Breaking Changes

• Require the new delete ability, or root, for every delete through the API and the MCP server, an API token with write alone can no longer delete resources, environment variables, storages, backups, scheduled tasks or tags, or detach a tag

Security

• Harden the CI workflows
  • Require every action to be pinned to a full-length commit SHA, with an Actions setting on GitHub that enforces it
  • Lock every action and the actions it calls to a commit in .github/workflows/actions.lock, together with the IDs of its owner and repository, which a commit SHA alone does not check
  • Require every workflow to use the lockfile, with an Actions policy on GitHub that enforces it
  • Keep the Docker Hub credentials and the CDN token in the release environment, which only the branches that release can use
  • Run without the GitHub Actions cache, layer caches and cached tool binaries, so no run restores what another run wrote
  • Grant every job the least permissions it needs and state the reason for every write permission
  • Keep the tokens that delete images in the cleanup environment, which only main can use
  • Fix every finding of jactionlint pedantic
• Refuse to update, force-push or delete the git tag of a release, with a tag protection rule on GitHub
• Refuse to delete or force-push main, next, release and maintenance branches, with branch protection rules on GitHub
• Hide locked environment variable values in the resource lists of GET /api/v1/resources and GET /api/v1/projects/{uuid}/{environment}, like the other endpoints already do
• Require an instance admin to disable the API, or to enable or disable the MCP server, through the API
• Route only the Reverb WebSocket path /app/ through the domain of the Coolify dashboard, the generated Traefik and Caddy configurations no longer expose the Reverb HTTP API under /apps
• Require the deploy ability for the registry check and the registry logout of the API and the MCP server, like the registry login
• Keep the file names of PostgreSQL init scripts inside the init script directory
• Protect archive branches from updates, deletions and force-pushing, with branch protection rules on GitHub

Added

• Limit a team member or an API token to selected projects, environments or resources, with the access levels read, read sensitive, deploy, write, delete and root, where a higher level includes the lower ones
  • Give an API token access to the whole team or to selected projects, environments or resources, a token never gets more access than its owner and stops working when its owner loses that access
  • Set the access of a member when you invite them, or later with a preset (viewer, developer, operator or full access) or per scope
  • Show members and tokens limited to some scopes only the projects, environments, resources, deployments and search results they can access, and keep them out of the team-wide pages and API endpoints
  • Set a member back to read-only to clear their grants and revoke their API tokens
  • See a summary of the access of every member under their email in the members list
• Choose the update channel of an instance on the update page: stable, preview with betas and release candidates, nightly with a warning that breaking changes are possible, or a custom image such as pr-1234
• Publish prereleases from next and the release branches, tagged like 4.6.0-beta.1, and the moving preview tag
• Publish a nightly version twice a day, tagged like 4.6.0-alpha.0.20261026.1, with the moving nightly tag and the nightly channel of the CDN, from next or from the release branch while one is in progress
• Keep the updates of the old channel after a switch to a more stable channel, until the stable release of the installed version is out
• Install the newest preview or nightly version with install.sh --preview or install.sh --nightly, which also switches the update channel of the instance
• Switch the update channel from the command line with php artisan app:update-channel
• Manage DNS records, integration tokens and secret managers through the API and the MCP server
  • View, create, replace and release the Cloudflare DNS records of the domains of applications and services
  • Create the DNS records of the domains that PATCH /applications/{uuid} and PATCH /services/{uuid} add, when exactly one zone with automatic DNS manages them, like the Domains page does
  • List, update, rotate and delete integration tokens, sync their DNS zones, and create Cloudflare tokens with DNS and tunnel capabilities
  • Set, remove and import the secret manager of applications, services and databases, key names are listed and values are never returned
  • Add the MCP tools manage_dns, manage_integration_tokens, manage_secret_manager and manage_cloudflare_tunnel
• Edit the description, permissions, access and expiry of an API token, its value stays the same
• Pause and resume an API token, a paused token cannot authenticate to the API or the MCP server
• Roll an API token to replace its secret and keep its description, permissions, access and expiry
• Clone private repositories from custom Git hosts over HTTPS with a username and a password or access token, set on the Source page or through the API, instead of a token in the repository URL
• Open the console of the main process of a container from the terminal, next to the shell, for containers that keep stdin open, such as game servers and REPLs, with the last 200 log lines and a command box that sends whole lines to the process
• Keep the stdin of a Docker image application open with -i or -it in its custom Docker options, so its terminal can open the console
• Send the logs of a server to Amazon CloudWatch Logs with the Docker awslogs log driver as a log drain
• Include the commit SHA, branch and message in deployment emails, with an opt-in setting of the email notifications
• Filter a table by clicking a type, status, server, source or role value in a row, and sort it by clicking a column header, also the projects and servers of the dashboard
• Show the Compose default of an empty environment variable in the developer view
• Add the Hi.Events one-click service
• Attach an SBOM attestation to every image, which lists every package of the image
• Publish the image of every pull request from a branch of this repository as ghcr.io/coollabsio/coolify:pr-<number>, so a change can be tried before it is merged
• Build main twice a day when it changed and move the main tag on ghcr.io to it, versioned like 4.5.0.20261028.1, to test fixes before their patch release
• Add OCI labels to the image, such as its version, commit, creation date, license and base image, instead of the labels it took over from its serversideup/php base image
• Copy the labels of the image to the annotations of its index, ghcr.io reads the description and the license of an image of several platforms from there
• Send a reminder email with a recovery link to the admin who started a subscription checkout on Coolify Cloud and did not finish it

