Shipped · DevOps and infrastructure

What bunkerity/bunkerweb shipped

The public repository of Bunkerweb · github.com/bunkerity/bunkerweb

Written by FoxPlug from the repository's own releases; not affiliated with Bunkerweb. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/bunkerity/bunkerweb; Bunkerweb did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.

Get a weekly update like this for your product, free

Or Use it as a GitHub Action

See the update FoxPlug writes for bunkerweb, free

Week of November 2, 2026

What shipped

Why it matters

This week a new release candidate, 1.6.18-rc3, was cut and staged with images and docs, so users can test upcoming changes before the final release. The scheduler's update-check log no longer contains raw color escape codes, which keeps the log readable when an update is available. Turkish translations were also completed and brought in line with the English source.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

V1.6.18-rc3 is out as a release candidate, with all-in-one, BunkerWeb and scheduler images plus docs. Also shipped: cleaner scheduler update-check logs with ANSI escapes removed from the alert box, and completed Turkish translations.

Post for LinkedIn

BunkerWeb v1.6.18-rc3 is now available as a release candidate, with all-in-one, BunkerWeb and scheduler images and documentation at the 1.6.18~rc3 docs. This week also fixed the scheduler update-check alert box, which was writing hardcoded ANSI color escapes into the background scheduler log. Turkish translations were updated and completed, covering remaining English strings in the CrowdSec module and resyncing outdated sections with the English file. Testing the release candidate and reporting issues helps before the final release.

Week of October 19, 2026

What shipped

Why it matters

A stable 1.6.17 release is out with matching Docker tags, so users have a production-ready version to run. Two fixes land alongside it: the dashboard now counts blocked requests correctly, and antibot keeps the destination when a first challenge solve fails. Work on 1.6.18~rc1 continues through staging merges.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

V1.6.17 is out with matching Docker tags. This week also brings fixes for blocked request counts on the dashboard chart, map and top blocked IPs, and for antibot keeping the post-challenge destination when the first solve fails. Testing images are separate and not for production.

Post for LinkedIn

BunkerWeb v1.6.17 is released, with Docker tags for all-in-one, BunkerWeb and scheduler images. Alongside the release, two fixes are in: the dashboard's blocking status chart, blocked-countries map and top blocked IPs now count every blocked request instead of only those with status 403, 429 or 444, and antibot now keeps the post-challenge destination when the first solve fails. Staging merges for 1.6.18~rc1 also continue, with Brotli v1.2.1 and lua-resty-dns v0.24. A testing build is available but should not be used in production.

Week of October 12, 2026

What shipped

Why it matters

This week brought a stable release alongside two release candidates for the next version, so users can run 1.6.16 in production and start checking 1.6.17 before it is finalized. A testing build is also available for those who want to follow development, with the project warning it should not be used in production.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

BunkerWeb v1.6.16 is out, with the all-in-one, BunkerWeb and scheduler images tagged and docs published. Release candidates v1.6.17-rc1 and rc2 are also available for testing, plus a testing build that is not for production.

Post for LinkedIn

BunkerWeb v1.6.16 is now available: the all-in-one image, the BunkerWeb image and the scheduler image are tagged 1.6.16, and the matching documentation is published. Following it, v1.6.17-rc1 and v1.6.17-rc2 are available for early testing with the same set of images, so you can check the next version before it becomes stable. A testing build is also published for BunkerWeb and the scheduler; it should not be used in production, and the latest stable release remains the recommended choice.

Week of September 28, 2026

What shipped

Why it matters

Version 1.6.16-rc3 brings improvements for cookie handling in cross-site scenarios and fixes a performance issue affecting Redis deployments. The metrics fix addresses unnecessary CPU consumption for users running BunkerWeb with Redis enabled.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

V1.6.16-rc3 is out. SameSite=None cookie support for legacy environments, plus a fix for Redis metrics syncing that was causing CPU spikes during idle traffic.

Post for LinkedIn

V1.6.16-rc3 release candidate now available. This release includes SameSite=None support for Set-Cookie flags to support cross-site cookie flows in legacy service environments, and fixes a metrics performance issue where unchanged metrics were being resynced to Redis every 5 seconds, causing unnecessary CPU spikes.

Week of September 21, 2026

What shipped

Why it matters

Two release candidates for v1.6.16 are available for testing, including a critical fix for BROTLI_MIN_LENGTH validation that prevents configuration injection. The stable v1.6.15 release is now available for production deployments.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

V1.6.16-rc2 is out with a fix for BROTLI_MIN_LENGTH regex validation. Test it now and report issues. v1.6.15 stable also available.

Post for LinkedIn

This week Bunkerweb released v1.6.16-rc2 and v1.6.15 stable. A security-relevant fix in v1.6.16-rc2 addresses BROTLI_MIN_LENGTH validation to prevent configuration injection. Both release candidates and stable versions are available on Docker Hub and GHCR for testing and production deployment.

Week of September 14, 2026

What shipped

Why it matters

V1.6.15-rc3 is ready for testing with fixes addressing ModSecurity configuration validation, Python compatibility, and Kubernetes test infrastructure. These changes improve configuration flexibility and test reliability for users deploying across different environments.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

V1.6.15-rc3 is available for testing. This release includes ModSecurity validation fixes, improved Python compatibility for tar extraction, and enhanced Kubernetes test infrastructure.

Post for LinkedIn

V1.6.15-rc3 of Bunkerweb is now available for testing. This release candidate includes fixes for ModSecurity configuration validation that previously rejected valid configurations on inactive scopes, improved tar extraction compatibility with older Python versions, and upgraded Kubernetes test infrastructure using CoreDNS resolver.

Weeks with too little public activity are left out rather than filled in. Last updated 2026-11-10.

Is this your repo? Ask us to remove this page.