What's Changed
- fix: validate API key name length to prevent opaque 500 by @tanaymishra in #4806
- fix(compose): preserve named-volume access mode when adding suffix by @Siumauricio in #4823
- fix(ui): disambiguate repos with the same name in the repository selector by @Siumauricio in #4826
- fix(settings): allow clearing the server domain by @Siumauricio in #4825
- fix(ui): typos by @EvanSchleret in #4800
- fix(security): OS command injection in git clone across all providers by @Siumauricio in #4855
- fix(security): git provider credential disclosure via cross-org IDOR (.one endpoints) by @Siumauricio in #4856
- fix(security): SSH private key disclosure via server read endpoints by @Siumauricio in #4857
- fix(security): cross-org IDOR + nodeId injection in swarm read endpoints by @Siumauricio in #4858
- fix(security): git provider secret disclosure via application.one by @Siumauricio in #4859
- fix(security): OS command injection in docker build/pull commands by @Siumauricio in #4860
- fix(security): OS command injection via dockerImage in database service deploys by @Siumauricio in #4861
- fix(security): OS command injection in database backup/restore commands by @Siumauricio in #4862
- fix(security): OS command injection via compose path and custom command by @Siumauricio in #4863
- fix(security): OS command injection via swarm nodeId and registry tag by @Siumauricio in #4864
- fix(security): missing authorization on docker/terminal WebSocket handlers (member -> root) by @Siumauricio in #4865
- fix(security): host-schedule owner/admin bypass via applicationId (member → root) by @Siumauricio in #4869
- fix(security): missing authorization on GitHub App setup callback (unauth cross-org write) by @Siumauricio in #4870
- refactor(providers): inline quote() in git clone commands, drop shellWord helper by @Siumauricio in #4871
- fix(security): escape user-controlled values across command-injection sinks (quote sweep) by @Siumauricio in #4873
- fix(security): command injection in registry.testRegistry / testRegistryById by @Siumauricio in #4875
- fix(security): cross-org authorization bypass in server.remove by @Siumauricio in #4874
- fix(ui): organization menu clipped when sidebar is collapsed by @Siumauricio in #4876
- fix(2fa): show correct error message for invalid TOTP code by @Siumauricio in #4877
- fix: rename compose "Reload" action to "Rebuild" by @ANSUJKMEHER in #4847
- fix(auth): enable email verification for SSO and user creation by @Siumauricio in #4880
- feat(ai): allow organizations to define custom AI provider presets by @Siumauricio in #4882
New Contributors
- @tanaymishra made their first contribution in #4806
- @EvanSchleret made their first contribution in #4800
- @ANSUJKMEHER made their first contribution in #4847
Full Changelog: v0.29.12...v0.29.13