2026-04-21-r2

[Zoey2936]

What's Changed since last release

• fix CSP (fix notifications)
• dep updates

What Changed in the last releases

• support voidauth
• remove AUTH_REQUEST_TINYAUTH_DOMAIN env, tinyauth v5.0.7+ is now required
• allow the backend to send all Upgrade headers again, if you have issues with apple clients try to instead disable http2 in your upstreams
• cookies are more strict now, the cookie name has changed because of this
• always send "Origin-Agent-Cluster: ?1" header
• hsts buttons are now better labeled
• CERTBOT_RUN_INTERVAL is now limited to 500 hours
• inbuilt php has been fixed
• the error log written to disk now uses error level info
• rename the advanced tab from a cogwheel symbol to advanced
• show a star if a custom config is set for locations
• dep and doc updates

Image tags:

• docker.io/zoeyvid/npmplus:2026-04-21-r2 (fixed to this release)
• ghcr.io/zoeyvid/npmplus:2026-04-21-r2 (fixed to this release)
• docker.io/zoeyvid/npmplus:latest (latest stable)
• ghcr.io/zoeyvid/npmplus:latest (latest stable)
• docker.io/zoeyvid/npmplus:beta (latest beta/stable)
• ghcr.io/zoeyvid/npmplus:beta (latest beta/stable)

Full Changelog: 2026-04-21-r1...2026-04-21-r2

---

This discussion was created from the release 2026-04-21-r2.

[Matthias-vdE]

This release seems to have broken my instance when coming from 2026-04-10-r2, which worked fine.

The web interface is unreachable. Some hosts are down, but not all. Redirects are not working properly.

The container is showing as "unhealthy" and the log is being flooded with these messages

2026-04-21T20:27:39.130017443+02:00 |2026-04-21T20:27:39.358: ngx_http_cp_request_and_response_size_handler@ngx_cp_hooks.c:522 [uid  | pid 686] | Updateing metrics with request size 45 and response size 505

2026-04-21T20:27:39.169167574+02:00 |2026-04-21T20:27:39.398: ngx_http_cp_request_and_response_size_handler@ngx_cp_hooks.c:522 [uid  | pid 686] | Updateing metrics with request size 45 and response size 505

2026-04-21T20:27:39.211984562+02:00 |2026-04-21T20:27:39.438: ngx_http_cp_request_and_response_size_handler@ngx_cp_hooks.c:522 [uid  | pid 686] | Updateing metrics with request size 45 and response size 505

2026-04-21T20:27:39.252205469+02:00 |2026-04-21T20:27:39.478: ngx_http_cp_request_and_response_size_handler@ngx_cp_hooks.c:522 [uid  | pid 686] | Updateing metrics with request size 45 and response size 505

2026-04-21T20:27:39.304439777+02:00 |2026-04-21T20:27:39.530: ngx_http_cp_request_and_response_size_handler@ngx_cp_hooks.c:522 [uid  | pid 686] | Updateing metrics with request size 45 and response size 505

2026-04-21T20:27:39.356545820+02:00 |2026-04-21T20:27:39.582: ngx_http_cp_request_and_response_size_handler@ngx_cp_hooks.c:522 [uid  | pid 686] | Updateing metrics with request size 45 and response size 505

2026-04-21T20:27:39.395411351+02:00 |2026-04-21T20:27:39.622: ngx_http_cp_request_and_response_size_handler@ngx_cp_hooks.c:522 [uid  | pid 686] | Updateing metrics with request size 45 and response size 505

2026-04-21T20:27:39.435400576+02:00 |2026-04-21T20:27:39.662: ngx_http_cp_request_and_response_size_handler@ngx_cp_hooks.c:522 [uid  | pid 686] | Updateing metrics with request size 45 and response size 505

2026-04-21T20:27:39.476642958+02:00 |2026-04-21T20:27:39.702: ngx_http_cp_request_and_response_size_handler@ngx_cp_hooks.c:522 [uid  | pid 686] | Updateing metrics with request size 45 and response size 505

2026-04-21T20:27:39.529318401+02:00 |2026-04-21T20:27:39.758: ngx_http_cp_request_and_response_size_handler@ngx_cp_hooks.c:522 [uid  | pid 686] | Updateing metrics with request size 45 and response size 505

2026-04-21T20:27:39.608377498+02:00 |2026-04-21T20:27:39.834: ngx_http_cp_request_and_response_size_handler@ngx_cp_hooks.c:522 [uid  | pid 686] | Updateing metrics with request size 45 and response size 505

In between there's also this

2026-04-21T20:27:26.123127788+02:00 |2026-04-21T20:27:26.349: ngx_http_cp_request_and_response_size_handler@ngx_cp_hooks.c:522 [uid  | pid 686] | Updateing metrics with request size 45 and response size 505

