Nginx UI: matoleo yote na matoleo ya zamani

Features
- None.
Bug Fixes
- Select the local account for OIDC logins only from trusted claims: a configured Identifier no longer falls back to other claims, name is no longer used, and email requires email_verified unless the new TrustUnverifiedEmail option is enabled (GHSA-q856-qj25-p7fc). Existing setups that matched users by display name or by unverified email must set Identifier to a stable claim; see the OIDC guide by @0xJacky (cab1e54f)
- Verify the organization, audience and token type of Casdoor tokens, and resolve JWT-Standard tokens by username rather than display name (GHSA-gv2g-m37c-8wwh). Users of other Casdoor organizations can no longer sign in; see the Casdoor guide by @0xJacky (bffd49fb)
- Show the container's uptime on the dashboard when Nginx UI runs inside an LXC container by @0xJacky (e3832ce1)
- Keep endpoint settings when restoring a portable backup by @0xJacky (9a42b757)
- Keep a loopback listener from failing the HTTP-01 route check when issuing certificates by @0xJacky (1f5f3f48)
- Make the Retry button of the certificate issue dialog work by @0xJacky (e202fbf2)
- Treat file names Windows rejects as missing files instead of logging errors by @0xJacky (a1bb61cd)
- Read the nginx log level only from a bracketed tag in nginx output by @kevin9327 (00d48cb4)
Contributors
@0xJacky
@kevin9327

Features
- None.
Bug Fixes
- Read-only service tokens (api:read, mcp:read) no longer receive stored secrets. Notifier credentials, health-check headers, request bodies and URL credentials, certificate private keys and other secret files, and DNS credentials nested in domain responses are now redacted or refused by @0xJacky (1f08595a, f531af6e)
- The config directive check now splits configuration the way nginx does, reads Lua block bodies the way ngx_lua does, and resolves negated include globs like nginx by @0xJacky (d1359aa7, 417b43eb)
- Certificate path validation no longer reads files outside the Nginx configuration directory, and only reads size-limited regular files inside it by @0xJacky (e6b9f3a0)
- The login lockout applies again after an earlier ban window expires, and secure-session OTP verification now limits failed attempts by @0xJacky (1a645cd4)
- Verifying an OTP no longer corrupts the cached copy of the user's OTP secret by @0xJacky (4556eb09)
- Certificate usage detection follows includes and indexes CA bundles by @0xJacky (15e96541)
- OIDC sign-in accepts authorization codes of any length by @XRafik (2dcff1a2)
- Host CPU usage in analytics is normalized by aggregate CPU time by @cbka (9eff129a)
- Access log lines whose remote user contains spaces are parsed correctly by @jayhemnani9910 (bd8ae28b)
- HTTP-level directives are kept when a site enters maintenance mode by @jayhemnani9910 (5a078434)
- Expected site config lookup misses no longer log "record not found" by @jayhemnani9910 (75a11f0a)
- The site list sorts correctly by the No. column by @jayhemnani9910 (496faec6)
Contributors
@0xJacky
@XRafik
@cbka
@jayhemnani9910

Features
- None.
Bug Fixes
- Restore the certificate and private key path inputs on the import certificate form, fixing a 406 error when importing pasted certificates and allowing existing certificate files to be referenced in place (#2008) by @0xJacky (4f3c5915)
Contributors
@0xJacky

Features
- Show which sites and streams use each certificate by @0xJacky (b8a0895a)
- Add a retention count to auto backup tasks by @SulimanAbdulrazzaq (6a079e01)
- Add Italian (it_IT) translation by @BluLupo (1c72533e)
- Tidy the certificate editor header and actions by @0xJacky (70147328)
Bug Fixes
- Isolate session cookies by protocol by @0xJacky (881ef81c)
- Keep certificates with long identifier lists in their own directory by @0xJacky (035192b8)
- Migrate shared certificates and wait for renewal before sending expiry notices by @0xJacky (f3a368d2)
- Skip backup retention cleanup when another task shares the same file names by @0xJacky (e95a6e66)
- Limit the height of the add-site config template and scroll inside it by @akinoccc (4e95c83b)
Contributors
@0xJacky @SulimanAbdulrazzaq @BluLupo @akinoccc

