starred/nginx-proxy-manager
1
0
Fork 0
mirror of https://github.com/NginxProxyManager/nginx-proxy-manager.git synced 2026-10-04 14:11:11 +01:00
Code Issues Packages Projects Releases 10 Wiki Activity
2,603 Commits 18 Branches 90 Tags
develop
Commit Graph
2603 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
jc21 c4fa8daa87 Merge pull request #5801 from vgoer/qr-services-2FA 
Switched to local QR code generation to prevent leaking 2FA keys to third-party QR services.
 2026-08-26 12:47:56 +10:00
jc21 3d800c7138 Merge branch 'develop' into qr-services-2FA 2026-08-26 08:07:11 +10:00
Jamie Curnow 2ed0c47de8 Fix #5802 404 hosts disable missing async/await paradigm 2026-08-26 08:02:52 +10:00
vgoer 4d30946d2f fix: local QR code 2026-08-25 09:14:44 +00:00
vgoer a5e49a53c0 feat: Add react-qr-code dependency 2026-08-25 09:13:41 +00:00
Franck Nijhof 41539c027f fix(certbot): update Timeweb Cloud DNS plugin to 2.0.0 2026-08-25 10:15:38 +02:00
jc21 046d3e022f Merge pull request #5798 from vgoer/develop 
Fix: Insufficient private key permissions led to a leak and  Effective fixing when setting PUID and PGid environment variables
 2026-08-25 07:41:27 +10:00
vgoer c98b1685bd Merge pull request #1 from vgoer/private-key-permissions 
Insufficient private key permissions led to a leak.
 2026-08-24 17:49:40 +08:00
vgoer b7772016ba fix: Ensure JWT key file ownership matches PUID/PGID at startup 2026-08-24 09:30:36 +00:00
vgoer 29687987b2 fix: Restrict JWT key file permissions to 0600 2026-08-24 09:30:22 +00:00
jc21 ab893706da Merge pull request #5796 from timothestoifl24/claude/nifty-neumann-83e87c 
Fix missing `new` on PermissionError so denied requests return 403, not 404
 2026-08-23 00:11:02 +10:00
Timothé Stoifl 246c54503e Merge branch 'develop' into claude/nifty-neumann-83e87c 2026-08-22 15:40:15 +02:00
Jamie Curnow 4ecb047299 Update frontend packages 
- Major update for react-table
- Fix Hosts menu staying around after selecting a menu item
 2026-08-22 23:23:20 +10:00
Jamie Curnow 4e2b052b50 Updated backend packages 2026-08-22 23:10:26 +10:00
Timothé Stoifl ce4e35a3d4 Fix missing new on PermissionError in access.can() 
The catch block in `access.can()` constructed `errs.PermissionError`
without `new`. The error constructors in `backend/lib/error.js` are plain
constructor functions that assign to `this` and return nothing, so calling
one without `new` evaluates to `undefined`.

The statement therefore did `throw undefined`, the express error handler
in `backend/app.js` received undefined (and could not read `.status` or
`.public` off it), and the request fell through to the catch-all 404
handler in `backend/routes/main.js`.

Net effect: every authorization failure raised by `access.can(...)` was
reported to clients as `404 Not Found` instead of `403 Forbidden`.

Line 45 of the same file already used `new` correctly, which shows this
was an oversight rather than deliberate resource-existence hiding. A grep
over `backend/` confirms this was the only error constructor invoked
without `new`.
 2026-08-22 13:07:09 +02:00
Silas 4cbeecaad2 fix: bump certbot-dns-tencentcloud to 2.1.1 2026-08-22 16:19:50 +08:00
Daniel Jacob Butcher fc8b1eb1fb Fixed Estonian flag bug 
The Estonian flag was appearing as an Ethiopian flag, due to a mixup of ISO 639 language codes and ISO 3166 country codes
 2026-08-20 00:04:47 +03:00
Daniel Slavkovsky d64d9a8ab2 fix(certbot): update Websupport DNS plugin to 5.0.0 2026-08-18 11:13:20 +02:00
Leon Schmidt 70f00d60be Add German translations for two-factor authentication and various UI elements 2026-08-18 10:19:06 +02:00
zergflag f43ef16fb5 Update dns-plugins.json 2026-08-09 14:59:39 +02:00
Dimas R. Wisnu 35ad8227d7 fix: resolve biome lint errors 
- Use optional chaining for nullable checks
- Replace template literals with string literals for plain SQL
- Add node: protocol to fs/promises import in setup.js
 2026-08-07 17:01:20 +07:00
Dimas R. Wisnu 4a0f212289 feat: per-path access lists, host logs modal, PostgreSQL support 
- Per-path access lists: assign different access lists to individual
  locations on the same proxy host
- Host logs modal: view access/error logs from proxy host dropdown
- PostgreSQL JSON containment query (@>) for location regeneration
- Locale keys: action.logs, column.error
 2026-08-07 16:40:32 +07:00
Fatih Emre ab96d78f4d Collapse custom locations into a filterable list 
The Custom Locations tab rendered every location fully expanded, which
becomes unusable once a host has more than a handful of them. Each row is
now a collapsible card showing its path and forward target, collapsed by
default, with the Add Location button moved to the top so it stays
reachable without scrolling to the end of the list.