2026-04-21T20:27:26.227468579+02:00 |2026-04-21T20:27:26.453: ngx_http_cp_req_header_handler_sync@ngx_cp_hooks.c:557 [uid  | pid 686] | Request headers received

2026-04-21T20:27:26.227507591+02:00 |2026-04-21T20:27:26.453: reset_failure_state@ngx_cp_failing_state.c:73 [uid  | pid 686] | Resetting failing interval to default. Interval: 20 seconds

2026-04-21T20:27:26.227511259+02:00 |2026-04-21T20:27:26.453: is_ngx_cp_attachment_disabled@ngx_http_cp_attachment_module.c:282 [uid  | pid 686] | NGINX attachment state: enabled

2026-04-21T20:27:26.227512816+02:00 |2026-04-21T20:27:26.453: init_cp_session_data@ngx_cp_hooks.c:69 [uid  | pid 686] | Initializing new session data ctx for session ID 1

2026-04-21T20:27:26.227514257+02:00 |2026-04-21T20:27:26.453: ngx_http_cp_req_header_handler_sync@ngx_cp_hooks.c:579 [uid  | pid 686] <session id 3> | Request header filter handling session ID: 3

2026-04-21T20:27:26.227515448+02:00 |2026-04-21T20:27:26.453: enforce_sessions_rate@ngx_cp_hooks.c:396 [uid  | pid 686] <session id 3> | Handling new session. Number of last minute sessions: 0 

2026-04-21T20:27:26.227516616+02:00 |2026-04-21T20:27:26.453: ngx_http_cp_req_header_handler_sync@ngx_cp_hooks.c:597 [uid  | pid 686] <session id 3> | spawn ngx_http_cp_registration_thread

2026-04-21T20:27:26.227517848+02:00 |2026-04-21T20:27:26.453: ngx_cp_run_in_thread_timeout@ngx_cp_thread.c:59 [uid  | pid 686] <session id 3> | Executing cb in dedicated thread, fn=ngx_http_cp_registration_thread

2026-04-21T20:27:26.231383427+02:00 |2026-04-21T20:27:26.453: init_general_config@ngx_cp_utils.c:1132 [uid  | pid 686] <session id 3> | Setting debug level to: 2

2026-04-21T20:27:26.231429681+02:00 |2026-04-21T20:27:26.457: init_general_config@ngx_cp_utils.c:1254 [uid  | pid 686] <session id 3> | Successfully loaded configuration. inspection mode: 0, debug level: 2, failure mode: fail-open, fail mode timeout: 50 msec, failure wait mode: fail-open, fail mode wait timeout: 150 msec, sessions per minute limit verdict: Accpet, max sessions per minute: 0, req max processing time: 3000 msec, res max processing time: 3000 msec, registration thread timeout: 100 msec, req header thread timeout: 100 msec, req body thread timeout: 150 msec, res header thread timeout: 100 msec, res body thread timeout: 150 msec, wait thread timeout: 150 msec, static resources path: /dev/shm/static_resources, num of nginx ipc elements: 200, keep alive interval msec: 150000 msec, min retries for verdict: 3, max retries for verdict: 15, num retries for hold verdict: 3, polling time for hold verdict: 1, body size trigger for request: 200000, decompression pool size: 262144 bytes, recompression pool size: 16384 bytes, async mode: 0

2026-04-21T20:27:26.231433407+02:00 |2026-04-21T20:27:26.457: set_unique_id@ngx_cp_initializer.c:806 [uid 4 | pid 686] <session id 3> | Successfully set attachment's unique_id: '4' (int: 4)

2026-04-21T20:27:26.293118166+02:00 |2026-04-21T20:27:26.521: init_signaling_socket@ngx_cp_initializer.c:447 [uid 4 | pid 686] <session id 3> | Paired affinity disabled, sending target_core=-1 to service

2026-04-21T20:27:26.293770611+02:00 |2026-04-21T20:27:26.521: init_signaling_socket@ngx_cp_initializer.c:476 [uid 4 | pid 686] <session id 3> | Successfully connected on client socket 68

2026-04-21T20:27:26.293901006+02:00 |2026-04-21T20:27:26.521: init_signaling_socket@ngx_cp_initializer.c:505 [uid 4 | pid 686] <session id 3> | Successfully connected on secondary client socket 69

2026-04-21T20:27:26.293907843+02:00 |2026-04-21T20:27:26.521: ngx_cp_attachment_init_process@ngx_cp_initializer.c:881 [uid 4 | pid 686] <session id 3> | Initializing IPC channel

2026-04-21T20:27:26.293909436+02:00 |2026-04-21T20:27:26.521: ngx_cp_attachment_init_process@ngx_cp_initializer.c:905 [uid 4 | pid 686] <session id 3> | Initializing secondary sync IPC channel

2026-04-21T20:27:26.293910707+02:00 |2026-04-21T20:27:26.521: ngx_cp_attachment_init_process@ngx_cp_initializer.c:941 [uid 4 | pid 686] <session id 3> | NGINX attachment (UID='4') successfully registered to nano service after 1 attempts.

