# Coolify changelog > An open-source, self-hostable deployment platform. - Vendor: Coollabs - Category: Developer Tools - Official site: https://coolify.io - Tracked by: What's New (https://whatsnew.fyi/product/coolify) - Harvested from: GitHub (coollabsio/coolify) - Entries below: 10 (newest first) What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. ## Releases ### v4.2.0 - Date: 2026-07-21 - Version: v4.2.0 - Original notes: https://github.com/coollabsio/coolify/releases/tag/v4.2.0 - Permalink: https://whatsnew.fyi/product/coolify/releases/v4.2.0 - Labels: Pre-release - **changed** — Team members with the Member role now have read-only access and can no longer create, update, delete, deploy, start, stop, or otherwise modify resources - **changed** — State-changing API endpoints now require POST instead of GET, with legacy GET requests returning 405 Method Not Allowed - **added** — Added scheduled persistent-volume and application-storage backups with retention controls, manual execution, and API schedule deletion - **added** — Added API endpoints for database, service, and container logs with optional timestamps - **added** — Added API endpoints to move applications, databases, and services between authorized environments - **added** — Added configurable Docker registry URL - **added** — Added API management for service applications and service databases including lifecycle actions and logs - **added** — Added tag management and tag assignment during application, database, and service creation - **added** — Added Hetzner firewall, internal network, and backup options during server creation - **added** — Added preview deployment settings to application API endpoints - **added** — Added REST API endpoints for listing, creating, inspecting, and deleting destinations - **added** — Added Vultr cloud server provisioning and power controls - **added** — Added Inngest one-click service template - **added** — Added per-team toggle for the MCP server - **added** — Added internal endpoint controls with protected DNS resolution for webhooks - **added** — Added DigitalOcean Droplet provisioning - **added** — Added scheduled ClickHouse backups and cloud administration commands - **added** — Added responsive resource navigation, mobile lifecycle actions, and consistent status badges - **security** — Enforced authorization policies consistently across the API and Livewire and restricted sensitive operations to admins - **fixed** — Populated Docker Compose domains correctly for applications created through the API ##### ⚠️ Breaking Change 1. Team members with the **Member** role now have read-only access. They can continue to view team resources and configuration, but can no longer create, update, delete, deploy, start, stop, or otherwise modify resources. Review your team roles before upgrading and promote users who still require write access. 2. State-changing API endpoints now require **POST**. Legacy GET requests return `405 Method Not Allowed`. Update API clients and deploy webhooks that use these endpoints: - `/enable` - `/disable` - `/deploy` - `/servers/{uuid}/validate` - `/applications/{uuid}/start` - `/applications/{uuid}/restart` - `/applications/{uuid}/stop` - `/databases/{uuid}/start` - `/databases/{uuid}/restart` - `/databases/{uuid}/stop` - `/services/{uuid}/start` - `/services/{uuid}/restart` - `/services/{uuid}/stop` - `/services/{uuid}/applications/{app_uuid}/start` - `/services/{uuid}/applications/{app_uuid}/restart` - `/services/{uuid}/applications/{app_uuid}/stop` ##### Features - Added scheduled persistent-volume and application-storage backups, including retention controls, manual execution, and API schedule deletion. (#10946, fixes #7701) - Added API endpoints for database, service, and container logs, including optional timestamps. (#6293) - Added API endpoints to move applications, databases, and services between authorized environments. (#8968) - Added a configurable Docker registry URL. (#9017) - Added API management for service applications and service databases, including lifecycle actions and logs. (#9249) - Added tag management and tag assignment during application, database, and service