diff --git a/.changes/a-list-view-on-the-new.md b/.changes/a-list-view-on-the-new.md
new file mode 100644
index 0000000000..6583416058
--- /dev/null
+++ b/.changes/a-list-view-on-the-new.md
@@ -0,0 +1,5 @@
+---
+type: added
+commit: 91d233be59
+---
+A list view on the new resource page
diff --git a/.changes/a-not-used-label-on-the.md b/.changes/a-not-used-label-on-the.md
new file mode 100644
index 0000000000..73e50b121f
--- /dev/null
+++ b/.changes/a-not-used-label-on-the.md
@@ -0,0 +1,8 @@
+---
+type: added
+commit: 777362cd97
+---
+A `Not used` label on the TLS certificates of the Traefik proxy page, and a `Delete unused` button that deletes them in one step ([#12447](https://github.com/coollabsio/coolify/issues/12447))
+
+- A certificate is unused when no route and no resource on the server uses its domain
+- Traefik renews every certificate in `acme.json` until you delete it and restart the proxy
diff --git a/.changes/a-run-in-a-shell-option.md b/.changes/a-run-in-a-shell-option.md
new file mode 100644
index 0000000000..cf25b02fd3
--- /dev/null
+++ b/.changes/a-run-in-a-shell-option.md
@@ -0,0 +1,8 @@
+---
+type: added
+commit: 31c3fcf50d
+---
+A `Run in a shell` option on scheduled tasks, so containers without `sh`, such as distroless or scratch images, can run them ([#8244](https://github.com/coollabsio/coolify/issues/8244))
+
+- Turn it off to split the command into arguments and run it directly
+- The API and the MCP tools set it too
diff --git a/.changes/a-separate-notification-sender-in-the.md b/.changes/a-separate-notification-sender-in-the.md
new file mode 100644
index 0000000000..1be671cc47
--- /dev/null
+++ b/.changes/a-separate-notification-sender-in-the.md
@@ -0,0 +1,9 @@
+---
+type: added
+commit: a5b4e1d32e
+---
+A separate notification sender in the instance email settings
+
+- Team notifications through the instance email settings, the S3 connection error alert and the channel disabled alert use it
+- Account emails keep the default sender
+- The `emails` artisan command no longer exists
diff --git a/.changes/a-skip-tls-certificate-verification-setting.md b/.changes/a-skip-tls-certificate-verification-setting.md
new file mode 100644
index 0000000000..49017e3a33
--- /dev/null
+++ b/.changes/a-skip-tls-certificate-verification-setting.md
@@ -0,0 +1,9 @@
+---
+type: added
+commit: 7f521e496d
+---
+A `Skip TLS certificate verification` setting on S3 storages, for endpoints with a self-signed or private CA certificate ([#9762](https://github.com/coollabsio/coolify/issues/9762), [#4402](https://github.com/coollabsio/coolify/issues/4402))
+
+- It applies to the connection test, backups, restores and the deletion of old backups
+- The S3 storages API sets it with `skip_tls_verification`
+- Browsers that download files from the storage must still trust the certificate
diff --git a/.changes/a-star-button-on-servers-and.md b/.changes/a-star-button-on-servers-and.md
new file mode 100644
index 0000000000..48571dac7a
--- /dev/null
+++ b/.changes/a-star-button-on-servers-and.md
@@ -0,0 +1,7 @@
+---
+type: added
+commit: c648f4ec6a
+---
+A star button on servers and resources for quick access on the dashboard
+
+- The button is after the status in the top bar
diff --git a/.changes/a-ui-scale-option-in-the.md b/.changes/a-ui-scale-option-in-the.md
new file mode 100644
index 0000000000..6936de298b
--- /dev/null
+++ b/.changes/a-ui-scale-option-in-the.md
@@ -0,0 +1,5 @@
+---
+type: added
+commit: bd499de1fb
+---
+A `UI scale` option in the appearance settings
diff --git a/.changes/a-warning-when-the-docker-compose.md b/.changes/a-warning-when-the-docker-compose.md
new file mode 100644
index 0000000000..03a364112e
--- /dev/null
+++ b/.changes/a-warning-when-the-docker-compose.md
@@ -0,0 +1,7 @@
+---
+type: added
+commit: fc027be248
+---
+A warning when the Docker Compose file of an application is in a subdirectory of the base directory, with a button that moves the directory of the file into the base directory ([#9525](https://github.com/coollabsio/coolify/issues/9525))
+
+- Coolify runs Docker Compose in the base directory, so relative paths such as `build.context: ..` resolve from there
diff --git a/.changes/api-endpoints-and-mcp-tools-that.md b/.changes/api-endpoints-and-mcp-tools-that.md
new file mode 100644
index 0000000000..ae9824bf12
--- /dev/null
+++ b/.changes/api-endpoints-and-mcp-tools-that.md
@@ -0,0 +1,8 @@
+---
+type: added
+commit: 1703265353
+---
+API endpoints and MCP tools that manage image scanning and read the scan results
+
+- `GET` and `PATCH /api/v1/servers/{uuid}/image-scanning`, `GET /api/v1/vulnerabilities` and `GET /api/v1/{applications|databases|services}/{uuid}/vulnerabilities`
+- The MCP tools are `get_vulnerabilities` and `manage_image_scanning`
diff --git a/.changes/api-token-search-out-of-sync.md b/.changes/api-token-search-out-of-sync.md
new file mode 100644
index 0000000000..f96f247c84
--- /dev/null
+++ b/.changes/api-token-search-out-of-sync.md
@@ -0,0 +1,5 @@
+---
+type: fixed
+commit: 59481c7bb6
+---
+API token search out of sync after you create, edit or revoke a token ([#12465](https://github.com/coollabsio/coolify/issues/12465))
diff --git a/.changes/applications-and-databases-removed-from-the.md b/.changes/applications-and-databases-removed-from-the.md
new file mode 100644
index 0000000000..5ca616c8d9
--- /dev/null
+++ b/.changes/applications-and-databases-removed-from-the.md
@@ -0,0 +1,10 @@
+---
+type: fixed
+commit: e29dcf70d9
+---
+Applications and databases removed from the Docker Compose file of a service showing as `Exited` and keeping the service degraded ([#9591](https://github.com/coollabsio/coolify/issues/9591))
+
+- They show `Not in Compose file` and do not count in the service status
+- Coolify keeps their settings and uses them again when you add the service back under the same name
+- To remove one, delete it in its settings
+- Existing ones are marked at the next deployment or save of the service
diff --git a/.changes/applications-deleted-on-all-their-servers.md b/.changes/applications-deleted-on-all-their-servers.md
new file mode 100644
index 0000000000..e349671fc4
--- /dev/null
+++ b/.changes/applications-deleted-on-all-their-servers.md
@@ -0,0 +1,10 @@
+---
+type: fixed
+commit: 83a5667387
+---
+Applications deleted on all their servers when you delete a server that they use only as an additional destination
+
+- This applies to `Delete all resources` and `DELETE /api/v1/servers/{uuid}?force=true`
+- Coolify removes the application only from the deleted server and stops its containers there
+- A server that has only such applications can be deleted without `Delete all resources`
+- The delete confirmation lists the resources it deletes and the applications that keep running on another server
diff --git a/.changes/applied-the-limits-of-api-tokens.md b/.changes/applied-the-limits-of-api-tokens.md
new file mode 100644
index 0000000000..0430930612
--- /dev/null
+++ b/.changes/applied-the-limits-of-api-tokens.md
@@ -0,0 +1,7 @@
+---
+type: security
+commit: 3c588d482d
+---
+Applied the limits of API tokens to more permission checks
+
+- A message explains when a token limit blocks a change
diff --git a/.changes/automatic-update-notifications-the-root-team.md b/.changes/automatic-update-notifications-the-root-team.md
new file mode 100644
index 0000000000..4658381892
--- /dev/null
+++ b/.changes/automatic-update-notifications-the-root-team.md
@@ -0,0 +1,7 @@
+---
+type: added
+commit: a5c3ca0b73
+---
+Automatic update notifications, the root team gets one when an automatic update starts, fails or finishes ([#12472](https://github.com/coollabsio/coolify/pull/12472))
+
+- A manual upgrade that fails before the upgrade script starts shows the error in the upgrade modal
diff --git a/.changes/bugsink-service-template-filling-the-disk.md b/.changes/bugsink-service-template-filling-the-disk.md
new file mode 100644
index 0000000000..a6eb08f0bd
--- /dev/null
+++ b/.changes/bugsink-service-template-filling-the-disk.md
@@ -0,0 +1,8 @@
+---
+type: fixed
+commit: ccaa04ce33
+---
+Bugsink service template filling the disk with MySQL binary logs until Bugsink stopped ([#10626](https://github.com/coollabsio/coolify/issues/10626))
+
+- New services use PostgreSQL 17 and Bugsink 2
+- To stop the growth in an existing service, run `PURGE BINARY LOGS BEFORE NOW();` in MySQL, then add `command: ['--disable-log-bin']` to the `mysql` service and restart it
diff --git a/.changes/builds-that-failed-with-x509-errors.md b/.changes/builds-that-failed-with-x509-errors.md
new file mode 100644
index 0000000000..44dd206847
--- /dev/null
+++ b/.changes/builds-that-failed-with-x509-errors.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: 4b9fe035dc
+---
+Builds that failed with x509 errors behind a TLS-inspecting proxy, although the server trusts the proxy CA ([#7568](https://github.com/coollabsio/coolify/issues/7568))
+
+- The helper container mounts the CA bundle of the server read-only
diff --git a/.changes/cancelled-the-older-queued-webhook-deployments.md b/.changes/cancelled-the-older-queued-webhook-deployments.md
new file mode 100644
index 0000000000..e04496c0cb
--- /dev/null
+++ b/.changes/cancelled-the-older-queued-webhook-deployments.md
@@ -0,0 +1,12 @@
+---
+type: changed
+breaking: true
+commit: cf1e0e70c5
+---
+Cancelled the older queued webhook deployments of an application by default when a newer push arrives, so only the latest commit is built ([#10921](https://github.com/coollabsio/coolify/discussions/10921), [#7678](https://github.com/coollabsio/coolify/discussions/7678))
+
+- It works per application, pull request and server
+- `Advanced` > `Deployment` and `is_auto_cancel_queued_deployments_enabled` in the applications API turn it off
+- Manual, API, restart and rollback deployments are never cancelled
+- An opt-in setting, `is_auto_cancel_building_deployments_enabled` in the API, also stops an older webhook deployment that is still building, a deployment that started to replace containers always finishes
+- `cancel_previous` (`none`, `queued` or `building`) on `/api/v1/deploy` and the MCP `deploy` tool cancels the older webhook, API and MCP deployments, the default is `none`
diff --git a/.changes/checked-that-members-with-access-grants.md b/.changes/checked-that-members-with-access-grants.md
new file mode 100644
index 0000000000..840dfb032e
--- /dev/null
+++ b/.changes/checked-that-members-with-access-grants.md
@@ -0,0 +1,10 @@
+---
+type: security
+commit: 8011d0d6ab
+---
+Checked that members with access grants can use the selected server and the team credentials ([#12488](https://github.com/coollabsio/coolify/pull/12488))
+
+- A new, cloned or migrated resource needs a server that the member can use, the localhost server needs an instance admin
+- Server lists show only the servers that the member can use
+- Team private keys, GitHub Apps, Gitea Apps and new S3 storages of backup schedules need write access on the whole team, also through the API
+- A message explains when write access on the whole team is needed
diff --git a/.changes/checked-the-deploy-permission-before-a.md b/.changes/checked-the-deploy-permission-before-a.md
