❌

Lees weergave

uNmINeD 0.19.59-dev

New uNmINeD development snapshot is available for download!

Changes:

  • (Hytale) Added texture average color calculation for vanilla blocks from the latest installed game assets
  • (Hytale) Added texture average color calculation for custom blocks added by mods
  • (Hytale) Updated vanilla stylesheet to version 2026-03-23
  • (Minecraft) Fixed an issue where the Bedrock vanilla resource pack would not load in some cases
  • (GUI) Fixed a zoom glitch when a map marker was under the mouse cursor
  •  

v4.0.0-beta.470

What's Changed

Security & Fixes

  • Fixed proxy config validation to ensure stored config matches the current proxy type (#9146, fixes #9127)
  • Fixed environment variables being incorrectly resolved in compose files instead of preserving ${VAR} references (#9147, fixes #9136)
  • Fixed deployment issues with shell argument escaping in nixpacks commands (#9122, fixes #9042)
  • Fixed GitHub webhook errors for unsupported event types (#9119, fixes #9090)
  • Fixed server limit checks when using API tokens (#9123, fixes #9116)
  • Fixed hostname validation to be case-insensitive and allow more characters (#9134, fixes #9131)
  • Fixed duplicate subscription creation
  • Fixed environment variable refresh when variables are missing or stale
  • Fixed Docker cleanup logging when server is unreachable

New Services & Templates

  • Added EspoCRM one-click service template (#8658)

Improvements

  • Improved mobile responsiveness for confirmation modals
  • Simplified Docker installation process
  • Added storage API endpoints with UUID support for databases and services
  • Added Nightwatch monitoring support
  • Disabled Booklore service template (#9105)
  • Bumped Sentinel and Traefik versions

What's Changed (Github)

New Contributors

Full Changelog: v4.0.0-beta.469...v4.0.0-beta.470

  •  
  •  

Minecraft 26.1 (stable) Released

26.1, the release of Tiny Takeover, is a game drop for Java Edition released on March 24, 2026, which adds new textures and models for every baby mob that did not already have a unique model, adds the golden dandelion, makes name tags craftable, and fixes bugs. Full changelog: https://minecraft.wiki/Java_Edition_26.1
  •  

Firefox

New

  • View two pages side-by-side in a single window with the new Split View feature that makes it easier to compare information, research topics or work across two pages at once. To create a split view, select one or two tabs and choose Add to Split View or Open in Split View.

    A screenshot of two pages side by side in split view

  • Firefox now offers a free built-in VPN. Whether you’re using public Wi-Fi while traveling, searching for sensitive health information, or shopping for something personal, this feature gives you a simple way to stay protected. Once you sign in and turn it on, you can hide your location and IP address by routing it through a secure proxy while you browse in Firefox. You will get 50 GB of protection every month, with the option to turn it on or off for specific websites. This feature is progressively rolling out in the US, UK, Germany and France starting today.

    Screenshot of the new VPN feature in use

    This feature is part of a progressive roll out.

    What is a progressive roll out?

    Certain new Firefox features are released gradually. This means some users will see the feature before everyone does. This approach helps to get early feedback to catch bugs and improve behavior quickly, meaning more Firefox users overall have a better experience.

  • Many PDF files will now load significantly faster thanks to hardware acceleration.

  • Firefox now automatically blocks notifications and permanently revokes permissions for any website flagged as malicious by SafeBrowsing. This prevents unsafe sites from sending background notifications to users, commonly used for ads, spam or phishing.

  • You can now add a Share button to your toolbar via Customize Toolbar, making it easy to share the current tab using your Windows or macOS system sharing options.

  • Address Autofill is enabled for users in Australia, India, Italy, Poland and Austria.

  • Explore more of the web with new on-device translation support for Bosnian, Norwegian BokmΓ₯l, Serbian and Thai β€” plus improved accuracy for Croatian.

Firefox Labs

  • Tab notes feature that lets you attach a short note to a web page is now available in Firefox Labs. You can use notes to remember why you opened a page, what you planned to do next or any details you want to revisit later. Please give notes a try and share your feedback on what works well and what can be improved.

    A screenshot of the tab notes dialog open

Fixed

  • Increased robustness of HTTP/3 upload performance for unstable network conditions.

  • Various security fixes.

Changed

  • The TrustPanel combines the privacy and security panels accessed from the address bar to give the user one place to check the Privacy and Security settings of the current page. Learn more.

    TrusPanel Screenshot

  • Security has been strengthened by tightening the requirements for JavaScript files that can be loaded in the parent process, providing additional defense in depth against potential threats.

  • On Linux, Firefox will now default to the XDG portal file picker if available, rather than the GTK3 one, which is usually better integrated with the user's desktop environment, and more powerful.

  • Firefox error pages have a fresh new look, with updated visuals that better match the overall feel of Firefox. The redesigned pages create a more cohesive experience while making it clearer what went wrong.

