e255f69999
Merge pull request #5752 from Dokploy/fix/security-issues
...
fix: security issues
2026-10-22 18:53:53 -04:00
02c73becf9
Merge pull request #5754 from Dokploy/chore/dependabot-security-bumps
...
chore(deps): bump dependencies flagged by Dependabot
2026-10-22 18:26:17 -04:00
fec8e386ef
chore(deps): keep better-auth on 1.6.23
...
1.6.29+ changes SSO org assignment: Google/GitHub sign-ins no longer
auto-join the org by email domain without domainVerification, and
SSO sign-ins skip membership when an invitation is pending.
2026-10-22 17:01:09 -04:00
b6f344efe3
fix(auth): disable SCIM management HTTP endpoints and bump better-auth to 1.6.33
2026-10-22 16:52:15 -04:00
4559aa6d7a
Merge pull request #5753 from Dokploy/fix/compose-yaml-merge-keys
...
fix: resolve YAML merge keys when rewriting compose files
2026-10-22 14:32:42 -06:00
b77e81e8a4
Merge pull request #5745 from Dokploy/fix/select-empty-value-on-reset
...
fix: prevent Radix Select from clearing form values on reset
2026-10-22 14:32:28 -06:00
9958500e0f
chore(deps): bump dependencies flagged by Dependabot
2026-10-22 16:24:00 -04:00
36ffed167c
test: make merge-key tests exercise injected networks and labels
2026-10-22 13:56:22 -06:00
9b97af0d03
fix(deployment): restrict server deployment history to accessible servers
2026-10-22 15:51:23 -04:00
722996833f
fix: resolve YAML merge keys when rewriting compose files ( #5625 )
2026-10-22 13:40:46 -06:00
b3cd3c5061
fix: close cross-tenant, backup destination and token leak security issues
...
- scope service permission checks to the active organization (#5635 )
- check backup and volume backup destinations against the organization,
confine certificate paths to CERTIFICATES_PATH, validate compose
branches (#5541 )
- send git provider tokens through an http extraHeader instead of the
clone URL so submodule URLs and build logs never contain them (#5618 )
- send the build log tail in build failure notifications (#5557 )
2026-10-22 15:34:13 -04:00
c7b0570bc6
fix(ai): hide AI actions for users without ai.read ( #5749 )
2026-10-23 00:37:49 +05:30
e59ba0636b
fix: register cloud schedules without a timezone ( #5139 )
2026-10-22 12:12:37 -06:00
9c06e34bec
Merge pull request #5732 from Totopo27/fix/gh-5659-webhook-remote-server-concurrency
...
fix(deploy): preserve remote serverId in webhook deployment jobs
2026-10-22 11:41:55 -06:00
7e346bb687
Merge pull request #5742 from imrja8/fix/monitoring-permissions
...
fix(monitoring): gate host monitoring on docker access and let docker readers see disk usage
2026-10-22 22:49:12 +05:30
3fd1fe1b85
fix(select): prevent clearing form values on reset by ignoring empty selections
2026-10-22 11:12:32 -06:00
f2685081d8
fix: prevent Radix Select from clearing form values on reset ( #5223 )
2026-10-22 11:09:36 -06:00
eb98876f88
Merge pull request #5738 from Dokploy/chore/bump-node-24.22.1
...
chore: bump Node.js to 24.22.1 (security release)
2026-10-22 10:56:20 -06:00
e7b640dddf
refactor(monitoring): run host monitoring permission checks in parallel
2026-10-22 22:14:03 +05:30
8cac2d849d
chore(monitoring): address review comments
2026-10-22 21:27:11 +05:30
c5e364dbcb
fix(monitoring): gate host monitoring on docker access and let docker readers see disk usage
2026-10-22 20:30:53 +05:30
f40b3e7490
refactor(wss): reuse findServiceAppName from container-ownership ( #5741 )
2026-10-22 20:22:12 +05:30
9f6e82abf6
fix(monitoring): let members with service access see container monitoring ( #5716 )
...
* fix(monitoring): let members with service access see container monitoring
The Monitoring tab opened /listen-docker-stats-monitoring without a
serviceId, so the socket required the docker permission and closed with
"Not authorized" for members granted the service. Pass the serviceId from
every service page, as the Logs tab does.
With a serviceId, the socket now also checks that the requested container
belongs to that service (app name for applications and databases, project
or namespace label for compose and stacks), and never serves host stats.