new file mode 100644
index 0000000000..859b974e7b
--- /dev/null
+++ b/.changes/checked-the-deploy-permission-before-a.md
@@ -0,0 +1,5 @@
+---
+type: security
+commit: 25b4236e35
+---
+Checked the deploy permission before a deploy through the API creates a preview or changes its image tag
diff --git a/.changes/compose-services-that-could-not-reach.md b/.changes/compose-services-that-could-not-reach.md
new file mode 100644
index 0000000000..3f49941fb6
--- /dev/null
+++ b/.changes/compose-services-that-could-not-reach.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: 3c87879e6b
+---
+Compose services that could not reach each other by name in preview deployments and failed to start ([#8030](https://github.com/coollabsio/coolify/issues/8030))
+
+- The original name is an alias on the preview network
diff --git a/.changes/container-image-vulnerability-scanning-opt-in.md b/.changes/container-image-vulnerability-scanning-opt-in.md
new file mode 100644
index 0000000000..09ad1bd802
--- /dev/null
+++ b/.changes/container-image-vulnerability-scanning-opt-in.md
@@ -0,0 +1,9 @@
+---
+type: added
+commit: 3c33f61d7b
+---
+Container image vulnerability scanning, opt-in for each server and each application ([#12377](https://github.com/coollabsio/coolify/pull/12377))
+
+- Syft and Grype run on your server, and no data goes to a third party
+- Each resource gets one security status and version recommendations, with an optional deploy gate for each application
+- The team `Security` page and the notifications show the results
diff --git a/.changes/copy-from-instance-settings-from-the.md b/.changes/copy-from-instance-settings-from-the.md
new file mode 100644
index 0000000000..e598afeff3
--- /dev/null
+++ b/.changes/copy-from-instance-settings-from-the.md
@@ -0,0 +1,5 @@
+---
+type: removed
+commit: f7867923b7
+---
+`Copy from instance settings` from the email notification page, select `Use system-wide settings` instead
diff --git a/.changes/copy-logs-not-changing-the-clipboard.md b/.changes/copy-logs-not-changing-the-clipboard.md
new file mode 100644
index 0000000000..23450d6c69
--- /dev/null
+++ b/.changes/copy-logs-not-changing-the-clipboard.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: 1ff99b0dc8
+---
+`Copy logs` not changing the clipboard on iPhone and iPad, in the runtime and deployment logs ([#9408](https://github.com/coollabsio/coolify/issues/9408))
+
+- Coolify starts the clipboard write during the tap and adds the logs when they load
diff --git a/.changes/cut-off-descriptions-of-postgresql-mongodb.md b/.changes/cut-off-descriptions-of-postgresql-mongodb.md
new file mode 100644
index 0000000000..d8b926f296
--- /dev/null
+++ b/.changes/cut-off-descriptions-of-postgresql-mongodb.md
@@ -0,0 +1,5 @@
+---
+type: fixed
+commit: 813bc72af4
+---
+Cut-off descriptions of PostgreSQL, MongoDB and ClickHouse on the new resource page
diff --git a/.changes/data-that-looked-lost-after-you.md b/.changes/data-that-looked-lost-after-you.md
new file mode 100644
index 0000000000..7a868f20ee
--- /dev/null
+++ b/.changes/data-that-looked-lost-after-you.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: a05fe524f8
+---
+Data that looked lost after you changed the name of a persistent volume, because a new name points to a new, empty Docker volume ([#8816](https://github.com/coollabsio/coolify/issues/8816))
+
+- A dialog asks for confirmation and tells you to copy the data into the new volume
diff --git a/.changes/database-backup-executions-table-that-did.md b/.changes/database-backup-executions-table-that-did.md
new file mode 100644
index 0000000000..9be99fba1a
--- /dev/null
+++ b/.changes/database-backup-executions-table-that-did.md
@@ -0,0 +1,8 @@
+---
+type: fixed
+commit: 0b89b857ed
+---
+Database backup executions table that did not fit the page and was hard to read ([#7188](https://github.com/coollabsio/coolify/issues/7188))
+
+- It shows the file name of the archive, with a button that copies its path
+- It shows `All databases` for a backup of all databases
diff --git a/.changes/database-backups-saved-to-s3-when.md b/.changes/database-backups-saved-to-s3-when.md
new file mode 100644
index 0000000000..becdbfcbcc
--- /dev/null
+++ b/.changes/database-backups-saved-to-s3-when.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: 3b64cbc379
+---
+Database backups saved to S3 when an API request does not send `save_s3`
+
+- The backup page resets the S3 selection when a change is not allowed
diff --git a/.changes/database-backups-that-passed-the-worker.md b/.changes/database-backups-that-passed-the-worker.md
new file mode 100644
index 0000000000..6ed3367e4c
--- /dev/null
+++ b/.changes/database-backups-that-passed-the-worker.md
@@ -0,0 +1,10 @@
+---
+type: fixed
+commit: 5c71067481
+---
+Database backups that passed the worker timeout, stayed running, and left the upload container and the dump file on the server
+
+- Each step gets only the time that is left of the backup timeout, so a run that takes too long fails and cleans up
+- An SSH retry does not start a second dump
+- The backup log explains exit code 124, and the timeout help says that it covers the complete run
+- The daily helper container cleanup removes the upload containers of executions that are not running
diff --git a/.changes/deleted-coolify-yaml-and-an-unreachable.md b/.changes/deleted-coolify-yaml-and-an-unreachable.md
new file mode 100644
index 0000000000..a4925682d3
--- /dev/null
+++ b/.changes/deleted-coolify-yaml-and-an-unreachable.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: ed03a31b3a
+---
+Deleted `coolify.yaml` and an unreachable dashboard on a server with the IP `host.docker.internal` that is not the default localhost server ([#12444](https://github.com/coollabsio/coolify/issues/12444))
+
+- Coolify keeps treating this server as localhost after a save, for example after a proxy restart
diff --git a/.changes/deleted-volume-coming-back-after-a.md b/.changes/deleted-volume-coming-back-after-a.md
new file mode 100644
index 0000000000..19dff39023
--- /dev/null
+++ b/.changes/deleted-volume-coming-back-after-a.md
@@ -0,0 +1,8 @@
+---
+type: fixed
+commit: 780d67ccbb
+---
+Deleted volume coming back after a redeploy when the image declares `VOLUME` at its path ([#6875](https://github.com/coollabsio/coolify/issues/6875))
+
+- Coolify removes containers that still mount a deleted volume before it starts the new ones
+- The stale volume delete dialog warns when a container still uses the volume
diff --git a/.changes/deploy-canvas-cards-with-another-border.md b/.changes/deploy-canvas-cards-with-another-border.md
new file mode 100644
index 0000000000..aae8ad11b1
--- /dev/null
+++ b/.changes/deploy-canvas-cards-with-another-border.md
@@ -0,0 +1,5 @@
+---
+type: fixed
+commit: 5960814df5
+---
+Deploy canvas cards with another border than the resource tiles
diff --git a/.changes/deployments-started-through-the-mcp-server.md b/.changes/deployments-started-through-the-mcp-server.md
new file mode 100644
index 0000000000..48a2abfebc
--- /dev/null
+++ b/.changes/deployments-started-through-the-mcp-server.md
@@ -0,0 +1,8 @@
+---
+type: fixed
+commit: b063a41624
+---
+Deployments started through the MCP server saved as API deployments
+
+- The deployment list shows them with the `MCP` source and filter
+- The API and MCP deployment data have a new `is_mcp` field
diff --git a/.changes/deployments-that-failed-on-one-502.md b/.changes/deployments-that-failed-on-one-502.md
new file mode 100644
index 0000000000..6628cec726
--- /dev/null
+++ b/.changes/deployments-that-failed-on-one-502.md
@@ -0,0 +1,8 @@
+---
+type: fixed
+commit: d70801aaa1
+---
+Deployments that failed on one `502` or one timeout from the GitHub API ([#9785](https://github.com/coollabsio/coolify/issues/9785))
+
+- GitHub API reads retry up to three times on a 5xx error or a failed connection
+- Writes, such as pull request comments, are not retried
diff --git a/.changes/deployments-that-failed-with-curl-error.md b/.changes/deployments-that-failed-with-curl-error.md
new file mode 100644
index 0000000000..0d08bc88af
--- /dev/null
+++ b/.changes/deployments-that-failed-with-curl-error.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: b7a2c75739
+---
+Deployments that failed with `cURL error 28` on `https://api.github.com/zen`, because Coolify compared its clock with GitHub before each token request ([#9785](https://github.com/coollabsio/coolify/issues/9785))
+
+- Coolify compares the clocks only when GitHub rejects a request, from the `Date` header of that response
diff --git a/.changes/deployments-that-failed-with-the-container.md b/.changes/deployments-that-failed-with-the-container.md
new file mode 100644
index 0000000000..b39f253b44
--- /dev/null
+++ b/.changes/deployments-that-failed-with-the-container.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: d6405d5545
+---
+Deployments that failed with "The container name ... is already in use" when `Use build secrets` is on ([#9363](https://github.com/coollabsio/coolify/issues/9363))
+
+- Coolify removes the old helper container and waits until Docker frees the name
diff --git a/.changes/deployments-that-stopped-on-a-broken.md b/.changes/deployments-that-stopped-on-a-broken.md
new file mode 100644
index 0000000000..548e89c346
--- /dev/null
+++ b/.changes/deployments-that-stopped-on-a-broken.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: 0b45d8dd6c
+---
+Deployments that stopped on a broken `.env` file, because multi-line JSON values saved before exact escaping had no quotes ([#8279](https://github.com/coollabsio/coolify/issues/8279))
+
+- These values use exact escaping, which gives the container the same value as before beta.463
diff --git a/.changes/deployments-to-additional-servers-losing-the.md b/.changes/deployments-to-additional-servers-losing-the.md
new file mode 100644
index 0000000000..17c1be2a33
--- /dev/null
+++ b/.changes/deployments-to-additional-servers-losing-the.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: 37b4a8b4e7
+---
+Deployments to additional servers losing the source of the main deployment
+
+- The audit log records actions that MCP tools do through the API as MCP events
diff --git a/.changes/different-coolify-branch-values-in-the.md b/.changes/different-coolify-branch-values-in-the.md
new file mode 100644
index 0000000000..3daa5e9f70
--- /dev/null
+++ b/.changes/different-coolify-branch-values-in-the.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: 71814b4541
+---
+Different `COOLIFY_BRANCH` values in the parts of a preview deployment ([#9572](https://github.com/coollabsio/coolify/issues/9572))
+
+- All parts use `pull/<pull request number>/head`
diff --git a/.changes/disabled-self-hosted-servers-that-stayed.md b/.changes/disabled-self-hosted-servers-that-stayed.md
new file mode 100644
index 0000000000..fff2a0eea2
--- /dev/null
+++ b/.changes/disabled-self-hosted-servers-that-stayed.md
@@ -0,0 +1,9 @@
+---
+type: fixed
+commit: f7ea962145
+---
+Disabled self-hosted servers that stayed disabled after a validation that connects ([#12475](https://github.com/coollabsio/coolify/issues/12475))
+
+- The unreachable cleanup skips the localhost server