A filter appears once there are five or more locations and matches on the
path as well as the forward scheme, host and port.

New locations are still appended to the end of the list, so the generated
nginx config is unchanged.

Also fixes two existing issues in this component: the per-location inputs
shared the same DOM ids across rows, and the advanced-config toggle state
was keyed by array index, so removing a location moved it onto the wrong
row.
 2026-08-04 16:11:46 +03:00
dependabot[bot] a42614094f Bump actions/stale from 10 to 11 
Bumps [actions/stale](https://github.com/actions/stale) from 10 to 11.
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/stale/compare/v10...v11)

---
updated-dependencies:
- dependency-name: actions/stale
  dependency-version: '11'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-03 13:06:48 +00:00
dependabot[bot] 2cd346d054 Bump postcss from 8.5.14 to 8.5.25 in /docs 
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.14 to 8.5.25.
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/postcss/postcss/compare/8.5.14...8.5.25)

---
updated-dependencies:
- dependency-name: postcss
  dependency-version: 8.5.25
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-02 06:13:35 +00:00
dependabot[bot] 20b8068aaa Bump tar from 7.5.15 to 7.5.22 in /test 
Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.15 to 7.5.22.
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](https://github.com/isaacs/node-tar/compare/v7.5.15...v7.5.22)

---
updated-dependencies:
- dependency-name: tar
  dependency-version: 7.5.22
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-26 16:21:19 +00:00
addielarue 9aa7fd5722 fix(stream): bracket IPv6 forward host for valid nginx upstream 
A Stream Host with an IPv6 address as the Forward Host was accepted and
saved but never activated. The generated stream config rendered
`proxy_pass {{ forwarding_host }}:{{ forwarding_port }}` as e.g.
`fe80::528:3c87:e7bb:ab08:25`, which nginx rejects with
"invalid port in upstream" because an IPv6 literal must be wrapped in
square brackets before the port is appended (`[fe80::...]:25`).

Normalize the stream forward host in generateConfig (alongside the existing
per-host-type data massaging) using net.isIPv6(), so IPv6 hosts render as
`[address]:port` while IPv4 addresses and hostnames are emitted unchanged.
The mutation is applied to the deep-copied render object, so persisted and
audit data are unaffected.

Fixes #5740
 2026-07-25 22:55:58 +10:00
dependabot[bot] 553f879c06 Bump immutable from 5.1.5 to 5.1.9 in /frontend 
Bumps [immutable](https://github.com/immutable-js/immutable-js) from 5.1.5 to 5.1.9.
- [Release notes](https://github.com/immutable-js/immutable-js/releases)
- [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/immutable-js/immutable-js/compare/v5.1.5...v5.1.9)

---
updated-dependencies:
- dependency-name: immutable
  dependency-version: 5.1.9
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-24 08:31:47 +00:00
dependabot[bot] cbf2782571 Bump systeminformation from 5.31.6 to 5.31.17 in /test 
Bumps [systeminformation](https://github.com/sebhildebrandt/systeminformation) from 5.31.6 to 5.31.17.
- [Release notes](https://github.com/sebhildebrandt/systeminformation/releases)
- [Changelog](https://github.com/sebhildebrandt/systeminformation/blob/master/CHANGELOG.md)
- [Commits](https://github.com/sebhildebrandt/systeminformation/compare/v5.31.6...v5.31.17)

---
updated-dependencies:
- dependency-name: systeminformation
  dependency-version: 5.31.17
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-16 00:15:51 +00:00
Jamie Curnow a62c2a6dc3 Adds support for custom admin port via env var #3808 
and documentation
 2026-06-10 11:24:53 +10:00
jc21 a5db5ed156 Merge pull request #5498 from Yasha-ops/develop 
fix: Changed order of escape to prevent RCE
 2026-06-08 08:51:46 +10:00
jc21 101595b90b Merge pull request #5616 from NginxProxyManager/dependabot/npm_and_yarn/backend/node-rsa-2.0.0 
Bump node-rsa from 1.1.1 to 2.0.0 in /backend
 2026-06-08 08:36:58 +10:00
Yassine Damiri 45a3659ffd Change fs import to use fs/promises 2026-06-04 15:08:31 +02:00
Yassine Damiri a457fe4d96 Merge branch 'develop' into develop 2026-06-04 15:06:42 +02:00
jc21 33ef7c859e Merge pull request #5592 from NginxProxyManager/dependabot/npm_and_yarn/test/tmp-0.2.6 
Bump tmp from 0.2.5 to 0.2.7 in /test
 2026-06-04 14:22:00 +10:00
jc21 bfa2dca1b1 Merge pull request #5626 from NginxProxyManager/dependabot/npm_and_yarn/frontend/prod-minor-updates-d03944a3ba 
Bump the prod-minor-updates group across 1 directory with 4 updates
 2026-06-04 14:21:43 +10:00
jc21 32fc268edf Merge pull request #5622 from fo5for/update-s6 
Update s6 overlay to 3.2.3.0
 2026-06-04 07:29:55 +10:00
dependabot[bot] 300d0653e0 Bump the prod-minor-updates group across 1 directory with 4 updates 
Bumps the prod-minor-updates group with 4 updates in the /frontend directory: [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query), [date-fns](https://github.com/date-fns/date-fns), [query-string](https://github.com/sindresorhus/query-string) and [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom).