    A screenshot of the revamped error page

  • On Windows, Firefox will use the modern Windows.Devices.Geolocation API for geolocation instead of Windows 7 location API.

Developer

Web Platform

  • showPicker() now supports text-based <input> elements with an associated <datalist>, displaying the autofill dropdown. See documentation.

  • The functions xywh() and rect() were previously implemented for the clip-path and offset-path properties. They are now also available for the shape-outside property.

  • The math value of the CSS font-family is now supported and used by default for MathML's <math> element. It enables Web developers to indicate special fonts with advanced math features should be used. Firefox will rely on the serif font for mathematics defined in Firefox preferences.

  • Added support for the HTML attribute popover="hint".

  • Enabled media element pseudo-classes, such as :playing, :paused…

  • Enabled the spec-compliant HTMLMediaElement.captureStream() API.

  • Added support for closing popovers & dialogs with the Android Back Button, and implemented the CloseWatcher API for handling this in script.

  • The new Reporting API provides a generic reporting mechanism for web applications to use to make reports available based on various platform features (for example Content Security Policy, Permissions-Policy or feature deprecation reports) in a consistent manner.

Community

  •  

MariaDB 13.0 Preview Now Available

We are pleased to announce the availability of a preview of the MariaDB 13.0 series. MariaDB 13.0 is a preview rolling release, published on 23 March 2026, and it continues the work started in 12.3 while adding a solid set of entirely new features. …

Continue reading \"MariaDB 13.0 Preview Now Available\"

The post MariaDB 13.0 Preview Now Available appeared first on MariaDB.org.

  •  

Heatit joins Works with Home Assistant

Heatit joins Works with Home Assistant

We’re thrilled to extend a very warm (ahem) Works with Home Assistant welcome to Heatit! As the name suggests, Heatit are all about keeping you, and your home, warm. They specialize in smart climate and heating control, which might have something to do with the fact they’re based in Norway, where energy management is a big reason people turn to Home Assistant, as winter temperatures can dip to below -20Β°C!

Home is where the heat is

Formerly known as Thermofloor, Heatit has spent more than 30 years building a rock-solid reputation across Scandinavia and Northern Europe for thermostats and controllers designed to handle harsh conditions, so they’re certainly robust enough for milder climes. But they don’t just stop at heating: the range extends to home safety, with the Heatit Z-Smoke 2 being the first Z-Wave smoke detector we’ve certified.

In fact, all of Heatit’s certified devices connect via Z-Wave, which is what makes them integrate so well with Home Assistant. Crucially, the Z-Smoke 2 will always function regardless of network status. The smart features are there when you need them, but the fundamentals never depend on them.

Z-Wave, and then some

If you’ve not heard of Z-Wave before, here’s a quick explainer: it’s a low-power wireless protocol built specifically for smart homes. Unlike WiFi, it operates on a dedicated frequency that means less interference and more reliable communication. It’s also a mesh network, where mains-powered devices help pass signals along to each other, strengthening the connection. Battery-powered devices can also benefit from this, since the mesh helps preserve their charge.

For heating and safety devices, those enhancements really count. Long battery life means a thermostat or smoke detector that should keep working without constant attention. Reliable range means your devices can stay connected even through thick walls or across a large home. And because everything runs locally, your heating responds quickly: no routing through a third-party server, no unnecessary delays.

Connecting with the community

Heatit are also serious about the impact they have beyond their products, with sustainability and reducing environmental impact being central to their company philosophy, which aligns with the Open Home Foundation’s principles of privacy, choice, and sustainability. What’s more, for Heatit, one of the most exciting things about joining the program is the chance to connect with the passionate, knowledgeable people who make up our community (yes, that’s you!).

"We're excited to join the Home Assistant program because of the strong community and the shared focus on open, local-first smart home solutions. This integration allows us to work more closely with both enthusiasts and professionals, and to deliver products that are flexible, reliable, and built for long-term use."

- PΓ₯l Aksel Forberg, CEO at Heatit

Devices

Works with Home Assistant isn’t just a badge: every certified product is rigorously tested by our in-house team to make sure it works seamlessly with Home Assistant out of the box. Brands joining the program also commit to long-term support and firmware updates, and to being an active, positive part of our community. Here’s what’s made the cut from Heatit:

Professionally built and designed to last, these devices cover both sides of a smart heating setup: the thermostats handle the actual temperature control, while the wall controller gives you a physical way to manage it all without reaching for your phone.

How to get started

It’s worth noting that in-wall devices will require installation by a qualified electrician in many regions, so if you’re not confident with electrics, it’s worth checking Heatit’s website for guidance and to find a local installer. The standalone devices are more straightforward to set up, and include SmartStart, making adding them to your Z-Wave network as simple as scanning a QR code.

