2026-04-21-r2
Breaking risk
⚠ Upgrade required
- CERTBOT_RUN_INTERVAL now limited to 500 hours maximum
- If experiencing issues with Apple clients, try disabling http2 in upstreams
Breaking changes
- AUTH_REQUEST_TINYAUTH_DOMAIN env var removed
- tinyauth v5.0.7+ now required (minimum version bump)
- Cookie names changed due to stricter cookie handling
Security fixes
- CSP fix for notifications
Notable features
- Support for voidauth
- Backend can now send all Upgrade headers
- Origin-Agent-Cluster: ?1 header always sent
Full changelog
What's Changed since last release
- fix CSP (fix notifications)
- dep updates
What Changed in the last releases
- support voidauth
- remove AUTH_REQUEST_TINYAUTH_DOMAIN env, tinyauth v5.0.7+ is now required
- allow the backend to send all Upgrade headers again, if you have issues with apple clients try to instead disable http2 in your upstreams
- cookies are more strict now, the cookie name has changed because of this
- always send "Origin-Agent-Cluster: ?1" header
- hsts buttons are now better labeled
- CERTBOT_RUN_INTERVAL is now limited to 500 hours
- inbuilt php has been fixed
- the error log written to disk now uses error level info
- rename the advanced tab from a cogwheel symbol to advanced
- show a star if a custom config is set for locations
- dep and doc updates
Image tags:
docker.io/zoeyvid/npmplus:2026-04-21-r2(fixed to this release)ghcr.io/zoeyvid/npmplus:2026-04-21-r2(fixed to this release)docker.io/zoeyvid/npmplus:latest(latest stable)ghcr.io/zoeyvid/npmplus:latest(latest stable)docker.io/zoeyvid/npmplus:beta(latest beta/stable)ghcr.io/zoeyvid/npmplus:beta(latest beta/stable)
Full Changelog: https://github.com/ZoeyVid/NPMplus/compare/2026-04-21-r1...2026-04-21-r2
