2026-05-22-b1

[Zoey2936]

What's Changed since last beta

• update nginx to fix a new CVE, I've added it to Yesterdays nginx CVEs #3285, nearly all NPMplus installation should NOT be effected

What else Changed since last release

• feat: Support for Multiple Access Control Lists and Location Specific Access Control Lists by @shopsD in [feature] Support for Multiple Access Control Lists and Location Specific Access Control Lists #3101
• nginx: set http3_stream_buffer_size to 1m to improve http3 speed on non perfect connections
• nginx: disable SHA1 and RSA_PKCS1 sigalgs, RSA-PKCS1 cna be reenabled using NGINX_TRUST_RSA_PKCS1
• nginx: hide more "useless" upstream headers
• nginx: update openappsec attachment and crowdsec
• nginx: update nginx to fix recent CVEs, see: Yesterdays nginx CVEs #3285
• startup: reduce time for 'chown' process when PUID/PGID != 0 by @invario in (feat) reduce time for 'chown' process when PUID/PGID != 0 #3144
• startup: fix disabling ech without container recreation and too early nginx reload
• startup: fix blocked startup if acme server is down
• startup: disable oepnappsec attachment during host regeneration
• UI: diffrent CSPs for NPMplus-UI and swaggerUI
• UI: add Permission Policy
• UI: improve sorting of online/offline/disabled column
• UI: fix button switching in custom location when clicking on the label
• Build: pin git clone steps against commit shas instead of tags and branches
• Build: verify downloaded patches against a shasum
• merge upstream (mainly lang updates)
• dep and doc updates

Image tags:

• docker.io/zoeyvid/npmplus:2026-05-22-b1 (fixed to this release)
• ghcr.io/zoeyvid/npmplus:2026-05-22-b1 (fixed to this release)
• docker.io/zoeyvid/npmplus:beta (latest beta/stable)
• ghcr.io/zoeyvid/npmplus:beta (latest beta/stable)

What's Changed

New Contributors

• @shopsD made their first contribution in [feature] Support for Multiple Access Control Lists and Location Specific Access Control Lists #3101
• @invario made their first contribution in (feat) reduce time for 'chown' process when PUID/PGID != 0 #3144

Full Changelog: 2026-05-21-b3...2026-05-22-b1

---

This discussion was created from the release 2026-05-22-b1.