## bunkerity/bunkerweb — v1.6.14-rc2…v1.6.14-rc3

_75 commits._

### Features
- **feat(api): add pushswap digest, applied marker and entry-wise swap** (bb7db4b)
- **feat(crowdsec): support per-service API and AppSec endpoints** (a4a1a48)

### Fixes
- **fix: Retry config save on concurrent write, fail loudly when it is dropped** (938586b)
- **Fix CVE-2026-7210 in Python Alpine packages** (dca5d8b)
- **fix: Fix shared dict and worker LRU handling in datastore** (47e1ec7)
- **fix: Fix reverse proxy regex location modifier handling** (b236eda)
- **fix(db): drop stale Jobs.last_run write in plugin sync** (c126c83)
- **[#3783] fix(letsencrypt): recover from an ACME account the CA refuses** (13521b5)
- **[#3682] fix(modsecurity): stop denying bodyless XML requests with a 400** (6da41df)
- **[#3361] fix(db): stop logging the database password and name the connection target** (c435f14)
- **[#3630] fix(customcert): validate the private key and its pairing with the certificate** (01fe605)
- **fix(limit): expire the local rate-limit cache entry written in Redis mode** (a2ffba1)
- **[#3783] fix(letsencrypt): stop losing certbot output and make the renew timeout fire** (ab8874a)
- **[#3783] fix(letsencrypt): recover renewal confs orphaned by an account purge** (2708d57)
- **[#3475] fix(metrics): stop building metric keys from request data** (bc00c5e)
- **fix(api): survive overlayfs and roll back cleanly on a failed push swap** (9f4546a)
- **fix(api): skip an unchanged push and swap directories atomically** (ebf4c14)
- **fix(api): build a reproducible archive so an unchanged push can be detected** (8939a0b)
- **[#3354] fix(linux): give the nginx user a writable HOME** (7a47e01)
- **[#3345] fix(ui): stop the temp setup UI without a TypeError** (1569c17)
- **fix(metrics): sync the LRU coldest-first so eviction keeps the hot keys** (18d5376)
- **[#3772] fix(letsencrypt): skip names no public CA can issue for** (7cb7dc9)
- **[#3772] fix(scheduler): push the config before jobs on every change, not just first start** (4a5956c)
- **fix(linux): apply API_TOKEN from variables.env to the startup config** (21f1fcc)
- **[#3773] fix(scheduler): wait for an instance before the first-start config push** (f4a5008)
- **[#3773] fix(letsencrypt): stop re-issuing every certificate when the listing fails** (fa9c276)
- **fix(metrics): apply MAX_LRU_HISTORY in every worker** (24fe496)
- **[#3758] fix(metrics): delete evicted counters from Redis, count URLs by path** (30a0cc9)
- **fix(core): drop directives whose only argument renders empty** (994a4c3)
- **[#3768] fix(reverseproxy): render anchored REVERSE_PROXY_URL as a regex location** (bdb3a34)
- **[#3770] fix(ui): strip HTML from exports again** (0a8f3b1)
- **[#3771] fix(autoconf): classify IPv6 load balancer addresses correctly** (af91dee)
- **[#3761] fix(modsecurity): guard the empty allowed-methods list** (84da748)
- **[#3751] fix(ui): let wizard-created services be edited again** (33f4259)
- **[#3759] fix(cli): report the real result of ban and unban** (e8a7bc4)
- **fix: Preserve upstream 403 responses in access logs** (331b7c1)
- **fix(mtls): strip client-supplied X-SSL-* headers on ingress** (a619d3e)
- **fix(ui): Remove the unrevocable remember-me token** (9603eeb)
- **fix(ui): persist TOTP last_counter so replay is blocked** (061d354)

### Backend
- **Merge pull request #3812 from bunkerity/staging** (ea209dc)
- **Merge pull request #3811 from bunkerity/dev** (cb7f09a)
- **Merge pull request #3809 from bunkerity/dev** (4d23602)
- **Road to 1.6.14~rc3 🚀** (ebccadd)
- **Merge pull request #3808 from bunkerity/dev** (0d756e5)
- **Merge branch 'dev' of https://github.com/bunkerity/bunkerweb into dev** (14393b0)
- **Merge pull request #3806 from bunkerity/dev** (3adaff8)
- **Merge pull request #3777 from bunkerity/dependabot/terraform/tests/terraform/dev/scaleway/scaleway-2.80.0** (18ca8f2)
- **Merge branch 'dev' of https://github.com/bunkerity/bunkerweb into dev** (7df63a9)
- **Merge pull request #3794 from bunkerity/dependabot/github_actions/dev/github/codeql-action/upload-sarif-4.37.6** (a0f82f8)
- **Merge pull request #3793 from bunkerity/dependabot/github_actions/dev/github/codeql-action/init-4.37.6** (3ecad7b)
- **Merge pull request #3792 from bunkerity/dependabot/github_actions/dev/github/codeql-action/analyze-4.37.6** (c9995ca)
- **deps/gha: bump github/codeql-action/upload-sarif from 4.37.4 to 4.37.6** (5aa53ce)
- **deps/gha: bump github/codeql-action/init from 4.37.4 to 4.37.6** (6cbb9b2)
- **deps/gha: bump github/codeql-action/analyze from 4.37.4 to 4.37.6** (71b83e6)
- **Monthly mmdb update** (c646a5a)
- **Merge branch 'dev' of https://github.com/bunkerity/bunkerweb into dev** (8e35e51)
- **Merge pull request #3782 from bunkerity/dependabot/github_actions/dev/github/codeql-action/init-4.37.4** (d7a6bd1)
- **Merge pull request #3781 from bunkerity/dependabot/github_actions/dev/github/codeql-action/upload-sarif-4.37.4** (7afd819)
- **Merge pull request #3780 from bunkerity/dependabot/github_actions/dev/github/codeql-action/analyze-4.37.4** (e2addea)
- **Merge pull request #3769 from bunkerity/dependabot/github_actions/dev/docker/login-action-4.5.2** (60cc9cc)
- **Merge pull request #3766 from bunkerity/dependabot/github_actions/dev/ossf/scorecard-action-2.4.4** (b4ee7ef)
- **[#3630] feat(ui): validate a custom certificate pair before saving the service** (2ec1789)
- **deps/gha: bump github/codeql-action/init from 4.37.3 to 4.37.4** (5666f41)
- **deps/gha: bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.4** (1ee48d9)
- **deps/gha: bump github/codeql-action/analyze from 4.37.3 to 4.37.4** (614f02e)
- **deps/terraform: bump scaleway/scaleway in /tests/terraform** (cbaff36)
- **Merge pull request #3774 from bunkerity/dev** (467d341)
- **core: Hide KEEP_CONFIG_ON_RESTART from database settings** (a8b05cb)
- **deps/gha: bump docker/login-action from 4.5.0 to 4.5.2** (d865888)
- **deps/gha: bump ossf/scorecard-action from 2.4.3 to 2.4.4** (c70ba6c)

### Docs
- **docs(readme): comment out broken star history chart** (1bc7901)

### Chore
- **chore: Add 1.6.14~rc3 database migrations across supported backends** (d7596f9)
- **chore: update pinned Python dependencies** (0443797)
- **chore: Reorganize v1.6.14~rc3 changelog entries** (961893a)
- **chore: update Python dependency pins** (48ba79f)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/bunkerity/bunkerweb?utm_source=github-action)._