SimpleHomelab/Deployrr v6.0.40

on GitHub

Released: 2026-11-02

This release updates Traefik to 3.7.17 for two security fixes, gives the Deployrr Dashboard a new look, and turns Check Pins into a report that never downgrades your apps.

Install

npm / npx (Recommended), needs Node.js and npm:

sudo npx @simplehomelab/deployrr@latest

curl standalone installer, no Node.js or npm needed:

sudo bash -c "$(curl -fsSL https://files.deployrr.app/install.sh)"

Then run deployrr.

Existing users: see Action required below before updating.

Highlights

• Traefik 3.7.17 is the new default for new installs and Traefik reinstalls, with two security fixes and extra request hardening. Existing installs need the steps below.
• Deployrr Dashboard: new look, now on Homepage v2.7.0.
• Check Pins is now a report. It shows which apps have a newer recommended version, and no longer changes anything (or offers downgrades).

Security

• Traefik 3.6 → 3.7.17 fixes CVE-2026-88011 (header alias spoofing, fixed in 3.7.12) and CVE-2026-88004 (the same defenses bypassed with HTTP trailers, fixed in 3.7.13).
• Header alias spoofing blocked: Traefik now deletes header aliases on all entrypoints (aliasHeadersStrategy=delete). For example, a request can no longer send X_Auth_User and have an app read it as X-Auth-User. This also removes the Traefik 3.7 startup warning.
• Encoded null and backslash rejected in request paths on the websecure entrypoints. Other encoded characters stay allowed, so apps such as Nextcloud/WebDAV, Gitea and Grafana should be unaffected.

These apply to new installs and Traefik reinstalls. Existing installs keep Traefik 3.6 and their current settings until you follow the steps below. Changing only the version pin is not enough: the header alias fix needs the new Traefik settings, which come with a reinstall.

Action required

Back up first. With a Pro licence: Tools > Backups > Backup. Without Pro, back up your Docker folder by hand, for example:

sudo tar -czf ~/docker-backup-$(date +%F).tar.gz -C /home/$USER docker

(Change /home/$USER and docker if your Docker folder is somewhere else.)

Traefik 3.7.17 and security settings

Needs a Plus or Pro licence and Hybrid setup mode, the same as the original Traefik setup. If you can't run the Traefik setup in Proxy > Traefik, don't delete Traefik: you would not be able to install it again.

1. Back up (see above).
2. Tools > Stack Manager > Delete. Choose Safe, then select traefik. When asked whether to create a live backup, press Y. Safe delete keeps the Traefik appdata folder, including your certificates (acme.json) and rules.

   Warning: while Traefik is removed, apps behind it can't be reached.

3. Prerequisites > Build Cache, to download the latest app files.
4. Install Traefik again from Proxy > Traefik.
5. Check: Tools > Stack Manager > Check Pins should not list Traefik as needing a newer version, and the Traefik logs should show no warnings about aliasHeadersStrategy.

Deployrr Dashboard: new look

Your existing dashboard keeps working as it is. Nothing changes until you choose to update it.

1. Back up (see above).
2. Tools > Stack Manager > Delete. Choose Full, then select deployrr-dashboard. When asked whether to create a live backup, press Y.

   Warning: Full delete removes the dashboard's appdata folder, including any manual changes to its config files. Press Y for the backup so you can copy back anything you need.

3. Prerequisites > Build Cache, to download the latest app files.
4. Docker > Deployrr Dashboard, to install the dashboard again.
5. Tools > ReDash, to restore your app cards.

Steps 2 and 5 need a Basic, Plus or Pro licence.

Breaking changes

• Check Pins no longer updates pins. It used to offer to update every pin that differed from the recommended one, which could downgrade apps (for example, a Traefik pin you had raised to 3.7.17 while the recommended version was still 3.6). It is now a report only. To update an app's version, use Settings > Version Pins (Pro), then Tools > Stack Manager > Update Stack, and check the app's logs afterwards. Without Pro, delete the app (Tools > Stack Manager > Delete) and install it again: it then gets the recommended version. Compose and config changes always need a reinstall.
• Traefik header aliases (after a Traefik reinstall): if an app relies on header names with underscores, such as X_Auth_User, it no longer receives them through Traefik.

New

• DEPLOYRRDASHBOARD_AUTH_ENABLED variable (default false), groundwork for Homepage's built-in login. See Known issues.

Improved

• Deployrr Dashboard default version v1.9.0 → v2.7.0 (Homepage).
• Deployrr Dashboard design: cleaner cards, status dots, equal-height cards, icons on the app groups, type-to-search quick launch, a date and time widget, and CPU temperature and uptime in the resources widget.
• Check Pins compares versions properly. It lists, one app per line, the pins where Deployrr recommends a newer version, the pins newer than recommended (kept), and tags it can't compare (such as latest or 16-alpine) for you to check manually. A leading v no longer counts as a difference (v1.9.0 and 1.9.0 match).

Fixed

• Check Pins offered downgrades when your pin was newer than the recommended one.
• Two Deployrr Dashboard bookmark descriptions did not show.

Known issues

• Existing installs keep their current version pins. New defaults (Traefik 3.7.17, Deployrr Dashboard v2.7.0) only apply to new installs, or after the steps above.
• Deployrr Dashboard login is not ready yet. Turning on DEPLOYRRDASHBOARD_AUTH_ENABLED alone does not enable a login: it also needs settings Deployrr doesn't set up yet.

Need help? Ask on Discord: https://www.simplehomelab.com/discord