2026-04-21T20:27:26.304780937+02:00 |2026-04-21T20:27:26.529: ngx_http_cp_request_and_response_size_handler@ngx_cp_hooks.c:522 [uid  | pid 686] | Updateing metrics with request size 45 and response size 505

2026-04-21T20:27:26.305037016+02:00 2026/04/21 20:27:26 [crit] 1288#1288: *244 connect() to unix:/run/npmplus.sock failed (2: No such file or directory) while connecting to upstream, client: 127.0.0.1, server: _, request: "GET /api HTTP/2.0", upstream: "http://unix:/run/npmplus.sock:/api", host: "127.0.0.1:81"

My compose file is unchanged since many versions and looks like this

services:
  npmplus:
    container_name: npmplus
    image: zoeyvid/npmplus:latest
    restart: always
    network_mode: host
    ipc: service:openappsec-agent # required when you want to use the openappsec attachment module
    volumes:
      - "/opt/npm:/data"
      - "shm-volume:/dev/shm/check-point"
    environment:
      - "TZ=Europe/Brussels" # set timezone, required
      - "ACME_EMAIL=${ACME_EMAIL}"
      - "ACME_MUST_STAPLE=false"
      - "ACME_OCSP_STAPLING=false"
      - "DISABLE_IPV6=true"
      - "TRUST_CLOUDFLARE=false"
      - "NGINX_LOG_NOT_FOUND=true" # Allow logging of 404 errors, default false
      - "LOGROTATE=true" # Enables writing http access logs to /opt/npm/nginx/access.log, stream access logs to /opt/npm/nginx/stream.log and enables daily logrotation, default false
      - "LOGROTATIONS=7" # Set how often the access.log should be rotated until it is deleted, default 3
      - "GOA=true" # Enables goaccess, requires LOGROTATE, default false --- if you download the GeoLite2-Country.mmdb, GeoLite2-City.mmdb AND GeoLite2-ASN.mmdb file from MaxMind and place them in /opt/npm/etc/goaccess/geoip it will automatically enable GeoIP in goaccess after restarting NPMplus (no need to change GOACLA below), you may also use the compose.geoip.yaml
      - "GOACLA=--agent-list --real-os --no-strict-status --double-decode --keep-last=30 --with-output-resolver --no-query-string --unknowns-as-crawlers --real-time-html --exclude-ip 127.0.0.1"
      - "NGINX_LOAD_GEOIP2_MODULE=true"
      - "DISABLE_GRAVATAR=true"
      - "NGINX_LOAD_OPENAPPSEC_ATTACHMENT_MODULE=true" # loads the openappsec attachment module, you also need to set ipc for NPMplus in this composse file, this will fully disable brotli, even if you enable it inside the UI, default false
      - "CERTBOT_RUN_INTERVAL=6"
      - "AUTH_REQUEST_ANUBIS_UPSTREAM=${AUTH_REQUEST_ANUBIS_UPSTREAM}"
      - "AUTH_REQUEST_AUTHENTIK_UPSTREAM=${AUTH_REQUEST_AUTHENTIK_UPSTREAM}"
      #- "AUTH_REQUEST_AUTHENTIK_DOMAIN=${AUTH_REQUEST_AUTHENTIK_DOMAIN}" # Uncommenting this breaks Authentik basic auth. Only use for Domain auth.
    labels:
      - "com.centurylinklabs.watchtower.enable=false"
      
  crowdsec:
    container_name: crowdsec
    image: crowdsecurity/crowdsec:latest
    restart: always
    ports:
      - "127.0.0.1:7422:7422"
      - "127.0.0.1:8080:8080"
      #Prometheus logging
      - "6060:6060"
    environment:
      - "TZ=Europe/Brussels"
      - "USE_WAL=true"
      - "COLLECTIONS=ZoeyVid/npmplus"
      - "LEVEL_FATAL=true"
      - "LEVEL_ERROR=true"
      - "LEVEL_WARN=true"
      - "LEVEL_INFO=true"
      - "LEVEL_DEBUG=false"
      - "LEVEL_TRACE=false"
    volumes:
      - "/opt/crowdsec/conf:/etc/crowdsec"
      - "/opt/crowdsec/data:/var/lib/crowdsec/data"
      - "/opt/npm/nginx:/opt/npm/nginx:ro"
      - "/opt/openappsec/logs:/opt/openappsec/logs:ro" # only uncomment if you also use the openappsec-agent container
    labels:
      - "com.centurylinklabs.watchtower.enable=false"
    networks:
      - npm_net