+- The server page explains why a server is disabled
+- Coolify Cloud servers and transferred servers stay disabled
diff --git a/.changes/dns-matches-on-a-domain-in.md b/.changes/dns-matches-on-a-domain-in.md
new file mode 100644
index 0000000000..5cc469b4e6
--- /dev/null
+++ b/.changes/dns-matches-on-a-domain-in.md
@@ -0,0 +1,9 @@
+---
+type: fixed
+commit: b7defddc32
+---
+`DNS matches` on a domain in a connected Cloudflare zone that goes through Cloudflare to a different server, which then failed with Cloudflare error 526 and a Let's Encrypt error ([#12436](https://github.com/coollabsio/coolify/issues/12436))
+
+- The domain shows `DNS mismatch`
+- CNAME records, for example of a Cloudflare Tunnel, are still accepted
+- A clone of an application or a service, or a new one through the API, gets a Cloudflare DNS record for each domain in a zone with automatic DNS, a clone only for the domains that the source does not use
diff --git a/.changes/docker-builds-that-failed-with-buildkit.md b/.changes/docker-builds-that-failed-with-buildkit.md
new file mode 100644
index 0000000000..d600062721
--- /dev/null
+++ b/.changes/docker-builds-that-failed-with-buildkit.md
@@ -0,0 +1,8 @@
+---
+type: fixed
+commit: 8c6774e17f
+---
+Docker builds that failed with "BuildKit is enabled but the buildx component is missing or broken" when an application has a build-time variable `HOME` or `DOCKER_CONFIG` ([#9726](https://github.com/coollabsio/coolify/issues/9726))
+
+- The Docker CLI in the helper container always uses `/root/.docker`
+- A `HOME` build argument keeps its value
diff --git a/.changes/docker-compose-previews-sharing-one-project.md b/.changes/docker-compose-previews-sharing-one-project.md
new file mode 100644
index 0000000000..57f9bb52da
--- /dev/null
+++ b/.changes/docker-compose-previews-sharing-one-project.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: d09480973e
+---
+Docker Compose previews sharing one project with the application and the other previews, so Docker Compose treated their containers as orphans ([#9014](https://github.com/coollabsio/coolify/issues/9014))
+
+- Each preview has its own Compose project, and the networks that the Compose file declares are not shared
diff --git a/.changes/dockerfile-healthcheck-options-not-imported-as.md b/.changes/dockerfile-healthcheck-options-not-imported-as.md
new file mode 100644
index 0000000000..59a3e5e743
--- /dev/null
+++ b/.changes/dockerfile-healthcheck-options-not-imported-as.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: 51a7e97619
+---
+Dockerfile `HEALTHCHECK` options not imported as Docker reads them, zero and sub-second values became 0 seconds ([#12455](https://github.com/coollabsio/coolify/issues/12455))
+
+- Coolify reads compound and fractional durations, quoted values, only the flags before `CMD`, the `escape` directive and `NONE` with flags
diff --git a/.changes/dockerfile-healthcheck-read-from-a-stage.md b/.changes/dockerfile-healthcheck-read-from-a-stage.md
new file mode 100644
index 0000000000..250574c346
--- /dev/null
+++ b/.changes/dockerfile-healthcheck-read-from-a-stage.md
@@ -0,0 +1,5 @@
+---
+type: fixed
+commit: fcf92b751f
+---
+Dockerfile `HEALTHCHECK` read from a stage that is not built ([#9475](https://github.com/coollabsio/coolify/issues/9475))
diff --git a/.changes/domains-showing-not-checked-when-an.md b/.changes/domains-showing-not-checked-when-an.md
new file mode 100644
index 0000000000..086038c392
--- /dev/null
+++ b/.changes/domains-showing-not-checked-when-an.md
@@ -0,0 +1,8 @@
+---
+type: fixed
+commit: c3a21eceeb
+---
+Domains showing `Not checked` when an existing Cloudflare DNS record of a new domain has a different IP
+
+- Coolify replaces the record when it created the record and no other resource uses it
+- Otherwise it opens the `Configure DNS` dialog, where you can replace the record, and the domain shows the conflict
diff --git a/.changes/duplicate-and-empty-rows-in-the.md b/.changes/duplicate-and-empty-rows-in-the.md
new file mode 100644
index 0000000000..f0ff496d7d
--- /dev/null
+++ b/.changes/duplicate-and-empty-rows-in-the.md
@@ -0,0 +1,5 @@
+---
+type: fixed
+commit: b7d0e6be2a
+---
+Duplicate and empty rows in the audit log
diff --git a/.changes/duplicate-environment-variables-and-extra-copies.md b/.changes/duplicate-environment-variables-and-extra-copies.md
new file mode 100644
index 0000000000..1e10d48260
--- /dev/null
+++ b/.changes/duplicate-environment-variables-and-extra-copies.md
@@ -0,0 +1,5 @@
+---
+type: fixed
+commit: f9bde1cd7a
+---
+Duplicate environment variables, and extra copies that could not be removed ([#8041](https://github.com/coollabsio/coolify/issues/8041))
diff --git a/.changes/empty-database-backups-of-odoo-services.md b/.changes/empty-database-backups-of-odoo-services.md
new file mode 100644
index 0000000000..4980384998
--- /dev/null
+++ b/.changes/empty-database-backups-of-odoo-services.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: 232e8b8616
+---
+Empty database backups of Odoo services, which backed up only the empty `postgres` database ([#7555](https://github.com/coollabsio/coolify/issues/7555))
+
+- New backup schedules of Odoo services back up all databases by default
diff --git a/.changes/empty-disk-usage-on-the-metrics.md b/.changes/empty-disk-usage-on-the-metrics.md
new file mode 100644
index 0000000000..a6148f0788
--- /dev/null
+++ b/.changes/empty-disk-usage-on-the-metrics.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: 6254f44f16
+---
+Empty disk usage on the `Metrics` tab, the `Fleet` page and in the MCP `get_server_metrics` tool when Sentinel reports the Coolify data disk under another mount point than `/`, `/data` or `/data/coolify` ([#12448](https://github.com/coollabsio/coolify/issues/12448))
+
+- This occurs for example on a NAS where `/data` is a symlink into a data volume
diff --git a/.changes/empty-list-of-the-commit-images.md b/.changes/empty-list-of-the-commit-images.md
new file mode 100644
index 0000000000..b78337a444
--- /dev/null
+++ b/.changes/empty-list-of-the-commit-images.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: f057aaf2e6
+---
+Empty list of the commit images of Docker Compose applications on the `Rollback` page and in `GET /api/v1/applications/{uuid}/rollback-images`, since v4.5.0 ([#12446](https://github.com/coollabsio/coolify/issues/12446))
+
+- The page also shows the running commit when the Compose file has services from other images
diff --git a/.changes/ended-terminal-sessions-when-access-to.md b/.changes/ended-terminal-sessions-when-access-to.md
new file mode 100644
index 0000000000..32e9dab2e2
--- /dev/null
+++ b/.changes/ended-terminal-sessions-when-access-to.md
@@ -0,0 +1,5 @@
+---
+type: security
+commit: cdc45e5736
+---
+Ended terminal sessions when access to the server is lost ([#12416](https://github.com/coollabsio/coolify/pull/12416))
diff --git a/.changes/enforced-fixed-ssh-connection-options-on.md b/.changes/enforced-fixed-ssh-connection-options-on.md
new file mode 100644
index 0000000000..5fe15ac80b
--- /dev/null
+++ b/.changes/enforced-fixed-ssh-connection-options-on.md
@@ -0,0 +1,5 @@
+---
+type: security
+commit: cdc45e5736
+---
+Enforced fixed SSH connection options on every connection, also for health checks ([#12420](https://github.com/coollabsio/coolify/pull/12420), [#12419](https://github.com/coollabsio/coolify/pull/12419))
diff --git a/.changes/exact-start-time-in-service-backup.md b/.changes/exact-start-time-in-service-backup.md
new file mode 100644
index 0000000000..6f820e845e
--- /dev/null
+++ b/.changes/exact-start-time-in-service-backup.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: ba966846e1
+---
+Exact start time in service backup executions that is hard to read
+
+- The table shows the relative time, with the exact date in a tooltip
diff --git a/.changes/expired-sessions-kept-for-the-retention.md b/.changes/expired-sessions-kept-for-the-retention.md
new file mode 100644
index 0000000000..9fa1699db9
--- /dev/null
+++ b/.changes/expired-sessions-kept-for-the-retention.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: 960471984c
+---
+Expired sessions kept for the retention days of the database cleanup ([#7394](https://github.com/coollabsio/coolify/issues/7394))
+
+- The cleanup deletes sessions older than the session lifetime
diff --git a/.changes/failed-backups-to-s3-endpoints-with.md b/.changes/failed-backups-to-s3-endpoints-with.md
new file mode 100644
index 0000000000..5c284810e5
--- /dev/null
+++ b/.changes/failed-backups-to-s3-endpoints-with.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: 21d1ad4874
+---
+Failed backups to S3 endpoints with a path, such as `/storage/v1/s3` of Supabase Storage ([#8530](https://github.com/coollabsio/coolify/issues/8530))
+
+- Database backups, volume backups and S3 restores use curl with a presigned URL for these endpoints
diff --git a/.changes/failed-clone-of-an-application-with.md b/.changes/failed-clone-of-an-application-with.md
new file mode 100644
index 0000000000..de5bcce38a
--- /dev/null
+++ b/.changes/failed-clone-of-an-application-with.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: c94411fb92
+---
+Failed clone of an application with a fixed preview URL template, with a duplicate preview domain error and a stopped, partial clone
+
+- A clone does not copy preview deployments and gets its own from new pull requests
diff --git a/.changes/failed-docker-install-on-ubuntu-derivatives.md b/.changes/failed-docker-install-on-ubuntu-derivatives.md
new file mode 100644
index 0000000000..63e672a788
--- /dev/null
+++ b/.changes/failed-docker-install-on-ubuntu-derivatives.md
@@ -0,0 +1,8 @@
+---
+type: fixed
+commit: d6acd9a3c5
+---
+Failed Docker install on Ubuntu derivatives such as Pop!_OS and Linux Mint, and on Raspbian 13 (Trixie) ([#9455](https://github.com/coollabsio/coolify/issues/9455))
+
+- The fallback uses the Ubuntu repository with `UBUNTU_CODENAME` on Ubuntu derivatives
+- It uses the Debian repository on Raspbian 13, which has no Docker repository of its own
diff --git a/.changes/failed-image-pull-in-the-convex.md b/.changes/failed-image-pull-in-the-convex.md
new file mode 100644
index 0000000000..2c6e28f303
--- /dev/null
+++ b/.changes/failed-image-pull-in-the-convex.md
@@ -0,0 +1,5 @@
+---
+type: fixed
+commit: 3895ca05f3
+---
+Failed image pull in the Convex service template, after the rename to the `ghcr.io/convex` namespace ([#12449](https://github.com/coollabsio/coolify/issues/12449))
diff --git a/.changes/failed-parse-of-a-docker-compose.md b/.changes/failed-parse-of-a-docker-compose.md
new file mode 100644
index 0000000000..3f488940e1
--- /dev/null
+++ b/.changes/failed-parse-of-a-docker-compose.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: 455b22f26c
+---
+Failed parse of a Docker Compose file whose `services` key is empty or is not a map, and unexplained exit code 255 in failed commands
+
+- The message explains that the SSH connection to the server closed before the command finished
diff --git a/.changes/failed-s3-uploads-of-backups-larger.md b/.changes/failed-s3-uploads-of-backups-larger.md
new file mode 100644
index 0000000000..9d292d9ccb
--- /dev/null