Changed

• Replace the release process, RELEASE.md describes it
  • Keep the Coolify versions in release.json, stable.coolify for main and the maintenance branches and preview.coolify for next and the release branches
  • Pin the helper, Sentinel and Traefik versions in upstream.json instead of versions.json, the CDN writes versions.json from it
  • Release from main, next, release branches such as release/v4.6 and maintenance branches such as v4.x and v4.4.x
  • Select the stage and the version with scripts/release.sh, which offers the versions the branch allows and preselects the bump the commits need
  • Publish the version a push of release.json sets, unless it is published already, instead of a reviewed draft release
  • Move latest and preview to their place among all published tags, so a release of an older version never moves a tag back
  • Plan the version, the releases, the moving tags and the nightlies with scripts/plan-version.sh, which also reports what a push publishes
  • Take the release commit back before the push with scripts/undo-release.sh
• Take the Coolify version from the image alone, the upgrade script removes COOLIFY_VERSION from .env
• Compress the image layers with zstd instead of gzip, it compresses better and compresses and decompresses faster, pulling needs Docker Engine 23.0 or later and Coolify requires 24.0
• Fetch the Fleet Metrics of all servers at the same time, with one SSH command per server instead of one per metric, so the page loads 10 to 19 times faster with 1 to 10 servers in our benchmark
• Move the helper image to coollabsio/coolify-helper, which releases it
• Bump the SQLite image to 3.54.1-v0.2.0 with SQLite 3.54.1, which lets any user ID write the database files, so a connected application no longer has to run as 65532 or root
  • Replace the user ID note on the connect page with a warning that a bind mount opens the database files to every user on the host
• Streamline the CDN
  • Sync every channel with the install and upgrade scripts and the compose files of the commit it releases, instead of the copies in other/nightly
  • List the Coolify, helper, Sentinel and Traefik versions of every channel in /coolify/versions.json, older instances keep reading its coolify and traefik keys
  • Add a preview channel for the betas and release candidates
  • Sync it with scripts/sync-cdn.sh instead of php artisan sync:cdn, from the release workflow when latest or preview moves and from the nightly workflow
  • Open a pull request for the stable channel and push the preview and nightly channels directly
  • Clear the Cloudflare cache of the CDN with scripts/sync-cdn.sh --purge
• Rework the CI workflows for the new release process
  • Build each platform once and publish exactly th...

Fixes

• Kept the Dockerfile HEALTHCHECK of existing applications. Since v4.5.1, the Coolify healthcheck replaced it.
• Fixed Docker Compose builds that failed with "required variable is missing a value" when a required variable was set only for runtime. (#12363)
• Fixed Railpack builds that failed when they started at the same time as another build.
• Removed orphaned SSH connection processes that collected on the Coolify host.
• Fixed server validation, which now continues over SSH when the Hetzner API call fails.
• Stopped retries of HTTP requests that timed out after they were sent, so the same action did not run two times.
• Fixed MCP tokens with the read:sensitive permission, which did not see the commands and configuration of applications and databases.