Features
- Add a Snippets page to manage reusable Nginx snippets: edit them on their own page with variables and a live preview, start from built-in templates, include them from the site editor, and sync them to nodes by @Hintay (dd7a40a7, d4bb80f6, f711f7b0, 2a9fb2cd)
- Pick a config template when creating a site by @akinoccc (dde9c05a)
- Set a custom URL that a dashboard site card opens when clicked by @EFX1SZH (bb7d07a6)
Bug Fixes
- Fix "database is locked" errors across the app after upgrading to v2.8.x, caused by the site check auto-upgrade waiting on its own SQLite transaction (#1994) by @0xJacky (f7ab4d9a)
- Stop access list saves from holding the database lock while Nginx tests and reloads by @0xJacky (b2cb7530)
- Replicate certificates to the nodes that serve them, so synced sites no longer fail with "cannot load certificate" and renewals reach those nodes by @0xJacky (06c8f951)
- Complete the Korean translation and fill in missing translations for the other languages by @0xJacky (933a8560, ce183d87)
Contributors
@0xJacky
@Hintay
@akinoccc
@EFX1SZH

Features
- None.
Bug Fixes
- Complete missing translations for the new access list, upstream group and certificate texts across all languages by @0xJacky (e6d755bd)
Contributors
@0xJacky

Features
- Add reusable IP access lists for sites and streams by @0xJacky (5fc9a08e)
- Manage standalone upstream groups, reference them from sites, and convert a site's upstream block into a shared group with a shared memory zone by @0xJacky (851b9e2a)
- Toggle upstream servers and search from the upstream groups page by @0xJacky (e8fcfbbb)
- Switch nodes from the header and work on two nodes side by side by @0xJacky (5e18ac05)
- Save each preference tab through its own endpoints by @0xJacky (f7365aac)
- Discover LLM models from the provider endpoint by @0xJacky (00ac4712)
- Choose the LLM model and thinking level per chat by @0xJacky (aeb37a71)
- Show the thinking process of reasoning models by @0xJacky (f0eb46c6)
- Index HTTP server blocks from nginx -T by @0xJacky (a5317221)
- Add a finish button, namespace and access select to the site flows by @0xJacky (be4c8d39)
- Export and import certificates as zip archives by @0xJacky (dfaa22f1)
- Deploy certificates in directory sync and report skipped files by @0xJacky (72d73589)
- Recommend an existing certificate that covers the site when enabling HTTPS by @0xJacky (f7fe3b68)
- Polish the layouts of the sites list, nodes status, ACME user and certificate pages by @EFX1SZH (e5cc3618)
- Rebuild the preference page as a settings center with setting rows, and track unsaved changes against a snapshot by @Hintay (33c27204)
Bug Fixes
- Probe HTTP-01 routes on the sockets that serve each domain by @0xJacky (d8e5f21b)
- Check certificate SANs when matching existing certificates by @0xJacky (e796c3ea)
- Translate certificate issuance errors and log them once by @0xJacky (e44097ac)
- Stop replicated changes from bouncing between cluster nodes by @0xJacky (618fde30)
- Honor InsecureSkipVerify on the node analytic WebSocket by @0xJacky (64546410)
- Let the controller open a child node's terminal by @0xJacky (a6fcfaac)
- Update only the DDNS records the user selected by @0xJacky (b5d5bea0)
- Make batch namespace edits work for sites and streams by @0xJacky (f473e692)
- Render the batch edit preview correctly by @0xJacky (bf9c6433)
- Keep non-ASCII characters in per-site access log names by @0xJacky (f22e094f)
- Confine managed upstream paths to conf.d by @0xJacky (c9d4cb5b)
- Key managed upstream group health by resolved socket by @0xJacky (e1c02c77)
- Keep hidden sensitive input values out of the DOM by @0xJacky (20ac34df)
- Copy to the clipboard over plain HTTP by @0xJacky (4729212c)
- Keep modal focus working over drawers by @0xJacky (1eeb1392)
- Keep overflowing right panel tabs reachable via the more menu by @0xJacky (9869d03e)
- Center the header banners again by @0xJacky (652d94c1)
- Use "No." as the site index column title by @0xJacky (14038d2a)
- Keep message contexts in the web translation catalog by @Hintay (7d021725)
- Keep gettext catalogs free of locations and fuzzy entries by @Hintay (f34c3fc4)
- Allow dismissing the 2FA prompt by @0xJacky (79caf96b)
Contributors
@0xJacky
@EFX1SZH
@Hintay