To use Z-Wave with Home Assistant, you’ll need a Z-Wave adapter and the Z-Wave integration. This will help everything run locally, keeping your data private and your smart home responsive. Of course, if you want to turn the heat up before you get home, or check on things while you’re away, Home Assistant Cloud gives you secure remote access, and by subscribing you’ll help fund the Open Home Foundation’s work, including the Works with Home Assistant program!

Wrapping up warmly

We hope this is just the beginning of Heatit’s involvement with the program, and we’re excited to see where things go, both with these devices and whatever comes next. In the meantime, there’s plenty here to get started with. Time to turn up the heat.

Frequently asked questions

If I have a device that is not listed under Works with Home Assistant, does this mean it’s not supported?

No! It just means that it hasn’t gone through a testing schedule with our team, or doesn’t fit the requirements of the program. It might function perfectly well but be added to the testing schedule in the future, or it might work under a different connectivity type that we don’t currently test under the program.

OK, so what’s the point of the Works with program?

It highlights the devices we know work well with Home Assistant and the brands that make a long-term commitment to keeping support for these devices going. The certification agreement specifies that the devices must have full functionality within Home Assistant, operate locally without the need for cloud, and will continue to do so long-term.

How were these devices tested?

All devices in this list were tested using a standard Home Assistant Green with the Home Assistant Connect ZWA-2 as the Z-Wave adapter and with our Z-Wave integration. If you have another hub or setup, that’s not a problem, but we test against these as they are the most effective way for our team to certify within our ecosystem.

Will you be adding more Heatit devices to the program?

Why not! We’re thrilled to foster a close relationship with the team at Heatit to work together on any upcoming releases or add in further products that are not yet listed here. They have also been working on integrating their WiFi products further in Home Assistant, so we’re excited to see their progress.

  •  

Stable Channel Update for Desktop

The Stable channel has been updated to 146.0.7680.164/165 for Windows/MacΒ  andΒ 146.0.7680.164 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in theΒ Log

Security Fixes and Rewards


Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.


This update includes 8 security fixes. Please see the Chrome Security Page for more information.


[$7000][485397284] High CVE-2026-4673: Heap buffer overflow in WebAudio. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-02-18

[TBD][488188166] High CVE-2026-4674: Out of bounds read in CSS. Reported by Syn4pse on 2026-02-27

[TBD][488270257] High CVE-2026-4675: Heap buffer overflow in WebGL. Reported by 86ac1f1587b71893ed2ad792cd7dde32 on 2026-02-27

[TBD][488613135] High CVE-2026-4676: Use after free in Dawn. Reported by 86ac1f1587b71893ed2ad792cd7dde32 on 2026-03-01

[TBD][490533968] High CVE-2026-4677: Out of bounds read in WebAudio. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-07

[TBD][491164019] High CVE-2026-4678: Use after free in WebGPU. Reported by Google on 2026-03-10

[TBD][491516670] High CVE-2026-4679: Integer overflow in Fonts. Reported by GF, Un3xploitable Of DeadSec on 2026-03-11

[TBD][491869946] High CVE-2026-4680: Use after free in FedCM. Reported by Shaheen Fazim on 2026-03-12


We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.


Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.


Interested in switching release channels? Find out howΒ here. If you find a new issue, please let us know byΒ filing a bug. TheΒ community help forumΒ is also a great place to reach out for help or learn about common issues.

Srinivas Sista

Google Chrome
  •  

v5.40.0

5.40.0 (2026-03-18)

πŸš€ New feature

  • add package manager dropdown before version in bug report template (#25679)

πŸ”₯ Bug fix

  • add maxwidth to documentactions menu (#25664)
  • formatErrorMessages array values formatting (#24196)
  • admin: alias singleton frontend deps in vite (#25682)
  • content-manager: reduce excessive rerendering in components and dynamic zones (#25631)
  • content-manager: skip non-draftAndPublish relations in countDraftRelations (#25453)
  • i18n: show locale key in disabled select when editing locale (#25124)

πŸ“š Documentation Changes

  • fix docs links in README (#25715)

βš™οΈ Chore

  • use https instead of git url in package.repository.url (#25698)
  • content-manager: optimize relations handling in EditView component (#25683)
  • core: parallelize and cache dynamic zone populate (#25685)

πŸ’… Enhancement

  • resolved filter editability on clicking filter tag (#24057)
  • core: remove beta on Document API, enforce deprecation on EntityService API (#25744)

❀️ Thank You

  •  

v5.38.1

5.38.1 (2026-03-11)

Superseded on March 11, 2026 by v5.39.0 due to versioning mistake.
Please use v5.39.0.

  •  

v5.39.0

5.39.0 (2026-03-11)

πŸš€ New feature

  • expand accordion by default when inserting a new component in a document (#24230)
  • content-manager: filter list view by publication status (#25510)

πŸ”₯ Bug fix

  • added shift+tab to blocks editors (#24122)
  • single type publish permission error (#24754)
  • es translations (#25655)
  • typo 'compatability' to 'compatibility' in error messages (#25535)
  • content-manager: export ContentManagerPlugin type for plugin dev… (#24149)
  • content-manager: reduce excessive rerendering in relation fields (#25623)
  • content-manager: reduce rerenders for conditional fields (#25617)
  • content-releases: publish in right order to preserve relations (#25551)
  • guided-tour: no overlay in dark mode (#25485)
  • openapi: correctly merge plugin router prefix with route paths (#25616)
  • types: fix document findOne params (#25613)
  • upload: add crossOrigin attribute to image preview (#24946)

βš™οΈ Chore

  • upgrade to glob 13 (#25610)
  • upgrade better-sqlite3 to 12.6.2 (#25611)
  • remove eslint-plugin-rxjs (#25612)
  • upgrade koa to 20.8.4 and minimatch to 10.2.4 (#25624)
  • eslintignore coverage (#25649)
  • stop adding issues to GitHub projects in issues_handleLabel workflow (#25677)
  • update package metadata (#25599)
  • *: register vitest dependency in Yarn catalog (#25400)
  • core/permissions: ensure engine properly merges conditions (#25569)
  • deps: bump js-yaml from 3.14.1 to 3.14.2 (#24858)
  • deps: bump qs from 6.14.2 to 6.15.0 (#25555)
  • deps: bump jws from 3.2.2 to 3.2.3 (#24981)
  • deps: bump elliptic from 6.5.7 to 6.6.1 (#24803)
  • deps: bump serialize-javascript from 6.0.1 to 6.0.2 (#24841)
  • deps: bump mdast-util-to-hast from 13.2.0 to 13.2.1 (#24950)
  • deps: bump jws from 3.2.2 to 3.2.3 (#25652)
  • deps: bump tar from 7.5.9 to 7.5.10 (#25642)
  • deps: bump serialize-javascript from 6.0.1 to 6.0.2 (#25653)

🚨 Security

  • upload: improve mimetype detection for uploads (#25177)

❀️ Thank You

  •  

v5.38.0

5.38.0 (2026-03-04)

πŸš€ New feature

  • content-manager: add relationOpenMode setting (modal/page/newTab) (#25433)
  • email-nodemailer: upgrade to Nodemailer v8 with advanced email features and Admin UI capabilities (#25392)
  • i18n: add missing french translations (#23093)

πŸ”₯ Bug fix

  • typo 'recieved' to 'received' across codebase (#25541)
  • markdown editor number list is created with wrong numbers (#24631)
  • add i18n for boolean cell values (#22314)
  • folder subtitles for folders without assets or subfolders (#22694)
  • vite and webpack config when linking ds locally (#25530)
  • types: add missing typing for proxy.koa config (#25575)

βš™οΈ Chore

  • bump design-system to v2.2.0 (#25584)
  • deps: bump rollup from 4.27.4 to 4.59.0 (#25566)
  • upload: add import from url (#25496)

❀️ Thank You

  •  

v5.37.1

5.37.1 (2026-02-26)

πŸ”₯ Bug fix

  • core: preserve component clone integrity in discard-drafts migration

❀️ Thank You

  •  

v5.37.0

5.37.0 (2026-02-26)

πŸ”₯ Bug fix

  • improve subnav on mobile so it works with banner (#25450)
  • layout page broken (#25501)
  • add design-system to config (#25435)
  • radix ui dialog dependency version (#25549)

πŸ“š Documentation Changes

  • fix typos in content-releases frontend intro (#25471)

βš™οΈ Chore

  • add bot and contributor detection to community-label workflow (#25497)
    (#25494))
  • docs: revise README for AWS S3 provider updates (#25449)

πŸ’… Enhancement

  • improve mobile ux of list view (#25366)

🚨 Security

  • feature: add strictParam, addQueryParams, addInputParams (#25528)
  • deps: upgrade to tar 7.5.9 (#25504)
  • deps: upgrade multiple dependencies (#25506)
  • deps: bump bn.js from 4.12.0 to 4.12.3 (#25521)
  • deps: bump minimatch from 9.0.3 to 10.2.1 ([#25494]

❀️ Thank You

  •  

v5.36.1

5.36.1 (2026-02-18)

πŸ”₯ Bug fix

  • handle undefined tours property (#25290)
  • core: handle negative and zero min/max validation for number fields (#25409)
  • history: improve error handling and batch deletion in cron jobs (#25425)
  • migrations: speed up discard-drafts with bulk batches (#25293)
  • ts: ignore generated .strapi folder (#25086)
  • utils: bump preferred-pm to fix npm workspace detection (#25406)

