Nginx Proxy Manager 2.16.0: certbot update, clean upgrade

released
lab run
upgraded from
2.15.1
guest
Ubuntu 26.04 VM
tested
yes, in our lab

Summary

2.16.0 adds a Logs viewer in the UI and per-path access lists in the Proxy Host dialog. It updates OpenResty (1.31.1.1), certbot (5.8.0) and s6-overlay (3.2.3.0). There are many smaller fixes, including one for a remote code execution issue (“changed order of escape to prevent RCE”), a change so 2FA QR codes are generated locally instead of by a third party, and invalidation of tokens issued before a password change. Several DNS plugins were added or updated, and three locales were added (Azerbaijani, Ukrainian, Persian).

Breaking changes and deprecations

Reported in the release notes: certbot has been updated, and DNS plugins “may not work as expected and require tweaks to dependencies”. The notes link to the certbot docs. The Azure DNS plugin was switched to certbot-dns-azure-modern, so Azure users should expect to revisit their setup.

Reported: DNS provider credentials are now removed from disk after certbot runs.

Tested in our lab

We upgraded from 2.15.1 to 2.16.0 with Docker Compose (stopped with docker compose down, changed the image tag, pulled, started).

  • Before: version 2.15.1, admin user created, one proxy host (test.example.com to the admin port) answering 200.
  • After: API reports 2.16.0, the same admin login works, the proxy host is still listed, its nginx config file is still present, and the host still answers 200. The web UI on port 81 returns 200.
  • Container logs showed one warning line only (a useradd warning about uid 0).

We did not test certbot, DNS plugins, Let’s Encrypt issuance, the new Logs viewer, per-path access lists or token invalidation. Our test used no certificates, so the main risk in this release is untested.

Lab log

$ curl -s localhost:81/api/
{"status":"OK","setup":false,"version":{"major":2,"minor":15,"revision":1}}
$ docker compose down
[...]
 Container npm-app-1  Removed
$ docker compose pull
[...]
$ docker compose up -d
 Container npm-app-1  Started
$ curl -s localhost:81/api/
{"status":"OK","setup":true,"version":{"major":2,"minor":16,"revision":0}}
$ curl -s -o /dev/null -w "%{http_code}\n" -H "Host: test.example.com" localhost/
200
$ ls data/nginx/proxy_host
1.conf

Reported by others

Nothing beyond the release notes; we did not search issues or forums.

Verdict

Wait if you use DNS-challenge certificates (especially Azure): check the certbot docs and test on a copy first. If you only use HTTP-challenge certificates or none, the upgrade looked safe in our lab, and the security fixes are a reason to move. Back up data and letsencrypt first.

sources