2026-05-21-b1

What's Changed since last release

• Support for Multiple Access Control Lists and Location Specific Access Control Lists by @shopsD in #3101
• set http3_stream_buffer_size to 1m to improve http3 speed on non perfect connections
• nginx: disable SHA1 and RSA_PKCS1 sigalgs, RSA-PKCS1 cna be reenabled using NGINX_TRUST_RSA_PKCS1
• nginx: hide more "useless" upstream headers
• nginx: update openappsec attachment and crowdsec
• nginx: update nginx to fix recent CVEs, see: #3285
• startup: fix disabling ech without container recreation and too early nginx reload
• startup: fix blocked startup if acme server is down
• startup: disable oepnappsec attachment during host regeneration
• UI: diffrent CSPs for NPMplus-UI and swaggerUI
• UI: add Permission Policy
• UI: improve sorting of online/offline/disabled column
• UI: fix button switching in custom location when clicking on the label
• Build: pin git clone steps against commit shas instead of tags and branches
• Build: verify downloaded patches against a shasum
• merge upstream (mainly lang updates)
• dep and doc updates

Image tags:

• docker.io/zoeyvid/npmplus:2026-05-21-b1 (fixed to this release)
• ghcr.io/zoeyvid/npmplus:2026-05-21-b1 (fixed to this release)
• docker.io/zoeyvid/npmplus:beta (latest beta/stable)
• ghcr.io/zoeyvid/npmplus:beta (latest beta/stable)

New Contributors

• @shopsD made their first contribution in #3101

Full Changelog: 2026-04-21-r2...2026-05-21-b1