## bunkerity/bunkerweb — v1.6.12…v1.6.13-rc1

_41 commits._

### Features
- **feat(db): add migration scripts for version 1.6.13~rc1 across all databases** (e119301)
- **[#3700] feat(letsencrypt): add Porkbun as a DNS challenge provider** (ab2b6cb)
- **[#3704] feat(antibot): add ANTIBOT_SUCCESS_URI for fixed post-challenge redirect** (9cdf2d5)

### Fixes
- **fix(headers): honor KEEP_UPSTREAM_HEADERS for CSP report-only header** (998d39d)
- **fix(deps): patch c-ares CVE-2026-33630 across build images** (1475fc6)
- **fix(deps): correct arm64 checksum for Go binary** (d021d6e)
- **fix(deps): update Go version to 1.26.5 and update checksums** (9c92995)
- **fix(api): flag admin-equivalent ACL write scopes** (6ee7037)
- **fix(ui): restrict plugin management to administrators** (eb35483)
- **fix(security): validate ACME challenge token to block path traversal** (bd405c2)
- **fix(security): forward-confirm rDNS (FCrDNS) in blacklist/greylist/antibot** (1a97e5b)

### Backend
- **Merge pull request #3711 from bunkerity/dev** (407e34c)
- **Road to 1.6.13~rc1 🚀** (9881475)
- **Merge branch 'dev' of https://github.com/bunkerity/bunkerweb into dev** (ac2c339)
- **Merge pull request #3699 from bunkerity/dependabot/github_actions/dev/docker/metadata-action-6.2.0** (55ea87f)
- **Merge pull request #3698 from bunkerity/dependabot/github_actions/dev/github/codeql-action/analyze-4.36.3** (ebcf726)
- **Merge pull request #3697 from bunkerity/dependabot/github_actions/dev/ruby/setup-ruby-1.316.0** (f912f50)
- **Merge pull request #3696 from bunkerity/dependabot/github_actions/dev/github/codeql-action/init-4.36.3** (04e2abc)
- **Merge pull request #3690 from bunkerity/dependabot/github_actions/dev/docker/build-push-action-7.3.0** (ae8c260)
- **Merge pull request #3706 from bunkerity/dependabot/terraform/tests/terraform/dev/scaleway/scaleway-2.78.0** (bfb9753)
- **Merge pull request #3687 from bunkerity/dependabot/terraform/tests/terraform/dev/hashicorp/kubernetes-3.2.1** (a23f8a4)
- **Update python deps** (9c7775d)
- **deps/terraform: bump scaleway/scaleway in /tests/terraform** (ed37b9d)
- **Monthly mmdb update** (97a1ded)
- **deps/gha: bump docker/metadata-action from 6.1.0 to 6.2.0** (180a43c)
- **deps/gha: bump github/codeql-action/analyze from 4.36.2 to 4.36.3** (c86ea4c)
- **deps/gha: bump ruby/setup-ruby from 1.314.0 to 1.316.0** (d02d19b)
- **deps/gha: bump github/codeql-action/init from 4.36.2 to 4.36.3** (121e2d0)
- **deps/gha: bump docker/build-push-action from 7.2.0 to 7.3.0** (1d92a3b)
- **deps/terraform: bump hashicorp/kubernetes in /tests/terraform** (a55e422)
- **Merge pull request #3657 from bunkerity/dev** (344ca87)
- **Merge pull request #3656 from bunkerity/dev** (7c417fa)
- **Merge pull request #3645 from bunkerity/dev** (13a3677)
- **Merge pull request #3644 from bunkerity/dev** (202313b)
- **Merge pull request #3617 from bunkerity/dev** (4f5274f)
- **Merge pull request #3616 from bunkerity/dev** (92ee594)
- **Merge pull request #3615 from bunkerity/dev** (10dab58)
- **Merge pull request #3588 from bunkerity/staging** (80fb6d5)

### Docs
- **docs(changelog): credit @kule500 for FCrDNS bypass report** (fb23e15)

### Chore
- **chore(deps): bump Python dependencies across services** (f0d5589)
- **ci: extend Trivy ignore policy to Go modules** (9bbb28f)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/bunkerity/bunkerweb?utm_source=github-action)._