Improvements

• Updated the Coolify helper image to 1.0.19.

Full Changelog: v4.5.2...v4.5.3

Fixes

• Fixed pull request previews that existed before the upgrade breaking on redeploy. They keep the production values they were first deployed with. New previews use only their own variables.
• Fixed 503 errors from Traefik during the first rolling update after you saved application settings. The retry proxy labels from v4.5.1 were removed, so the proxy labels are the same as in v4.5.0.
• Fixed SSH connections that stayed open and used up memory on the server when another process held the multiplexing socket.
• Fixed S3 backups that failed when the MinIO client fell back to S3v2 signing. Requests now always use S3v4, and failed uploads are tried again.
• Improved MySQL and MariaDB restores. They use the restore options of newer client versions, check the backup before they change the database, and stop with a clear message for unsupported content (#12352).
• Custom database configuration and custom Docker options of standalone databases are now shown only to team admins and owners, and to API tokens with sensitive read access (#12353).
• Application commands and configuration are now shown only to team admins and owners, and to API tokens with read:sensitive access.
• The service configuration form now uses the same role permissions as the environment variables page. Users who cannot manage the service environment see its fields as read-only (#12356).
• Finish events of background tasks now apply only to servers and services of their own team (#12355).
• API tokens with the write ability can now set manual webhook secrets.
• Pushover notifications no longer write the message payload to the log.

What's Changed

• fix(database-import): improve MySQL and MariaDB restore handling by @andrasbacsai in #12352
• fix(databases): show custom configuration only to admins by @andrasbacsai in #12353
• fix: scope finish events of background tasks to their team by @andrasbacsai in #12355
• fix(services): align service configuration form with role permissions by @andrasbacsai in #12356

Full Changelog: v4.5.1...v4.5.2

Breaking Changes

• Removed the "Remove from Coolify only" service delete option. A normal delete now works when the server is unreachable, and the services API rejects delete_from_coolify_only with 422.
• Removed the Highlight log drain because the service ended. Coolify stops its running containers.

Features

• (Self-hosted only) Limited first root account registration to ten minutes after Coolify starts. Restart Coolify to open the window again.
• Let team owners and admins require 2FA for all team members.
• Skipped the Compose image build when the images match the build inputs, so runtime-only changes no longer rebuild.
• Added a four-color custom theme dialog with presets and share codes.
• Let admins drag project and server zones on the canvases.
• Reworked the dashboard layout and showed live CPU and memory in the server table.
• Synced metric chart tooltips across charts and added local or UTC tooltip times.
• Made live refresh a toggle for every metrics and analytics range.
• Added compact traffic metrics with scaled latency units.
• Replaced native number spinners with a branded stepper.
• Moved the file browser container picker to a header dropdown.
• Added # coolify: flag directives (literal, buildtime, runtime) to the developer view of environment variables (#12349).
• Added a "Use path-style URLs" setting to S3 storages for providers that need virtual-hosted-style URLs.

Improvements

• Stopped 502 errors during rolling updates with proxy retries and a configurable drain time (#8627).
• Made metrics faster with one Sentinel SSH command and Sentinel-side bucketing (#12300).
• Stopped syncing file storages on every Compose parse.
• Made canvas pan and zoom faster.
• Added a confirmation when you clone with volume data, and stopped the source while data is copied.
• Verified helper downloads by SHA256 and updated Docker CLI, Compose, Buildx, and Railpack.
• Updated Sentinel images to 1.1.3.
• Updated Laravel to 12.70.1, the PHP image to v5.0.3, and Nginx to 1.31.8.
• Hid container tooling user agents in traffic analytics by default (#12335).
• Added a DNS menu to the domains toolbar.
• Explained what 100% CPU means in chart tooltips.
• Retried connection failures of idempotent HTTP requests, including Cloudflare API calls.
• Updated Fluent Bit for log drains from 2.0 to 5.1, and restarted running drains when their files change.
• Fetched Sentinel analytics dashboards of all servers at the same time.
• Validated new cloud servers automatically when they are running.

