NPMplus

What Changed since the last release

• Note: using the openappsec attachment module may break nginx config tests, reloads and cert renewals
• feat: Support for Multiple Access Control Lists and Location Specific Access Control Lists by @shopsD in #3101
• nginx: set http3_stream_buffer_size to 1m to improve http3 speed on non perfect connections
• nginx: disable SHA1 and RSA_PKCS1 sigalgs, RSA-PKCS1 can be reenabled using NGINX_TRUST_RSA_PKCS1
• nginx: prefer chacha20 and aes256 over aes128 for tls1.3 by patching aws-lc
• nginx: fix grpc
• nginx: hide more "useless" upstream headers
• nginx: enable mldsa87:mldsa65:mldsa44 sigalgs, I think no browser supports them
• nginx: update openappsec attachment and crowdsec
• nginx: update nginx to fix recent CVEs, see: #3285
• nginx: fix nginx quic gso (#3408) by patching nginx
• nginx: fix $server_port being broken in streams #3149
• nginx: fix loadbalancing, by checking if a hostname is a user provided upstream block based on a prefix #3093
• update aws-lc to v5, NPMplus will follow theier rolling mainline releases, like with nginx
• update alpine to v3.24
• startup: reduce time for 'chown' process when PUID/PGID != 0 by @invario in #3144
• startup: fix disabling ech without container recreation and too early nginx reload
• startup: fix blocked startup if acme server is down
• startup: disable openappsec attachment during host regeneration
• startup: improve user/group generation for PUID/PGID
• startup: only reload once after regenerating all config files
• UI: diffrent CSPs for NPMplus-UI and swaggerUI
• UI: add Permission Policy
• UI: improve sorting of online/offline/disabled column
• UI: fix button switching in custom location when clicking on the label
• UI: fix OIDC with authelia
• UI: add Button to disable nginx url sanitisation, default false, but true for existing hosts and custom locations
• UI: add Button to spoof host header
• UI: allow overwriting the upstream URL for an auth request provider in the UI per host
• UI: reset button values if they get disabled when the scheme changed, but exclude the "empty" scheme
• UI/nginx: keep uri sanitisation for npmplus itself and goaccess
• UI: allow multiple hosts to share the same domain name if only one of them is enabled #3362
• Build: pin git clone steps against commit shas instead of tags and branches
• Build: verify downloaded patches against a shasum
• Build: harden CFLAGS even more
• Build: remove unused lua rocks (session and openidc)
• merge upstream (mainly lang updates)
• dep and doc updates

What's Changed since the last beta

• dep updates
• access-list password hashes are now mask for custom locations

Image tags:

• docker.io/zoeyvid/npmplus:2026-06-22-r1 (fixed to this release)
• ghcr.io/zoeyvid/npmplus:2026-06-22-r1 (fixed to this release)
• docker.io/zoeyvid/npmplus:latest (latest stable)
• ghcr.io/zoeyvid/npmplus:latest (latest stable)
• docker.io/zoeyvid/npmplus:beta (latest beta/stable)
• ghcr.io/zoeyvid/npmplus:beta (latest beta/stable)

New Contributors

• @shopsD made their first contribution in https://github.com/ZoeyVid/NPMplus/pull/3101
• @invario made their first contribution in https://github.com/ZoeyVid/NPMplus/pull/3144

Full Changelog: https://github.com/ZoeyVid/NPMplus/compare/2026-04-21-r2...2026-06-22-r1