From f05609dc11d0b52648d94d9dfcc0ab6ec8d913b7 Mon Sep 17 00:00:00 2001 From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com> Date: Wed, 21 Oct 2026 14:05:44 +0200 Subject: [PATCH 1/7] fix(docker): use the patched PHP base image --- docker/production/Dockerfile | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/docker/production/Dockerfile b/docker/production/Dockerfile index 8c4b349c5e..ec030f5885 100644 --- a/docker/production/Dockerfile +++ b/docker/production/Dockerfile @@ -1,7 +1,6 @@ # Versions -# https://hub.docker.com/r/serversideup/php/tags?name=8.4-fpm-nginx-alpine -# Pinned: v5 moved user bundles to /etc/s6-overlay/user-bundles.d and breaks startup (#12141) -ARG SERVERSIDEUP_PHP_VERSION=8.4-fpm-nginx-alpine-v4.5.1 +# Temporary: serversideup/php v4.5.1 (8.4-fpm-nginx-alpine) rebuilt on the patched PHP 8.4 release +ARG SERVERSIDEUP_PHP_IMAGE=ghcr.io/coollabsio/serversideup-php:8.4-fpm-nginx-alpine-v4.5.1-hotfix # https://github.com/cloudflare/cloudflared/releases ARG CLOUDFLARED_VERSION=2026.7.3 # https://www.postgresql.org/support/versioning/ @@ -19,7 +18,7 @@ ARG GROUP_ID=9999 # ================================================================= # Stage 1: Composer dependencies # ================================================================= -FROM serversideup/php:${SERVERSIDEUP_PHP_VERSION} AS base +FROM ${SERVERSIDEUP_PHP_IMAGE} AS base USER root @@ -69,7 +68,7 @@ FROM quay.io/minio/aistor/mc:RELEASE.2026-09-06T02-44-40Z AS minio-client # ================================================================= # Stage 4: Terminal dependencies (match the production Node.js ABI and libc) # ================================================================= -FROM serversideup/php:${SERVERSIDEUP_PHP_VERSION} AS terminal-dependencies +FROM ${SERVERSIDEUP_PHP_IMAGE} AS terminal-dependencies USER root @@ -87,7 +86,7 @@ COPY docker/coolify-terminal/terminal-utils.js /terminal/terminal-utils.js # ================================================================= # Final Stage: Production image # ================================================================= -FROM serversideup/php:${SERVERSIDEUP_PHP_VERSION} +FROM ${SERVERSIDEUP_PHP_IMAGE} ARG USER_ID ARG GROUP_ID From 6a6d33cd046faabaa17ef7a7baa80d2db3659cfb Mon Sep 17 00:00:00 2001 From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com> Date: Wed, 21 Oct 2026 14:05:45 +0200 Subject: [PATCH 2/7] fix(docker): use Node.js 24.22.1 --- docker/production/Dockerfile | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/docker/production/Dockerfile b/docker/production/Dockerfile index ec030f5885..5547bb5bb2 100644 --- a/docker/production/Dockerfile +++ b/docker/production/Dockerfile @@ -8,6 +8,8 @@ ARG CLOUDFLARED_VERSION=2026.7.3 ARG POSTGRES_VERSION=18 # https://nginx.org/en/linux_packages.html ARG NGINX_VERSION=1.31.2-r1 +# https://nodejs.org/en/about/previous-releases +ARG NODE_VERSION=24.22.1 # https://pecl.php.net/package/uv ARG PHP_UV_VERSION=0.3.0 @@ -48,10 +50,15 @@ RUN --mount=type=cache,target=/tmp/cache \ USER www-data +# Temporary: the node:24.22.1 multi-arch manifest is not published yet, pull the per-arch image instead +FROM amd64/node:${NODE_VERSION}-alpine3.24 AS nodejs-amd64 +FROM arm64v8/node:${NODE_VERSION}-alpine3.24 AS nodejs-arm64 +FROM nodejs-${TARGETARCH} AS nodejs + # ================================================================= # Stage 2: Frontend assets compilation # ================================================================= -FROM node:24-alpine AS static-assets +FROM nodejs AS static-assets WORKDIR /app COPY package*.json vite.config.js postcss.config.cjs ./ @@ -73,7 +80,10 @@ FROM ${SERVERSIDEUP_PHP_IMAGE} AS terminal-dependencies