On self-hosted, a validation that connects now clears force_disabled. The unreachable cleanup skips the localhost server, and the server page explains why a server is disabled. Cloud and transferred servers stay disabled.
Closes#12475
Add changelog entries for the Orbit service template, moving
maintenance mode to its own page with a confirmed toggle, and no
longer warning about the port when a service domain has no port.
An empty port routes to the required port, so it needs no confirmation.
The edit dialog shows the effective port, the warning buttons name the
ports, and domain conflicts ignore the container port.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Group the Unreleased breaking changes and security notes into short,
bolded summary bullets with combined PR links, replacing the long
per-change descriptions.
Document the breaking changes for queued webhook deployment cancellation,
cloud provider token API access, and the new Resend sender fields.
List the security changes: SSH host key pinning for servers and Git hosts,
Ed25519 key generation and key rotation, hardened SSH options, hidden
private keys, Sentinel token handling, terminal session expiry, SMTP and
DNS validation, stricter team access checks, audit event privacy, and
API rate limiting for failed requests.
- Restores, downloads, and the import check refuse an SFTP storage without a saved host key.
- Only Validate, Save, Create, and the API validate endpoint save a new key; backup and
revalidation jobs do not.
- An endpoint change or a host key reset marks the storage unusable.
- Save the key only when the endpoint did not change during the connection test.
- Queue a status sync for deployments that Init, fail_undispatchable_deployment, and
superseded cancels change with a query update, so GitHub does not show them as
in progress forever.
- Run SyncGithubDeploymentJob on the default queue with 10 s GitHub request timeouts
and a 100 s job timeout, so a slow GitHub cannot delay deployments.
The gate treated a busy server scan lock as a scan error after 120 s, so a gated
deploy with Block failed while another scan ran. It now waits in steps, bounded by the
deployment job timeout, and still honors a cancel. The lock TTL now covers the sum
of the scan step timeouts.
- Restore the saved SMTP/Resend flags when a provider switch fails validation, so a
later event toggle cannot save a half-configured Resend (team and instance pages).
- Resend uses smtp_from_* when resend_from_* is blank, as before the Resend sender fields.
- Require the Resend sender only when Resend is enabled.
- Replace wire:confirm in the SMTP server picker with x-modal-confirmation.
Change the standalone_redis image column default to
valkey/valkey:9-alpine. Existing databases keep their current image.
Update the API docs, OpenAPI specs and image helper text to name Valkey
as the default and redis:8 as the Redis example.
Also restyle the status badges and database image cards on the new
resource page.
When a user creates a Redis database, a new step asks for Redis 7.2
(default) or Valkey 9. Valkey uses the same binaries (redis-* symlinks),
config, and data format, so the Redis start action runs it unchanged.
The UI now names the type "Redis / Valkey" and shows a combined logo,
and global search accepts "new valkey".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The check was [CMD-SHELL, redis-cli, ping], so Docker ran only redis-cli
and it always passed. redis-cli also exits 0 on NOAUTH and LOADING.
The check now pings with the server password and requires PONG. With a
custom redis.conf that sets its own requirepass, it requires PONG or NOAUTH.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Raise the Reverb max request size and store the remembered list view
cookies unencrypted, so the WebSocket handshake no longer fails with 413
and live updates (like proxy restart logs) reach the browser.
Anonymize the audit events of a deleted user, store only the ID and
name of other users, and drop the metadata copy of actor_email.
Store URLs without query strings, registries without user info, and
the exception class instead of raw SSH errors.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Andras Bacsai
