starred/nginx-proxy-manager
1
0 Fork 0
mirror of https://github.com/NginxProxyManager/nginx-proxy-manager.git synced 2026-11-15 22:48:04 +00:00
Code Issues Packages Projects Releases 10 Wiki Activity
2,718 Commits 11 Branches 90 Tags
5c8aec9bdeca0a2fb6a71e060ec598aa6eddd186
Commit Graph
85 Commits
Author SHA1 Message Date
Jamie Curnow 66ab4b24d1 Stop non-admins injecting nginx directives through host fields 
advanced_config is admin-only, but other fields are written into nginx
config as-is and the schema barely limited them. A non-admin could add
any directive through them:

- location path, forward_host and forward_path (any non-empty string)
- proxy host forward_host (a quote breaks out of set $server "...")
- redirection forward_domain_name and stream forwarding_host (their
  pattern allowed ";", e.g. "example.com; return 200; #")
- access list IPv6 addresses ("%.+" zone id allowed "::1%x; allow all")
- domain names (a newline got out of the header comment)

Validation
- New lib/nginx-values.js holds the rules. Values can't contain
  characters that end or change an nginx token: whitespace, control
  characters, ; { } " ' # \, and no $ in a host. Location paths allow a
  modifier and an unquoted or double-quoted URI, so =, ~, ~* and ^~
  locations and quoted regexes keep working.
- The API schemas use the same patterns, including the certificate
  schema's own copy of the domain rule. A test fails if they drift.
- generateConfig checks stored values again, so rows saved before these
  rules can't inject either. The check is about nginx structure only:
  a stored value the API would now reject, but which can't add
  directives, still renders. If a value is unsafe, nothing is written
  and the host is marked offline with the reason in nginx_err. The same
  check covers per-location access lists and the Let's Encrypt request
  config.
- htpasswd user names can't contain ":" or control characters, which
  corrupted the file.

Fixes along the way
- IPv6 client addresses: drop zone ids, which nginx's allow/deny
  rejects anyway, and fix broken escapes (literal "d" for digits, an
  unescaped ".").
- Rewrite the domain rule used by redirection and stream hosts so it
  can't backtrack exponentially. It accepts the same values.
- Pattern errors still say "must match pattern", but no longer quote
  the regex.

Tests
- backend/test/nginx-values.test.js, run by `yarn test` and in
  scripts/ci/test-and-build. Real request schemas reject an injection
  set and accept valid values on every endpoint. Accepted values,
  rendered through the real templates and parsed using nginx's
  tokenizer rules, keep the same statement structure. The check
  refuses unsafe stored rows.
- NginxValues.cy.js: injection attempts from a non-admin get 400, and
  hosts using valid edge-case values come up with nginx_online true.
 2026-11-10 08:20:02 +10:00
Jamie Curnow 47c9bfba4f Update dependencies 2026-11-09 11:55:20 +10:00
Jamie Curnow f915ca2462 Update all deps, and cypress 2026-11-04 20:54:23 +10:00
mikeyheneinandClaude Opus 5.5 c214a49afb Backend: refresh yarn.lock within the declared ranges (fixes 15 of 16 advisories, incl. body-parser DoS) 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-11-02 20:28:36 -08:00
dependabot[bot] 1cb352847a build(deps): bump moment in /backend in the prod-minor-updates group 
Bumps the prod-minor-updates group in /backend with 1 update: [moment](https://github.com/moment/moment).


Updates `moment` from 2.30.1 to 2.31.0
- [Release notes](https://github.com/moment/moment/releases)
- [Changelog](https://github.com/moment/moment/blob/develop/CHANGELOG.md)
- [Commits](https://github.com/moment/moment/compare/2.30.1...2.31.0)

---
updated-dependencies:
- dependency-name: moment
  dependency-version: 2.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-21 13:04:26 +00:00
dependabot[bot] d8488048ca Bump the prod-patch-updates group across 1 directory with 3 updates 
Bumps the prod-patch-updates group with 3 updates in the /backend directory: [@apidevtools/json-schema-ref-parser](https://github.com/APIDevTools/json-schema-ref-parser), [compression](https://github.com/expressjs/compression) and [mysql2](https://github.com/sidorares/node-mysql2).