Features
- Enable HTTPS for a site from a single card in the site wizard and editor, with the backend orchestrating certificate issuance and the HTTPS config by @0xJacky (51556433, 017fc3fa).
- Verify HTTP-01 challenge routes with an active loopback probe and explain ACME failures with actionable hints by @0xJacky (9e2503fb, b71c2c54).
- Support listening on a Unix domain socket by @emecii and @0xJacky (12d4b2e2, e7051e05).
- Choose the ACME challenge method per certificate, allowing HTTP-01 issuance without a DNS credential, with challenge reminders and more detailed issuance and renewal errors by @EFX1SZH (1ae407a7, 27b4b12e).
- Download certificates as certificate only, certificate with CA chain, or a password-protected PFX/PKCS#12 bundle by @EFX1SZH (216184c4, d8a65536).
- Show subject alternative names and richer certificate metadata, copyable certificate details, clearer issuance logs, and a certificate name field in the certificate editor by @EFX1SZH (27bed2b7, 8ef17c90, 86e7b4c5, 834fbd1e).
- Mask the email password and Teams client secret in the External Notify editor by @EFX1SZH (7a5b27c3).
- Use a consistent tag style for valid certificate status in the certificate list by @EFX1SZH (a6040dbf).
Bug Fixes
- Scope short tokens to WebSocket login sessions by @0xJacky (1b022804).
- Keep ACME challenges reachable behind the quick-setup HTTPS redirect and register the default ACME account after install by @0xJacky (ec9a07f3, f7d63bd3).
- Pause certificate renewal while a site or stream is disabled by @0xJacky (93f99177).
- Run delete refusal checks before any side effect when deleting sites and streams by @0xJacky (a921b2ec, bad5ea64).
- Stop site list sync from resetting site monitoring settings, with a smooth migration and soft-delete fallback for abnormal records by @EFX1SZH (7dbaf271, 5b4e79ce).
- Preserve JSON domain serialization when importing certificates and repair corrupted rows by @Mr-Robot-ops and @0xJacky (97b22fa6, 926a736d).
- Accept uppercase nginx size suffixes in performance settings by @Dev-next-gen and @0xJacky (38b4ae43, 2b0e5730).
- Show translated titles and messages for site health check failure and recovery notifications by @EFX1SZH and @0xJacky (b059c044, 84ab8f77, 1cea7491).
- Restore styling lost in the antdv-next migration by @0xJacky (804103af).
- Complete plural forms across translation catalogs and correct German translation typos by @0xJacky (29360d52, 7cc52451).
- Complete Simplified and Traditional Chinese translations for the certificate DNS help text by @EFX1SZH (7496e8ee, b51e8206).
- Harden CI workflows by pinning third-party actions, declaring explicit token scopes, and not persisting unused checkout credentials by @SaboniAmine (6c979832, bf37e582, 1e75c49b).
Contributors
@0xJacky
@EFX1SZH
@emecii
@Mr-Robot-ops
@Dev-next-gen
@SaboniAmine

Features
- Show remaining TLS certificate days on dashboard site cards and highlight expired certificates by @EFX1SZH (a12c628e).
- Document RainYun one-click deployment availability by @0xJacky (87b9ce48).
Bug Fixes
- Use the typed advanced-indexing status response without a legacy unsafe cast by @0xJacky (3ab1f239).
- Restore spacing between status indicators and labels in the dashboard and node list by @0xJacky (1e48eb0a).
Contributors
@0xJacky
@EFX1SZH

