Add scripts that take screenshots of a dev instance, render slides, and
join them into a video, plus PROMPT.md with the steps for an AI agent.
Keep the v4.7 spec and contact sheet so older videos can be checked and
rendered again. Videos and build output stay out of git.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The view still read the $allowed variable that the component no longer
passes after the instance switch was removed, so /vulnerabilities
returned a 500 error.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The shared banner had a dark background and no text colour, so the
subscription and server limit banners were unreadable in light mode.
Use a light surface with dark text in light mode and keep the dark look.
Refs #12494
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add the gh api PATCH command for editing a security advisory comment, and note that advisory comments do not auto-link bare commit SHAs, so they must be written as Markdown links to the commit URL.
Document replying to security advisories through comments instead of
editing the advisory description, including the gh api commands to
list and post comments and the note that comments cannot be deleted.
When no instance domain is set, invitation links were built from the
request host, which a client can spoof through a forwarded Host header.
Links now always use base_url(). The fallback test now forces a spoofed
root URL and checks that the link ignores it.
- Treat a commit value on the preview endpoint as a preview change
- Update the API docs, the MCP tool description, and the change file
- Add a test case
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Instances that ran a since-removed migration from an earlier version of
task auto-disable still have these columns. The current implementation
uses consecutive_failures, failing_since, and disabled_reason instead.
The migration checks that each column exists before dropping it.
- Remove tests that only check markup, CSS, static text, wire:key strings,
framework behavior, copied app logic, or expect(true)
- Replace source-grep and Reflection checks of security fixes with tests
that run the real code (shell quoting, locked properties, 403 checks,
webhook fork trust, log redaction, Sentinel token cleanup)
- Assert response bodies and unchanged data on API error paths
- Run the Traefik version job through handle() instead of private methods
- Update stale tests for scheduled task props, the default Postgres image,
and the disabled transfer link of unvalidated servers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The backup upload returned a hard-coded 500 when the database uuid was
unknown or belonged to another team. It now returns 404 with the same
JSON error shape that the import form reads.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Drop the RejectPublishedAppKey middleware and its registration in the
HTTP kernel, so requests are no longer refused with a 503 when APP_KEY
or APP_PREVIOUS_KEYS matches a key shipped in the repository.
Rename PublishedAppKeyTest to DecryptWithoutClassesTest and keep only
the checks that Sentinel tokens and team channel payloads are decrypted
without unserializing objects.
- Require the write permission and update policy to open a preview or
change its pull request URL, git type, or docker tag via the API;
deploy-only tokens can only redeploy an existing preview
- Reject rollbacks to commits that are neither a listed rollback image
nor a successful production deployment (GetRollbackImages::allows)
- Validate git_repository with ValidGitRepositoryUrl when it changes on
application update
- Add RejectPublishedAppKey global middleware
- Show a "still starting" message when the root setup window is pending
- Document the new 403 responses and constraints in the OpenAPI spec
- Add tests for the new checks
- Use the limits of the API token in more permission checks.
- Show a clearer message when a token limit blocks a change.
- Describe API tokens with limits in SECURITY.md.
Scanning is now controlled per server and per app. Each server downloads
the Grype database from its default source.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Show a clear message when team-wide write access is needed to use
team credentials.
- Reset the S3 selection on the backup page when a change is not allowed.
- Do not save database backups to S3 when the API request does not
send save_s3, as the API documentation says.
On self-hosted, a validation that connects now clears force_disabled. The unreachable cleanup skips the localhost server, and the server page explains why a server is disabled. Cloud and transferred servers stay disabled.
Closes#12475
Add changelog entries for the Orbit service template, moving
maintenance mode to its own page with a confirmed toggle, and no
longer warning about the port when a service domain has no port.
Andras Bacsai
peaklabs-dev