Updates `@apidevtools/json-schema-ref-parser` from 16.0.0 to 16.0.2
- [Release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases)
- [Commits](https://github.com/APIDevTools/json-schema-ref-parser/compare/v16.0.0...v16.0.2)

Updates `compression` from 1.8.1 to 1.8.2
- [Release notes](https://github.com/expressjs/compression/releases)
- [Changelog](https://github.com/expressjs/compression/blob/master/HISTORY.md)
- [Commits](https://github.com/expressjs/compression/compare/v1.8.1...v1.8.2)

Updates `mysql2` from 3.24.2 to 3.24.4
- [Release notes](https://github.com/sidorares/node-mysql2/releases)
- [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md)
- [Commits](https://github.com/sidorares/node-mysql2/compare/v3.24.2...v3.24.4)

---
updated-dependencies:
- dependency-name: "@apidevtools/json-schema-ref-parser"
  dependency-version: 16.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-patch-updates
- dependency-name: compression
  dependency-version: 1.8.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-patch-updates
- dependency-name: mysql2
  dependency-version: 3.24.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-patch-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-14 13:04:01 +00:00
dependabot[bot] 33250a0e38 Bump @apidevtools/swagger-parser from 12.1.0 to 13.0.0 in /backend 
Bumps [@apidevtools/swagger-parser](https://github.com/APIDevTools/swagger-parser) from 12.1.0 to 13.0.0.
- [Release notes](https://github.com/APIDevTools/swagger-parser/releases)
- [Changelog](https://github.com/APIDevTools/swagger-parser/blob/main/CHANGELOG.md)
- [Commits](https://github.com/APIDevTools/swagger-parser/compare/v12.1.0...v13.0.0)

---
updated-dependencies:
- dependency-name: "@apidevtools/swagger-parser"
  dependency-version: 13.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-07 13:03:22 +00:00
dependabot[bot] f7a696cf08 Bump mysql2 in /backend in the prod-minor-updates group 
Bumps the prod-minor-updates group in /backend with 1 update: [mysql2](https://github.com/sidorares/node-mysql2).


Updates `mysql2` from 3.23.4 to 3.24.2
- [Release notes](https://github.com/sidorares/node-mysql2/releases)
- [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md)
- [Commits](https://github.com/sidorares/node-mysql2/compare/v3.23.4...v3.24.2)

---
updated-dependencies:
- dependency-name: mysql2
  dependency-version: 3.24.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-31 13:04:27 +00:00
Jamie Curnow 4e2b052b50 Updated backend packages 2026-08-22 23:10:26 +10:00
dependabot[bot] a08f821c54 Bump node-rsa from 1.1.1 to 2.0.0 in /backend 
Bumps [node-rsa](https://github.com/rzcoder/node-rsa) from 1.1.1 to 2.0.0.
- [Release notes](https://github.com/rzcoder/node-rsa/releases)
- [Changelog](https://github.com/rzcoder/node-rsa/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rzcoder/node-rsa/compare/1.1.1...v2.0.0)

---
updated-dependencies:
- dependency-name: node-rsa
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-02 13:59:29 +00:00
dependabot[bot] 6bb9a90103 Bump the prod-minor-updates group across 1 directory with 2 updates 
Bumps the prod-minor-updates group with 2 updates in the /backend directory: [liquidjs](https://github.com/harttle/liquidjs) and [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg).


Updates `liquidjs` from 10.25.7 to 10.27.0
- [Release notes](https://github.com/harttle/liquidjs/releases)
- [Changelog](https://github.com/harttle/liquidjs/blob/master/CHANGELOG.md)
- [Commits](https://github.com/harttle/liquidjs/compare/v10.25.7...v10.27.0)

Updates `pg` from 8.20.0 to 8.21.0
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.21.0/packages/pg)

---
updated-dependencies:
- dependency-name: liquidjs
  dependency-version: 10.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
- dependency-name: pg
  dependency-version: 8.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-26 22:54:39 +00:00
Jamie Curnow 03c70e3902 Fixes for upgraded debian trixie 
- Adds request logging in debug mode for some endpoints
- Moves certbot version determination to the startup scripts and removes
  bash script encapsulation when installing plugins
- Revert loose domain validation, which was there for a specific reason
  addressing CVE's
- Fix Cypress suite for cert generation
- Adds Cypress test that iterates over the entire certbot plugins list
  and installs each one, ensuring at the very least that the install
  works
- Fixed some plugins based on this
- (!) Still some work to do on this, hostinger is still broken at least
- Improved cypress tests for custom certs; they will generate on each
  run instead of being baked in. The baked ones were due to expire soon
 2026-05-25 07:37:24 +10:00
Jamie Curnow 18b3404f46 Update all packages and fix related problems 2026-05-13 13:27:59 +10:00
Jamie Curnow 15896132ff Update all deps 2026-03-05 06:37:10 +10:00
dependabot[bot] a714b41fd6 Bump the prod-minor-updates group in /backend with 3 updates 
Bumps the prod-minor-updates group in /backend with 3 updates: [@apidevtools/json-schema-ref-parser](https://github.com/APIDevTools/json-schema-ref-parser), [mysql2](https://github.com/sidorares/node-mysql2) and [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg).


