Instances that ran a since-removed migration from an earlier version of
task auto-disable still have these columns. The current implementation
uses consecutive_failures, failing_since, and disabled_reason instead.
The migration checks that each column exists before dropping it.
- Remove tests that only check markup, CSS, static text, wire:key strings,
framework behavior, copied app logic, or expect(true)
- Replace source-grep and Reflection checks of security fixes with tests
that run the real code (shell quoting, locked properties, 403 checks,
webhook fork trust, log redaction, Sentinel token cleanup)
- Assert response bodies and unchanged data on API error paths
- Run the Traefik version job through handle() instead of private methods
- Update stale tests for scheduled task props, the default Postgres image,
and the disabled transfer link of unvalidated servers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The backup upload returned a hard-coded 500 when the database uuid was
unknown or belonged to another team. It now returns 404 with the same
JSON error shape that the import form reads.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Drop the RejectPublishedAppKey middleware and its registration in the
HTTP kernel, so requests are no longer refused with a 503 when APP_KEY
or APP_PREVIOUS_KEYS matches a key shipped in the repository.
Rename PublishedAppKeyTest to DecryptWithoutClassesTest and keep only
the checks that Sentinel tokens and team channel payloads are decrypted
without unserializing objects.
- Require the write permission and update policy to open a preview or
change its pull request URL, git type, or docker tag via the API;
deploy-only tokens can only redeploy an existing preview
- Reject rollbacks to commits that are neither a listed rollback image
nor a successful production deployment (GetRollbackImages::allows)
- Validate git_repository with ValidGitRepositoryUrl when it changes on
application update
- Add RejectPublishedAppKey global middleware
- Show a "still starting" message when the root setup window is pending
- Document the new 403 responses and constraints in the OpenAPI spec
- Add tests for the new checks
- Use the limits of the API token in more permission checks.
- Show a clearer message when a token limit blocks a change.
- Describe API tokens with limits in SECURITY.md.
Scanning is now controlled per server and per app. Each server downloads
the Grype database from its default source.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Show a clear message when team-wide write access is needed to use
team credentials.
- Reset the S3 selection on the backup page when a change is not allowed.
- Do not save database backups to S3 when the API request does not
send save_s3, as the API documentation says.
On self-hosted, a validation that connects now clears force_disabled. The unreachable cleanup skips the localhost server, and the server page explains why a server is disabled. Cloud and transferred servers stay disabled.
Closes#12475
Add changelog entries for the Orbit service template, moving
maintenance mode to its own page with a confirmed toggle, and no
longer warning about the port when a service domain has no port.
An empty port routes to the required port, so it needs no confirmation.
The edit dialog shows the effective port, the warning buttons name the
ports, and domain conflicts ignore the container port.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Group the Unreleased breaking changes and security notes into short,
bolded summary bullets with combined PR links, replacing the long
per-change descriptions.
Document the breaking changes for queued webhook deployment cancellation,
cloud provider token API access, and the new Resend sender fields.
List the security changes: SSH host key pinning for servers and Git hosts,
Ed25519 key generation and key rotation, hardened SSH options, hidden
private keys, Sentinel token handling, terminal session expiry, SMTP and
DNS validation, stricter team access checks, audit event privacy, and
API rate limiting for failed requests.
- Restores, downloads, and the import check refuse an SFTP storage without a saved host key.
- Only Validate, Save, Create, and the API validate endpoint save a new key; backup and
revalidation jobs do not.
- An endpoint change or a host key reset marks the storage unusable.
- Save the key only when the endpoint did not change during the connection test.
- Queue a status sync for deployments that Init, fail_undispatchable_deployment, and
superseded cancels change with a query update, so GitHub does not show them as
in progress forever.
- Run SyncGithubDeploymentJob on the default queue with 10 s GitHub request timeouts
and a 100 s job timeout, so a slow GitHub cannot delay deployments.
The gate treated a busy server scan lock as a scan error after 120 s, so a gated
deploy with Block failed while another scan ran. It now waits in steps, bounded by the
deployment job timeout, and still honors a cancel. The lock TTL now covers the sum
of the scan step timeouts.
- Restore the saved SMTP/Resend flags when a provider switch fails validation, so a
later event toggle cannot save a half-configured Resend (team and instance pages).
- Resend uses smtp_from_* when resend_from_* is blank, as before the Resend sender fields.
- Require the Resend sender only when Resend is enabled.
- Replace wire:confirm in the SMTP server picker with x-modal-confirmation.
Change the standalone_redis image column default to
valkey/valkey:9-alpine. Existing databases keep their current image.
Update the API docs, OpenAPI specs and image helper text to name Valkey
as the default and redis:8 as the Redis example.
Also restyle the status badges and database image cards on the new
resource page.
When a user creates a Redis database, a new step asks for Redis 7.2
(default) or Valkey 9. Valkey uses the same binaries (redis-* symlinks),
config, and data format, so the Redis start action runs it unchanged.
The UI now names the type "Redis / Valkey" and shows a combined logo,
and global search accepts "new valkey".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Andras Bacsai
peaklabs-dev
