## bunkerity/bunkerweb — v1.6.16-rc1…v1.6.16-rc2

_37 commits._

### Features
- **feat(antibot): configurable PoW difficulty and redesigned challenge pages** (8ccdd1f)
- **feat(templates): add whitelist settings** (e2d4d76)
- **feat: nginx-style time suffixes on duration settings, compressed and versioned Web UI assets** (3075b9d)

### Fixes
- **fix(autoconf): leave ingresses and gateways of another controller's class alone** (84f8856)
- **[#3960] fix(duration): keep non-zero sub-unit durations at 1 instead of the 0 sentinel** (192114c)
- **fix(docker): bump expat/libexpat floor to 2.8.5-r0, fixing CVE-2026-93990** (0dc2c4b)
- **fix(ui): read row ids as strings on the jobs, plugins, templates, services and bans pages** (7c51dca)
- **fix(ui): stop a digit-only custom config name from deleting its siblings** (71ecded)
- **fix(rdns): forward-confirm IPv6 clients in whitelist, greylist, antibot and blacklist** (0cb063e)
- **fix(ui): read USE_REDIS from env while the database migrates** (284f70a)
- **fix(antibot): skip CSP override when session data is missing** (4edaf5a)
- **fix(metrics): rebuild and trim request facets in slices so the Lua heap can't push Redis past maxmemory** (a00307a)
- **fix(ui): rename a service in one transaction so its custom configs, certificates and job cache follow it** (09493b5)
- **fix(db): keep settings written in the same save as a service rename or removal on SQLite** (efaa56e)
- **[#3957] fix(letsencrypt): keep the client Host on passed-through ACME challenges** (9ed8ea5)
- **fix: name a service by its id when it has no SERVER_NAME row** (cea19bc)
- **Merge pull request #3959 from Ayushsinha322/fix/brotli-min-length-anchor** (2a93810)
- **fix(metrics): heal an unparsable Redis counter instead of retrying it forever** (eadd1b8)
- **Revert "fix(brotli,gzip): use an exact end anchor and ASCII digits for the min-length regexes"** (8962657)
- **fix(brotli,gzip): use an exact end anchor and ASCII digits for the min-length regexes** (564416d)
- **fix(brotli): anchor BROTLI_MIN_LENGTH regex to reject trailing input** (0b257f7)

### Backend
- **Road to 1.6.16~rc2 🚀** (30d7b74)
- **Merge branch 'dev' of https://github.com/bunkerity/bunkerweb into dev** (22e5fa7)
- **Prepare for 1.6.16~rc2 🚀** (65dd468)
- **Merge pull request #3952 from bunkerity/dependabot/github_actions/dev/pullfrog/pullfrog-0.1.82** (a9be299)
- **Merge pull request #3954 from bunkerity/dependabot/github_actions/dev/github/codeql-action/init-4.38.1** (b9e589a)
- **Merge pull request #3956 from bunkerity/dependabot/github_actions/dev/github/codeql-action/analyze-4.38.1** (c910d67)
- **Merge pull request #3961 from bunkerity/dependabot/github_actions/dev/ruby/setup-ruby-1.325.0** (4665a63)
- **Merge pull request #3962 from bunkerity/dependabot/github_actions/dev/getplumber/plumber-0.5.4** (73553c8)
- **deps/gha: bump getplumber/plumber from 0.5.2 to 0.5.4** (fb18208)
- **deps/gha: bump ruby/setup-ruby from 1.324.0 to 1.325.0** (425fc74)
- **deps/gha: bump github/codeql-action/analyze from 4.38.0 to 4.38.1** (f4636ba)
- **deps/gha: bump github/codeql-action/init from 4.38.0 to 4.38.1** (951b86b)
- **deps/gha: bump pullfrog/pullfrog from 0.1.81 to 0.1.82** (2524e37)

### Docs
- **docs(changelog): thank Ayushsinha322 for #3959** (93e7ce6)
- **docs(plugins): external plugins 1.13 (BunkerWeb 1.6.15), add open-appsec** (4128411)
- **docs(readme): update Star History badges** (c088ccb)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/bunkerity/bunkerweb?utm_source=github-action)._