βš™οΈ Chore

  • add --no-build-admin option to 'strapi develop' command (#25415)
  • */vitest: introduce Vitest and vitest-config package (#25286)
  • ci: redirect question issues to GitHub Discussions (#25441)
  • deps: bump @casl/ability from 6.5.0 to 6.7.5 (#25430)
  • deps: bump qs from 6.14.1 to 6.14.2 (#25444)

🚨 Security

  • upgrade to tar 7 (#25380)
  • update react-router (#25391)
  • deps: upgrade axios from v1.12.2 to v1.13.5 (#25427)

❀️ Thank You

  •  

v5.36.0

5.36.0 (2026-02-11)

πŸš€ New feature

  • persistent list view settings (#24246)
  • strapi/create: type strapi configs (#21859)
  • upload-aws-s3: add extended configuration for S3-compatible providers (#25263)

πŸ”₯ Bug fix

  • responsive drawer for content history (#25344)
  • scrolling in sidenav also scroll content (#25379)
  • match database package version (#25389)
  • content-manager: preserve origin id when cloning, to fetch relations so they are corrected re-populated (#25307)
  • preview-config: allow and await for async handler (#25396)
  • upload-aws-s3: use baseUrl even if upload location lacks protocol (#23400)

πŸ’… Enhancement

  • improve mobile design for edit view forms (#25320)
  • create-strapi-app: add --non-interactive mode for CI and scripts (#25373)

🚨 Security

  • upgrade apollo to 4.13.0 (#25375)

❀️ Thank You

  •  

v5.35.0

5.35.0 (2026-02-04)

πŸš€ New feature

  • upload: add focal point picker for images (#25267)

πŸ”₯ Bug fix

  • prevent bulk publish modal from closing during API refetch (#24632)
  • update ko.json (#23501)
  • mobile actions drawer in content manager edit view (#25243)
  • upload: prevent asset deletion when clicking cancel on EditAssetDialog (#25318)

βš™οΈ Chore

  • bump yarn 4.5 to 4.12 (#25284)

πŸ’… Enhancement

  • improve mobile design for content history forms (#25338)

🚨 Security

  • update multiple subdependencies (#25337)

❀️ Thank You

  •  

v5.34.0

5.34.0 (2026-01-28)

πŸš€ New feature

  • update german translations for various components (#24143)
  • upload: add retroactive ai metadata generation (#25066)

πŸ”₯ Bug fix

  • add missing labels to IT locale (#25217)
  • form elements mobile adjustments (#25202)
  • responsive cm header (#25203)
  • run orphan removal for the 'related_type' column (#24833)
  • adjust padding for cm subnav (#25253)
  • admin: format input error message with values (#23932)
  • i18n: ai translation losing unsupported fields (#25247)
  • menu: render external links as anchors (#25269)

πŸ“š Documentation Changes

  • clarify strapi installation instructions in README (#25016)
  • CONTRIBUTING: set link to latest version of .commitlintrc.ts (#25224)

βš™οΈ Chore

  • update pinned elliptic (#25206)
  • remove unused imports from react and @strapi/design-system (#25222)
  • update pinned dependencies express, qs, body-parser (#25209)
  • remove in-app marketplace (#24958)
  • update lodash to 4.17.23 (#25244)
  • deps: bump lodash-es from 4.17.21 to 4.17.23 (#25239)
  • upload: setup future flag for media lib redesign work (#25229)
  • β€Ž.github/workflows: bump outdated GitHub Actions versions (#25233)

πŸ’… Enhancement

  • responsiveness consistency for subnav (#25107)

🚨 Security

  • update pinned mdast-utils (#25227)
  • update pinned js-yaml, node-forge, tmp, and more (#25228)

❀️ Thank You

  •  

v4.0.0-beta.469

What's Changed

Security & Fixes

  • Fixed sporadic SSH "permission denied" errors during key rotation (#8990, fixes #7724)
  • Fixed deployment failures when build server is enabled during restart operations (#9045, fixes #9013)
  • Fixed breadcrumb queries causing out-of-memory crashes (#9048, fixes #9009)
  • Fixed GitHub App webhook endpoint defaulting to IPv4 instead of instance domain (#8948)
  • Fixed Hoppscotch service failing to start due to database health check (#8949)
  • Fixed Docker Compose not respecting preserveRepository for project directory (#8956, fixes #8953)
  • Fixed backup error when S3 storage is missing or deleted (#9038, fixes #9035)
  • Fixed Stripe subscription error handling and resilience (#9030)
  • Fixed Heyform template configuration (#8747)
  • Fixed API resource UUID extraction from route parameters
  • Fixed Docker cleanup stale container warning on cloud instances
  • Fixed Compose file-not-found error now includes git branch info

New Services & Templates

  • Added LibreSpeed service for self-hosted speed testing (#8626)
  • Added imgcompress service for offline image processing (#8763)
  • Updated Databasus to v3.16.2 (#8586)
  • Updated n8n with Postgres and Worker to v2.10.4 (#8807)
  • Updated SeaweedFS images to v4.13 (#8738)
  • Fixed Castopod service port from 8000 to 8080 (#8817)

