Andras Bacsai c75e7078b7 fix(access): restrict preview changes, rollbacks, and repo URL updates ...

- Require the write permission and update policy to open a preview or
  change its pull request URL, git type, or docker tag via the API;
  deploy-only tokens can only redeploy an existing preview
- Reject rollbacks to commits that are neither a listed rollback image
  nor a successful production deployment (GetRollbackImages::allows)
- Validate git_repository with ValidGitRepositoryUrl when it changes on
  application update
- Add RejectPublishedAppKey global middleware
- Show a "still starting" message when the root setup window is pending
- Document the new 403 responses and constraints in the OpenAPI spec
- Add tests for the new checks

2026-11-08 17:26:34 +01:00

..

AppServiceProvider.php

fix(access): enforce member grants on more actions

2026-10-30 16:11:10 +01:00

AuthServiceProvider.php

fix(access): enforce member grants on more actions

2026-10-30 16:11:10 +01:00

BroadcastServiceProvider.php

…

ConfigurationServiceProvider.php

…

EventServiceProvider.php

feat(terminal): interactive console mode for containers (docker attach) (#11538)

2026-10-14 14:32:02 +02:00

FortifyServiceProvider.php

fix(access): restrict preview changes, rollbacks, and repo URL updates

2026-11-08 17:26:34 +01:00

HorizonServiceProvider.php

feat(horizon): read allowed emails from config and allow root user by id

2026-08-17 13:07:49 +02:00

RouteServiceProvider.php

fix(api): use the Cloudflare client IP for allowed IPs and audit logs

2026-10-25 23:47:39 +01:00