Add Doppler, Infisical, and Vault integrations with per-resource secret links, autocomplete, and deploy-time resolution for applications, services, and databases without persisting remote values.
Add manual fix-release validation and stable image rebuilds, inject traceable development versions into SHA builds, and suppress invalid release links for development versions.
The pinned cloudflared 2025.7.0 is built with Go 1.24.4 and grpc
v1.72.2, which carry two CRITICAL vulnerabilities:
- CVE-2025-68121 (crypto/tls: incorrect certificate validation
during TLS session resumption), fixed in Go 1.24.13
- CVE-2026-33186 (grpc-go authz: authorization bypass due to
improper HTTP/2 path validation), fixed in grpc 1.79.3
cloudflared 2026.7.3 ships patched Go/grpc; a Trivy scan of the
official linux-amd64 binary reports zero CRITICAL findings.
Introduce V5Feature and config so V5 routes, jobs, commands, morph maps,
and model queries run only when enabled. Move V5 migrations to
migrations-v5 (loaded only when enabled), remove Flux from production
Docker/install paths, and add isolation tests.
Keep the dev container as root for s6 init so composer can create
vendor/ on root-owned mounts, then chown writable paths to www-data.
Move init-setup into a shell script and expose VITE_HOST/PORT for
remote HMR (LAN/Tailscale) with Vite listening on 0.0.0.0.
Split V5 dashboard behavior into domain controllers and policies,
add agent token rotation/revocation, status reconciliation jobs,
ingress firewall syncing, and canvas connection APIs.
Add migrations for V5 status tracking, server capabilities, resource
connection aliases, and revoked agent tokens.
Adds v5 routing, middleware, home page rendering, team context sharing,
project model/table support, and Flux health reporting. Installs Flux in
container builds with role-aware s6 services and documents runtime roles.
Run Laravel Reverb and the terminal server inside the Coolify container instead of shipping a separate coolify-realtime image. Update compose files, proxy routing, cleanup behavior, and packaging tests for the embedded realtime services.
Cache destination lookups and skip empty resource queries during push
server updates. Add database indexes and Postgres storage tuning for
hot-update tables, and make the realtime entrypoint forward process
failures and signals reliably.
Remove axios from the realtime server dependencies to avoid header injection risk,
switch Docker builds to npm ci, and bump the realtime image version to 1.0.15.
Remove RAILPACK_FRONTEND_IMAGE env var from helper Dockerfile and resolve
the image ref at runtime using a new `railpack_version` constant in config.
Eliminates Docker build-time env interpolation for BUILDKIT_SYNTAX arg.
Extract NIXPACKS_/RAILPACK_ prefix filtering into a reusable
`scopeWithoutBuildpackControlVariables` query scope on EnvironmentVariable.
Apply scope consistently to runtime vars, runtime preview vars, and
buildtime var generation in ApplicationDeploymentJob.
Refactor `generate_railpack_env_variables` to return a Collection.
Add `RAILPACK_FRONTEND_IMAGE` constant and bake it into the
coolify-helper Dockerfile as a build arg.
Add DevelopmentRailpackExamplesSeeder (dev/local env only) for
seeding example Railpack apps, wired into DatabaseSeeder.
Add tests:
- ApplicationDeploymentControlVarFilteringTest: verifies control vars
are excluded from runtime and buildtime envs
- DevelopmentRailpackExamplesSeederTest: verifies seeder behavior
- ApplicationDeploymentRailpackEnvParityTest: parity checks for env
handling across build/runtime paths
Andras Bacsai
Bo Sundgaardandpeaklabs-dev
Juan Torchia
JuanTorchia
ShadowArcanist
dependabot[bot]