Updates `@apidevtools/json-schema-ref-parser` from 15.2.2 to 15.3.1
- [Release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases)
- [Commits](https://github.com/APIDevTools/json-schema-ref-parser/compare/v15.2.2...v15.3.1)

Updates `mysql2` from 3.17.5 to 3.18.2
- [Release notes](https://github.com/sidorares/node-mysql2/releases)
- [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md)
- [Commits](https://github.com/sidorares/node-mysql2/compare/v3.17.5...v3.18.2)

Updates `pg` from 8.18.0 to 8.19.0
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.19.0/packages/pg)

---
updated-dependencies:
- dependency-name: "@apidevtools/json-schema-ref-parser"
  dependency-version: 15.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
- dependency-name: mysql2
  dependency-version: 3.18.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
- dependency-name: pg
  dependency-version: 8.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-02 13:45:00 +00:00
jc21 020b3ebb33 Merge pull request #5338 from NginxProxyManager/dependabot/npm_and_yarn/backend/dev-patch-updates-d8f01b0b39 
Bump nodemon from 3.1.13 to 3.1.14 in /backend in the dev-patch-updates group
 2026-02-25 08:30:51 +10:00
jc21 672b5d6dd9 Merge pull request #5341 from NginxProxyManager/dependabot/npm_and_yarn/backend/prod-patch-updates-07cfa309fd 
Bump mysql2 from 3.17.3 to 3.17.5 in /backend in the prod-patch-updates group
 2026-02-25 08:30:00 +10:00
Jamie Curnow da5955412d Command to regenerate nginx configs 2026-02-25 08:13:38 +10:00
dependabot[bot] 71d59516e8 Bump mysql2 in /backend in the prod-patch-updates group 
Bumps the prod-patch-updates group in /backend with 1 update: [mysql2](https://github.com/sidorares/node-mysql2).


Updates `mysql2` from 3.17.3 to 3.17.5
- [Release notes](https://github.com/sidorares/node-mysql2/releases)
- [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md)
- [Commits](https://github.com/sidorares/node-mysql2/compare/v3.17.3...v3.17.5)

---
updated-dependencies:
- dependency-name: mysql2
  dependency-version: 3.17.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-patch-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-02-23 13:50:35 +00:00
dependabot[bot] 06e220e184 Bump nodemon in /backend in the dev-patch-updates group 
Bumps the dev-patch-updates group in /backend with 1 update: [nodemon](https://github.com/remy/nodemon).


Updates `nodemon` from 3.1.13 to 3.1.14
- [Release notes](https://github.com/remy/nodemon/releases)
- [Commits](https://github.com/remy/nodemon/compare/v3.1.13...v3.1.14)

---
updated-dependencies:
- dependency-name: nodemon
  dependency-version: 3.1.14
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-patch-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-02-23 13:50:13 +00:00
Jamie Curnow e8224ff0af Update all dependencies 2026-02-20 11:02:56 +10:00
dependabot[bot] 5601dd14fc Bump the prod-minor-updates group in /backend with 3 updates 
Bumps the prod-minor-updates group in /backend with 3 updates: [ajv](https://github.com/ajv-validator/ajv), [mysql2](https://github.com/sidorares/node-mysql2) and [otplib](https://github.com/yeojz/otplib/tree/HEAD/packages/otplib).


Updates `ajv` from 8.17.1 to 8.18.0
- [Release notes](https://github.com/ajv-validator/ajv/releases)
- [Commits](https://github.com/ajv-validator/ajv/compare/v8.17.1...v8.18.0)

Updates `mysql2` from 3.16.3 to 3.17.1
- [Release notes](https://github.com/sidorares/node-mysql2/releases)
- [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md)
- [Commits](https://github.com/sidorares/node-mysql2/compare/v3.16.3...v3.17.1)

Updates `otplib` from 13.2.1 to 13.3.0
- [Release notes](https://github.com/yeojz/otplib/releases)
- [Changelog](https://github.com/yeojz/otplib/blob/main/release.config.json)
- [Commits](https://github.com/yeojz/otplib/commits/v13.3.0/packages/otplib)

---
updated-dependencies:
- dependency-name: ajv
  dependency-version: 8.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
- dependency-name: mysql2
  dependency-version: 3.17.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
- dependency-name: otplib
  dependency-version: 13.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-02-16 14:01:58 +00:00
Jamie Curnow 77662b4e7f Use better-sqlite3 package for sqlite databases 2026-02-05 13:11:57 +10:00
jc21 4833dcbf3a Merge pull request #5237 from NginxProxyManager/dependabot/npm_and_yarn/backend/dev-patch-updates-2bda1081ab 
Bump @biomejs/biome from 2.3.12 to 2.3.13 in /backend in the dev-patch-updates group
 2026-02-05 07:58:38 +10:00
dependabot[bot] 3c54413752 Bump mysql2 in /backend in the prod-patch-updates group 
Bumps the prod-patch-updates group in /backend with 1 update: [mysql2](https://github.com/sidorares/node-mysql2).


Updates `mysql2` from 3.16.2 to 3.16.3
- [Release notes](https://github.com/sidorares/node-mysql2/releases)
- [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md)
- [Commits](https://github.com/sidorares/node-mysql2/compare/v3.16.2...v3.16.3)

---
updated-dependencies:
- dependency-name: mysql2
  dependency-version: 3.16.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-patch-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-02-04 00:15:00 +00:00
dependabot[bot] 2bcf5e91ce Bump @biomejs/biome in /backend in the dev-patch-updates group 
Bumps the dev-patch-updates group in /backend with 1 update: [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome).


Updates `@biomejs/biome` from 2.3.12 to 2.3.13
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.3.13/packages/@biomejs/biome)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.3.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-patch-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-02-03 21:51:39 +00:00
dependabot[bot] bb4b5fb3aa Bump otplib from 12.0.1 to 13.2.1 in /backend 
Bumps [otplib](https://github.com/yeojz/otplib/tree/HEAD/packages/otplib) from 12.0.1 to 13.2.1.
- [Release notes](https://github.com/yeojz/otplib/releases)
- [Commits](https://github.com/yeojz/otplib/commits/v13.2.1/packages/otplib)

---
updated-dependencies:
- dependency-name: otplib
  dependency-version: 13.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-02-03 21:22:20 +00:00
dependabot[bot] 60404b6f7e Bump pg in /backend in the prod-minor-updates group 
Bumps the prod-minor-updates group in /backend with 1 update: [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg).


Updates `pg` from 8.17.2 to 8.18.0
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.18.0/packages/pg)

---
updated-dependencies:
- dependency-name: pg
  dependency-version: 8.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-02-03 13:04:13 +00:00
jc21 f09876d31b Merge pull request #5252 from NginxProxyManager/dependabot/npm_and_yarn/backend/apidevtools/json-schema-ref-parser-14.1.1 
Bump @apidevtools/json-schema-ref-parser from 11.9.3 to 14.1.1 in /backend
 2026-02-03 17:06:56 +10:00
dependabot[bot] 8532e7520f Bump body-parser from 1.20.4 to 2.2.2 in /backend 
Bumps [body-parser](https://github.com/expressjs/body-parser) from 1.20.4 to 2.2.2.
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](https://github.com/expressjs/body-parser/compare/1.20.4...v2.2.2)

---
updated-dependencies:
- dependency-name: body-parser
  dependency-version: 2.2.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-01-30 13:04:20 +00:00
dependabot[bot] 58d47cd69a Bump @apidevtools/json-schema-ref-parser in /backend 
Bumps [@apidevtools/json-schema-ref-parser](https://github.com/APIDevTools/json-schema-ref-parser) from 11.9.3 to 14.1.1.
- [Release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases)
- [Commits](https://github.com/APIDevTools/json-schema-ref-parser/compare/v11.9.3...v14.1.1)

---
updated-dependencies:
- dependency-name: "@apidevtools/json-schema-ref-parser"
  dependency-version: 14.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-01-30 13:04:04 +00:00
dependabot[bot] 00b58f73f8 Bump archiver from 5.3.2 to 7.0.1 in /backend 
Bumps [archiver](https://github.com/archiverjs/node-archiver) from 5.3.2 to 7.0.1.
- [Release notes](https://github.com/archiverjs/node-archiver/releases)
- [Changelog](https://github.com/archiverjs/node-archiver/blob/master/CHANGELOG.md)
- [Commits](https://github.com/archiverjs/node-archiver/compare/5.3.2...7.0.1)

---
updated-dependencies:
- dependency-name: archiver
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-01-30 01:35:10 +00:00
dependabot[bot] a99cde9cd8 Bump bcrypt from 5.1.1 to 6.0.0 in /backend 
Bumps [bcrypt](https://github.com/kelektiv/node.bcrypt.js) from 5.1.1 to 6.0.0.
- [Release notes](https://github.com/kelektiv/node.bcrypt.js/releases)
- [Changelog](https://github.com/kelektiv/node.bcrypt.js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/kelektiv/node.bcrypt.js/compare/v5.1.1...v6.0.0)

---
updated-dependencies:
- dependency-name: bcrypt
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-01-29 23:33:36 +00:00
dependabot[bot] 3ed3ec0001 Bump express from 4.22.0 to 5.2.1 in /backend 
Bumps [express](https://github.com/expressjs/express) from 4.22.0 to 5.2.1.
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](https://github.com/expressjs/express/compare/4.22.0...v5.2.1)

---
updated-dependencies:
- dependency-name: express
  dependency-version: 5.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-01-28 13:04:19 +00:00
dependabot[bot] df81c8425f Bump @apidevtools/swagger-parser from 10.1.1 to 12.1.0 in /backend 
Bumps [@apidevtools/swagger-parser](https://github.com/APIDevTools/swagger-parser) from 10.1.1 to 12.1.0.
- [Release notes](https://github.com/APIDevTools/swagger-parser/releases)
- [Changelog](https://github.com/APIDevTools/swagger-parser/blob/main/CHANGELOG.md)
- [Commits](https://github.com/APIDevTools/swagger-parser/compare/v10.1.1...v12.1.0)

---
updated-dependencies:
- dependency-name: "@apidevtools/swagger-parser"
  dependency-version: 12.1.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-01-28 02:56:17 +00:00
jc21 c1ef3a3795 Merge pull request #5238 from NginxProxyManager/dependabot/npm_and_yarn/backend/chalk-5.6.2 
Bump chalk from 4.1.2 to 5.6.2 in /backend
 2026-01-28 07:45:10 +10:00
dependabot[bot] c50f0a144e Bump the prod-minor-updates group in /backend with 4 updates 
Bumps the prod-minor-updates group in /backend with 4 updates: [liquidjs](https://github.com/harttle/liquidjs), [mysql2](https://github.com/sidorares/node-mysql2), [objection](https://github.com/vincit/objection.js) and [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg).


Updates `liquidjs` from 10.6.1 to 10.24.0
- [Release notes](https://github.com/harttle/liquidjs/releases)
- [Changelog](https://github.com/harttle/liquidjs/blob/master/CHANGELOG.md)
- [Commits](https://github.com/harttle/liquidjs/compare/v10.6.1...v10.24.0)

Updates `mysql2` from 3.15.3 to 3.16.1
- [Release notes](https://github.com/sidorares/node-mysql2/releases)
- [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md)
- [Commits](https://github.com/sidorares/node-mysql2/compare/v3.15.3...v3.16.1)

Updates `objection` from 3.0.1 to 3.1.5
- [Commits](https://github.com/vincit/objection.js/compare/3.0.1...3.1.5)

Updates `pg` from 8.16.3 to 8.17.2
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.17.2/packages/pg)

---
updated-dependencies:
- dependency-name: liquidjs
  dependency-version: 10.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
- dependency-name: mysql2
  dependency-version: 3.16.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
- dependency-name: objection
  dependency-version: 3.1.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
- dependency-name: pg
  dependency-version: 8.17.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-01-27 13:02:36 +00:00
dependabot[bot] 2a9c1df3cb Bump chalk from 4.1.2 to 5.6.2 in /backend 
Bumps [chalk](https://github.com/chalk/chalk) from 4.1.2 to 5.6.2.
- [Release notes](https://github.com/chalk/chalk/releases)
- [Commits](https://github.com/chalk/chalk/compare/v4.1.2...v5.6.2)

