fix(certbot): update Timeweb Cloud DNS plugin to 2.0.0

[frenck]

Why

certbot-dns-timeweb is pinned to ~=1.0.1, and 1.0.1 requires certbot>=2.8,<3.0. Against the certbot 5.7.0 in the current image, installing it makes pip downgrade certbot and acme, after which certbot cannot import at all:

before: certbot 5.7.0
$ pip install 'certbot-dns-timeweb~=1.0.1'
Successfully installed acme-3.3.0 certbot-2.11.1 certbot-dns-timeweb-1.0.1 josepy-1.15.0
after:  AttributeError: module 'OpenSSL.crypto' has no attribute 'X509Req'

acme 3.3.0 still references OpenSSL.crypto.X509Req, which pyOpenSSL 26 removed, so every certificate operation in the container fails, not only the Timeweb ones. Same failure as #5606 and #5719, and the same shape as #5788 for Websupport.

certbot-dns-timeweb 2.0.0 (released 2026-08-23) requires certbot>=2.8 with no upper bound. The entry point is still dns-timeweb and the credentials key is still dns_timeweb_api_key, so existing credential files keep working and no other field in dns-plugins.json needs to change. It also drops the timeweb-cloud and tld dependencies in favour of requests.

Verified on debian:trixie-slim with the same venv layout as the image:

before: certbot 5.7.0
$ pip install 'certbot-dns-timeweb~=2.0.0'
Successfully installed certbot-dns-timeweb-2.0.0
after:  certbot 5.7.0

$ certbot plugins --init --prepare
* dns-timeweb
  Description: Obtain certificates using a DNS TXT record using the Timeweb Cloud API

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Code refactoring
• API changes
• Performance improvement
• Test addition or update

AI Usage

• AI was used to write this
• AI was used to review this

[nginxproxymanagerci]

Docker Image for build 1 is available on DockerHub:

nginxproxymanager/nginx-proxy-manager-dev:pr-5800

Note

Ensure you backup your NPM instance before testing this image! Especially if there are database changes.
This is a different docker image namespace than the official image.

Warning

Changes and additions to DNS Providers require verification by at least 2 members of the community!