- 3.54.1-v0.2.0 lets any uid write the databases, so the application no longer has to run as 65532 or root for improved compatibility, however the SQLite files are now writable by every user, so a bind mount instead of a docker volume mount opens them to every user on the host
- Backup pages show Backup, and service sub-resources show their own
name, because the row opens that menu.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- On a resource page, the main menu starts with a row that shows the
resource name and opens the deepest resource menu again.
- Pass the resource name to registerMainNavContext() again.
- Document the row in DESIGN.md.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Rows with two or more actions use a shared "..." menu (x-table.row-actions);
rows with one action keep a single icon button. Every actions column has an
"Actions" header. Removing a member and revoking an invitation now ask for
confirmation. Row and card icons are neutral in dark mode.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Require write access on the target environment to clone or move a resource
- Check read access on shared variables before a reference is added or resolved
- Limit team credentials, git sources, and imports of other backups to team-wide writers
- Require the delete level for backup, volume, storage, and task deletes
- Require create access for previews, new projects, and git sources
- Use the token team for the access scope, and check team-wide access on Livewire updates
- Require instance admin to toggle the API and MCP server
- Hide server pickers and broadcast details from members without access
- Check read access on the project or environment for shared variables
pages, the canvas, and the sidebar, not only navigation access
- Require team-wide read for the server shared variables canvas API
- Open the environment variable editor read-only when the value is hidden
- Show the integration tokens button only to users who can open it
- Show disabled confirmation buttons as disabled, not as danger buttons
Keep the description, permissions, scopes, and expiry. Move the row actions into a dropdown menu and measure the dropdown panel after it is shown, so menus at the right edge stay on screen.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The browser uses only the /app/{key} WebSocket. Laravel sends events to
Reverb over 127.0.0.1, so the generated Traefik and Caddy configs no longer
route /apps to port 6001, and the WebSocket rule only matches /app/.
Closes#12390
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Save build_server_id as soon as a build server is selected, so the cancel
cleanup finds the helper container on the build server. Let the final
helper stop run after a cancel.
Closes#12383
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
phpdotenv trims whitespace around an unquoted value, including the \r of
CRLF line endings. The repair quoted such values, which broke valid lines in
CRLF files and kept spaces that phpdotenv drops. Trim the value first and
quote it only when a space is still inside it.
Closes#12375
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Installers before 4.5.1 and manual edits could leave ROOT_USERNAME (or the
root email or password) with spaces and no quotes. The running container
ignores .env because its config is cached, so the next upgrade recreated it
and phpdotenv failed, which made every page return HTTP 500. The upgrade now
quotes these values before it restarts Coolify.
Closes#12375
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An invited user who set a password with Forgot password kept the forced
reset flag. A re-invite then replaced the password, and a revoked or
expired invitation deleted the account.
Re-inviting an email after its invitation expired, or re-inviting a user
who never set a password, sent a link that needs a login the user cannot
complete. Unused invited accounts now get a magic link again, and changing
another user's password no longer ends the current session.
Two applications that build the same Docker image name push the same
tags (commit SHA, latest, pr-<id>), so one can run the image of the
other. Deployments, the General form, and the API now reject such a
name for applications of the same team.
Closes#9834
Key the loaded view so the lazy-load morph replaces the placeholder
skeleton instead of patching it in place. Alpine did not start the
Locations toggle, the globe, and the table pagers on reused nodes.
Closes#12370
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
peaklabs-dev
github-actions[bot]
Andras BacsaiandClaude Opus 5.5