+++ b/.changes/failed-s3-uploads-of-backups-larger.md
@@ -0,0 +1,5 @@
+---
+type: fixed
+commit: 8126a5c128
+---
+Failed S3 uploads of backups larger than about 15.6 GiB on providers that accept only 1000 parts, such as Scaleway ([#8411](https://github.com/coollabsio/coolify/issues/8411))
diff --git a/.changes/failed-sign-up-and-login-in.md b/.changes/failed-sign-up-and-login-in.md
new file mode 100644
index 0000000000..e153446c3e
--- /dev/null
+++ b/.changes/failed-sign-up-and-login-in.md
@@ -0,0 +1,8 @@
+---
+type: fixed
+commit: d3ef4d1c57
+---
+Failed sign-up and login in the Rybbit service template, `/api` requests got a 404 error ([#9055](https://github.com/coollabsio/coolify/issues/9055))
+
+- The template routes `/api` on the same domain to the backend on port 3001 and keeps the `/api` prefix
+- For an existing service, add `SERVICE_URL_RYBBIT_3001=/api` to `rybbit_backend`, move it above `rybbit` in the Docker Compose file, set `Path prefixes` to `Keep prefixes` in the advanced settings of the backend and redeploy
diff --git a/.changes/failed-startup-and-broken-public-album.md b/.changes/failed-startup-and-broken-public-album.md
new file mode 100644
index 0000000000..5deb18db80
--- /dev/null
+++ b/.changes/failed-startup-and-broken-public-album.md
@@ -0,0 +1,9 @@
+---
+type: fixed
+commit: 927e3f0b42
+---
+Failed startup and broken public album links in the Ente service templates ([#7405](https://github.com/coollabsio/coolify/issues/7405))
+
+- An albums service with its own domain serves public links
+- The images come from `ghcr.io/ente`, and the JWT secret is URL-safe so that Museum can decode it
+- With S3, the template uses the routed `MINIO_SERVER_URL` as the S3 endpoint and allows all CORS origins
diff --git a/.changes/forgejo-and-codeberg-in-the-gitea.md b/.changes/forgejo-and-codeberg-in-the-gitea.md
new file mode 100644
index 0000000000..003bec0be2
--- /dev/null
+++ b/.changes/forgejo-and-codeberg-in-the-gitea.md
@@ -0,0 +1,8 @@
+---
+type: added
+commit: a58588faa0
+---
+Forgejo and Codeberg in the Gitea App source
+
+- A `Provider` list fills in the Gitea.com or Codeberg URLs
+- Webhooks accept the `X-Forgejo-*` headers
diff --git a/.changes/generated-new-ssh-keys-as-ed25519.md b/.changes/generated-new-ssh-keys-as-ed25519.md
new file mode 100644
index 0000000000..2b0a518fde
--- /dev/null
+++ b/.changes/generated-new-ssh-keys-as-ed25519.md
@@ -0,0 +1,5 @@
+---
+type: security
+commit: cdc45e5736
+---
+Generated new SSH keys as Ed25519 and validated private keys more strictly ([#12415](https://github.com/coollabsio/coolify/pull/12415))
diff --git a/.changes/generic-error-when-a-new-private.md b/.changes/generic-error-when-a-new-private.md
new file mode 100644
index 0000000000..e128e8958f
--- /dev/null
+++ b/.changes/generic-error-when-a-new-private.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: b83b97f7e6
+---
+Generic error when a new private key cannot connect to a server ([#7980](https://github.com/coollabsio/coolify/issues/7980))
+
+- The message shows the SSH error
diff --git a/.changes/gitea-app-endpoints-in-the-api.md b/.changes/gitea-app-endpoints-in-the-api.md
new file mode 100644
index 0000000000..3cd0153479
--- /dev/null
+++ b/.changes/gitea-app-endpoints-in-the-api.md
@@ -0,0 +1,7 @@
+---
+type: added
+commit: 3bc82eb71d
+---
+Gitea App endpoints in the API and the MCP tools, `GET /gitea-apps` and `POST /applications/private-gitea-app` ([#12459](https://github.com/coollabsio/coolify/issues/12459))
+
+- `gitea_app_uuid` sets the source when you create or update an application
diff --git a/.changes/github-deployments-sync-each-deployment-and.md b/.changes/github-deployments-sync-each-deployment-and.md
new file mode 100644
index 0000000000..49c30190d6
--- /dev/null
+++ b/.changes/github-deployments-sync-each-deployment-and.md
@@ -0,0 +1,7 @@
+---
+type: added
+commit: bf4b6ad921
+---
+GitHub Deployments sync, each deployment and preview reports to GitHub Deployments with links to the log and the environment ([#12451](https://github.com/coollabsio/coolify/pull/12451))
+
+- It needs a private GitHub App with `Deployments: write`
diff --git a/.changes/hardened-smtp-and-terminal-connections.md b/.changes/hardened-smtp-and-terminal-connections.md
new file mode 100644
index 0000000000..7d8de669f9
--- /dev/null
+++ b/.changes/hardened-smtp-and-terminal-connections.md
@@ -0,0 +1,8 @@
+---
+type: security
+commit: cdc45e5736
+---
+Hardened SMTP and terminal connections
+
+- SMTP hosts are validated, and Coolify connects only to the checked address
+- The error message explains why an SMTP host is refused
diff --git a/.changes/health-checks-in-their-start-period.md b/.changes/health-checks-in-their-start-period.md
new file mode 100644
index 0000000000..86945caf50
--- /dev/null
+++ b/.changes/health-checks-in-their-start-period.md
@@ -0,0 +1,5 @@
+---
+type: fixed
+commit: 666ac84efb
+---
+Health checks in their start period shown as unknown, not as `running:starting` ([#9411](https://github.com/coollabsio/coolify/issues/9411))
diff --git a/.changes/high-cpu-use-of-dockerd-while.md b/.changes/high-cpu-use-of-dockerd-while.md
new file mode 100644
index 0000000000..63b5b52740
--- /dev/null
+++ b/.changes/high-cpu-use-of-dockerd-while.md
@@ -0,0 +1,5 @@
+---
+type: fixed
+commit: 1b571f4509
+---
+High CPU use of `dockerd` while you stream the logs of a container with a large log file ([#7693](https://github.com/coollabsio/coolify/issues/7693))
diff --git a/.changes/ignored-concurrent-build-limit-of-build.md b/.changes/ignored-concurrent-build-limit-of-build.md
new file mode 100644
index 0000000000..d0f2fa48d6
--- /dev/null
+++ b/.changes/ignored-concurrent-build-limit-of-build.md
@@ -0,0 +1,8 @@
+---
+type: fixed
+commit: e0b94662e9
+---
+Ignored concurrent build limit of build servers ([#7649](https://github.com/coollabsio/coolify/issues/7649))
+
+- Each build counts on the server that runs it, and a deployment reserves a build server with a free slot when it starts
+- A freed build server slot starts the waiting deployments of other servers
diff --git a/.changes/import-backup-from-the-resource-menu.md b/.changes/import-backup-from-the-resource-menu.md
new file mode 100644
index 0000000000..27f671b4e9
--- /dev/null
+++ b/.changes/import-backup-from-the-resource-menu.md
@@ -0,0 +1,8 @@
+---
+type: changed
+commit: 688134a994
+---
+`Import Backup` from the resource menu to an `Import backup` button on the `Backups` page of databases and services ([#11818](https://github.com/coollabsio/coolify/discussions/11818))
+
+- The button opens the import in a dialog
+- Old `Import Backup` links open the `Backups` page
diff --git a/.changes/inconsistent-status-badges-and-s3-storage.md b/.changes/inconsistent-status-badges-and-s3-storage.md
new file mode 100644
index 0000000000..1c4af5c777
--- /dev/null
+++ b/.changes/inconsistent-status-badges-and-s3-storage.md
@@ -0,0 +1,5 @@
+---
+type: fixed
+commit: b12c965fbe
+---
+Inconsistent status badges and S3 storage names in service backup tables
diff --git a/.changes/instance-database-backups-running-on-the.md b/.changes/instance-database-backups-running-on-the.md
new file mode 100644
index 0000000000..8422c84366
--- /dev/null
+++ b/.changes/instance-database-backups-running-on-the.md
@@ -0,0 +1,9 @@
+---
+type: fixed
+commit: 860e786481
+---
+Instance database backups running on the wrong server when the destination of `coolify-db` points to another one ([#8139](https://github.com/coollabsio/coolify/issues/8139))
+
+- The backup always runs on the Coolify host
+- A failed pre-update backup shows why it failed
+- The pre-update backup skips a disabled schedule
diff --git a/.changes/kept-personal-data-and-credentials-out.md b/.changes/kept-personal-data-and-credentials-out.md
new file mode 100644
index 0000000000..416d6c72da
--- /dev/null
+++ b/.changes/kept-personal-data-and-credentials-out.md
@@ -0,0 +1,7 @@
+---
+type: security
+commit: 3379fa448a
+---
+Kept personal data and credentials out of audit events
+
+- The audit events of a deleted user are anonymized
diff --git a/.changes/kept-stored-private-keys-out-of.md b/.changes/kept-stored-private-keys-out-of.md
new file mode 100644
index 0000000000..b4b6ccacf3
--- /dev/null
+++ b/.changes/kept-stored-private-keys-out-of.md
@@ -0,0 +1,5 @@
+---
+type: security
+commit: cdc45e5736
+---
+Kept stored private keys out of the browser ([#12423](https://github.com/coollabsio/coolify/pull/12423))
diff --git a/.changes/kept-the-sentinel-token-out-of.md b/.changes/kept-the-sentinel-token-out-of.md
new file mode 100644
index 0000000000..c1d1465e58
--- /dev/null
+++ b/.changes/kept-the-sentinel-token-out-of.md
@@ -0,0 +1,7 @@
+---
+type: security
+commit: cdc45e5736
+---
+Kept the Sentinel token out of process arguments ([#12402](https://github.com/coollabsio/coolify/pull/12402))
+
+- Sentinel reads it from an env file
diff --git a/.changes/limited-api-clients-that-keep-failing.md b/.changes/limited-api-clients-that-keep-failing.md
new file mode 100644
index 0000000000..80bab0ad11
--- /dev/null
+++ b/.changes/limited-api-clients-that-keep-failing.md
@@ -0,0 +1,8 @@
+---
+type: security
+commit: 13298591d8
+---
+Limited API clients that keep failing to 30 failed requests per minute for one token or IP
+
+- More failed requests get `429`, `API_FAILED_REQUEST_RATE_LIMIT` sets the limit
+- The team of the token gets one notification a day when the token reaches the limit
diff --git a/.changes/limited-the-cloud-provider-token-api.md b/.changes/limited-the-cloud-provider-token-api.md
new file mode 100644
index 0000000000..a662548647
--- /dev/null
+++ b/.changes/limited-the-cloud-provider-token-api.md
@@ -0,0 +1,8 @@
+---
+type: changed
+breaking: true
+commit: cdc45e5736
+---
+Limited the cloud provider token API to team admins and owners
+
+- Other members get `403`
diff --git a/.changes/litellm-service-template-with-a-master.md b/.changes/litellm-service-template-with-a-master.md
new file mode 100644
index 0000000000..88b24eaca8
--- /dev/null
+++ b/.changes/litellm-service-template-with-a-master.md
@@ -0,0 +1,9 @@
+---
+type: fixed
+commit: a487d7c9d3
+---
+LiteLLM service template with a master key that did not start with `sk-` ([#10521](https://github.com/coollabsio/coolify/issues/10521))
+
+- The admin API key is `sk-` followed by the value of `SERVICE_PASSWORD_MASTERKEY`
+- A separate `LITELLM_SALT_KEY` keeps stored model credentials readable when the master key changes
+- `STORE_MODEL_IN_DB` is `True` by default, so you can add models in the LiteLLM UI
diff --git a/.changes/live-updates-such-as-proxy-restart.md b/.changes/live-updates-such-as-proxy-restart.md
new file mode 100644
index 0000000000..c9bfe53126
--- /dev/null
+++ b/.changes/live-updates-such-as-proxy-restart.md
@@ -0,0 +1,5 @@
+---
+type: fixed
+commit: c8c639e3d6
+---
+Live updates, such as proxy restart logs, that did not reach the browser, because the WebSocket handshake failed with `413` with large cookie headers
diff --git a/.changes/localhost-server-page-that-did-not.md b/.changes/localhost-server-page-that-did-not.md
new file mode 100644
index 0000000000..0c9521f01c
--- /dev/null
+++ b/.changes/localhost-server-page-that-did-not.md