Fixes

• Security: enforced resource permissions for stored secrets and hid locked and admin-only secrets in forms, Compose, and the API.
• Security: closed holes in server transfer import, claim, and archives.
• Security: blocked PostgreSQL restore scan bypasses and stopped restores on SQL errors (#12333).
• Security: enforced GitHub App webhook signatures in the local environment.
• Security: limited system-wide Gitea sources to instance admins and source app lists to the current team.
• Security: hid database URLs in API create responses without sensitive access (#12297, fixes #11190).
• Security: scoped database backup API endpoints to the database type (#12279).
• Security: used the Cloudflare client IP for API allow-lists and audit logs (#12301).
• Wrote the generated Compose file after the image build (#12331).
• Wrote regular deployment files when the repository has symlinks (#12324).
• Prevented Git fetches from hanging (#12321, fixes #10316).
• Read the Compose file from Git objects and from Git submodules (#12320, fixes #11018).
• Allowed safe percent-encoded repository paths (#12319).
• Stripped paths and ports from COOLIFY_FQDN in env files (#12245, fixes #9649).
• Used SSH user registry credentials for host image pulls (#12216, fixes #12205).
• Rebuilt when a build secret value changed.
• Replaced the Dockerfile HEALTHCHECK when the healthcheck was enabled (#10974).
• Kept the healthy new container when a rolling update failed late (#12253).
• Stopped false pending changes (#11101, #12284).
• Found the current rollback image for containers with any name (#12296).
• Reported a failed application stop (#11063).
• Parsed mode suffixes in long-form bind targets.
• Created one Compose service on repeated submits and rejected Compose without services (#11078).
• Skipped the PORT mismatch warning when readonly labels were disabled (#10941).
• Deployed previews with their own environment variables (#12325).
• Kept custom preview domains on redeploy (#6536).
• Built the PR commit on manual Bitbucket preview redeploys (#10806).
• Keyed preview Docker tags by preview ID and stopped the DNS poll from re-queuing sync jobs.
• Kept open preview volumes out of stale Compose volumes (#10855).
• Kept locked variables and their preview copies locked with their values (#12299).
• Kept omitted values and flags when patching env variables through the API (#12240, fixes #9977).
• Included Infisical imported secrets (#12267).
• Regenerated proxy labels when the API changed exposed ports (#12334, fixes #11074).
• Saved is_auto_deploy_enabled for Docker image and Dockerfile apps created by the API (#12339).
• Wrote file storage content to the server on API PATCH (#12248, fixes #11759).
• Accepted API settings that the UI can change (#11092).
• Showed only permitted MCP tools and actions in help and hints (#12295).
• Kept privileges in PostgreSQL backups (#12244).
• Signed S3 uploads with the storage region (#12264).
• Saved removed databases in the backup list (#11548) and explained dumps that stopped without an error (#11549).
• Identified the instance database backup by ID.
• Used the instance URL in volume backup notifications (#12285).
• Kept the proxy status current and stopped auto-start during proxy restarts.
• Validated servers without a proxy (#11048) and explained Docker Engine version check failures (#11089).
• Blocked server migration when the target proxy is not running.
• Replaced wedged SSH multiplexing masters (#12241, fixes #10077, #11130).
• Proxied realtime and terminal WebSockets on the dashboard port (#11707).
• Kept new images during Docker cleanup (#11069) and skipped scheduled cleanups during deployments (#12183).
• Removed orphaned legacy realtime containers.
• Kept a detected public IP when the other IP family's lookup timed out (#12275).
• Quoted root credentials in the installer .env (#12276) and kept operator SSH keys that mention coolify (#12278).
• Reported a failed manual update check (#12266).
• Passed the cloudflared Access service token to the terminal SSH (#12312).
• Browsed files in containers without a shell (#12305).
• Trimmed Telegram bot tokens and chat IDs (#12323).
• Showed the server timezone in scheduled task help (#10904).
• Listed production, staging, and development environments first (#12317).
• Hid deleted resources on the environment page after the redirect.
• Showed held-back package updates separately.
• Fixed the filtered tag count in pagination.
• Recreated the Mosquitto password file on each start (#11691).
• Updated the Reactive Resume template to v6 (#12282).
• Fixed server online status (#12289), disk detection (#12315), chart density (#12281), and loading on slow servers in metrics.
• Fixed checkbox clicks in confirmation dialogs (#12338).
• Fixed the database image picker (#12337) and server IDs in the new resource wizard (#12327).
• Floated listbox panels over modals (#11529) and fell back to the default for invalid theme colors (#12287).
• Fixed sidebar, tooltip, canvas, chart, list, and Compose loading issues in the UI.
• Kept member API tokens when a member is promoted (#12342).
• Returned success: false on API access denied responses (#12343).
• Documented database and resource list responses in OpenAPI, and stopped requiring both environment_name and environment_uuid on create endpoints (#10449).
• Allowed environment variable references in image tags (#10642).
• Kept quoted values when saving the developer view of environment variables (#10406).
• Reported Compose files with no parsed services during deployments.
• Stopped containers again while they restart past their restart limit (#10761).
• Showed container logs that contain invalid UTF-8 (#10628).
• Fixed terminal connections that closed with "Missing required tokens" when the session cookie name was custom.
• Updated breadcrumb names after a rename (#12341).
• Showed why Hetzner, DigitalOcean, and Vultr API requests fail, stopped duplicate Hetzner create requests, and deleted unsaved VPS instances.
• Recreated database TCP proxies that run an outdated configuration.
• Skipped Git LFS downloads when Git LFS is disabled (#10360).
• Kept the base directory in new repository applications (#10319).
• Kept saving applications with unchanged legacy build commands.
• Used the owner/repo slug for GitHub API calls with SSH repository URLs (#10175).
• Showed GitHub App errors when loading repositories (#10174).
• Fixed terminal authentication when a sibling subdomain sets another XSRF-TOKEN cookie.
• Added an Axiom edge domain setting to log drains, so EU datasets work.
• Hid out-of-stock and deprecated Hetzner server types, or showed them as disabled.
• Let password managers autofill the confirmation password (#9963).
• Checked out short commit SHAs with shallow clones (#9926).
• Replaced the clone suffix instead of adding one for each clone (#9976).
• Kept port-suffixed SERVICE_URL and SERVICE_FQDN variables in sync with the domain (#9877).
• Returned logs of stopped containers through the API, like the UI.
• Renamed the old Security labels to Keys & Tokens.