Improvements

  • Added per-volume control of PR suffix in preview deployments (#9006, fixes #7802, fixes #7343)
  • Added auto-population of FQDN from docker_compose_domains for compose previews (#8963, fixes #8958)
  • Added force deletion option for servers with existing resources (#8962)
  • Added auto-fetch of server metadata after validation (#8964)
  • Added container label escape control to services API (#8955, fixes #8954)
  • Added database environment variable management API endpoints
  • Added storage management API endpoints for applications and backup schedules
  • Added support for comments in bulk environment variable API endpoints
  • Added placeholder hints for magic environment variables
  • Added next billing date and billing interval display for subscriptions
  • Added cache-based deduplication for delayed cron execution
  • Simplified environment variable settings by removing buildtime/runtime options

What's Changed (Github)

  • fix(git): GitHub App webhook endpoint defaults to IPv4 instead of the instance domain by @ShadowArcanist in #8948
  • feat(service): update n8n-with-postgres-and-worker to 2.10.4 by @michachan in #8807
  • Change Castopod service port from 8000 to 8080 by @SeriousM in #8817
  • fix(service): hoppscotch fails to start due to db unhealthy by @ShadowArcanist in #8949
  • fix(api): allow is_container_label_escape_enabled in service operations by @andrasbacsai in #8955
  • fix(docker-compose): respect preserveRepository when injecting --project-directory by @andrasbacsai in #8956
  • feat(server): allow force deletion of servers with resources by @andrasbacsai in #8962
  • feat(compose-preview): populate fqdn from docker_compose_domains by @andrasbacsai in #8963
  • feat(server): auto-fetch server metadata after validation by @andrasbacsai in #8964
  • feat(templates): Add imgcompress service, for offline image processing by @ariqpradipa in #8763
  • fix(template): fix heyform template by @iMuFeng in #8747
  • chore(service): Update SeaweedFS images to version 4.13 by @FabioHAraujo in #8738
  • feat(service): Add librespeed by @diogo24m in #8626
  • feat(service): update databasus to v3.16.2 by @Luzefiru in #8586
  • fix(preview): enable per-volume control of PR suffix in preview deployments by @andrasbacsai in #9006
  • fix: prevent sporadic SSH permission denied on key rotation by @pannous in #8990
  • fix(stripe): add error handling and resilience to subscription operations by @andrasbacsai in #9030
  • fix(backup): throw explicit error when S3 storage missing or deleted by @andrasbacsai in #9038
  • perf(breadcrumb): optimize queries and simplify navigation to fix OOM by @andrasbacsai in #9048
  • fix(deployment): disable build server during restart operations by @andrasbacsai in #9045
  • v4.0.0-beta.469 by @andrasbacsai in #9007

New Contributors

Full Changelog: v4.0.0-beta.468...v4.0.0-beta.469

  •  

v4.0.0-beta.468

What's Changed

Security & Fixes

  • Fixed SSH connection retry failures during deployments (#8927, fixes #8926)
  • Fixed deployment type selection when using GitHub/GitLab Apps (#8934, fixes #8917)
  • Fixed deployment authorization endpoint returning incorrect 404 errors (#8931, fixes #8925)
  • Fixed shared variables not resolving in Docker Compose environments (#8930, fixes #8918)
  • Fixed SSH keys not being used for git submodule and LFS operations (#8933, fixes #8895)
  • Added support for scoped npm packages in file path validation (#8928, fixes #8924)

Improvements

  • Added log filtering capability based on log level in deployment logs (#8784)

What's Changed (Github)

Full Changelog: v4.0.0-beta.467...v4.0.0-beta.468

  •  

v4.0.0-beta.467

What's Changed

Security & Fixes

  • Fixed command injection vulnerability in health check commands (#8898)
  • Added path validation to prevent command injection in file locations
  • Fixed environment variables being overwritten when changing service domains (#8915, fixes #8912)
  • Fixed Nixpacks deployment failures when application has no domain set (#8902, fixes #6830)
  • Fixed resource deletion failing silently in the danger zone (#8909, fixes #8836)
  • Fixed scheduled task input fields losing focus while editing (#8654, fixes #8647)
  • Added docker_cleanup parameter to API stop endpoints (#8899, fixes #7758)

Improvements

  • Added GitLab source integration with SSH deploy keys and HTTP basic auth (#8910, fixes #5295)
  • Added database-backed proxy config storage with automatic recovery and versioned backups (#8905, fixes #7178)
  • Added server metadata collection and display

