What's Changed
Security & Fixes
- Fixed SSH command injection vulnerability (#8748)
- Resolved 419 session errors with Cloudflare Tunnels and domain-based access (#8749, fixes #5404)
- Fixed SSH directory permission issues during upgrades (#8635, resolves #6621)
- Added SSH directory permission auto-fix for new installations (#8635)
- Prevented command injection in certificate handling via base64 encoding (#8617)
- Hardened Docker command execution with centralized escaping (#8615)
- Prevented command injection in health check commands (#8611)
- Fixed cross-tenant IDOR vulnerability in resource cloning (#8613)
- Added IPv6 CIDR support for API access IP allowlist (#8750, fixes #8729)
- Fixed proxy initialization with IPv6 networks on Docker 25+ (#8703, fixes #8649)
- Fixed CSRF redirect loop during 2FA authentication (#8596)
- Corrected API permission requirements for POST endpoints (#8600)
- Added team authorization checks to domains_by_server API (#8616)
- Fixed Cloudreve service data persistence across restarts (#8740)
- Fixed Ente Photos join link configuration (#8727)
- Fixed application rollback to use correct commit SHA (#8576)
- Fixed deployment detection for BuildKit and secrets (#8565)
- Resolved team lookup for service relationships (#8559, fix #8431)
- Added webhook notification status validation (#8557, fix #8448)
- Fixed deploy key handling when private_key_id is zero (#8563, fixes #8562)
- Fixed Redis/KeyDB config permissions with custom configurations (#8561, fix #8539)
- Fixed password field UI flash before Alpine.js initialization (#8599, closes #8592)
- Fixed GlitchTip webdashboard loading issue (#8249)
- Fixed Grist service template configuration (#8384)
- Fixed API documentation schema references (#8239, closes #8229)
New Services & Templates
- Added Pydio Cells service (#8323)
- Added Sure service (#8157)
- Added Spacebot service with custom logo support (#8427)
- Updated N8N templates to 2.10.2 (#8679)
- Upgraded Beszel and Beszel Agent to v0.18 (#8513)
- Disabled Plane service in template suite (#8580)
- Disabled Pterodactyl Panel and Wings from service templates (#8512)
- Disabled Minio Community Edition from service templates (#8686)
- Disabled Maybe service in template suite (#8167)
Features & Improvements
- Added refund and cancellation management for subscriptions (#8637)
- Added comment field support to environment variables (#7269, fix #7239)
- Added command-based health check support for services (#8612)
- Added scheduled job monitoring dashboard (#8433)
- Added scheduled tasks CRUD API with authentication and validation (#8428)
- Made Horizon max time configurable (#8560, fix #8435)
- Fixed Soketi host binding for IPv6 support (#8619, closes #8584)
- Fixed scheduler self-healing for stale Redis locks with UI detection (#8618, fixes #8327)
- Fixed Traefik service label handling for force HTTPS (#8550)
- Improved security by hardening deployment paths and deploy abilities (#8549)
- Fixed queue timeout handling in Horizon gracefully (#8360)
- Fixed missing status variable in Hetzner status checks (#8359)
- Fixed container filtering in push server job (#8361)
- Improved proxy error handling on port allocation failure (#8362)
- Enhanced SSH error tracking with proper Sentry scoping (#8363)
UI & Developer Experience
- Added container labels header to UI (#8752)
- Improved project heading navigation spacing (#8564)
- Fixed datalist border color and added repository selection watcher (#8240)
- Fixed Docker Compose force HTTPS preference behavior (#8424)
- Migrated test suite to SQLite in-memory with Pest browser testing (#8364)