Volver al registro de cambios
Backend del panel

v1.0.586

Corrección de seguridad Versión de seguridad Publicada el 6 de noviembre de 2026

One TLS policy for every site: connections without forward secrecy are no longer accepted, main domains staple OCSP, and HSTS finally applies to Node and Python sites.

Mejoras

2
  • TLS: main domains now staple the certificate revocation answer, as subdomains always have — one round trip less for the visitor, and the certificate authority no longer sees who visits your site.
  • Disk: updating the panel interface no longer leaves every older copy behind. A release is removed only once it is older than every version the panel can still roll back to, so the installed version and all three rollback points keep their files; nothing from the last week is touched either. Measured on a test server: 523 MB on disk where 106 MB is in use.

Correcciones de errores

3
  • HSTS: turning HSTS on for a domain had no effect on a Node or Python application site, because that renderer wrote no header at all. It now follows the domain setting and its max-age.
  • Existing sites receive the TLS change: the vhost template is refreshed on the first start and the vhost files still carrying the old policy are re-rendered once — nginx validates everything once and reloads once, and if it refuses, every file is restored and nothing is reloaded.
  • Webhooks: ssl.revoked is no longer offered — nothing in the panel revokes a certificate, so subscribing to it only produced silence. Existing subscriptions keep working and remain editable.

Correcciones de seguridad

2
  • TLS: every generator now serves one cipher policy, the forward-secret list subdomains and webmail have always used. Measured on a live site: a connection with no forward secrecy (AES256-SHA) was accepted before this release and is refused after it. Ordinary browsers negotiate exactly what they did before.
  • Updates: a package is no longer installed unless its SHA-256 is known. The endpoint used to accept whatever checksum the caller supplied, including none; it now resolves the published one itself and refuses the update if it cannot.

Lanzamientos recientes

Todos los lanzamientos
Ver la demostración