@@ -0,0 +1,5 @@
+---
+type: fixed
+commit: ca27224628
+---
+Localhost server page that did not refresh after its connection is validated
diff --git a/.changes/locked-environment-variables-that-could-not.md b/.changes/locked-environment-variables-that-could-not.md
new file mode 100644
index 0000000000..f58a7f6a9e
--- /dev/null
+++ b/.changes/locked-environment-variables-that-could-not.md
@@ -0,0 +1,8 @@
+---
+type: fixed
+commit: da7779d061
+---
+Locked environment variables that could not be changed, unlocked or deleted when Docker Compose uses them ([#6803](https://github.com/coollabsio/coolify/issues/6803))
+
+- A locked value can be replaced without showing it
+- The lock is permanent in the UI, the API and MCP, and `Lock` asks for confirmation
diff --git a/.changes/lost-audit-events-12433-https-github.md b/.changes/lost-audit-events-12433-https-github.md
new file mode 100644
index 0000000000..9f20adf9c2
--- /dev/null
+++ b/.changes/lost-audit-events-12433-https-github.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: cdc45e5736
+---
+Lost audit events ([#12433](https://github.com/coollabsio/coolify/pull/12433))
+
+- Coolify writes audit events at commit time
diff --git a/.changes/lost-telegram-notifications-when-telegram-rejects.md b/.changes/lost-telegram-notifications-when-telegram-rejects.md
new file mode 100644
index 0000000000..dc5cbf8e97
--- /dev/null
+++ b/.changes/lost-telegram-notifications-when-telegram-rejects.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: a7b7aa350a
+---
+Lost Telegram notifications when Telegram rejects a button URL, for example localhost or an IP address without a domain ([#8269](https://github.com/coollabsio/coolify/issues/8269))
+
+- Coolify then sends the links as text
diff --git a/.changes/lost-trailing-newline-of-multiline-environment.md b/.changes/lost-trailing-newline-of-multiline-environment.md
new file mode 100644
index 0000000000..6bbb1945ec
--- /dev/null
+++ b/.changes/lost-trailing-newline-of-multiline-environment.md
@@ -0,0 +1,9 @@
+---
+type: fixed
+commit: 52a78cdb0f
+---
+Lost trailing newline of multiline environment variables, so OpenSSH rejected an SSH private key with "error in libcrypto" ([#9438](https://github.com/coollabsio/coolify/issues/9438))
+
+- A value with more than one line is saved exactly as you enter it, in the UI and in the API
+- Single-line values still lose their edge whitespace
+- Save a variable again to add the newline that Coolify removed
diff --git a/.changes/lost-update-channel-in-settings-updates.md b/.changes/lost-update-channel-in-settings-updates.md
new file mode 100644
index 0000000000..6950fa914c
--- /dev/null
+++ b/.changes/lost-update-channel-in-settings-updates.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: 7e7f491749
+---
+Lost update channel in `Settings` > `Updates` and lost healthcheck `Check type` when one of them is the only change
+
+- The `Save changes` bar opens for them
diff --git a/.changes/maintenance-mode-to-its-own-maintenance.md b/.changes/maintenance-mode-to-its-own-maintenance.md
new file mode 100644
index 0000000000..25630ea198
--- /dev/null
+++ b/.changes/maintenance-mode-to-its-own-maintenance.md
@@ -0,0 +1,5 @@
+---
+type: changed
+commit: 17a9fa624e
+---
+Maintenance mode to its own `Maintenance` page of applications and services, and you must confirm the toggle
diff --git a/.changes/missing-check-of-the-closest-cloudflare.md b/.changes/missing-check-of-the-closest-cloudflare.md
new file mode 100644
index 0000000000..70dc51bde5
--- /dev/null
+++ b/.changes/missing-check-of-the-closest-cloudflare.md
@@ -0,0 +1,5 @@
+---
+type: fixed
+commit: e20e652c00
+---
+Missing check of the closest Cloudflare wildcard record for deeper domain names, such as `app.apps.example.com` through `*.example.com` ([#12436](https://github.com/coollabsio/coolify/issues/12436))
diff --git a/.changes/missing-cloudflare-dns-record-when-you.md b/.changes/missing-cloudflare-dns-record-when-you.md
new file mode 100644
index 0000000000..c30b763a85
--- /dev/null
+++ b/.changes/missing-cloudflare-dns-record-when-you.md
@@ -0,0 +1,8 @@
+---
+type: fixed
+commit: daf0e1a70c
+---
+Missing Cloudflare DNS record when you edit a domain to a hostname in a connected Cloudflare zone, for example a generated domain changed to your own domain
+
+- Coolify adds the record automatically or opens the `Configure DNS` dialog, as it did only for new domains
+- This applies to the `Domains` pages, the application and service application settings and the service application API
diff --git a/.changes/missing-disabled-server-message-on-the.md b/.changes/missing-disabled-server-message-on-the.md
new file mode 100644
index 0000000000..7db79d7eb5
--- /dev/null
+++ b/.changes/missing-disabled-server-message-on-the.md
@@ -0,0 +1,5 @@
+---
+type: fixed
+commit: eb5f238a45
+---
+Missing disabled server message on the localhost server page ([#12475](https://github.com/coollabsio/coolify/issues/12475))
diff --git a/.changes/missing-git-error-reason-when-coolify.md b/.changes/missing-git-error-reason-when-coolify.md
new file mode 100644
index 0000000000..3982b272e0
--- /dev/null
+++ b/.changes/missing-git-error-reason-when-coolify.md
@@ -0,0 +1,5 @@
+---
+type: fixed
+commit: 3f51c251c0
+---
+Missing Git error reason when Coolify cannot read a repository
diff --git a/.changes/missing-links-to-the-provider-dashboards.md b/.changes/missing-links-to-the-provider-dashboards.md
new file mode 100644
index 0000000000..cdcb7c50fe
--- /dev/null
+++ b/.changes/missing-links-to-the-provider-dashboards.md
@@ -0,0 +1,5 @@
+---
+type: fixed
+commit: 693cf0486d
+---
+Missing links to the provider dashboards on the secret manager token forms
diff --git a/.changes/missing-project-environment-and-service-in.md b/.changes/missing-project-environment-and-service-in.md
new file mode 100644
index 0000000000..d821ce2054
--- /dev/null
+++ b/.changes/missing-project-environment-and-service-in.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: 8d07d178f0
+---
+Missing project, environment and service in Fluent Bit log drains for containers without the Coolify default variables ([#8415](https://github.com/coollabsio/coolify/issues/8415))
+
+- The `fluentd` driver also sends the Coolify container labels, and the built-in configurations use them as a fallback
diff --git a/.changes/missing-resource-status-changes-notification-when.md b/.changes/missing-resource-status-changes-notification-when.md
new file mode 100644
index 0000000000..820c46c569
--- /dev/null
+++ b/.changes/missing-resource-status-changes-notification-when.md
@@ -0,0 +1,9 @@
+---
+type: fixed
+commit: f21acdc3e4
+---
+Missing `Resource status changes` notification when an application, preview, service or database stops unexpectedly, for example after a crash or `docker kill` ([#9493](https://github.com/coollabsio/coolify/issues/9493))
+
+- Coolify waits 2 minutes and notifies only when the resource is still stopped
+- A stop, restart or redeploy from Coolify sends no notification
+- The same resource sends at most one notification in 15 minutes
diff --git a/.changes/missing-traefik-proxy-outdated-notification-when.md b/.changes/missing-traefik-proxy-outdated-notification-when.md
new file mode 100644
index 0000000000..1b427b52e2
--- /dev/null
+++ b/.changes/missing-traefik-proxy-outdated-notification-when.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: 2fbe9d2abe
+---
+Missing `Traefik Proxy Outdated` notification when a newer Traefik patch version of the running branch is available ([#9727](https://github.com/coollabsio/coolify/issues/9727))
+
+- Coolify sends one notification for each new patch version, not one for each hourly check
diff --git a/.changes/moved-the-resend-sender-to-the.md b/.changes/moved-the-resend-sender-to-the.md
new file mode 100644
index 0000000000..0196275f39
--- /dev/null
+++ b/.changes/moved-the-resend-sender-to-the.md
@@ -0,0 +1,8 @@
+---
+type: changed
+breaking: true
+commit: f7867923b7
+---
+Moved the Resend sender to the new `resend_from_address` and `resend_from_name` fields, API clients must use the new fields
+
+- A migration copies the current values
diff --git a/.changes/names-and-descriptions-saved-through-the.md b/.changes/names-and-descriptions-saved-through-the.md
new file mode 100644
index 0000000000..7f09b19e8b
--- /dev/null
+++ b/.changes/names-and-descriptions-saved-through-the.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: 32541a32ce
+---
+Names and descriptions saved through the API and the MCP server that the UI rejects, so the resource could not be saved in the UI afterwards ([#12466](https://github.com/coollabsio/coolify/issues/12466))
+
+- Applications, services, databases, servers and private keys use the rules and the error messages of the UI
diff --git a/.changes/nested-test-key-in-the-api.md b/.changes/nested-test-key-in-the-api.md
new file mode 100644
index 0000000000..c51afeec06
--- /dev/null
+++ b/.changes/nested-test-key-in-the-api.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: 05e52fc41d
+---
+Nested `test` key in the `api` service when you update the image of a service named like `api.test` ([#12456](https://github.com/coollabsio/coolify/issues/12456))
+
+- A service name that Docker cannot use as a container name prefix gets a clear error on save
diff --git a/.changes/network-error-when-you-sign-in.md b/.changes/network-error-when-you-sign-in.md
new file mode 100644
index 0000000000..4fe9d671af
--- /dev/null
+++ b/.changes/network-error-when-you-sign-in.md
@@ -0,0 +1,8 @@
+---
+type: fixed
+commit: e9028e1338
+---
+"Network error" when you sign in with email in AppFlowy Web ([#10545](https://github.com/coollabsio/coolify/issues/10545))
+
+- The template sets `GOTRUE_CORS_ALLOWED_HEADERS=redirect_to`
+- For an existing service, add this variable to the `gotrue` service in the Docker Compose file and restart the service
diff --git a/.changes/new-rsa-deploy-keys-that-github.md b/.changes/new-rsa-deploy-keys-that-github.md
new file mode 100644
index 0000000000..b96ea3435e
--- /dev/null
+++ b/.changes/new-rsa-deploy-keys-that-github.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: 4bdf03db69
+---
+New RSA deploy keys that GitHub rejected, because Coolify made 2048-bit keys ([#12461](https://github.com/coollabsio/coolify/issues/12461))
+
+- New RSA keys are 4096 bits
diff --git a/.changes/oauth-redirect-uris-that-silently-sent.md b/.changes/oauth-redirect-uris-that-silently-sent.md
new file mode 100644
index 0000000000..d9f1ae7ef4
--- /dev/null
+++ b/.changes/oauth-redirect-uris-that-silently-sent.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: 3dc89cfe05
+---
+OAuth redirect URIs that silently sent the user back to the login page
+
+- A redirect URI must point at the callback route of the provider, any other path gets a validation error
diff --git a/.changes/old-cached-image-in-the-usesend.md b/.changes/old-cached-image-in-the-usesend.md
new file mode 100644
index 0000000000..ea0e4d5bc1
--- /dev/null
+++ b/.changes/old-cached-image-in-the-usesend.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: 7ec000ab86
+---
