Skip to content

Conversation

@andrasbacsai
Copy link
Member

@andrasbacsai andrasbacsai commented Oct 21, 2025

What's Changed

Security & Fixes

New Services & Templates

Improvements

yipfram and others added 30 commits September 4, 2025 00:52
- Add Home Assistant template with version 2025.10.2
- Configure reverse proxy support for Coolify with trusted private IP ranges
- Include D-Bus volume for Bluetooth integration support
- Add healthcheck for container monitoring
- Include configuration.yaml with reverse proxy settings to fix 400 Bad Request errors
Add Docker Compose template for Pocket ID, a simple and secure OIDC provider with passkey authentication support.
Add variant of Pocket ID template with PostgreSQL database support for better scalability and production use.
Include SMTP settings for email notifications and one-time access features.
Include SMTP settings for email notifications and one-time access features.
Add Docker Compose template for SparkyFitness, a comprehensive fitness tracking application, including the SVG logo and configuration for frontend, server, and database services.
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 6.3.6 to 6.4.1.
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/[email protected]/packages/vite)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 6.4.1
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <[email protected]>
Add ignore directive to minio.yaml
andrasbacsai and others added 27 commits October 27, 2025 16:04
…dade2

Update sponsor link from Darweb to Dade2
…lic-proto

fix(database): prevent malformed URLs when server IP is empty
…mponent

- Remove wire:ignore from modal-input.blade.php wrapper to allow child Livewire components to be properly tracked
- Add unique wire:key to EditCompose component for proper identification when teleported
- Fixes 'Unable to call component method' error when saving compose files

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
- Add null check before updating OAuth settings to prevent calling methods on null
- Apply couldBeEnabled() validation for all settings in bulk update (not just instant save)
- Disable OAuth providers that fail validation and collect error messages
- Surface all validation errors to the user instead of silently failing
- Update oauth_settings_map with fresh data after saving each setting

This ensures bulk updates follow the same validation logic as instant-save paths
and prevents bypassing model validation by directly calling update.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>
feat: add funding.json for standardized funding information
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
…r-support

Add repository-based Docker installation fallbacks for Debian 13 and other major distros
The login and forgot-password rate limiters were vulnerable to bypass
by manipulating the X-Forwarded-For header. Attackers could rotate
this header value to circumvent the 5 attempts per minute limit.

Changed both rate limiters to use server('REMOTE_ADDR') instead of
ip() to prevent header spoofing. REMOTE_ADDR gives the actual
connecting IP before proxy headers are processed.

Also added comprehensive unit tests to verify the fix.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>
feat: update Evolution API slogan to better reflect its capabilities
Update Plane version to v1.0.0
fix(service): seafile cannot upload files due to network errors
Fix and update the "pterodactly with wings" template.
Update & rename the pterodactly template
…hecks

feat(service): appwrite added healthchecks
…limit-bypass

fix: prevent login rate limit bypass via spoofed headers
…-6.4.1

build(deps-dev): bump vite from 6.3.6 to 6.4.1
@andrasbacsai andrasbacsai merged commit fe7ebc3 into v4.x Oct 29, 2025
3 of 4 checks passed
@levino
Copy link

levino commented Oct 29, 2025

Will this be released? My coolify deployment seems stuck at 434.

@levino
Copy link

levino commented Oct 29, 2025

The CDN shows:

{
   "coolify":{
      "v4":{
         "version":"4.0.0-beta.434"
      },
      "nightly":{
         "version":"4.0.0-beta.435"
      },
      "helper":{
         "version":"1.0.11"
      },
      "realtime":{
         "version":"1.0.10"
      },
      "sentinel":{
         "version":"0.0.16"
      }
   }
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment