⚠️ Breaking Change Team members with the Member role now have read-only access. They can continue to view team resources and configuration, but can no longer create, update, delete, deploy, start, stop, or otherwise modify resources. Review your team roles before upgrading and promote users who still require write access. State-changing API endpoints now require POST. Legacy GET requests return 40…
What's Changed Security & Fixes Fixed private submodule authentication during deployments (#8900, fixes #2731) Fixed deploy keys overwriting server root SSH keys (#10440, fixes #10203) Improved fork pull request safety for preview deployments (#10457, fixes #10342) Hardened API token team checks (#10505) Improved image, branch, proxy, and deployment input validation (#10501, #10502, #10503, #10504…
What's Changed Security & Fixes Restricted source and private key selection to the current team (#10348) Restricted environment deletion to the current team (#10349) Restricted server and network selection to the current team (#10352) Fixed source selection during repository setup (#10354) Hardened API token permission handling (#10355) Fixed service pages opening in the correct project and enviro…
Features Added Railpack as a beta build pack option with build-time environment support, config merging, examples, and deployment smoke coverage (#9117, resolves #5282). Added configurable application stop grace periods for manual stops, previews, and deployments (#9746, fixes #5620). Added structured audit logging for API mutations, webhook events, authentication, and authorization outcomes (#984…
Finally releasing v4.0. It was long overdue because we have been in beta for a long time. Thousands of companies and people have been using Coolify in production for 1-2 years. Of course, this does not mean it has no bugs, it has many, but we fix them every day. v5 is coming together, but we are not rushing it. The biggest feature will be full scalability in the core, so you will have cloud infras…
What's Changed Security & Fixes Prevent data loss when persistent containers (databases, apps, services) are accidentally pruned during service deletion (#9654, fixes #9582) Fix S3 storage backup endpoints returning 500 in API context (#9655, fixes #9581) Encrypt manual webhook secrets and strengthen HMAC signature verification (#9652) Fix Rocky Linux installer to use correct RHEL Docker repositor…
Fixes Fixed the upgrade modal to show the correct target version and cleared stale upgrade notifications when the instance was already up to date. (#7774, fixes #6039, #8707) Fixed user deletion cleanup so team-owned Git app sources were handled safely, while instance-wide sources were preserved for the root team. (#9435, fixes #8172) Fixed dashboard homepage add buttons so they remained visible i…
What's Changed Security & Fixes Allow quoted arguments in custom Docker run options (#9481, fixes #9343) Patched Alpine packages in helper, realtime, and development Docker images (#9437) Bumped Alexandrie images to address upstream security advisory (#9434) New Services & Templates Added Grimmory one-click service, the successor to Booklore (#9109) Comprehensive Supabase template update to latest…
What's Changed Security & Fixes Harden model mass assignment protection across all models (#9282) Scope server and project queries to current team (#9230) Harden GetLogs component with locked properties and input validation (#9229) Add validation and escaping for Docker network names (#9228) Add URL validation for notification webhook fields (#9224) Use server-side config for password reset URL ge…
What's Changed Security & Fixes Fixed proxy config validation to ensure stored config matches the current proxy type (#9146, fixes #9127) Fixed environment variables being incorrectly resolved in compose files instead of preserving ${VAR} references (#9147, fixes #9136) Fixed deployment issues with shell argument escaping in nixpacks commands (#9122, fixes #9042) Fixed GitHub webhook errors for un…
What's Changed Security & Fixes Fixed sporadic SSH "permission denied" errors during key rotation (#8990, fixes #7724) Fixed deployment failures when build server is enabled during restart operations (#9045, fixes #9013) Fixed breadcrumb queries causing out-of-memory crashes (#9048, fixes #9009) Fixed GitHub App webhook endpoint defaulting to IPv4 instead of instance domain (#8948) Fixed Hoppscotc…