Andras BacsaiandClaude Opus 5.5 aa2592b17c fix(security): stop leaking locked shared variables and proxy secrets ...

- References to locked (shown once) shared variables keep their reference
  text in the UI, copy action, and API instead of the locked value.
- Remove the saved proxy configuration and validation logs from nested
  servers (for example destination.server) in API responses unless the
  token can read sensitive data.
- The services list API now applies removeSensitiveData to every service.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-02 16:01:00 +02:00

..

Application.php

fix(server): keep data directory commands working for non-root SSH users

2026-09-29 20:46:54 +02:00

ApplicationDeploymentQueue.php

fix(multi-server): make applications on several servers consistent

2026-09-28 15:38:57 +02:00

ApplicationPreview.php

fix(compose): use external volumes as declared

2026-09-27 16:53:54 +02:00

ApplicationSetting.php

feat(docker): limit container name prefixes to 30 characters

2026-09-09 15:01:57 +02:00

AuditEvent.php

feat(audit): expand event tracking and remove scheduled job monitoring

2026-09-21 12:23:42 +02:00

BaseModel.php

fix(security): enforce team access on mutable actions

2026-06-04 11:03:06 +02:00

CloudInitScript.php

feat(security): add editable cloud credential pages

2026-07-08 12:58:27 +02:00

CloudProviderToken.php

feat(security): add editable cloud credential pages

2026-07-08 12:58:27 +02:00

DiscordNotificationSettings.php

fix(applications): persist restart limit state for stopped containers (#11566)

2026-08-31 13:13:26 +02:00

DnsProviderZone.php

feat: add database import API and Cloudflare DNS management

2026-09-09 11:14:22 +02:00

DockerCleanupExecution.php

feat(deployments): support Docker image tags for preview deployments

2026-03-30 13:35:35 +02:00

EmailNotificationSettings.php

fix(applications): persist restart limit state for stopped containers (#11566)

2026-08-31 13:13:26 +02:00

Environment.php

feat(database): add sqlite as a standalone database type

2026-09-24 19:03:42 +02:00

EnvironmentVariable.php

fix(security): stop leaking locked shared variables and proxy secrets

2026-10-02 16:01:00 +02:00

GithubApp.php

feat(github-runners): add ephemeral self-hosted runners on build servers (#12054)

2026-09-30 12:13:11 +02:00

GithubRunnerConfig.php

feat(github-runners): allow public repositories and refuse pull request jobs by default

2026-10-01 08:14:30 +02:00

GithubRunnerExecution.php

feat(github-runners): add ephemeral self-hosted runners on build servers (#12054)

2026-09-30 12:13:11 +02:00

GitlabApp.php

feat(audit): add team activity tracking and audit log

2026-08-22 13:18:14 +02:00

InstanceSettings.php

refactor(http): remove the TrustHosts middleware that never checked the host

2026-09-28 12:00:16 +02:00

IntegrationToken.php

feat: add database import API and Cloudflare DNS management

2026-09-09 11:14:22 +02:00

LocalFileVolume.php

fix(storage): resolve relative file paths, keep volume options on clone, use random clone dirs

2026-09-30 18:10:10 +02:00

LocalPersistentVolume.php

fix(compose): keep name-only declaration for pre-existing volumes

2026-09-30 14:31:33 +02:00

ManagedDnsRecord.php

feat: add Traefik ACME cert UI and shared managed DNS record ownership

2026-09-25 19:00:00 +02:00

ManagedDnsRecordReference.php

feat: add Traefik ACME cert UI and shared managed DNS record ownership

2026-09-25 19:00:00 +02:00

NotificationThrottle.php

fix(jobs): resume S3 revalidation and remove orphaned notification throttles

2026-09-30 18:10:10 +02:00

OauthIdentity.php

Reapply "Merge branch 'next' into main"

2026-08-21 12:15:46 +02:00

OauthSetting.php

refactor(auth): remove OAuth re-authentication for destructive actions

2026-09-30 21:37:02 +02:00

PersonalAccessToken.php

fix(api-tokens): persist expiration warning state

2026-05-13 10:11:40 +02:00

PrivateKey.php

fix(keys): check duplicate private keys in the key's own team

2026-09-28 10:13:20 +02:00

Project.php

feat(database): add sqlite as a standalone database type

2026-09-24 19:03:42 +02:00

ProjectSetting.php

fix(models): replace forceFill/forceCreate with fill/create and add fillable guards

2026-03-31 13:45:31 +02:00

PushoverNotificationSettings.php

fix(applications): persist restart limit state for stopped containers (#11566)

2026-08-31 13:13:26 +02:00

S3Storage.php

feat(audit): add team activity tracking and audit log

2026-08-22 13:18:14 +02:00

ScheduledDatabaseBackup.php

revert(scheduler): go back to the cron scan and keep the reliability fixes

2026-10-02 08:05:18 +02:00

ScheduledDatabaseBackupExecution.php

feat(backups): alert when scheduled backups are missing (#11433)

