Stable releases of October 29, 2026

Everything that shipped on the stable channel on October 29, 2026 — v2.10.86.

Stable v2.10.86 — Security

Bugfixes & Security — v2.10.86

• Disable proxy header trust in management-agent ClientIP
• Restrict Gin trusted proxies to loopback
• Re-patch 8 published extensions against new stdlib/x-net CVEs

Stable v2.10.86

Features — v2.10.86

• Add per-site application-layer flood protection (nginx limit_req/limit_conn)
• Add Cloudflare Turnstile progressive-friction CAPTCHA on login
• Non-blocking 2FA recommendation banner regardless of force_2fa policy

Improvements — v2.10.86

• Render ModSecurity WAF include in Apache-proxy vhosts
• Extend flood protection to Apache-proxy vhosts, shrink per-site zone size
• Frame untrusted third-party text in tool results
• Address Turnstile CAPTCHA review findings
• Fix 4 bugs found during live E2E test against real ClouDNS API
• Bump x/net and go directive in clouddns-sync to clear govulncheck gate