v4.2.0
Pre-releaseAdded 16
- Added scheduled persistent-volume and application-storage backups with retention controls, manual execution, and API schedule deletion
- Added API endpoints for database, service, and container logs with optional timestamps
- Added API endpoints to move applications, databases, and services between authorized environments
- Added configurable Docker registry URL
- Added API management for service applications and service databases including lifecycle actions and logs
- Added tag management and tag assignment during application, database, and service creation
- Added Hetzner firewall, internal network, and backup options during server creation
- Added preview deployment settings to application API endpoints
- Added REST API endpoints for listing, creating, inspecting, and deleting destinations
- Added Vultr cloud server provisioning and power controls
- Added Inngest one-click service template
- Added per-team toggle for the MCP server
- Added internal endpoint controls with protected DNS resolution for webhooks
- Added DigitalOcean Droplet provisioning
- Added scheduled ClickHouse backups and cloud administration commands
- Added responsive resource navigation, mobile lifecycle actions, and consistent status badges
Changed 2
- Team members with the Member role now have read-only access and can no longer create, update, delete, deploy, start, stop, or otherwise modify resources
- State-changing API endpoints now require POST instead of GET, with legacy GET requests returning 405 Method Not Allowed
Fixed 1
- Populated Docker Compose domains correctly for applications created through the API
Security 1
- Enforced authorization policies consistently across the API and Livewire and restricted sensitive operations to admins
⚠️ Breaking Change
-
Team members with the Member role now have read-only access. They can continue to view team resources and configuration, but can no longer create, update, delete, deploy, start, stop, or otherwise modify resources. Review your team roles before upgrading and promote users who still require write access.
-
State-changing API endpoints now require POST. Legacy GET requests return
405 Method Not Allowed. Update API clients and deploy webhooks that use these endpoints:
/enable/disable/deploy/servers/{uuid}/validate/applications/{uuid}/start/applications/{uuid}/restart/applications/{uuid}/stop/databases/{uuid}/start/databases/{uuid}/restart/databases/{uuid}/stop/services/{uuid}/start/services/{uuid}/restart/services/{uuid}/stop/services/{uuid}/applications/{app_uuid}/start/services/{uuid}/applications/{app_uuid}/restart/services/{uuid}/applications/{app_uuid}/stop
Features
- Added scheduled persistent-volume and application-storage backups, including retention controls, manual execution, and API schedule deletion. (#10946, fixes #7701)
- Added API endpoints for database, service, and container logs, including optional timestamps. (#6293)
- Added API endpoints to move applications, databases, and services between authorized environments. (#8968)
- Added a configurable Docker registry URL. (#9017)
- Added API management for service applications and service databases, including lifecycle actions and logs. (#9249)
- Added tag management and tag assignment during application, database, and service creation. (#9275)
- Added Hetzner firewall, internal network, and backup options during server creation. (#9646, fixes #9619)
- Added preview deployment settings to application API endpoints. (#10188)
- Added REST API endpoints for listing, creating, inspecting, and deleting destinations. (#10405)
- Added Vultr cloud server provisioning and power controls. (#10533)
- Added an Inngest one-click service template. (#10612)
- Added a per-team toggle for the MCP server. (#10771)
- Added internal endpoint controls with protected DNS resolution for webhooks. (#10835)
- Added DigitalOcean Droplet provisioning. (#10871)
- Added scheduled ClickHouse backups and cloud administration commands.
- Added dedicated server, cloud credential, cloud-init, and private-key management flows.
- Added application settings to application API responses.
Fixes
- Enforced authorization policies consistently across the API and Livewire, restricted sensitive operations to admins, and protected secrets from team members. (#8628)
- Populated Docker Compose domains correctly for applications created through the API. (#9300, fixes #9211)
- Hid sensitive API fields by default while allowing privileged tokens with sensitive-read access to retrieve them. (#9893)
- Prevented
force=falsedeployment requests from incorrectly forcing cache-busting rebuilds. (#9909) - Ensured closed pull-request previews were cleaned up even when status updates failed. (#10180, fixes #9495)
- Preserved full public Git repository URLs for non-GitHub hosts. (#10274)
- Allowed the source-commit build setting through the application API. (#10551, fixes #10280)
- Limited Grafana-specific service fields to Grafana images. (#10562, fixes #10556)
- Corrected GitHub Enterprise App installation paths. (#10576, fixes #10573)
- Corrected GitHub API URL derivation while preserving custom API URLs. (#10610)
- Corrected Convex origin variables and exposed its HTTP Actions port. (#10646, fixes #7232, #7989)
- Validated invitation magic-link tokens while preserving database-session login flows. (#10651, fixes #10633)
- Accepted underscores in HTTP(S) domain hostnames used by the API. (#10663, fixes #10597)
- Interpolated Railpack build-time environment variables correctly. (#10768, fixes #10736)
- Validated environment-variable keys before saving them. (#10773)
- Preserved deployment-key command metadata without exposing private-key commands in logs. (#10795)
- Hardened database backup imports and file handling. (#10796)
- Aligned resource-creation permissions across the application. (#10799)
- Improved team resource route handling. (#10829)
- Improved storage mount-path handling. (#10831)
- Improved S3 storage selection, validation, and error handling. (#10832)
- Strengthened outbound URL validation. (#10833)
- Corrected additional release regressions and compatibility issues. (#10834, fixes #9204)
- Improved application URL validation and preserved case-sensitive paths. (#10836)
- Avoided invalid service preview environment-variable lookups. (#10837, fixes #10830)
- Isolated Railpack Buildx commands from Docker client environment settings. (#10840, fixes #10769)
- Preserved file-volume state during service parsing. (#10843, fixes #10525)
- Removed Ray debugging hooks from production runtime paths. (#10847, fixes #6407)
- Preserved intentionally empty service environment-variable values. (#10850, fixes #10827)
- Honored skip flags when synchronizing pull-request preview deployments. (#10873, fixes #10870)
- Clarified and enforced build-server hosting restrictions. (#10961, fixes #10898)
- Hardened Vultr provisioning cleanup, cloud-provider retries, Gmail identity normalization, and cloud server status handling.
- Fixed application configuration-change detection after settings updates.
- Fixed backup storage defaults and required valid S3 selections.
Improvements
- Added responsive resource navigation, mobile lifecycle actions, and consistent status badges.
- Improved private-key creation and prevented deletion of keys still used by servers.
- Improved cloud server provisioning by retaining instances awaiting public IP assignment and separating provider checks from SSH checks.
- Updated EspoCRM configuration for version 10 compatibility. (#10848)
- Updated the Alexandrie service template to version 8.10.0. (#10864)
- Updated the Gitea Runner template. (#10566)
- Improved contributor documentation and issue templates. (#8577)
- Updated Laravel, Vite, Symfony, Guzzle, phpseclib, WebAuthn, and NGINX dependencies. (#10665, #10680, #10683, #10710, #10711, #10738, #10739, #10901)
Breaking Changes
- Required
POSTfor state-changing API operations such as start, stop, restart, deploy, enable, disable, and server validation; equivalentGETrequests now return405 Method Not Allowed.
Related issue references:
- (#10872, fixes #5293, #6407, #6488, #6518, #6881, #7232, #7989, #8104, #9204, #9211, #9495, #9619, #9860, #9943, #10280, #10525, #10556, #10573, #10597, #10632, #10633, #10692, #10732, #10736, #10769, #10827, #10830, #10870)