Latest release
Updated PHP images and runtime safeguards.
- PHP and WordPress container images move to PHP 8.3.36 for the php2shell fixes (CVE-2026-109618 and CVE-2026-109619). Update host PHP separately and rebuild container images when upgrading.
- PHP 8.2+ is the supported floor. The dashboard flags vulnerable and end-of-life installs, and the installer refuses older branches.
- Go 1.26.10 addresses certificate distrust in crypto/x509; dashboard and upstream docs dependencies receive Vite advisory fixes.
- Dashboard PHP installation passes the selected PHP version correctly. This release supersedes the unpublished v0.11.30 tag.
Security & reliability
Steadier under load. More precise caching.
- Go 1.26.9 and golang.org/x/net v0.60.0 address HTTP/2 vulnerabilities; proxy mirrors drop client-supplied forwarding headers.
- A bounded logging queue prevents backed-up log output from stalling requests; dropped lines are counted and reported.
- Canonical-host redirects respect domain rate limits, and global rate-limit rejections feed auto-block.
- Client no-cache headers no longer bypass the response cache. Origin freshness caps TTL, domain purges cover aliases and www, and cache_control rules reach proxy clients.
- Backup restore rechecks path containment, WordPress config rewriting avoids duplicate definitions, and database explorer limits handle SQL comments and identifiers.
Reliability & protection
More dependable, down to the details.
- Image conversions are published atomically so concurrent requests cannot read partially written files.
- Domain backups fail when a database dump fails, instead of appearing complete.
- WAF file_probe protection ships for scanner requests to backup and secret filenames.
- Alert titles explain operational events, including HTTP 5xx spikes.
Reliability & security
Routing and operator safeguards.
- Weighted round-robin honors configured backend weights; failed half-open probes re-open circuit breakers.
- The SQL explorer rejects EXPLAIN ANALYZE and Docker arguments reject short-flag bypasses.
- DNS record identifiers are escaped and nested zones use the longest matching name.
- WebSocket forwarding derives protocol and host from the actual connection.
Maintenance
A fresh release, with dependency fixes.
- Publishes the v0.11.24 changes with updated dashboard dependencies.
- File Manager pagination reaches every entry in a directory; new uploads and saves use mode 0600.
- Cache key components are length-prefixed to avoid collisions.