Improved
- Added Monitor Mode for Deny Rule: log events only, without blocking requests
- ACME auto-renewal now reuses the existing private key to keep the public key fingerprint stable
- Improved security validation for configuration delivery, internal service access, and static resource handling
- Added an application quota notice when downgrading to Personal/Lite; applications exceeding the limit are disabled by default while their data and configurations are retained
Fixed
- Fixed multiple issues in Config Auto Sync and node re-binding involving application data, configuration delivery, and authentication
- Fixed the CVE-2026-1642 (NGINX SSL upstream injection) security issue in the bundled tengine
- Fixed existing group configurations and application assignments being lost after Group Management was disabled
- Fixed a full-page frontend error when using the Custom HTML edit mode in Settings
- Fixed an empty list when returning to Allow & Deny via the sidebar after opening logs from a rule's Hits Today
- [Personal/Lite] Fixed the account and IP address showing as "-" in authentication logs