Stop now returns 404 unless the application runs on the server, either
as its main server or as an additional server. Redeploy now returns 404
unless the network is the application's main destination or one of its
additional networks on that server.
Add a security changelog entry.
The root setup window and the scanner disk usage checked is_int() on
cached values, but the Redis store returns numbers as strings. The
setup window was closed right after each start.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Grype was killed at the fixed 1 GiB container limit on large images.
- Add the per-server setting image_scan_memory_mb (1, 2, 4 or 8 GB,
default 1 GB) on the Vulnerabilities page and in the
/servers/{uuid}/image-scanning API.
- Set GOMEMLIMIT to 85% of the limit, so Go collects garbage before
the container limit kills the scanner.
- The out-of-memory error now tells the user to raise the limit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
When no instance domain is set, invitation links were built from the
request host, which a client can spoof through a forwarded Host header.
Links now always use base_url(). The fallback test now forces a spoofed
root URL and checks that the link ignores it.
- Require the write permission and update policy to open a preview or
change its pull request URL, git type, or docker tag via the API;
deploy-only tokens can only redeploy an existing preview
- Reject rollbacks to commits that are neither a listed rollback image
nor a successful production deployment (GetRollbackImages::allows)
- Validate git_repository with ValidGitRepositoryUrl when it changes on
application update
- Add RejectPublishedAppKey global middleware
- Show a "still starting" message when the root setup window is pending
- Document the new 403 responses and constraints in the OpenAPI spec
- Add tests for the new checks
Scanning is now controlled per server and per app. Each server downloads
the Grype database from its default source.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Show a clear message when team-wide write access is needed to use
team credentials.
- Reset the S3 selection on the backup page when a change is not allowed.
- Do not save database backups to S3 when the API request does not
send save_s3, as the API documentation says.
An empty port routes to the required port, so it needs no confirmation.
The edit dialog shows the effective port, the warning buttons name the
ports, and domain conflicts ignore the container port.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Restores, downloads, and the import check refuse an SFTP storage without a saved host key.
- Only Validate, Save, Create, and the API validate endpoint save a new key; backup and
revalidation jobs do not.
- An endpoint change or a host key reset marks the storage unusable.
- Save the key only when the endpoint did not change during the connection test.
- Restore the saved SMTP/Resend flags when a provider switch fails validation, so a
later event toggle cannot save a half-configured Resend (team and instance pages).
- Resend uses smtp_from_* when resend_from_* is blank, as before the Resend sender fields.
- Require the Resend sender only when Resend is enabled.
- Replace wire:confirm in the SMTP server picker with x-modal-confirmation.
When a user creates a Redis database, a new step asks for Redis 7.2
(default) or Valkey 9. Valkey uses the same binaries (redis-* symlinks),
config, and data format, so the Redis start action runs it unchanged.
The UI now names the type "Redis / Valkey" and shows a combined logo,
and global search accepts "new valkey".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Anonymize the audit events of a deleted user, store only the ID and
name of other users, and drop the metadata copy of actor_email.
Store URLs without query strings, registries without user info, and
the exception class instead of raw SSH errors.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Preview containers (-pr-<id>) came and went with pull requests and
invalidated the build cache of every app on the network. A build server
got the IPs of the deployment server network, which it cannot reach.
Add a per-app setting to turn off network hosts during the build.
Closes#12452
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ServerValidated and ServerPatchCheckFinished used broadcastAs(), so Echo
listeners without a leading dot never matched them. Close the validation
dialog that a background job opened when the job finishes.
Odoo keeps its data in databases that the user creates in Odoo, so the
POSTGRES_DB=postgres database that the backup used was empty. Also show the
sections of the edit backup schedule modal without nested cards.
Closes#7555
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A locked variable used by Docker Compose could not be changed, unlocked,
or deleted, so a lock by mistake had no fix in the UI. A locked value can
now be replaced without showing it. The lock is permanent in the UI, the
API, and MCP, and Lock asks for confirmation.
Closes#6803
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Read the running version from the container that answers the status request, not from the old page state, so the modal shows success as soon as the new version is up. Hide all Livewire error pages while an upgrade runs.
Closes#8024
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Containers without sh (distroless or scratch images) could not run
scheduled tasks, because Coolify always ran the command with sh -c.
Turn off "Run in a shell" to split the command into arguments and run
it directly. The option is also in the API, the MCP tools, and the
server transfer.
Closes#8244
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
