Drop the RejectPublishedAppKey middleware and its registration in the
HTTP kernel, so requests are no longer refused with a 503 when APP_KEY
or APP_PREVIOUS_KEYS matches a key shipped in the repository.
Rename PublishedAppKeyTest to DecryptWithoutClassesTest and keep only
the checks that Sentinel tokens and team channel payloads are decrypted
without unserializing objects.
- Require the write permission and update policy to open a preview or
change its pull request URL, git type, or docker tag via the API;
deploy-only tokens can only redeploy an existing preview
- Reject rollbacks to commits that are neither a listed rollback image
nor a successful production deployment (GetRollbackImages::allows)
- Validate git_repository with ValidGitRepositoryUrl when it changes on
application update
- Add RejectPublishedAppKey global middleware
- Show a "still starting" message when the root setup window is pending
- Document the new 403 responses and constraints in the OpenAPI spec
- Add tests for the new checks
- Use the limits of the API token in more permission checks.
- Show a clearer message when a token limit blocks a change.
- Describe API tokens with limits in SECURITY.md.
Scanning is now controlled per server and per app. Each server downloads
the Grype database from its default source.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Show a clear message when team-wide write access is needed to use
team credentials.
- Reset the S3 selection on the backup page when a change is not allowed.
- Do not save database backups to S3 when the API request does not
send save_s3, as the API documentation says.
On self-hosted, a validation that connects now clears force_disabled. The unreachable cleanup skips the localhost server, and the server page explains why a server is disabled. Cloud and transferred servers stay disabled.
Closes#12475
Add changelog entries for the Orbit service template, moving
maintenance mode to its own page with a confirmed toggle, and no
longer warning about the port when a service domain has no port.
An empty port routes to the required port, so it needs no confirmation.
The edit dialog shows the effective port, the warning buttons name the
ports, and domain conflicts ignore the container port.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Group the Unreleased breaking changes and security notes into short,
bolded summary bullets with combined PR links, replacing the long
per-change descriptions.
Document the breaking changes for queued webhook deployment cancellation,
cloud provider token API access, and the new Resend sender fields.
List the security changes: SSH host key pinning for servers and Git hosts,
Ed25519 key generation and key rotation, hardened SSH options, hidden
private keys, Sentinel token handling, terminal session expiry, SMTP and
DNS validation, stricter team access checks, audit event privacy, and
API rate limiting for failed requests.
Change the standalone_redis image column default to
valkey/valkey:9-alpine. Existing databases keep their current image.
Update the API docs, OpenAPI specs and image helper text to name Valkey
as the default and redis:8 as the Redis example.
Also restyle the status badges and database image cards on the new
resource page.
When a user creates a Redis database, a new step asks for Redis 7.2
(default) or Valkey 9. Valkey uses the same binaries (redis-* symlinks),
config, and data format, so the Redis start action runs it unchanged.
The UI now names the type "Redis / Valkey" and shows a combined logo,
and global search accepts "new valkey".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The check was [CMD-SHELL, redis-cli, ping], so Docker ran only redis-cli
and it always passed. redis-cli also exits 0 on NOAUTH and LOADING.
The check now pings with the server password and requires PONG. With a
custom redis.conf that sets its own requirepass, it requires PONG or NOAUTH.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Raise the Reverb max request size and store the remembered list view
cookies unencrypted, so the WebSocket handshake no longer fails with 413
and live updates (like proxy restart logs) reach the browser.
Anonymize the audit events of a deleted user, store only the ID and
name of other users, and drop the metadata copy of actor_email.
Store URLs without query strings, registries without user info, and
the exception class instead of raw SSH errors.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Set env var version and compose parsing version while creating, so a create writes one row
- Record no rows for the auto-created preview copy of an env var
- Record env and application API updates only with the fields that really changed
- Store no change data for new env vars, and null for empty change data
- Store metadata team_id as an integer
- Drop the unused level and resource indexes of audit_events
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Return 429 after 30 failed (401/403/404) requests per minute for one
token or IP, also for unknown API routes (API_FAILED_REQUEST_RATE_LIMIT)
- Notify the team once a day when a token reaches the limit
- Deduplicate ability_denied and scope_denied audit events for 5 minutes
- Send Retry-After: 300 when the server is not functional
- Send Retry-After: 3600 when the push token cannot be decrypted
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