---
updated-dependencies:
- dependency-name: chalk
  dependency-version: 5.6.2
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-01-27 13:02:11 +00:00
dependabot[bot] 124737bbc6 Bump knex from 2.4.2 to 3.1.0 in /backend 
Bumps [knex](https://github.com/knex/knex) from 2.4.2 to 3.1.0.
- [Release notes](https://github.com/knex/knex/releases)
- [Changelog](https://github.com/knex/knex/blob/master/CHANGELOG.md)
- [Commits](https://github.com/knex/knex/compare/2.4.2...3.1.0)

---
updated-dependencies:
- dependency-name: knex
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-01-26 21:19:32 +00:00
jc21 b96e932c64 Merge pull request #5218 from NginxProxyManager/dependabot/npm_and_yarn/backend/dev-patch-updates-166e475698 
Bump @biomejs/biome from 2.3.2 to 2.3.12 in /backend in the dev-patch-updates group
 2026-01-27 07:18:25 +10:00
jc21 d09cb2884c Merge pull request #5225 from NginxProxyManager/dependabot/npm_and_yarn/backend/nodemon-3.1.11 
Bump nodemon from 2.0.22 to 3.1.11 in /backend
 2026-01-27 07:18:11 +10:00
dependabot[bot] 5f19f7125e Bump nodemon from 2.0.22 to 3.1.11 in /backend 
Bumps [nodemon](https://github.com/remy/nodemon) from 2.0.22 to 3.1.11.
- [Release notes](https://github.com/remy/nodemon/releases)
- [Commits](https://github.com/remy/nodemon/compare/v2.0.22...v3.1.11)

---
updated-dependencies:
- dependency-name: nodemon
  dependency-version: 3.1.11
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-01-25 12:31:28 +00:00
dependabot[bot] 8d35644190 Bump jsonwebtoken in /backend in the prod-patch-updates group 
Bumps the prod-patch-updates group in /backend with 1 update: [jsonwebtoken](https://github.com/auth0/node-jsonwebtoken).


Updates `jsonwebtoken` from 9.0.2 to 9.0.3
- [Changelog](https://github.com/auth0/node-jsonwebtoken/blob/master/CHANGELOG.md)
- [Commits](https://github.com/auth0/node-jsonwebtoken/compare/v9.0.2...v9.0.3)

---
updated-dependencies:
- dependency-name: jsonwebtoken
  dependency-version: 9.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-patch-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-01-25 12:30:49 +00:00
dependabot[bot] ad2e4c8afe Bump @biomejs/biome in /backend in the dev-patch-updates group 
Bumps the dev-patch-updates group in /backend with 1 update: [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome).


Updates `@biomejs/biome` from 2.3.2 to 2.3.12
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.3.12/packages/@biomejs/biome)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.3.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-patch-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-01-25 12:30:27 +00:00
dependabot[bot] 2deb5447d6 Bump lodash from 4.17.21 to 4.17.23 in /backend 
Bumps [lodash](https://github.com/lodash/lodash) from 4.17.21 to 4.17.23.
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](https://github.com/lodash/lodash/compare/4.17.21...4.17.23)

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.17.23
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-01-21 23:43:45 +00:00
dependabot[bot] 4ce5da5930 Bump express from 4.21.2 to 4.22.0 in /backend 
Bumps [express](https://github.com/expressjs/express) from 4.21.2 to 4.22.0.
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/4.22.0/History.md)
- [Commits](https://github.com/expressjs/express/compare/4.21.2...4.22.0)

---
updated-dependencies:
- dependency-name: express
  dependency-version: 4.22.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-01-13 13:26:06 +00:00
piotrfx 427afa55b4 Add TOTP-based two-factor authentication 
- Add 2FA setup, enable, disable, and backup code management
- Integrate 2FA challenge flow into login process
- Add frontend modal for 2FA configuration
- Support backup codes for account recovery
 2025-12-28 11:58:30 +01:00
Jamie Curnow 4cb85f6480 Fix #4833 supports the usual proxy env vars for outgoing admin related requests 2025-11-05 15:16:42 +10:00
Jamie Curnow 74a8c5d806 Fix app crash when do unautorized things 2025-10-30 15:03:01 +10:00
Jamie Curnow e4e5fb3b58 Update biome 2025-10-27 19:29:14 +10:00