+Old cached image in the Usesend service template, which used `latest` ([#12443](https://github.com/coollabsio/coolify/issues/12443))
+
+- The template pins `usesend/usesend:v1.10.0`, which has the Next.js, Node.js 24 and nodemailer security updates
diff --git a/.changes/one-email-provider-list-with-none.md b/.changes/one-email-provider-list-with-none.md
new file mode 100644
index 0000000000..81acd857e7
--- /dev/null
+++ b/.changes/one-email-provider-list-with-none.md
@@ -0,0 +1,5 @@
+---
+type: added
+commit: f7867923b7
+---
+One email provider list with None, SMTP and Resend, more than one named SMTP server with its own sender, and SMTP templates for common providers ([#12471](https://github.com/coollabsio/coolify/pull/12471))
diff --git a/.changes/outline-service-template-restarting-in-a.md b/.changes/outline-service-template-restarting-in-a.md
new file mode 100644
index 0000000000..ffd8a7f246
--- /dev/null
+++ b/.changes/outline-service-template-restarting-in-a.md
@@ -0,0 +1,8 @@
+---
+type: fixed
+commit: dd8ea3dc93
+---
+Outline service template restarting in a loop with `syntax error at or near "TRIGGER"` on `postgres:12-alpine` ([#12345](https://github.com/coollabsio/coolify/issues/12345))
+
+- New services use PostgreSQL 16
+- An existing service keeps PostgreSQL 12, the Outline service documentation has the steps to upgrade it
diff --git a/.changes/paid-coolify-cloud-subscriptions-that-lost.md b/.changes/paid-coolify-cloud-subscriptions-that-lost.md
new file mode 100644
index 0000000000..5c5a4f92e8
--- /dev/null
+++ b/.changes/paid-coolify-cloud-subscriptions-that-lost.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: d333f3f6e6
+---
+Paid Coolify Cloud subscriptions that lost their link to Stripe staying active after the customer cancels them
+
+- `cloud:sync-stripe-subscriptions` reports them
diff --git a/.changes/pinned-the-ssh-host-key-of.md b/.changes/pinned-the-ssh-host-key-of.md
new file mode 100644
index 0000000000..43466fea25
--- /dev/null
+++ b/.changes/pinned-the-ssh-host-key-of.md
@@ -0,0 +1,7 @@
+---
+type: security
+commit: cdc45e5736
+---
+Pinned the SSH host key of a server on the first connection, the team gets a notification when it changes ([#12418](https://github.com/coollabsio/coolify/pull/12418))
+
+- `SSH_HOST_KEY_CHECKING` sets the mode: `warn`, `enforce` or `off`
diff --git a/.changes/pinned-the-ssh-host-keys-of.md b/.changes/pinned-the-ssh-host-keys-of.md
new file mode 100644
index 0000000000..82de6eedd2
--- /dev/null
+++ b/.changes/pinned-the-ssh-host-keys-of.md
@@ -0,0 +1,7 @@
+---
+type: security
+commit: cdc45e5736
+---
+Pinned the SSH host keys of Git hosts across deployments ([#12421](https://github.com/coollabsio/coolify/pull/12421))
+
+- Coolify shows the published host keys of GitHub, GitLab and Bitbucket
diff --git a/.changes/port-warning-on-a-service-domain.md b/.changes/port-warning-on-a-service-domain.md
new file mode 100644
index 0000000000..4f1a4c7948
--- /dev/null
+++ b/.changes/port-warning-on-a-service-domain.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: 53e21abe97
+---
+Port warning on a service domain without a port, although Coolify routes it to the required port
+
+- The edit dialog shows the effective port, and the warning buttons name the ports
diff --git a/.changes/rebuilt-docker-layers-when-a-preview.md b/.changes/rebuilt-docker-layers-when-a-preview.md
new file mode 100644
index 0000000000..2faf55c5b7
--- /dev/null
+++ b/.changes/rebuilt-docker-layers-when-a-preview.md
@@ -0,0 +1,8 @@
+---
+type: fixed
+commit: e7e952fcad
+---
+Rebuilt Docker layers when a preview comes or goes, and unreachable hosts on a build server ([#12452](https://github.com/coollabsio/coolify/issues/12452))
+
+- Preview containers and the hosts of the deployment server stay out of `--add-host` on a build server
+- A setting of the application turns off the network hosts during the build
diff --git a/.changes/rebuilt-docker-layers-when-a-short.md b/.changes/rebuilt-docker-layers-when-a-short.md
new file mode 100644
index 0000000000..6748fb9593
--- /dev/null
+++ b/.changes/rebuilt-docker-layers-when-a-short.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: 6ab538d0f1
+---
+Rebuilt Docker layers when a short-lived container joins or leaves the network between two builds ([#12452](https://github.com/coollabsio/coolify/issues/12452))
+
+- Database backup and S3 import helpers, Sentinel and the proxy error page container stay out of `--add-host`
diff --git a/.changes/redis-health-check-that-always-passed.md b/.changes/redis-health-check-that-always-passed.md
new file mode 100644
index 0000000000..22eebc91f4
--- /dev/null
+++ b/.changes/redis-health-check-that-always-passed.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: 878d77bd66
+---
+Redis health check that always passed, because it did not ping the database
+
+- The check pings with the password and requires `PONG`
diff --git a/.changes/refused-servers-with-the-same-ip.md b/.changes/refused-servers-with-the-same-ip.md
new file mode 100644
index 0000000000..48e8882afc
--- /dev/null
+++ b/.changes/refused-servers-with-the-same-ip.md
@@ -0,0 +1,5 @@
+---
+type: fixed
+commit: ecb14e6cd5
+---
+Refused servers with the same IP and different SSH ports ([#7573](https://github.com/coollabsio/coolify/issues/7573))
diff --git a/.changes/resource-limits-shown-for-docker-compose.md b/.changes/resource-limits-shown-for-docker-compose.md
new file mode 100644
index 0000000000..334cd175f1
--- /dev/null
+++ b/.changes/resource-limits-shown-for-docker-compose.md
@@ -0,0 +1,5 @@
+---
+type: fixed
+commit: cdc45e5736
+---
+Resource limits shown for Docker Compose applications
diff --git a/.changes/restricted-preview-changes-rollbacks-and-repository.md b/.changes/restricted-preview-changes-rollbacks-and-repository.md
new file mode 100644
index 0000000000..e50cfda6a7
--- /dev/null
+++ b/.changes/restricted-preview-changes-rollbacks-and-repository.md
@@ -0,0 +1,9 @@
+---
+type: security
+commit: c75e7078b7
+---
+Restricted preview changes, rollbacks and repository URL changes
+
+- Opening a preview or changing its pull request URL, Git type or Docker tag through the API needs write access, a deploy token can only redeploy an existing preview
+- A rollback goes only to a listed rollback image or a successful production deployment
+- A new `git_repository` of an application is validated like in the UI
diff --git a/.changes/rotate-key-on-private-keys-which.md b/.changes/rotate-key-on-private-keys-which.md
new file mode 100644
index 0000000000..ba88933da8
--- /dev/null
+++ b/.changes/rotate-key-on-private-keys-which.md
@@ -0,0 +1,10 @@
+---
+type: added
+commit: cdc45e5736
+---
+`Rotate key` on private keys, which replaces a key on all servers that use it ([#12422](https://github.com/coollabsio/coolify/pull/12422))
+
+- Coolify adds the new key to `authorized_keys`, can undo the rotation, and removes the old key
+- A server delete can remove the key from `authorized_keys`
+- Coolify deletes unused SSH key files every hour
+- The button shows only when a server uses the key
diff --git a/.changes/sentinel-that-kept-pushing-after-its.md b/.changes/sentinel-that-kept-pushing-after-its.md
new file mode 100644
index 0000000000..b564ce3dcf
--- /dev/null
+++ b/.changes/sentinel-that-kept-pushing-after-its.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: 5c34a1b3d4
+---
+Sentinel that kept pushing after its server was deleted or its team stopped paying
+
+- Coolify removes the Sentinel container of unpaid servers once a day and before a server is deleted
diff --git a/.changes/server-page-that-did-not-refresh.md b/.changes/server-page-that-did-not-refresh.md
new file mode 100644
index 0000000000..612cf07be3
--- /dev/null
+++ b/.changes/server-page-that-did-not-refresh.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: 30a8e3357a
+---
+Server page that did not refresh after a background validation
+
+- The validation dialog that a background job opens closes when the job finishes
diff --git a/.changes/server-shared-variables-that-did-not.md b/.changes/server-shared-variables-that-did-not.md
new file mode 100644
index 0000000000..e5aae7a3ff
--- /dev/null
+++ b/.changes/server-shared-variables-that-did-not.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: 106a6d7ac0
+---
+Server shared variables that did not resolve in Docker Compose files
+
+- Their values are redacted in the rendered Compose file
diff --git a/.changes/server-usage-in-the-server-table.md b/.changes/server-usage-in-the-server-table.md
new file mode 100644
index 0000000000..6b75ccb8f0
--- /dev/null
+++ b/.changes/server-usage-in-the-server-table.md
@@ -0,0 +1,5 @@
+---
+type: added
+commit: cab5ae9903
+---
+Server usage in the server table of the dashboard on mobile
diff --git a/.changes/servers-that-refused-new-ssh-logins.md b/.changes/servers-that-refused-new-ssh-logins.md
new file mode 100644
index 0000000000..c3ca975f1f
--- /dev/null
+++ b/.changes/servers-that-refused-new-ssh-logins.md
@@ -0,0 +1,8 @@
+---
+type: fixed
+commit: 5431d4954d
+---
+Servers that refused new SSH logins with "Maximum number of sessions (8192) reached", because each connection check opened three SSH logins ([#9148](https://github.com/coollabsio/coolify/issues/9148))
+
+- The Docker and Docker Compose version checks use the multiplexed SSH connection, so each check opens one login
+- To remove the stuck sessions, run `systemctl restart systemd-logind` on the server
diff --git a/.changes/service-backup-path-that-could-not.md b/.changes/service-backup-path-that-could-not.md
new file mode 100644
index 0000000000..e89de9c840
--- /dev/null
+++ b/.changes/service-backup-path-that-could-not.md
@@ -0,0 +1,5 @@
+---
+type: fixed
+commit: 3115980c77
+---
+Service backup path that could not be copied, and an S3 badge on runs that are not stored in S3
diff --git a/.changes/service-backup-tables-that-were-not.md b/.changes/service-backup-tables-that-were-not.md
new file mode 100644
index 0000000000..052d2766e3
--- /dev/null
+++ b/.changes/service-backup-tables-that-were-not.md
@@ -0,0 +1,5 @@
+---
+type: fixed
+commit: 7fbc5d7797
+---
+Service backup tables that were not aligned or sortable by column
diff --git a/.changes/service-resource-cards-showing-a-starting.md b/.changes/service-resource-cards-showing-a-starting.md
new file mode 100644
index 0000000000..3267150ab4
--- /dev/null
+++ b/.changes/service-resource-cards-showing-a-starting.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: 50af95a70b
+---
+Service resource cards showing a starting health check as success ([#9411](https://github.com/coollabsio/coolify/issues/9411))
+
+- The card shows it as a warning
diff --git a/.changes/service-resource-cards-that-did-not.md b/.changes/service-resource-cards-that-did-not.md
new file mode 100644
index 0000000000..2b07ebf621
--- /dev/null
+++ b/.changes/service-resource-cards-that-did-not.md
@@ -0,0 +1,5 @@
+---
+type: fixed
+commit: 4d932b3078
+---
+Service resource cards that did not update their status together with the heading badge
diff --git a/.changes/sftp-ftps-and-webdav-backup-storages.md b/.changes/sftp-ftps-and-webdav-backup-storages.md
new file mode 100644
index 0000000000..97a8efdc59
--- /dev/null
