coolify

Added

• The reason of a failed image scan in a Show error log section on the Security page and in the Laravel log
  • The error log shows the failed step, its exit code, and the end of the command output. Only users who can change the resource or server see it

Fixed

• Failed image scans on self-hosted instances, because the scanner templates were missing from the Coolify image
• Ignored custom container labels and wildcard domains in maintenance mode (#12498)
  • With editable container labels, maintenance mode uses the Traefik router rules and the Caddy site addresses of the labels
• Showed an error on the Vulnerabilities page
• Showed warning callouts in the accent color instead of yellow when a custom theme is active

Breaking Changes

• Cancelled the older queued webhook deployments of an application by default when a newer push arrives, so only the latest commit is built (#10921, #7678)
  • It works per application, pull request and server
  • Advanced > Deployment and is_auto_cancel_queued_deployments_enabled in the applications API turn it off
  • Manual, API, restart and rollback deployments are never cancelled
  • An opt-in setting, is_auto_cancel_building_deployments_enabled in the API, also stops an older webhook deployment that is still building, a deployment that started to replace containers always finishes
  • cancel_previous (none, queued or building) on /api/v1/deploy and the MCP deploy tool cancels the older webhook, API and MCP deployments, the default is none
• Limited the cloud provider token API to team admins and owners
  • Other members get 403
• Moved the Resend sender to the new resend_from_address and resend_from_name fields, API clients must use the new fields
  • A migration copies the current values

Security

• Applied the limits of API tokens to more permission checks
  • A message explains when a token limit blocks a change
• Built team invitation links from the instance URL instead of the request host, when no instance domain is set
• Checked that members with access grants can use the selected server and the team credentials
  • A new, cloned or migrated resource needs a server that the member can use, the localhost server needs an instance admin
  • Server lists show only the servers that the member can use
  • Team private keys, GitHub Apps, Gitea Apps and new S3 storages of backup schedules need write access on the whole team, also through the API
  • A message explains when write access on the whole team is needed
• Checked the deploy permission before a deploy through the API creates a preview or changes its image tag
• Ended terminal sessions when access to the server is lost
• Enforced fixed SSH connection options on every connection, also for health checks
• Generated new SSH keys as Ed25519 and validated private keys more strictly
• Hardened SMTP and terminal connections
  • SMTP hosts are validated, and Coolify connects only to the checked address
  • The error message explains why an SMTP host is refused
• Limited the server data in the application, service, and database API responses to tokens that cover the whole team
• Removed the server details from the response of the get_service MCP tool
• Kept personal data and credentials out of audit events
  • The audit events of a deleted user are anonymized
• Kept stored private keys out of the browser
• Kept the Sentinel token out of process arguments
  • Sentinel reads it from an env file
• Limited API clients that keep failing to 30 failed requests per minute for one token or IP
  • More failed requests get 429, API_FAILED_REQUEST_RATE_LIMIT sets the limit
  • The team of the token gets one notification a day when the token reaches the limit
• Pinned the SSH host key of a server on the first connection, the team gets a notification when it changes
  • SSH_HOST_KEY_CHECKING sets the mode: warn, enforce or off
• Pinned the SSH host keys of Git hosts across deployments
  • Coolify shows the published host keys of GitHub, GitLab and Bitbucket
• Restricted preview changes, rollbacks and repository URL changes
  • Opening a preview, changing its pull request URL, Git type or Docker tag, or choosing a commit through the API needs write access, a deploy token can only redeploy an existing preview
  • A rollback goes only to a listed rollback image or a successful production deployment
  • A new git_repository of an application is validated like in the UI
  • The docker_tag of /api/v1/deploy is validated like in the preview API
• Validated webhook URLs, limited DNS lookups and tightened the

Breaking Changes

• Require the new delete ability, or root, for every delete through the API and the MCP server, an API token with write alone can no longer delete resources, environment variables, storages, backups, scheduled tasks or tags, or detach a tag

Security

• Harden the CI workflows
  • Require every action to be pinned to a full-length commit SHA, with an Actions setting on GitHub that enforces it
  • Lock every action and the actions it calls to a commit in .github/workflows/actions.lock, together with the IDs of its owner and repository, which a commit SHA alone does not check
  • Require every workflow to use the lockfile, with an Actions policy on GitHub that enforces it
  • Keep the Docker Hub credentials and the CDN token in the release environment, which only the branches that release can use
  • Run without the GitHub Actions cache, layer caches and cached tool binaries, so no run restores what another run wrote
  • Grant every job the least permissions it needs and state the reason for every write permission
  • Keep the tokens that delete images in the cleanup environment, which only main can use
  • Fix every finding of jactionlint pedantic
• Refuse to update, force-push or delete the git tag of a release, with a tag protection rule on GitHub
• Refuse to delete or force-push main, next, release and maintenance branches, with branch protection rules on GitHub
• Hide locked environment variable values in the resource lists of GET /api/v1/resources and GET /api/v1/projects/{uuid}/{environment}, like the other endpoints already do
• Require an instance admin to disable the API, or to enable or disable the MCP server, through the API
• Route only the Reverb WebSocket path /app/ through the domain of the Coolify dashboard, the generated Traefik and Caddy configurations no longer expose the Reverb HTTP API under /apps
• Require the deploy ability for the registry check and the registry logout of the API and the MCP server, like the registry login
• Keep the file names of PostgreSQL init scripts inside the init script directory
• Protect archive branches from updates, deletions and force-pushing, with branch protection rules on GitHub

Added

• Limit a team member or an API token to selected projects, environments or resources, with the access levels read, read sensitive, deploy, write, delete and root, where a higher level includes the lower ones
  • Give an API token access to the whole team or to selected projects, environments or resources, a token never gets more access than its owner and stops working when its owner loses that access
  • Set the access of a member when you invite them, or later with a preset (viewer, developer, operator or full access) or per scope
  • Show members and tokens limited to some scopes only the projects, environments, resources, deployments and search results they can access, and keep them out of the team-wide pages and API endpoints
  • Set a member back to read-only to clear their grants and revoke their API tokens
  • See a summary of the access of every member under their email in the members list
• Choose the update channel of an instance on the update page: stable, preview with betas and release candidates, nightly with a warning that breaking changes are possible, or a custom image such as pr-1234
• Publish prereleases from next and the release branches, tagged like 4.6.0-beta.1, and the moving preview tag
• Publish a nightly version twice a day, tagged like 4.6.0-alpha.0.20261026.1, with the moving nightly tag and the nightly channel of the CDN, from next or from the release branch while one is in progress
• Keep the updates of the old channel after a switch to a more stable channel, until the stable release of the installed version is out
• Install the newest preview or nightly version with install.sh --preview or install.sh --nightly, which also switches the update channel of the instance
• Switch the update ch

Fixes

• Kept the Dockerfile HEALTHCHECK of existing applications. Since v4.5.1, the Coolify healthcheck replaced it.
• Fixed Docker Compose builds that failed with "required variable is missing a value" when a required variable was set only for runtime. (#12363)
• Fixed Railpack builds that failed when they started at the same time as another build.
• Removed orphaned SSH connection processes that collected on the Coolify host.
• Fixed server validation, which now continues over SSH when the Hetzner API call fails.
• Stopped retries of HTTP requests that timed out after they were sent, so the same action did not run two times.
• Fixed MCP tokens with the read:sensitive permission, which did not see the commands and configuration of applications and databases.

Improvements

• Updated the Coolify helper image to 1.0.19.

Full Changelog: https://github.com/coollabsio/coolify/compare/v4.5.2...v4.5.3