What's Changed

  • fix(security): sanitize newlines in health check commands to prevent RCE by @andrasbacsai in #8898
  • fix: prevent scheduled task input fields from losing focus by @sharkcreep87 in #8654
  • fix(api): add docker_cleanup parameter to stop endpoints by @andrasbacsai in #8899
  • fix(deployment): filter null and empty environment variables from nixpacks plan by @andrasbacsai in #8902
  • feat(proxy): add database-backed config storage with disk backups by @andrasbacsai in #8905
  • fix(livewire): add error handling and selectedActions to delete methods by @andrasbacsai in #8909
  • feat(git-sources): add GitLab integration and URL encode credentials by @andrasbacsai in #8910
  • fix(parsers): use firstOrCreate instead of updateOrCreate for environment variables by @andrasbacsai in #8915
  • v4.0.0-beta.467 by @andrasbacsai in #8911

New Contributors

Full Changelog: v4.0.0-beta.466...v4.0.0-beta.467

  •  

v4.0.0-beta.466

What's Changed

Security & Fixes

  • Prevent command injection via base64-encoding log drain environment variables
  • Prevent command injection via git reference validation
  • Add sentinel token validation to prevent command injection
  • Require write permission for API validation endpoints
  • Prevent false container exits on failed docker queries (#8860)
  • Track last_online_at and reset database restart state
  • Preserve user-saved environment variables on Docker Compose redeploy (#8894)
  • Fix build-time environment variables breaking Next.js (#8890)
  • Prevent command injection in developer view shared variables (#8889)
  • Make confirmation modal close after dispatching Livewire actions (#8892)
  • Respect keep for rollback setting for Nixpacks build images (#8859)

Dependencies

  • Bump rollup from 4.57.1 to 4.59.0 (#8691)
  • Bump league/commonmark from 2.8.0 to 2.8.1 (#8793)

What's Changed

Full Changelog: v4.0.0-beta.465...v4.0.0-beta.466

  •  

v4.0.0-beta.465

What's Changed

Security & Fixes

  • Fixed WebSocket connection and host authorization issues in terminal (#8862, fixes #8856)
  • Fixed environment variable parser capturing trailing braces in bash-style defaults (#8855, fixes #8851)
  • Fixed confirmation modal staying open after database import/restore (#8697, fixes #8689)
  • Fixed nginx.conf mounting error in development mode (#8662)
  • Fixed docker-compose deployment with custom start commands and preserveRepository setting (#8848, fixes #8417)
  • Fixed preview deployment page visibility for deploy key applications (#8579)

Improvements

  • Added configurable timeout for public database TCP proxy connections (#8673, fixes #7743)

What's Changed

  • fix: enable preview deployment page for deploy key applications by @mauritsderuiter95 in #8579
  • fix(docker-compose): respect preserveRepository setting when executing start command by @andrasbacsai in #8848
  • fix(proxy): mounting error for nginx.conf in dev by @Cinzya in #8662
  • feat: add configurable proxy timeout for public database TCP proxy by @brendanlim in #8673
  • fix(database): close confirmation modal after database import/restore by @devrim-1283 in #8697
  • fix(env-parser): capture clean variable names without trailing braces in bash-style defaults by @andrasbacsai in #8855
  • fix(terminal): resolve WebSocket connection and host authorization issues by @andrasbacsai in #8862
  • v4.0.0-beta.465 by @andrasbacsai in #8853

New Contributors

Full Changelog: v4.0.0-beta.464...v4.0.0-beta.465

  •  

v4.0.0-beta.464

What's Changed

Security & Fixes

  • Fixed SSH command injection vulnerability (#8748)
  • Resolved 419 session errors with Cloudflare Tunnels and domain-based access (#8749, fixes #5404)
  • Fixed SSH directory permission issues during upgrades (#8635, resolves #6621)
  • Added SSH directory permission auto-fix for new installations (#8635)
  • Prevented command injection in certificate handling via base64 encoding (#8617)
  • Hardened Docker command execution with centralized escaping (#8615)
  • Prevented command injection in health check commands (#8611)
  • Fixed cross-tenant IDOR vulnerability in resource cloning (#8613)
  • Added IPv6 CIDR support for API access IP allowlist (#8750, fixes #8729)
  • Fixed proxy initialization with IPv6 networks on Docker 25+ (#8703, fixes #8649)
  • Fixed CSRF redirect loop during 2FA authentication (#8596)
  • Corrected API permission requirements for POST endpoints (#8600)
  • Added team authorization checks to domains_by_server API (#8616)
  • Fixed Cloudreve service data persistence across restarts (#8740)
  • Fixed Ente Photos join link configuration (#8727)
  • Fixed application rollback to use correct commit SHA (#8576)
  • Fixed deployment detection for BuildKit and secrets (#8565)
  • Resolved team lookup for service relationships (#8559, fix #8431)
  • Added webhook notification status validation (#8557, fix #8448)
  • Fixed deploy key handling when private_key_id is zero (#8563, fixes #8562)
  • Fixed Redis/KeyDB config permissions with custom configurations (#8561, fix #8539)
  • Fixed password field UI flash before Alpine.js initialization (#8599, closes #8592)
  • Fixed GlitchTip webdashboard loading issue (#8249)
  • Fixed Grist service template configuration (#8384)
  • Fixed API documentation schema references (#8239, closes #8229)