Updates `@tanstack/react-query` from 5.100.14 to 5.101.0
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.101.0/packages/react-query)

Updates `date-fns` from 4.3.0 to 4.4.0
- [Release notes](https://github.com/date-fns/date-fns/releases)
- [Commits](https://github.com/date-fns/date-fns/compare/v4.3.0...v4.4.0)

Updates `query-string` from 9.3.1 to 9.4.0
- [Release notes](https://github.com/sindresorhus/query-string/releases)
- [Commits](https://github.com/sindresorhus/query-string/compare/v9.3.1...v9.4.0)

Updates `react-router-dom` from 7.15.1 to 7.16.0
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router-dom/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.16.0/packages/react-router-dom)

---
updated-dependencies:
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.101.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
- dependency-name: date-fns
  dependency-version: 4.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
- dependency-name: query-string
  dependency-version: 9.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
- dependency-name: react-router-dom
  dependency-version: 7.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-03 21:22:00 +00:00
dependabot[bot] 06f060dc0f Bump tmp from 0.2.5 to 0.2.7 in /test 
Bumps [tmp](https://github.com/raszi/node-tmp) from 0.2.5 to 0.2.7.
- [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md)
- [Commits](https://github.com/raszi/node-tmp/compare/v0.2.5...v0.2.7)

---
updated-dependencies:
- dependency-name: tmp
  dependency-version: 0.2.6
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-03 21:21:13 +00:00
jc21 7e447acfcc Merge pull request #5617 from NginxProxyManager/dependabot/npm_and_yarn/frontend/prod-patch-updates-509dafd62b 
Bump the prod-patch-updates group in /frontend with 3 updates
 2026-06-04 07:19:19 +10:00
jc21 acd26d7adb Merge pull request #5612 from NginxProxyManager/dependabot/npm_and_yarn/test/prod-patch-updates-e5e2dd2d94 
Bump the prod-patch-updates group in /test with 2 updates
 2026-06-04 07:18:45 +10:00
jc21 1f5a56d0bd Merge pull request #5615 from NginxProxyManager/dependabot/npm_and_yarn/frontend/dev-patch-updates-6b7b087425 
Bump the dev-patch-updates group in /frontend with 4 updates
 2026-06-04 07:18:24 +10:00
jc21 258b522725 Merge branch 'develop' into dependabot/npm_and_yarn/backend/node-rsa-2.0.0 2026-06-04 07:17:53 +10:00
jc21 179c27e382 Merge pull request #5275 from 7heMech/develop 
Add reuseport to improve performance and reduce packet drops
 2026-06-04 07:16:50 +10:00
Tony Chau 94176d2f9c Update s6 overlay to 3.2.3.0 2026-06-03 20:03:29 +08:00
jc21 76f09db610 Merge pull request #5619 from NginxProxyManager/develop 
v2.15.1
v2.15.1 		2026-06-03 14:14:30 +10:00
jc21 d51602b150 Merge branch 'master' into develop 2026-06-03 08:23:48 +10:00
Jamie Curnow af2de98c41 Bump version 2026-06-03 08:22:27 +10:00
dependabot[bot] 6311329772 Bump the prod-patch-updates group in /frontend with 3 updates 
Bumps the prod-patch-updates group in /frontend with 3 updates: [react](https://github.com/facebook/react/tree/HEAD/packages/react), [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) and [react-intl](https://github.com/formatjs/formatjs).


Updates `react` from 19.2.6 to 19.2.7
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react)

Updates `react-dom` from 19.2.6 to 19.2.7
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react-dom)

Updates `react-intl` from 10.1.9 to 10.1.11
- [Release notes](https://github.com/formatjs/formatjs/releases)
- [Commits](https://github.com/formatjs/formatjs/compare/react-intl@10.1.9...react-intl@10.1.11)

---
updated-dependencies:
- dependency-name: react
  dependency-version: 19.2.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-patch-updates
- dependency-name: react-dom
  dependency-version: 19.2.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-patch-updates
- dependency-name: react-intl
  dependency-version: 10.1.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-patch-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-02 14:00:10 +00:00
dependabot[bot] a08f821c54 Bump node-rsa from 1.1.1 to 2.0.0 in /backend 
Bumps [node-rsa](https://github.com/rzcoder/node-rsa) from 1.1.1 to 2.0.0.
- [Release notes](https://github.com/rzcoder/node-rsa/releases)
- [Changelog](https://github.com/rzcoder/node-rsa/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rzcoder/node-rsa/compare/1.1.1...v2.0.0)

---
updated-dependencies:
- dependency-name: node-rsa
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-02 13:59:29 +00:00