What's Changed

• fix(api): hide DB URLs in create responses without sensitive access by @andrasbacsai in #12297
• fix(deployments): strip paths and ports...

Features

• Added Gitea App sources to deploy private Gitea repositories (#12234)
• Added server patching (beta) with automatic security updates per server, reboot and risky package warnings, and patch status in the server list
• Added a fleet Metrics page with server and container tables, trend charts, and one-click enable (#11867, #12162)
• Added disk, network, and load charts to the server metrics page (#11867)
• Added a Canvas view on the dashboard with interactive resource views, active deployments, and team avatars (#12160)
• Added a file browser for applications, services, and databases (#11518, fixes #6519)
• Added passkey sign-in (#12154)
• Added custom proxy error pages and maintenance mode for applications and services (#12112)
• Added hashing options for HTTP basic authentication on the proxy (#12086)
• Added optional permanent redirects for applications and services (#12233, closes #6032)
• Added a configurable Traefik certificate resolver per server, with an override per resource
• Added server creation on Hostinger VPS (#11176)
• Added Cloudflare tunnel setup with stored API tokens (#12157)
• Added an automatic backup of the Coolify database before an update (#12093)
• Server transfers to another Coolify instance now run in the background (#12180)
• Added deployments from GitLab system hooks, so each project no longer needs its own webhook (#12185)
• Added MCP tools to manage resources (#12163, closes #11281, #11881)
• Added Smart scan to detect the build pack, Dockerfiles, and environment variables for new Git projects (#8502)
• Added a cache flush for Redis, KeyDB, and Dragonfly databases (#11513)
• Added city-level traffic analytics with sortable tables (#12158)
• Added rollback to Docker registry images of recent deployments
• Added an interactive console mode (docker attach) to container terminals (#11538)
• Added an AWS CloudWatch (awslogs) log drain (#11972)
• Added opt-in commit details to deployment emails (#12030)
• Added a per-resource option to restore the Coolify default environment variables
• Added a configurable request timeout for Infisical and Vault secret managers (#12270)
• Added the app-key:reencrypt command to re-encrypt stored secrets after an APP_KEY rotation
• Added server GPU detection in the GPU settings
• Added a Detect button for the instance public IPs
• Added connecting resources to a tag from the tag page
• Added a text view for logs and grouped the log toolbar into menus
• Added a compact deployment history beside the deployment logs, with switching between deployments without a page load
• Added log exports with secrets hidden, and redacted application secrets in the full log download
• Added Deployment and Service selectors for runtime logs, with replica containers merged into one stream (discussion #12176)
• Added YAML syntax highlighting for dynamic proxy configurations and file mounts
• Added pagination with an adjustable page size for Docker images on a server
• Added a copy button to password inputs