+++ b/.changes/sftp-ftps-and-webdav-backup-storages.md
@@ -0,0 +1,7 @@
+---
+type: added
+commit: 0db8f60bdd
+---
+SFTP, FTPS and WebDAV backup storages for database and volume backups, with downloads, retention and restores ([#12417](https://github.com/coollabsio/coolify/pull/12417))
+
+- SFTP restores and downloads need a host key that an admin saved with a validation
diff --git a/.changes/startup-and-the-nightly-cleanup-of.md b/.changes/startup-and-the-nightly-cleanup-of.md
new file mode 100644
index 0000000000..b9c85a1f4d
--- /dev/null
+++ b/.changes/startup-and-the-nightly-cleanup-of.md
@@ -0,0 +1,8 @@
+---
+type: fixed
+commit: 9c6138fe18
+---
+Startup and the nightly cleanup of stuck resources stopping with "Allowed memory size exhausted" on instances with many large deployment logs ([#12435](https://github.com/coollabsio/coolify/issues/12435))
+
+- Stuck deployments, tasks and backups are marked as failed, and the proxy configuration is set up
+- Database backup pages and `Settings` > `Backup` do not load all executions on each request
diff --git a/.changes/supabase-studio-showing-the-api-logs.md b/.changes/supabase-studio-showing-the-api-logs.md
new file mode 100644
index 0000000000..7f71aa5f05
--- /dev/null
+++ b/.changes/supabase-studio-showing-the-api-logs.md
@@ -0,0 +1,8 @@
+---
+type: fixed
+commit: 8f7d1be7a9
+---
+Supabase Studio showing the API logs of another stack when two Supabase services run on one server ([#10324](https://github.com/coollabsio/coolify/issues/10324))
+
+- The Vector container of the template reads only the logs of its own stack
+- An existing service keeps its `vector.yml`, to fix it add `include_labels: ['com.docker.compose.project=${COOLIFY_RESOURCE_UUID}']` under `sources.docker_host` in `/data/coolify/services/<service-uuid>/volumes/logs/vector.yml` and restart the service
diff --git a/.changes/the-data-retention-of-unsubscribed-teams.md b/.changes/the-data-retention-of-unsubscribed-teams.md
new file mode 100644
index 0000000000..733deeea46
--- /dev/null
+++ b/.changes/the-data-retention-of-unsubscribed-teams.md
@@ -0,0 +1,7 @@
+---
+type: changed
+commit: 997396b926
+---
+The data retention of unsubscribed teams on Coolify Cloud from 30 to 60 days
+
+- The cleanup saves the deleted users to `cloud-deleted-users.csv` on the backups disk
diff --git a/.changes/the-default-image-of-new-redis.md b/.changes/the-default-image-of-new-redis.md
new file mode 100644
index 0000000000..c7786157e7
--- /dev/null
+++ b/.changes/the-default-image-of-new-redis.md
@@ -0,0 +1,7 @@
+---
+type: changed
+commit: b7dc2e435b
+---
+The default image of new Redis databases to `valkey/valkey:9-alpine`
+
+- Existing databases keep their image
diff --git a/.changes/the-default-images-of-new-databases.md b/.changes/the-default-images-of-new-databases.md
new file mode 100644
index 0000000000..e898aef875
--- /dev/null
+++ b/.changes/the-default-images-of-new-databases.md
@@ -0,0 +1,7 @@
+---
+type: changed
+commit: 70adcc2b0e
+---
+The default images of new databases to PostgreSQL 18, MongoDB 9, MySQL 9.7, MariaDB 12.3 and ClickHouse 26.8
+
+- Existing databases keep their image
diff --git a/.changes/the-default-images-on-the-new.md b/.changes/the-default-images-on-the-new.md
new file mode 100644
index 0000000000..b797991103
--- /dev/null
+++ b/.changes/the-default-images-on-the-new.md
@@ -0,0 +1,5 @@
+---
+type: changed
+commit: 145569bea6
+---
+The default images on the new resource page to Supabase PostgreSQL 17.11.0.018 and PostGIS 18-3.7-alpine
diff --git a/.changes/the-finish-time-of-recent-deployments.md b/.changes/the-finish-time-of-recent-deployments.md
new file mode 100644
index 0000000000..05bfbab04c
--- /dev/null
+++ b/.changes/the-finish-time-of-recent-deployments.md
@@ -0,0 +1,5 @@
+---
+type: added
+commit: 1652a1d091
+---
+The finish time of recent deployments on the dashboard
diff --git a/.changes/the-logo-and-name-of-the.md b/.changes/the-logo-and-name-of-the.md
new file mode 100644
index 0000000000..7c2296175e
--- /dev/null
+++ b/.changes/the-logo-and-name-of-the.md
@@ -0,0 +1,5 @@
+---
+type: added
+commit: 973cd8684a
+---
+The logo and name of the resource on the resource creation screen
diff --git a/.changes/the-notifications-of-scheduled-jobs-that.md b/.changes/the-notifications-of-scheduled-jobs-that.md
new file mode 100644
index 0000000000..7d32cebc62
--- /dev/null
+++ b/.changes/the-notifications-of-scheduled-jobs-that.md
@@ -0,0 +1,13 @@
+---
+type: changed
+commit: 06c41f57d6
+---
+The notifications of scheduled jobs that keep failing, to the first failure and then at most once a day
+
+- This covers scheduled tasks, database backups, storage backups and Docker cleanup
+- The first successful run after a failure sends one "works again" notification to the failure channels
+- A database backup whose S3 upload keeps failing also notifies at most once a day
+- A scheduled task disables itself after 10 failures in a row when the first failure is more than 24 hours old, one notification and the task page give the reason, and enabling the task again clears it
+- The scheduled tasks API returns `consecutive_failures`, `failing_since` and `disabled_reason`
+- Backups and Docker cleanup are never disabled automatically, so they start again by themselves after an outage
+- A scheduled task skips a run when the application or service has no running container, without a notification and without a count toward the automatic disable
diff --git a/.changes/the-orbit-service-template-a-self.md b/.changes/the-orbit-service-template-a-self.md
new file mode 100644
index 0000000000..63aa31957b
--- /dev/null
+++ b/.changes/the-orbit-service-template-a-self.md
@@ -0,0 +1,5 @@
+---
+type: added
+commit: abea0747ed
+---
+The Orbit service template, a self-hosted workspace for teams with tasks, docs, chat and an MCP server for AI clients
diff --git a/.changes/the-security-settings-of-a-server.md b/.changes/the-security-settings-of-a-server.md
new file mode 100644
index 0000000000..46a3027743
--- /dev/null
+++ b/.changes/the-security-settings-of-a-server.md
@@ -0,0 +1,5 @@
+---
+type: changed
+commit: cdc45e5736
+---
+The security settings of a server to one `Security` page with patches, terminal access, SSH host key and image scanning
diff --git a/.changes/the-sentinel-version-to-1-1.md b/.changes/the-sentinel-version-to-1-1.md
new file mode 100644
index 0000000000..b87d2a3bbb
--- /dev/null
+++ b/.changes/the-sentinel-version-to-1-1.md
@@ -0,0 +1,5 @@
+---
+type: changed
+commit: 54da974045
+---
+The Sentinel version to 1.1.5
diff --git a/.changes/the-unused-minio-client-from-the.md b/.changes/the-unused-minio-client-from-the.md
new file mode 100644
index 0000000000..e9ae5ba821
--- /dev/null
+++ b/.changes/the-unused-minio-client-from-the.md
@@ -0,0 +1,5 @@
+---
+type: removed
+commit: 91985acf42
+---
+The unused MinIO client from the Coolify image ([#12491](https://github.com/coollabsio/coolify/pull/12491))
diff --git a/.changes/tooltips-on-close-and-dismiss-buttons.md b/.changes/tooltips-on-close-and-dismiss-buttons.md
new file mode 100644
index 0000000000..afb91e0880
--- /dev/null
+++ b/.changes/tooltips-on-close-and-dismiss-buttons.md
@@ -0,0 +1,5 @@
+---
+type: fixed
+commit: b1a20fabd4
+---
+Tooltips on close and dismiss buttons that stayed visible
diff --git a/.changes/two-deployments-of-one-application-running.md b/.changes/two-deployments-of-one-application-running.md
new file mode 100644
index 0000000000..e9f60dbe3a
--- /dev/null
+++ b/.changes/two-deployments-of-one-application-running.md
@@ -0,0 +1,9 @@
+---
+type: fixed
+commit: bb6dfd147e
+---
+Two deployments of one application running at once when started from the MCP `deploy` tool or the MCP `control` start action, which could stop the application ([#12442](https://github.com/coollabsio/coolify/issues/12442))
+
+- They queue behind a deployment in progress, as the API and the `Deploy` button do
+- A deployment of the same commit is skipped, and the response gives the UUID of the deployment in progress
+- A rolling update removes only the containers that ran before it started
diff --git a/.changes/unexplained-uuid-prefix-on-the-names.md b/.changes/unexplained-uuid-prefix-on-the-names.md
new file mode 100644
index 0000000000..003e46e78f
--- /dev/null
+++ b/.changes/unexplained-uuid-prefix-on-the-names.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: e0ae59deca
+---
+Unexplained UUID prefix on the names of new volumes ([#8620](https://github.com/coollabsio/coolify/issues/8620))
+
+- The dialog explains that Coolify adds the prefix so that the volume name is unique on the server
diff --git a/.changes/unreadable-accent-text-and-fills-in.md b/.changes/unreadable-accent-text-and-fills-in.md
new file mode 100644
index 0000000000..7fed10b446
--- /dev/null
+++ b/.changes/unreadable-accent-text-and-fills-in.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: 6518734935
+---
+Unreadable accent text and fills in custom themes ([#12468](https://github.com/coollabsio/coolify/issues/12468))
+
+- Accent text reaches a contrast of 4.5:1 on the page and in the sidebar, and the preview shows the real fill
diff --git a/.changes/unreadable-account-menu-entries-such-as.md b/.changes/unreadable-account-menu-entries-such-as.md
new file mode 100644
index 0000000000..4a1fcc31d6
--- /dev/null
+++ b/.changes/unreadable-account-menu-entries-such-as.md
@@ -0,0 +1,5 @@
+---
+type: fixed
+commit: 5eee9933ca
+---
+Unreadable account menu entries, such as `Log out`, when a custom theme sidebar uses the other light or dark scheme than the page ([#12467](https://github.com/coollabsio/coolify/issues/12467))
diff --git a/.changes/upgrade-modal-that-did-not-finish.md b/.changes/upgrade-modal-that-did-not-finish.md
new file mode 100644
index 0000000000..e323813ad2
--- /dev/null
+++ b/.changes/upgrade-modal-that-did-not-finish.md
@@ -0,0 +1,8 @@
+---
+type: fixed
+commit: dec776025e
+---
+Upgrade modal that did not finish when the new version answered ([#8024](https://github.com/coollabsio/coolify/issues/8024))
+
+- The modal shows success as soon as the new version is up
+- Livewire error pages stay hidden while an upgrade runs
diff --git a/.changes/validated-webhook-urls-limited-dns-lookups.md b/.changes/validated-webhook-urls-limited-dns-lookups.md
new file mode 100644
index 0000000000..fd353fda2c
--- /dev/null
+++ b/.changes/validated-webhook-urls-limited-dns-lookups.md
@@ -0,0 +1,5 @@
+---
+type: security
+commit: cdc45e5736
+---
+Validated webhook URLs, limited DNS lookups and tightened the authorization of team resources
diff --git a/.changes/valkey-as-an-image-of-the.md b/.changes/valkey-as-an-image-of-the.md
new file mode 100644
index 0000000000..427ae2b860
--- /dev/null
+++ b/.changes/valkey-as-an-image-of-the.md
@@ -0,0 +1,8 @@
+---
+type: added
+commit: 41877198b3
+---
+Valkey as an image of the Redis database type
+
+- A new step of a new Redis database asks for Redis or Valkey
+- Global search accepts "new valkey"
diff --git a/.changes/volume-data-checkboxes-that-were-not.md b/.changes/volume-data-checkboxes-that-were-not.md
new file mode 100644
index 0000000000..7fd257bc1e
--- /dev/null
