Both VMs used one fixed MAC address, and libvirt keeps the leases of
deleted VMs, so the script could take the IP of an old VM and wait
without output for about ten minutes. Give each VM a random MAC and
match the NIC by name in the cloud-init network config. Show the
progress of the IP, SSH, and cloud-init waits, and stop the cloud-init
wait after ten minutes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Coolify Cloud backup leaves out the rows of
scheduled_database_backup_executions but keeps database_backup_s3_replicas,
so pg_restore failed when it added db_backup_s3_replicas_execution_fk.
Restore by section and delete the orphan replica rows before post-data.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Backup retention removes only successful runs, so failed runs stayed in
scheduled_database_backup_executions forever. A failed run has no local
file and no S3 copy, so the daily database cleanup can delete its record.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Check the root team grants for the instance database, which has no environment.
- Return the root team as the team of the instance database.
- Hide the instance database from the API and MCP.
- Fix the links in backup notifications of the instance and service databases.
Closes#12503Closes#12505
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- restructure the listing of untagged manifests for ShellCheck SC2015
- expand a group the way shfmt formats it
- keep the pull request images of the variants VARIANTS lists, none here
Before committing, release.sh now checks whether git can sign by running
a throwaway signed commit-tree. If that fails, because there is no
user.signingkey or no agent holds the key, the script warns and makes
the release commit with --no-gpg-sign. The success message now says
whether the commit is signed or unsigned. AGENTS.md is updated to match.
Stop now returns 404 unless the application runs on the server, either
as its main server or as an additional server. Redeploy now returns 404
unless the network is the application's main destination or one of its
additional networks on that server.
Add a security changelog entry.
The root setup window and the scanner disk usage checked is_int() on
cached values, but the Redis store returns numbers as strings. The
setup window was closed right after each start.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The section and resource names in the top breadcrumb open their page.
The arrow next to a name still opens the switch list.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Grype was killed at the fixed 1 GiB container limit on large images.
- Add the per-server setting image_scan_memory_mb (1, 2, 4 or 8 GB,
default 1 GB) on the Vulnerabilities page and in the
/servers/{uuid}/image-scanning API.
- Set GOMEMLIMIT to 85% of the limit, so Go collects garbage before
the container limit kills the scanner.
- The out-of-memory error now tells the user to raise the limit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add scripts that take screenshots of a dev instance, render slides, and
join them into a video, plus PROMPT.md with the steps for an AI agent.
Keep the v4.7 spec and contact sheet so older videos can be checked and
rendered again. Videos and build output stay out of git.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The view still read the $allowed variable that the component no longer
passes after the instance switch was removed, so /vulnerabilities
returned a 500 error.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The shared banner had a dark background and no text colour, so the
subscription and server limit banners were unreadable in light mode.
Use a light surface with dark text in light mode and keep the dark look.
Refs #12494
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add the gh api PATCH command for editing a security advisory comment, and note that advisory comments do not auto-link bare commit SHAs, so they must be written as Markdown links to the commit URL.
Document replying to security advisories through comments instead of
editing the advisory description, including the gh api commands to
list and post comments and the note that comments cannot be deleted.
When no instance domain is set, invitation links were built from the
request host, which a client can spoof through a forwarded Host header.
Links now always use base_url(). The fallback test now forces a spoofed
root URL and checks that the link ignores it.
- Treat a commit value on the preview endpoint as a preview change
- Update the API docs, the MCP tool description, and the change file
- Add a test case
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Instances that ran a since-removed migration from an earlier version of
task auto-disable still have these columns. The current implementation
uses consecutive_failures, failing_since, and disabled_reason instead.
The migration checks that each column exists before dropping it.
- Remove tests that only check markup, CSS, static text, wire:key strings,
framework behavior, copied app logic, or expect(true)
- Replace source-grep and Reflection checks of security fixes with tests
that run the real code (shell quoting, locked properties, 403 checks,
webhook fork trust, log redaction, Sentinel token cleanup)
- Assert response bodies and unchanged data on API error paths
- Run the Traefik version job through handle() instead of private methods
- Update stale tests for scheduled task props, the default Postgres image,
and the disabled transfer link of unvalidated servers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The backup upload returned a hard-coded 500 when the database uuid was
unknown or belonged to another team. It now returns 404 with the same
JSON error shape that the import form reads.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Andras BacsaiandClaude Opus 5.5
Aditya TripathiandAndras Bacsai
peaklabs-dev