaDB.
• [BUGFIX] ui: row actions on the jobs, plugins, templates, services and bans pages keep digit-only ids as text.
• [BUGFIX] autoconf: with KUBERNETES_SKIP_FOREIGN_CLASSES=yes, the Kubernetes controller ignores Ingresses and Gateways whose class belongs to another controller.
• [FEATURE] antibot: ANTIBOT_JAVASCRIPT_DIFFICULTY (16 to 28 bits) raises the JavaScript challenge cost. Regenerate custom JavaScript pages first.
• [FEATURE] antibot: redesigned challenge pages that follow browser preferences (theme, reduced motion, contrast, text size), with a discreet reload link.
• [UI] Responses are compressed (brotli/gzip) and static assets carry a versioned, long-lived cache header, so the Web UI stays fast when reached directly; the API gains gzip.
• [MISC] Duration settings accept nginx-style time suffixes (ms, s, m, h, d, w, M, y): antibot, badbehavior, sessions, cors, reversescan, redis, metrics, crowdsec, db, letsencrypt, selfsigned and the scheduler timeouts. A bare number keeps its previous unit.
• [BREAKING] METRICS_REDIS_TTL now takes time units: m means minutes, not millions. Values stored in the database are migrated; values set through the environment are not.
• [CONTRIBUTION] Thank you @Ayushsinha322 for anchoring the BROTLI_MIN_LENGTH regex so trailing garbage is rejected. (#3959)