Fixes

Security

• Plaintext secrets are now encrypted at rest
• PHP-based service templates were disabled for CVE-2026-109618 and CVE-2026-109619, then enabled again with patched images (#12268)
• System-wide Git sources are now restricted to instance admins (#12164)
• Deployment queries are now scoped to the applications of the team (#12195)
• The MCP endpoint now enforces the allowed IPs
• Server transfer bundle exports now require update access
• Read-only credentials are no longer saved from client input
• S3-compatible avatars and icons no longer use unauthenticated public URLs (#11865, fixes #11806)
• Custom log drain configurations are now validated (#12197)
• URL redaction no longer spans multiple log lines (#12238, fixes #11066)

Deployments and builds

• Railpack builds no longer leave an idle BuildKit builder running (#12097, fixes #11770, #12077)
• Environment variable values are now passed to containers exactly as entered, and existing variables keep the old escaping (#12024, fixes #7635)
• Build pack variables set at start time are kept in the runtime environment (#12025, fixes #11628)
• Transient GitHub token and clone failures are now retried
• Same-repository PR previews deploy regardless of the author association
• GitHub watch paths now use the net change of a push and paginate PR files
• GitHub webhooks are routed to the source of their app installation
• Closed Bitbucket, GitLab, and Gitea pull requests are cleaned up after a target branch change (#12008, #12012, #12013, fixes #12007, #12010, #12011)
• Compose preview storage records are deleted on cleanup (#12006, fixes #12005)
• Preview URL templates no longer have a doubled scheme
• Locally built Compose images are no longer pulled before a stop
• A deployment timeout now logs the configured timeout
• Deploy key setup works with a custom SSH username, and ssh:// repository URLs accept custom ports
• GPU settings now work in Docker Compose deployments

Docker Compose and storage

• Compose environment variable semantics are preserved (#11794, fixes #12057)
• Long bind options and non-creating bind sources are preserved (#12135, fixes #11882, #12036, #12079)
• ${VAR:-default} bind sources are resolved, and long-form bind sources with variable or vault references are kept (#12227, fixes #8854)
• ../ bind sources are resolved in raw Compose mode
• A UTF-8 BOM is removed before Compose YAML is parsed (#12223, fixes #6777)
• Compose commands use explicit file paths and remove volumes by name (#12199)
• Quoted and hyphenated custom Docker option values are parsed correctly (#12208, fixes #8173)
• SERVICE_URL_* stays on the named service domain, and a SERVICE_FQDN_ twin is treated as a copy
• Service URLs set through the API persist across Compose re-parses

Proxy and domains

• Running proxy status from Sentinel push updates is saved (#12237, fixes #11539)
• Server-Sent Events streams are excluded from Traefik compression (#12229, fixes #5586)
• The proxy check requires the coolify-proxy container name outside Swarm (#12225, fixes #7083)
• sslip.io domains resolve the server hostname to an IP
• noindex is applied to domains that include a port
• Absent Let's Encrypt resolvers are cleared during migration

Backups and scheduled tasks

• PostgreSQL healthchecks and backups set PGPASSWORD (#12224, fixes #6353)
• Backups use the configured databases when the container environment is missing (#12212, fixes #9417)
• S3-only volume backups send Content-MD5 for Object Lock buckets (#12215, fixes #12211) and no longer panic in the mc pipe
• Volume backups accept tar exit code 1 and skip containers removed during the scan
• Scheduled tasks run only in running application containers (#12226, fixes #7377) and skip a run while the previous run is still active
• Deleting a scheduled task no longer shows a 404
• Backup tables show exact execution times and sort again

API

• The fqdn field rejection now points to domains on application writes (#12217, fixes #9502)
• force_domain_override is honored for docker_compose_domains on create (#12032, fixes #12031)
• Application updates accept dockerfile and github_app_uuid
• Database updates apply redis_password and instant_deploy
• Service creation accepts connect_to_docker_network
• API token creation for MCP works when the REST API is disabled