2026-09-07 14:09:42 +02:00

ScheduledJobDelivery.php

feat(scheduling): persist and claim scheduled job occurrences

2026-09-18 13:56:40 +02:00

ScheduledJobState.php

revert(scheduler): go back to the cron scan and keep the reliability fixes

2026-10-02 08:05:18 +02:00

ScheduledTask.php

revert(scheduler): go back to the cron scan and keep the reliability fixes

2026-10-02 08:05:18 +02:00

ScheduledTaskExecution.php

fix(api): return task execution duration as float (#11636)

2026-09-05 15:18:51 +02:00

ScheduledVolumeBackup.php

revert(scheduler): go back to the cron scan and keep the reliability fixes

2026-10-02 08:05:18 +02:00

ScheduledVolumeBackupExecution.php

fix(backups): pin S3 per volume execution and harden deletes

2026-07-16 14:30:58 +02:00

SecretManagerLink.php

fix(secrets): skip remote secret names that are not valid variable keys

2026-10-01 07:16:45 +02:00

Server.php

fix(sentinel): stop hourly check job pile-up and self-heal Sentinel

2026-10-02 09:41:04 +02:00

ServerSetting.php

revert(scheduler): go back to the cron scan and keep the reliability fixes

2026-10-02 08:05:18 +02:00

Service.php

fix(services): resolve the old denoKV template key to deno-kv

2026-10-02 16:00:52 +02:00

ServiceApplication.php

feat: add Traefik ACME cert UI and shared managed DNS record ownership

2026-09-25 19:00:00 +02:00

ServiceDatabase.php

fix(backups): improve backup command handling

2026-09-24 11:44:53 +02:00

SharedEnvironmentVariable.php

feat(audit): add team activity tracking and audit log

2026-08-22 13:18:14 +02:00

SlackNotificationSettings.php

fix(applications): persist restart limit state for stopped containers (#11566)

2026-08-31 13:13:26 +02:00

SslCertificate.php

fix(databases): keep SSL certificate files and CA in sync with each engine

2026-09-30 19:01:11 +02:00

StandaloneClickhouse.php

Merge remote-tracking branch 'origin/next' into automation/sync-main-to-next

2026-09-08 10:02:12 +02:00

StandaloneDocker.php

feat(database): add sqlite as a standalone database type

2026-09-24 19:03:42 +02:00

StandaloneDragonfly.php

fix(databases): keep the server password of existing KeyDB and Dragonfly databases

2026-10-02 16:00:41 +02:00

StandaloneKeydb.php

fix(databases): keep the server password of existing KeyDB and Dragonfly databases

2026-10-02 16:00:41 +02:00

StandaloneMariadb.php

Merge remote-tracking branch 'origin/next' into automation/sync-main-to-next

2026-09-08 10:02:12 +02:00

StandaloneMongodb.php

Merge remote-tracking branch 'origin/next' into automation/sync-main-to-next

2026-09-08 10:02:12 +02:00

StandaloneMysql.php

Merge remote-tracking branch 'origin/next' into automation/sync-main-to-next

2026-09-08 10:02:12 +02:00

StandalonePostgresql.php

Merge remote-tracking branch 'origin/next' into automation/sync-main-to-next

2026-09-08 10:02:12 +02:00

StandaloneRedis.php

Merge remote-tracking branch 'origin/next' into automation/sync-main-to-next

2026-09-08 10:02:12 +02:00

StandaloneSqlite.php

fix(transfer): keep SQLite volume links during server transfer

2026-10-01 07:16:35 +02:00

Subscription.php

fix(models): replace forceFill/forceCreate with fill/create and add fillable guards

2026-03-31 13:45:31 +02:00

SwarmDocker.php

feat(database): add sqlite as a standalone database type

2026-09-24 19:03:42 +02:00

Tag.php

feat(audit): add team activity tracking and audit log

2026-08-22 13:18:14 +02:00

Team.php

feat: add import restore options, OAuth confirmation, and fixes

2026-09-30 13:35:22 +02:00

TeamInvitation.php

fix(auth): require confirmation before accepting magic links (#11413)

2026-08-20 09:34:05 +02:00

TelegramNotificationSettings.php

fix(applications): persist restart limit state for stopped containers (#11566)

2026-08-31 13:13:26 +02:00

User.php

refactor(auth): remove OAuth re-authentication for destructive actions

2026-09-30 21:37:02 +02:00

UserChangelogRead.php

feat(changelog): implement automated changelog fetching from GitHub and enhance changelog read tracking

2025-08-12 10:07:11 +02:00

WebhookNotificationSettings.php

fix(applications): persist restart limit state for stopped containers (#11566)

2026-08-31 13:13:26 +02:00