Features
- Add notification deep links with backend-provided URLs and richer external notification templates with channel-specific level colors by @EFX1SZH (9b611f80, d4611240).
- Support configurable local GeoJSON boundary files for nginx log dashboard maps by @EFX1SZH (6ad5c1ff, 079481a3).
- Allow users to delete a certificate even when revocation fails by @0xJacky (093181ef).
Bug Fixes
- Keep terminal sessions visible and usable after switching tabs or pages by @EFX1SZH (3c7ddae8).
- Stabilize shared WebSocket lifecycles across upstream monitoring, session changes, code completion, dashboards, and disconnected peers by @0xJacky (f722ff94, 2b5dbad4, 19fe5314, 967a1c2a, 33761778).
- Use HTTPS for the default AWS S3 backup endpoint by @Dev-next-gen (a4298ec3).
- Report certificate revocation outcomes accurately and clean up deSEC DNS records correctly by @Dev-next-gen and @0xJacky (1851a914, 0aea1072, d750df2f).
- Fall back to CDN map boundaries and parse province drill-down data correctly when local GeoJSON files are not configured by @EFX1SZH (ec165b32, 2105f2da).
- Preserve upstream availability results across configuration rescans by @0xJacky (4ae7bd9c).
- Ignore commented directives when calculating nginx performance configuration by @Dev-next-gen (8369f607).
- Accept Bark notification configurations without a device key by @Dev-next-gen (cf5d576c).
- Reload configuration editor state when switching between sites or streams by @0xJacky (f981b8f8).
- Preserve namespaces and stage managed configurations correctly during cluster propagation by @0xJacky (7626fd40, bb180726).
- Harden MCP request parsing, user-management authorization, sensitive credential reads, demo health checks, and passkey session handling by @0xJacky (66471391, cb27607c, 9594b04d, 64bc599e, d766e90b, 6c76811e).
Contributors
@0xJacky
@EFX1SZH
@Dev-next-gen

Features
- Redesign the home hub with pinnable configuration favorites and clearer navigation by @0xJacky (36336a56).
- Add descriptions, copy actions, and stable ID-based ordering and labels for external notification providers by @EFX1SZH (43317f59).
- Remember the selected upgrade channel and allow reinstalling the same development commit by @EFX1SZH (dd526f0e).
- Support internationalized domain names across DNS providers, searches, records, and DDNS while displaying their Unicode form by @0xJacky (6476cc40, bb102ade, 0c88fbbc, 83b53e76, 09508454).
Bug Fixes
- Complete OIDC login error handling, proxy-aware callbacks, hash-route redirects, and two-factor submission after the credentials form unmounts by @EFX1SZH and @0xJacky (b37d9989, 8390bf12, 6571e530, ab386ebd).
- Restore certificate list actions across desktop and mobile layouts and keep the view transitionable by @be-student (2de0711b, 4544a506, 4b512395).
- Preserve secure group-readable permissions when writing certificate keys by @0xJacky (7604b231).
- Keep long sidebar tab titles within the available navigation width by @EFX1SZH (2ef489a5).
- Restore page and card headers, including the Sites edit action and dashboard navigation controls by @EFX1SZH and @0xJacky (7aa7e6d7, b8e460e8, 6f11187d).
- Improve nginx log type detection and keep time-range and view controls visible by @EFX1SZH (1223addf).
- Make preference pages and form controls use the available space while retaining content-sized fields by @EFX1SZH and @0xJacky (f6794e84, d636475c).
- Restore missing translation catalog entries and make external notifier field labels translatable by @0xJacky and @EFX1SZH (a275fafe, 7924475e, 4cc2b64a).
- Show the correct current commit SHA on the upgrade page by @EFX1SZH (bdfd7fd4).
- Probe nginx upstreams that use unix: socket addresses against the underlying filesystem path by @Dev-next-gen (2d3fd9da).
- Let the sidebar menu scroll far enough to reach its final entry by @0xJacky (5f3cb92e).
Contributors
@0xJacky
@EFX1SZH
@be-student
@Dev-next-gen