Backend 0.101.5 security update for self-hosted Nuphos

Security

This release fixes an input-validation issue in the cloud account APIs. Nuphos Cloud has run with this fix since 2026-10-22. Self-hosted backends on v0.101.4 or earlier are affected; upgrade to v0.101.5 or later (we recommend the latest release, which also carries later security fixes).

• Cloud region parameters: region values on the AWS, Alibaba Cloud and Volcengine account routes were used to build provider API hostnames without validation, so a team member with edit access could make the backend send a signed provider request to an unintended host. Region values are now validated and malformed ones are rejected with 400.

No configuration change is needed.

Upgrading from v0.101.4

1. No database changes and no environment variable changes. A backup is still recommended before any upgrade.
2. Update the image and restart:
   • Compose: check out backend-v0.101.5, rebuild the backend, and run docker compose up -d backend.
   • Railway: set the backend service image to ghcr.io/nuphos/backend:v0.101.5.
   • Zeabur: set the backend image to v0.101.5.
   • Helm: set backend.image.tag: v0.101.5 until a chart with appVersion 0.101.3 is published.
3. Check that /health returns 200.

Read the full backend v0.101.5 release notes.