#This can be used to run openappsec, you also need to set NGINX_LOAD_OPENAPPSEC_ATTACHMENT_MODULE to true and set ipc for NPMplus
  openappsec-agent:
    container_name: openappsec-agent
    image: ghcr.io/openappsec/agent:latest
    restart: always
    ipc: host
    volumes:
      - "shm-volume:/dev/shm/check-point"
      - "/opt/openappsec/conf:/etc/cp/conf"
      - "/opt/openappsec/data:/etc/cp/data"
      - "/opt/openappsec/logs:/var/log/nano_agent"
      - "/opt/openappsec/localconf:/ext/appsec" # if you don't set AGENT_TOKEN, then please put a local_policy.yaml in the /opt/openappsec/localconf folder before deploying
      - "/opt/openappsec/open-appsec-advanced-model.tgz:/advanced-model/open-appsec-advanced-model.tgz:rw" # optional, if you want to use a different model
    environment:
      - "TZ=Europe/Brussels" # needs to be changed
      - "autoPolicyLoad=true"
      - "registered_server=NPMplus"
      - "user_email=${OAS_EMAIL}" # optional, from theier docs: "This allows the open-appsec team to provide you easy assistance in case of any issues you might have with your specific deployment in the future and also to provide you information proactively regarding open-appsec in general or regarding your specific deployment. [...] If we send automatic emails there will also be an opt-out option included for receiving similar communication in the future."
      - "AGENT_TOKEN=${AGENT_TOKEN}" # optional, you can specify an openappsec deployment profile token for connecting to their central webinterface  at https://my.openappsec.io, if you leave this commented, make sure to uncomment all other openappsec containers below, see: https://docs.openappsec.io/getting-started/using-the-web-ui-saas/create-a-profile
    command: /cp-nano-agent
    labels:
      - "com.centurylinklabs.watchtower.enable=false"
    networks:
      - npm_net

# See the readme on how to configure your proxy hosts to use anubis and what needs to be changes in the botPolicy to make it work
  anubis:
    container_name: anubis
    image: ghcr.io/techarohq/anubis:latest
    restart: unless-stopped
    ports:
      - "127.0.0.1:8923:8923"
    environment:
      - "TZ=Europe/Brussels" # needs to be changed
      - "TARGET= " # important to be set to a space
      - "POLICY_FNAME=/etc/botPolicies.yaml" # required so the status codes can be changed
    volumes:
      - "/opt/anubis/botPolicies.yaml:/etc/botPolicies.yaml:ro" # since a file is mounted here, you first need to create it before deploying this container, you can download the default file from here: https://raw.githubusercontent.com/TecharoHQ/anubis/refs/heads/main/data/botPolicies.yaml
    labels:
      - "com.centurylinklabs.watchtower.enable=false"
    networks:
      - npm_net

  geoipupdate:
    container_name: geoipupdate
    image: maxmindinc/geoipupdate:latest
    restart: always
    environment:
      - "TZ=Europe/Brussels"
      - "GEOIPUPDATE_EDITION_IDS=GeoLite2-Country GeoLite2-City GeoLite2-ASN"
      - "GEOIPUPDATE_ACCOUNT_ID=${GEOIPUPDATE_ACCOUNT_ID}"
      - "GEOIPUPDATE_LICENSE_KEY=${GEOIPUPDATE_LICENSE_KEY}"
      - "GEOIPUPDATE_FREQUENCY=24"
    volumes:
      - "/opt/npm/goaccess/geoip:/usr/share/GeoIP"
    labels:
      - "com.centurylinklabs.watchtower.enable=false"
    networks:
      - npm_net

networks:
  npm_net:
    external: true
    name: npm_net

volumes:
  shm-volume:

Reverting back to 2026-04-10-r2 fixes it but I had to manually edit and save each host to make the certificate function properly.

[Zoey2936]

try to disable the oipenappsec attachment module during upgrade and enable it after the upgrade

[Matthias-vdE]

@Zoey2936 That seems to have fixed it. Thanks!

[gadget78]

i am getting

  "error": {
    "code": 400,
    "message": "data/meta must NOT have additional properties, data/meta must NOT have additional properties"
  }

on new(er) version when trying to use the local API
is it to do with cookies are more strict now, the cookie name has changed because of this
as i cannot see where this is explained what has changed...

[gadget78]

as i posted i found it ! always the way ..
e0f103f

so this is another method of logging in ? and not cookie token=... its hard to keep up with all these breaking changes on each version :(
but im not 100% this is where my issue is .. the same calls work on older versions..

[Zoey2936]

the cookie has a new name, it now has a cookie prefix: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#cookie_prefixes