USER root RUN apk upgrade && \ - apk add --no-cache nodejs npm make g++ python3 + apk add --no-cache make g++ python3 +COPY --from=nodejs /usr/local/bin/node /usr/local/bin/node +COPY --from=nodejs /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/npm +RUN ln -s ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm COPY docker/coolify-terminal/package*.json /terminal/ RUN --mount=type=cache,target=/root/.npm \ npm ci --prefix /terminal && \ @@ -129,7 +139,7 @@ RUN --mount=type=cache,target=/var/cache/apk \ apk upgrade && \ apk add --no-cache \ postgresql${POSTGRES_VERSION}-client \ - nodejs \ + libstdc++ \ openssh-client \ git \ git-lfs \ @@ -185,6 +195,7 @@ COPY --chown=www-data:www-data changelogs/ ./changelogs/ RUN composer dump-autoload # Install terminal WebSocket server dependencies +COPY --from=nodejs /usr/local/bin/node /usr/local/bin/node COPY --from=terminal-dependencies --chown=www-data:www-data /terminal /terminal # Configure Nginx and S6 overlay From 19d1014e2b027647a5e0e45ecccf617b29b3332c Mon Sep 17 00:00:00 2001 From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com> Date: Wed, 21 Oct 2026 14:05:45 +0200 Subject: [PATCH 3/7] fix(sentinel): bump Sentinel to 1.1.2 --- other/nightly/versions.json | 2 +- versions.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/other/nightly/versions.json b/other/nightly/versions.json index c8ee5c91c9..1559e29661 100644 --- a/other/nightly/versions.json +++ b/other/nightly/versions.json @@ -10,7 +10,7 @@ "version": "1.0.17" }, "sentinel": { - "version": "1.0.2" + "version": "1.1.2" }, "sentinel-host": { "version": "1.0.2", diff --git a/versions.json b/versions.json index c8ee5c91c9..1559e29661 100644 --- a/versions.json +++ b/versions.json @@ -10,7 +10,7 @@ "version": "1.0.17" }, "sentinel": { - "version": "1.0.2" + "version": "1.1.2" }, "sentinel-host": { "version": "1.0.2", From a220c1c7fe6f8043c777f114cd7363615076554d Mon Sep 17 00:00:00 2001 From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com> Date: Wed, 21 Oct 2026 14:05:45 +0200 Subject: [PATCH 4/7] ci(release): allow stable releases from fix branches --- .github/workflows/coolify-release.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/coolify-release.yml b/.github/workflows/coolify-release.yml index 9f83302ee9..70bb5d6af5 100644 --- a/.github/workflows/coolify-release.yml +++ b/.github/workflows/coolify-release.yml @@ -30,7 +30,8 @@ jobs: version: ${{ steps.version.outputs.version }} steps: - name: Reject releases outside the production branch - if: ${{ github.ref_name != 'main' }} + # tmp: allow the 4.4.7 security release from fix/v4.4.7 + if: ${{ github.ref_name != 'main' && !startsWith(github.ref_name, 'fix/v') }} run: | echo "Stable releases must run from main, not ${{ github.ref_name }}." exit 1 From 4b11e0b97e15833e05d4fa42cd25040eeeb407e7 Mon Sep 17 00:00:00 2001 From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com> Date: Wed, 21 Oct 2026 14:05:45 +0200 Subject: [PATCH 5/7] chore(release): bump version to 4.4.7 --- config/constants.php | 2 +- other/nightly/versions.json | 2 +- versions.json | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/config/constants.php b/config/constants.php index 9c7df6e804..3260cd1018 100644 --- a/config/constants.php +++ b/config/constants.php @@ -5,7 +5,7 @@ $sshCommandTimeout = (int) env('SSH_COMMAND_TIMEOUT', 3600); return [ 'coolify' => [ - 'version' => env('COOLIFY_VERSION') ?: '4.4.6', + 'version' => env('COOLIFY_VERSION') ?: '4.4.7', 'helper_version' => '1.0.17', 'self_hosted' => env('SELF_HOSTED', true), 'autoupdate' => env('AUTOUPDATE'), diff --git a/other/nightly/versions.json b/other/nightly/versions.json index 1559e29661..be9bea0d60 