Closes #5674
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
* fix(monitoring): reject unknown appType on the service-scoped stats path
appType comes from the URL, so an unexpected value skipped every
ownership filter and returned the first running container's stats.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-22 19:10:00 +05:30
ad222962b8
Merge pull request #5701 from Gabrielgvl/fix/registry-login-stdin
...
fix(security): pass registry passwords to docker login via stdin
2026-10-22 09:14:43 -04:00
95c1e81beb
chore: bump Node.js to 24.22.1 (security release)
2026-10-22 14:02:21 +05:30
47b0d6563a
refactor(wss): look up service app names from a table list
2026-10-21 22:41:15 -04:00
73c795e157
fix(wss): resolve libsql services when binding the container terminal
2026-10-21 22:26:02 -04:00
99e4f1c8dc
fix(wss): bind container terminal to the service it was opened from
2026-10-21 22:18:25 -04:00
e76283bc09
fix: keep commands and secrets out of ExecError messages and inspect output
2026-10-21 22:18:25 -04:00
5849102a40
fix(deploy): preserve remote serverId in webhook deployment jobs
2026-10-21 18:15:35 -06:00
b5c5faf9f0
fix(security): pass registry login passwords through stdin
...
Use execFile arguments for local login and the SSH stream for remote login. Discard execution errors after sanitizing their messages so echoed credentials cannot survive in nested error fields.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-17 12:18:12 -03:00
e0c8d80cde
fix: decode Route53 octal escapes in record names ( #5553 )
...
* fix: decode Route53 octal escapes in record names
* fix: keep escaped dots and backslashes in Route53 record names
2026-10-16 21:10:45 +05:30
49d250aaa9
Merge pull request #5590 from GlebsonS4ntos/fix/prevent-service-header-overflow-mobile
...
fix(ui): prevent service header overflow on mobile
2026-10-16 09:14:28 -06:00
e38a980d9f
[autofix.ci] apply automated fixes
2026-10-16 11:42:40 +00:00
829f8af63f
fix(ui): fix server badge and appName overflow on mobile
2026-10-16 17:09:26 +05:30
837730038c
fix(billing): guard loadStripe behind key check for self-hosted instances
2026-10-16 14:54:24 +05:30
53464e9096
Merge pull request #5070 from bunlongheng/fix/traefik-file-path-traversal
...
fix(settings): confine Traefik file read/write to the Traefik config directory
2026-10-15 17:24:35 -04:00
136a09d016
fix(settings): check server organization in traefik file endpoints
2026-10-15 15:24:24 -04:00
5ff8d05ff7
perf(ai): optimize permission evaluation and remove redundant DB queries
2026-10-15 21:51:48 +05:30
0049421095
fix(ai): fix PermissionCtx type on resolveInputApiKey
2026-10-15 21:51:48 +05:30
3d67665c33
fix(ai): require update permission for stored key resolution, deduplicate resolve logic
2026-10-15 21:51:48 +05:30
2bfcac58b0
fix(ai): mask apiKey exposure, add audit logging, resolve masked-key UX regression
2026-10-15 21:51:48 +05:30
a7d8378f52
fix(permissions): mask apiKey on ai.one, add audit logging, remove dead endpoint
2026-10-15 21:51:48 +05:30
bdefc02e77
fix: redact apiKey from getAll AI endpoint to prevent credential exposure
2026-10-15 21:51:31 +05:30
293e19703a
fix: resolve cross-tenant access and granular role UI issues for AI settings
2026-10-15 21:51:31 +05:30
cd9edb290b
fix(permissions): resolve AI module authorization edge cases and test failures
2026-10-15 21:51:31 +05:30
b5473e63fd
feat(permissions): add AI module to enterprise custom roles
2026-10-15 21:51:31 +05:30
e0006758c0
Merge pull request #5517 from Dokploy/dependabots-alerts
...
Dependabots alerts fixes
2026-10-14 16:14:50 -04:00
d9fe046396
Merge pull request #5661 from manozzo/fix/template-card-tags-overflow
...
fix(templates): cap visible tags so the Create button stays visible
2026-10-15 01:33:09 +05:30
502d6c8a18
Merge branch 'canary' into dependabots-alerts
2026-10-15 00:44:53 +05:30
Narciso E. Núñez Arias