Servers, Sentinel, and upgrades

• Upgrades keep Coolify running when Docker reports IPv6 gateways with a prefix
• Rate-limited image pulls are retried and automatic updates are spread over time
• The installer no longer restarts Docker with running containers, handles a stopped Docker daemon, and changes data directories only after checks and downloads (#12050)
• Sentinel starts on servers with a userns-remap Docker daemon
• OS derivatives are accepted through ID_LIKE in server validation
• SSH multiplexing orphans are reaped by socket ownership
• Docker cleanup removes old Coolify images on Docker 29 and fails executions orphaned by a killed worker
• Unreachable servers no longer block dashboard metrics charts
• Manually set instance public IPs are kept on restart
• Failed server validations are rate limited on Coolify Cloud

Services

• Fixed or updated the Appwrite, Forgejo, Hatchet, Hermes, Homepage (#12221, fixes #11758), Huly (#12209, fixes #11004), Langfuse (#12207, fixes #8797), Mixpost, Odoo (#12231, fixes #3441), RabbitMQ, Seafile, SigNoz, Supabase (#12001, #12002, fixes #11998, #11999), Sure (#12228, fixes #11756), Trigger (#12214, fixes #8638), Twenty (#12222, fixes #8381), and Weblate (#12220, fixes #4513) templates
• Templates that used removed MinIO images now use pgsty/silo
• Containers connect to the predefined network before they start
• The container terminal works for degraded services
• The Website button links to the project page

Other

• Interactive terminal programs no longer leak CPU after close (#12230, fixes #6125)
• Telegram test notifications show API errors (#12219, fixes #9978)
• Notification and log drain fields are required only when enabled (#12232, fixes #5631, #6123)
• Notification channels are disabled after repeated configuration failures
• Server names with whitespace work in log drains (#12239, fixes #6406)
• The manual Git webhook form is hidden for non-Git resources (#12218, fixes #7514), and GitLab App sources show the webhook setup
• Switched teams persist when concurrent requests save the session
• Database custom configurations apply on servers with a strict umask
• Firefox tab restore no longer switches the theme to custom
• Log deployment and service menus stay open on live updates
• Fullscreen logs now show above the sidebar and top bar

Improvements

• Refreshed the dark mode with the coolLabs purple brand (#12277)
• Strengthen...

curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash

curl -fsSL https://cdn.coollabs.io/coolify/install.sh | sudo bash -s 4.0.1

Security

• Updated PHP to 8.4.27 to fix PHP2Shell (CVE-2026-109618, CVE-2026-109619).
• Updated Node.js to 24.22.1 for the terminal server and the asset build.
• Updated cloudflared to 2026.10.3 for the eMudhra certificate compromise.
• Updated Sentinel to 1.1.2 to fix CVE-2026-111943.

Issues

• fixes #12266

curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash

Security

• Updated PHP to 8.4.27 to fix PHP2Shell (CVE-2026-109618, CVE-2026-109619).
• Updated cloudflared to 2026.10.3 for the eMudhra certificate compromise.
• Updated Sentinel to 1.1.2 to fix CVE-2026-111943.

Issues

• fixes #12266

curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash

Security

• Updated PHP to 8.4.27 to fix PHP2Shell (CVE-2026-109618, CVE-2026-109619).
• Updated cloudflared to 2026.10.3 for the eMudhra certificate compromise.
• Updated Sentinel to 1.1.2 to fix CVE-2026-111943.

Issues

• fixes #12266

curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash

Security

• Updated PHP to 8.4.27 to fix PHP2Shell (CVE-2026-109618, CVE-2026-109619).
• Updated cloudflared to 2026.10.3 for the eMudhra certificate compromise.
• Updated Sentinel to 1.1.2 to fix CVE-2026-111943.

Issues

• fixes #12266

curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash

Security

• Updated PHP to 8.4.27 to fix PHP2Shell (CVE-2026-109618, CVE-2026-109619).
• Updated cloudflared to 2026.10.3 for the eMudhra certificate compromise.
• Updated Sentinel to 1.1.2 to fix CVE-2026-111943.

Issues

• fixes #12266