100644 --- a/other/nightly/versions.json +++ b/other/nightly/versions.json @@ -1,7 +1,7 @@ { "coolify": { "v4": { - "version": "4.4.6" + "version": "4.4.7" }, "nightly": { "version": "4.5-rc.1" diff --git a/versions.json b/versions.json index 1559e29661..be9bea0d60 100644 --- a/versions.json +++ b/versions.json @@ -1,7 +1,7 @@ { "coolify": { "v4": { - "version": "4.4.6" + "version": "4.4.7" }, "nightly": { "version": "4.5-rc.1" From 86c21c0d5babfa8c7d65a9c27e5863c629a89c7c Mon Sep 17 00:00:00 2001 From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com> Date: Wed, 21 Oct 2026 16:01:07 +0200 Subject: [PATCH 6/7] fix(docker): bump cloudflared to 2026.10.3 --- docker/production/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker/production/Dockerfile b/docker/production/Dockerfile index 5547bb5bb2..3478d9db2f 100644 --- a/docker/production/Dockerfile +++ b/docker/production/Dockerfile @@ -2,7 +2,7 @@ # Temporary: serversideup/php v4.5.1 (8.4-fpm-nginx-alpine) rebuilt on the patched PHP 8.4 release ARG SERVERSIDEUP_PHP_IMAGE=ghcr.io/coollabsio/serversideup-php:8.4-fpm-nginx-alpine-v4.5.1-hotfix # https://github.com/cloudflare/cloudflared/releases -ARG CLOUDFLARED_VERSION=2026.7.3 +ARG CLOUDFLARED_VERSION=2026.10.3 # https://www.postgresql.org/support/versioning/ # Note: We are using version 18 of the postgres client (while still using postgres 15 for the postgres server) as version 15 has been removed from Alpine 3.23+ https://pkgs.alpinelinux.org/packages?name=postgresql*-client&branch=v3.23&repo=&arch=x86_64&origin=&flagged=&maintainer= ARG POSTGRES_VERSION=18 From eeda30719f71fa879600275c1c1d7a9eb7cd5645 Mon Sep 17 00:00:00 2001 From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com> Date: Wed, 21 Oct 2026 16:16:13 +0200 Subject: [PATCH 7/7] feat(cdn): add patch.sh to sync:cdn --- app/Console/Commands/SyncCdn.php | 2 ++ tests/Feature/SyncCdnTest.php | 2 ++ 2 files changed, 4 insertions(+) diff --git a/app/Console/Commands/SyncCdn.php b/app/Console/Commands/SyncCdn.php index 3e7be78b4a..c447c5f726 100644 --- a/app/Console/Commands/SyncCdn.php +++ b/app/Console/Commands/SyncCdn.php @@ -312,6 +312,7 @@ class SyncCdn extends Command $install_script_location = "$parent_dir/scripts/install.sh"; $upgrade_script_location = "$parent_dir/scripts/upgrade.sh"; $upgrade_postgres_script_location = "$parent_dir/scripts/upgrade-postgres.sh"; + $patch_script_location = "$parent_dir/scripts/patch.sh"; $production_env_location = "$parent_dir/.env.production"; $service_template_location = "$parent_dir/templates/$service_template"; $versions_location = "$parent_dir/$versions"; @@ -346,6 +347,7 @@ class SyncCdn extends Command $install_script_location => 'json/coolify/install.sh', $upgrade_script_location => 'json/coolify/upgrade.sh', $upgrade_postgres_script_location => 'json/coolify/upgrade-postgres.sh', + $patch_script_location => 'json/coolify/patch.sh', $service_template_location => 'json/coolify/service-templates-latest.json', ]; } diff --git a/tests/Feature/SyncCdnTest.php b/tests/Feature/SyncCdnTest.php index 00bed238c7..52e0ea8945 100644 --- a/tests/Feature/SyncCdnTest.php +++ b/tests/Feature/SyncCdnTest.php @@ -97,6 +97,7 @@ SH); 'install.sh', 'upgrade.sh', 'upgrade-postgres.sh', + ...($environment === 'production' ? ['patch.sh'] : []), 'service-templates-latest.json', ]; $allTargets = array_map(fn (string $file) => "$targetDirectory/$file", $allBasenames); @@ -179,6 +180,7 @@ it('purges the CDN files from the Cloudflare cache', function (string $environme 'install.sh', 'upgrade.sh', 'upgrade-postgres.sh', + ...($environment === 'production' ? ['patch.sh'] : []), 'service-templates-latest.json', ]))->all()); })->with([