New Services & Templates

  • Added Pydio Cells service (#8323)
  • Added Sure service (#8157)
  • Added Spacebot service with custom logo support (#8427)
  • Updated N8N templates to 2.10.2 (#8679)
  • Upgraded Beszel and Beszel Agent to v0.18 (#8513)
  • Disabled Plane service in template suite (#8580)
  • Disabled Pterodactyl Panel and Wings from service templates (#8512)
  • Disabled Minio Community Edition from service templates (#8686)
  • Disabled Maybe service in template suite (#8167)

Features & Improvements

  • Added refund and cancellation management for subscriptions (#8637)
  • Added comment field support to environment variables (#7269, fix #7239)
  • Added command-based health check support for services (#8612)
  • Added scheduled job monitoring dashboard (#8433)
  • Added scheduled tasks CRUD API with authentication and validation (#8428)
  • Made Horizon max time configurable (#8560, fix #8435)
  • Fixed Soketi host binding for IPv6 support (#8619, closes #8584)
  • Fixed scheduler self-healing for stale Redis locks with UI detection (#8618, fixes #8327)
  • Fixed Traefik service label handling for force HTTPS (#8550)
  • Improved security by hardening deployment paths and deploy abilities (#8549)
  • Fixed queue timeout handling in Horizon gracefully (#8360)
  • Fixed missing status variable in Hetzner status checks (#8359)
  • Fixed container filtering in push server job (#8361)
  • Improved proxy error handling on port allocation failure (#8362)
  • Enhanced SSH error tracking with proper Sentry scoping (#8363)

UI & Developer Experience

  • Added container labels header to UI (#8752)
  • Improved project heading navigation spacing (#8564)
  • Fixed datalist border color and added repository selection watcher (#8240)
  • Fixed Docker Compose force HTTPS preference behavior (#8424)
  • Migrated test suite to SQLite in-memory with Pest browser testing (#8364)

  •  

v4.0.0-beta.463

Changes

  • feat(database): add official postgres 18 and pgvector 18 support -> You could always change the database image and volume mount path manually and achieve unofficial support that is why this was not added faster
  • feat(ui): add postgres 16 to the UI
  • feat(ui): improve global search with uuid and pr support
  • feat(installer): add tencentos as a supported os
  • feat(service): upgrade checkmate to v3 with all the necessary changes
  • feat(service): upgrade listmonk to v6 with all the necessary changes
  • feat(service): upgrade formbricks to v4 with all the necessary changes
  • feat(service): update pterodactyl version
  • fix(backup): postgres restore arithmetic syntax error
  • fix(validation): add @, / and & support to names and descriptions
  • fix(api): infinite loop with github app with many repos
  • fix(parser): replace dashes and dots in auto generated envs
  • fix(labels): make sure name is slugified
  • fix(ui): make tooltips a bit wider
  • fix(ui): modal issues
    • tooltips can not extend outside the modal causing a scrollbar to appear
    • modals are to wide
    • remove unused minWidth and maxWidth props
  • fix(ui): horizontal overflow on application and service headings
  • fix(validation): enforce url validation for instance domain
  • fix(service): autobase database is not persisted correctly
  • fix(service): supabase studio settings redirect loop
  • fix(service): disable supabase kong response buffering and increase timeouts which fixes large file downloads
  • fix(service): reactive-resume template
    • pinned to v4.3.7 instead of latest (solution provided by #8045 author)
    • added healthchecks for reactive resume and chrome service
  • fix(service): allowed hosts and image version problems with strapi
    • automatically generate vite.config.js with the strapi FQDN
  • fix(service): bluesky pds invite code doesn't generate
  • fix(service): bugsink login fails due to cors
  • fix(service): forgejo login failure
  • fix(service): rocketchat fails to start due to database version incompatibility
  • fix(service): kimai fails to start due to the healthcheck ip not being in the trusted hosts
  • fix(service): activepieces postgres 18 volume mount
  • fix(service): users unable to create their first ente account without SMTP
  • fix(service): seaweedfs logo
  • fix(service): soju svg
  • chore(service): use major version for openpanel
  • build: upgrade postgres client to fix build error
  • refactor(services): improve some service slogans
  • docs(api): improve compose app endpoint deprecation description

New Services

  • added openclaw template
  • added langflow template
  • added bento-pdf
  • added alexandrie template
  • added goatcounter template
  • added satisfactory game server
  • added back soketi-app-manager

Issues

What's Changed (by Github)

New Contributors

Full Changelog: v4.0.0-beta.462...v4.0.0-beta.463

  •  
❌