v2026.10.29.01 — 2026-10-29

Features

• Add per-site application-layer flood protection (nginx limit_req/limit_conn)
• Add Cloudflare Turnstile progressive-friction CAPTCHA on login
• Non-blocking 2FA recommendation banner regardless of force_2fa policy

Improvements

• Render ModSecurity WAF include in Apache-proxy vhosts
• Extend flood protection to Apache-proxy vhosts, shrink per-site zone size
• Frame untrusted third-party text in tool results
• Address Turnstile CAPTCHA review findings
• Record prompt-injection investigation
• Fix 4 bugs found during live E2E test against real ClouDNS API
• List extension in extensions table, sharpen zone-page wording
• Bump x/net and go directive in clouddns-sync to clear govulncheck gate

Bugfixes & Security

• Disable proxy header trust in management-agent ClientIP
• Restrict Gin trusted proxies to loopback
• Rebuild backend binaries for CVE republish
• Republish 8 CVE-fixed extensions
• Re-patch 8 published extensions against new stdlib/x-net CVEs