fabriziosalmi/certmate v2.14.0

v2.14.0 — DNS provider coverage, CI regression net, openssl CVE fix

on GitHub

Minor release bundling the work merged since v2.13.2.

DNS providers

• Four providers are now configurable from the UI: ArvanCloud, Infomaniak, ACME-DNS, and Hetzner Cloud. They were already issuable via the API but absent from the settings picker, the quick-add select, and the setup wizard — so a UI-only user could not configure them. (#300)
• Fixed Vultr's empty Add-Account modal — it had a provider card but rendered no credential fields. (#300)

Correctness and consistency (single source of truth)

• The API dns_provider enum is now derived from the canonical provider list instead of a hand-maintained literal, so it can no longer drift (it had silently omitted hetzner-cloud and infomaniak). (#299)
• New consistency ratchets make provider-wiring drift a build failure: the DNS-alias maps, and the frontend provider lists vs the backend, are now pinned by tests. (#299, #300)

CI / reliability

• A real-container readiness check (/health/ready) now runs on every CI build, catching a container that boots but whose renewal scheduler never started. (#298)
• An opt-in real-certificate E2E workflow (Let's Encrypt staging via DNS-01) is wired for the provider/DNS/ACME paths the mocked unit tests can't exercise. (#298)

Security

• Base image bumped to patch openssl CVE-2026-45447 (HIGH) (openssl 3.5.6-1~deb13u2). Verified with Trivy. (#301)

Full changelog: v2.13.2...v2.14.0