+++ b/.changes/volume-data-checkboxes-that-were-not.md
@@ -0,0 +1,5 @@
+---
+type: fixed
+commit: 19762a7950
+---
+Volume data checkboxes that were not next to their labels
diff --git a/.changes/websockets-closed-by-caddy-on-every.md b/.changes/websockets-closed-by-caddy-on-every.md
new file mode 100644
index 0000000000..c91088d2bc
--- /dev/null
+++ b/.changes/websockets-closed-by-caddy-on-every.md
@@ -0,0 +1,7 @@
+---
+type: fixed
+commit: f4a1e3e427
+---
+WebSockets closed by Caddy on every configuration reload ([#7942](https://github.com/coollabsio/coolify/issues/7942))
+
+- The application, service and dashboard routes set `stream_close_delay`
diff --git a/.changes/white-flash-of-the-dark-theme.md b/.changes/white-flash-of-the-dark-theme.md
new file mode 100644
index 0000000000..275573d621
--- /dev/null
+++ b/.changes/white-flash-of-the-dark-theme.md
@@ -0,0 +1,5 @@
+---
+type: fixed
+commit: 618d377d87
+---
+White flash of the dark theme during page loads and `wire:navigate` ([#7866](https://github.com/coollabsio/coolify/issues/7866))
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7f5d24c1c0..5783668d1d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,66 +6,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
-### Breaking Changes
-
-- **Queued webhook deployments are cancelled by default**: when a newer push arrives, Coolify cancels the older queued webhook deployments. Turn this off in **Advanced > Deployment**
-- **Cloud provider token API**: only team admins and owners can use it. Other members get `403`
-- **Resend sender**: Resend sends from the new `resend_from_address` and `resend_from_name` fields. A migration copies the current values. API clients must use the new fields
-
-### Security
-
-- **SSH host key pinning**: Coolify trusts the host key of a server on the first connection and notifies the team when it changes (`SSH_HOST_KEY_CHECKING`: `warn`, `enforce`, or `off`). Git hosts are pinned too ([#12418](https://github.com/coollabsio/coolify/pull/12418), [#12421](https://github.com/coollabsio/coolify/pull/12421))
-- **SSH keys**: new keys are Ed25519 (RSA keys are 4096 bits), private keys are validated more strictly, and the browser no longer gets them. **Rotate key** replaces a key on all servers, and a server delete can remove the key from `authorized_keys` ([#12415](https://github.com/coollabsio/coolify/pull/12415), [#12422](https://github.com/coollabsio/coolify/pull/12422), [#12423](https://github.com/coollabsio/coolify/pull/12423))
-- **Hardening**: fixed SSH options on all connections, Sentinel token kept out of process arguments, terminal sessions end when access is lost, SMTP host and DNS checks, stricter team and role checks, API rate limit for clients that keep failing, and no personal data or credentials in audit events ([#12460](https://github.com/coollabsio/coolify/pull/12460))
-
-### Added
-
-- **Container image vulnerability scanning**: opt-in for each server. Syft and Grype run on your server, and no data goes to a third party. Each resource gets one security status, version recommendations, and an optional deploy gate. Includes a team **Security** page, notifications, API endpoints, and MCP tools ([#12377](https://github.com/coollabsio/coolify/pull/12377))
-- **GitHub Deployments sync**: Coolify reports each deployment and preview to GitHub Deployments, with links to the log and the environment. Needs a private GitHub App with **Deployments: write** ([#12451](https://github.com/coollabsio/coolify/pull/12451))
-- **SFTP, FTPS, and WebDAV backup storages**: for database and volume backups, with downloads, retention, and restores ([#12417](https://github.com/coollabsio/coolify/pull/12417))
-- **Email providers**: one provider list (None, SMTP, or Resend), more than one named SMTP server with its own sender, SMTP templates for common providers, and a separate notification sender for the instance ([#12471](https://github.com/coollabsio/coolify/pull/12471))
-- **Cancel superseded deployments**: older queued webhook deployments are cancelled when a newer push arrives, and optionally also running builds. `/api/v1/deploy` and the MCP `deploy` tool accept `cancel_previous` ([#10921](https://github.com/coollabsio/coolify/discussions/10921), [#7678](https://github.com/coollabsio/coolify/discussions/7678))
-- **Forgejo and Codeberg**: connect them with the Gitea App source. The API and MCP get Gitea App endpoints
-- **Valkey**: offered as an image of the Redis database type, and the default for new Redis databases
-- **Automatic update notifications**: the root team gets a notification when an automatic update starts, fails, or finishes ([#12472](https://github.com/coollabsio/coolify/pull/12472))
-- **Unused Traefik certificates**: marked as "Not used", with a **Delete unused** button ([#12447](https://github.com/coollabsio/coolify/issues/12447))
-- **S3 skip TLS verification**: for endpoints with a self-signed or private CA certificate ([#9762](https://github.com/coollabsio/coolify/issues/9762))
-- **Scheduled tasks without a shell**: **Run in a shell** can be turned off for containers without a shell, such as distroless images ([#8244](https://github.com/coollabsio/coolify/issues/8244))
-- **New resource page list view** and a **UI scale** option in the appearance settings
-- **Orbit service template**: a self-hosted workspace for teams with tasks, docs, chat, and an MCP server for AI clients
-
-### Changed
-
-- **Fewer failure notifications**: failing scheduled tasks, backups, and Docker cleanups notify on the first failure, then at most once a day, and once when they work again. A task that failed 10 times in a row for more than 24 hours is disabled automatically
-- **Newer default database images**: PostgreSQL 18, MongoDB 9, MySQL 9.7, MariaDB 12.3, ClickHouse 26.8, and Valkey 9. Existing databases keep their image
-- **Backup import**: moved to an **Import backup** dialog on the **Backups** page ([#11818](https://github.com/coollabsio/coolify/discussions/11818))
-- **Server security page**: patches, terminal access, SSH host key, and image scanning are on one **Security** page
-- **Locked environment variables**: you can replace the value of a locked variable without seeing it ([#6803](https://github.com/coollabsio/coolify/issues/6803))
-- **Same IP, different SSH port**: more than one server can use the same IP when the SSH ports are different ([#7573](https://github.com/coollabsio/coolify/issues/7573))
-- **Maintenance mode**: moved to its own **Maintenance** page of applications and services, and you must confirm the toggle
-
-### Fixed
-
-- **Deployments**: the build server concurrency limit works, the server CA bundle is trusted in the helper container, the Docker build cache is kept when containers on the network change, and Use build secrets, `HOME`, and `DOCKER_CONFIG` no longer break builds ([#7649](https://github.com/coollabsio/coolify/issues/7649), [#7568](https://github.com/coollabsio/coolify/issues/7568), [#12452](https://github.com/coollabsio/coolify/issues/12452), [#9363](https://github.com/coollabsio/coolify/issues/9363), [#9726](https://github.com/coollabsio/coolify/issues/9726))
-- **Docker Compose and previews**: each Compose preview has its own project, service names stay usable as host names, one `COOLIFY_BRANCH` value is used, deleted volumes do not come back, and services removed from the Compose file are marked ([#9014](https://github.com/coollabsio/coolify/issues/9014), [#8030](https://github.com/coollabsio/coolify/issues/8030), [#9572](https://github.com/coollabsio/coolify/issues/9572), [#6875](https://github.com/coollabsio/coolify/issues/6875), [#9591](https://github.com/coollabsio/coolify/issues/9591))
-- **Environment variables**: multiline values keep their trailing newline, duplicate keys are prevented, and server shared variables resolve in Compose files ([#9438](https://github.com/coollabsio/coolify/issues/9438), [#8041](https://github.com/coollabsio/coolify/issues/8041))
-- **Backups**: S3 endpoints with a path (such as Supabase Storage), a 1000-part upload limit (such as Scaleway), the full run stays within its timeout, and the instance database backup uses the localhost server ([#8530](https://github.com/coollabsio/coolify/issues/8530), [#8411](https://github.com/coollabsio/coolify/issues/8411), [#8139](https://github.com/coollabsio/coolify/issues/8139))
-- **Cloudflare DNS**: records are added when you edit or clone domains and when you create resources through the API, conflicts are shown, and the DNS check verifies the real origin behind Cloudflare ([#12436](https://github.com/coollabsio/coolify/issues/12436))
-- **Notifications**: unexpected stops of resources and new Traefik patch versions send notifications, and Telegram messages with rejected button URLs still arrive ([#9493](https://github.com/coollabsio/coolify/issues/9493), [#9727](https://github.com/coollabsio/coolify/issues/9727), [#8269](https://github.com/coollabsio/coolify/issues/8269))
-- **GitHub**: fewer API requests before each deployment, and reads are retried on 5xx errors and timeouts ([#9785](https://github.com/coollabsio/coolify/issues/9785))
-- **MCP deployments**: they queue behind a deployment in progress and are saved with the **MCP** source ([#12442](https://github.com/coollabsio/coolify/issues/12442))
-- **Servers**: fewer SSH logins for the connection check, the Docker install fallback works on Ubuntu derivatives, and deleting a server keeps applications that also run on other servers ([#9148](https://github.com/coollabsio/coolify/issues/9148), [#9455](https://github.com/coollabsio/coolify/issues/9455))
-- **Health checks**: the Redis health check uses the password, Dockerfile `HEALTHCHECK` options are imported as Docker reads them, and containers in the start period show "starting" ([#12455](https://github.com/coollabsio/coolify/issues/12455), [#9411](https://github.com/coollabsio/coolify/issues/9411))
-- **Performance**: the startup cleanup no longer runs out of memory with large deployment logs, backup pages load faster, and log streaming no longer makes dockerd read the full log file ([#12435](https://github.com/coollabsio/coolify/issues/12435), [#7693](https://github.com/coollabsio/coolify/issues/7693))
-- **UI**: **Copy logs** works on iOS, the dark theme stays during page loads, custom theme colors stay readable, Caddy keeps WebSockets open across reloads, and Reverb accepts large cookie headers ([#9408](https://github.com/coollabsio/coolify/issues/9408), [#7866](https://github.com/coollabsio/coolify/issues/7866), [#7942](https://github.com/coollabsio/coolify/issues/7942))
-- **Rollback**: the commit images of Docker Compose applications are listed ([#12446](https://github.com/coollabsio/coolify/issues/12446))
-- **Service templates**: fixes for AppFlowy, Bugsink, Convex, Ente, LiteLLM, Odoo, Outline, Rybbit, Supabase, and Usesend
-- **Service domains**: a domain without a port no longer shows a port warning, because Coolify routes it to the required port
-
-### Removed
-
-- **Copy from instance settings**: removed from the email notification page. Select **Use system-wide settings** instead
-
 ## [v4.6.0] - 2026-11-02
 
 ### Breaking Changes