creation. (#9275) - Added Hetzner firewall, internal network, and backup options during server creation. (#9646, fixes #9619) - Added preview deployment settings to application API endpoints. (#10188) - Added REST API endpoints for listing, creating, inspecting, and deleting destinations. (#10405) - Added Vultr cloud server provisioning and power controls. (#10533) - Added an Inngest one-click service template. (#10612) - Added a per-team toggle for the MCP server. (#10771) - Added internal endpoint controls with protected DNS resolution for webhooks. (#10835) - Added DigitalOcean Droplet provisioning. (#10871) - Added scheduled ClickHouse backups and cloud administration commands. - Added dedicated server, cloud credential, cloud-init, and private-key management flows. - Added application settings to application API responses. ##### Fixes - Enforced authorization policies consistently across the API and Livewire, restricted sensitive operations to admins, and protected secrets from team members. (#8628) - Populated Docker Compose domains correctly for applications created through the API. (#9300, fixes #9211) - Hid sensitive API fields by default while allowing privileged tokens with sensitive-read access to retrieve them. (#9893) - Prevented `force=false` deployment requests from incorrectly forcing cache-busting rebuilds. (#9909) - Ensured closed pull-request previews were cleaned up even when status updates failed. (#10180, fixes #9495) - Preserved full public Git repository URLs for non-GitHub hosts. (#10274) - Allowed the source-commit build setting through the application API. (#10551, fixes #10280) - Limited Grafana-specific service fields to Grafana images. (#10562, fixes #10556) - Corrected GitHub Enterprise App installation paths. (#10576, fixes #10573) - Corrected GitHub API URL derivation while preserving custom API URLs. (#10610) - Corrected Convex origin variables and exposed its HTTP Actions port. (#10646, fixes #7232, #7989) - Validated invitation magic-link tokens while preserving database-session login flows. (#10651, fixes #10633) - Accepted underscores in HTTP(S) domain hostnames used by the API. (#10663, fixes #10597) - Interpolated Railpack build-time environment variables correctly. (#10768, fixes #10736) - Validated environment-va _[Truncated at 4000 characters — full notes: https://github.com/coollabsio/coolify/releases/tag/v4.2.0]_ ### v4.1.2 - Date: 2026-06-04 - Version: v4.1.2 - Original notes: https://github.com/coollabsio/coolify/releases/tag/v4.1.2 - Permalink: https://whatsnew.fyi/product/coolify/releases/v4.1.2 - **fixed** — Fixed private submodule authentication during deployments - **fixed** — Fixed deploy keys overwriting server root SSH keys - **fixed** — Improved fork pull request safety for preview deployments - **security** — Hardened API token team checks - **changed** — Improved image, branch, proxy, and deployment input validation - **fixed** — Fixed generated Compose environment variables breaking preview deployments - **fixed** — Fixed registry image tags being pushed for preview deployments - **fixed** — Fixed Git repository imports for large repositories - **fixed** — Fixed GitLab SSH webhook matching with custom ports - **fixed** — Fixed log copying on non-HTTPS instances - **fixed** — Fixed unsafe HTML showing in the log viewer - **fixed** — Fixed deployment and container log timestamps to use the server timezone - **fixed** — Fixed in-progress form edits being wiped by live updates - **fixed** — Fixed skipped service database backup links - **fixed** — Fixed S3 backup storage validation before scheduling - **fixed** — Fixed current team deletion errors - **fixed** — Fixed self-hosted server cleanup preserving server IPs - **fixed** — Fixed API server private key updates - **fixed** — Fixed SSH usernames with dots - **fixed** — Fixed stale page loading cloak after navigation ##### What's Changed ###### Security & Fixes - Fixed private submodule authentication during deployments (#8900, fixes #2731) - Fixed deploy keys overwriting server root SSH keys (#10440, fixes #10203) - Improved fork pull request safety for preview deployments (#10457, fixes #10342) - Hardened API token team checks (#10505) - Improved image, branch, proxy, and deployment input validation (#10501, #10502, #10503, #10504) - Fixed generated Compose environment variables breaking preview deployments (#10186, fixes #7552) - Fixed registry image tags being pushed for preview deployments (#10185, fixes #7616) - Fixed Git repository imports for large repositories (#10528, fixes #5251) - Fixed GitLab SSH webhook matching with custom ports (#10479, fixes #10450) - Fixed log copying on non-HTTPS instances (#8942) - Fixed unsafe HTML showing in the log viewer (#10346, fixes #10345) - Fixed deployment and container log timestamps to use the server timezone (#10165, fixes #8003) - Fixed in-progress form edits being wiped by live updates (#10321, fixes #6062, #6354, #9695) - Fixed skipped service database backup links (#10527, fixes #10526) - Fixed S3 backup storage validation before scheduling (#10389) - Fixed current team deletion errors (#10353, fixes #10351) - Fixed self-hosted server cleanup preserving server IPs (#10480, fixes #10471) - Fixed API server private key updates (#10416) - Fixed SSH usernames with dots (#9951) - Fixed stale page loading cloak after navigation (#10518, fixes #10506) - Fixed password field keyboard focus order (#10519, fixes #10486) - Fixed Railpack Buildx cache metadata persistence (#10511, fixes #10507) ###### New Services & Templates - Added Healthchecks as a one-click service (#10335) - Fixed Garage startup by using the correct RPC secret length (#10425) - Updated Chatwoot support for private API inbox webhooks (#10426) - Fixed Hermes Agent with Web UI image tag (#10445) - Updated Gitea runner to v1.0.7 (#10500) - Fixed ownCloud trusted-domain login issues (#10508, fixes #9944) ###### Improvements - Made exposed ports optional for portless apps (#9182, fixes #9170) - Added configurable application restart loop limits (#9231, fixes #8669) - Added standalone database health check settings (#10481, fixes #10444) - Added resource details with easier access to UUIDs (#9756) - Added destination resource listings (#9757) - Added environment variable search (#10421, fixes #10413) - Moved Sentinel into its own tab and improved metrics refresh (#9544) - Improved the configuration changes modal for redeployments (#10461, fixes #10367) - Added scrollable modals for smaller screens (#9647, fixes #9618) - Kept long-running terminal sessions connected (#10482) - Added mobile terminal controls (#10498) - Added custom Docker DNS option support (#10516) - Improved the GitHub App setup flow (#10524) - Updated the team invitation flow (#10510) ##### What's Changed * fix(livewire): stop broadcast handlers from wiping in-progress form by @adiologydev in https://github.com/coollabsio/coolify/pull/10321 * fix(service): set correct image tag for hermes-agent-with-webui by @ShadowArcanist in https://github.com/coollabsio/coolify/pull/10445 * fix(service): Chatwoot Support allowlisted private API inbox webhooks by @kunumigab in https://github.com/coollabsio/coolify/pull/10426 * chore(deps): bump symfony/polyfill-intl-idn from 1.37.0 to 1.38.1 by @dependabot[bot] in https://github.com/coollabsio/coolify/pull/10442 * chore(deps): bump ws from 8.19.0 to 8.20.1 in /docker/coolify-realtime by @dependabot[bot] in https://github.com/coollabsio/coolify/pull/10424 * fix(team): prevent 500 when deleting the current team by @Firsak in https://github.com/coollabsio/coolify/pull/10353 * fix(webhook): skip preview deployments for fork PRs by @ShadowArcanist in https://github.com/coollabsio/coolify/pull/10457 * fix(webhook): match GitLab SSH repos with custom ports by @andrasbacsai in _[Truncated at 4000 characters — full notes: https://github.com/coollabsio/coolify/releases/tag/v4.1.2]_ ### v4.1.1 - Date: 2026-05-27 - Version: v4.1.1 - Original notes: https://github.com/coollabsio/coolify/releases/tag/v4.1.1 - Permalink: https://whatsnew.fyi/product/coolify/releases/v4.1.1 - **security** — Restricted source and private key selection to the current team - **security** — Restricted environment deletion to the current team - **security** — Restricted server and network selection to the current team - **security** — Hardened API token permission handling - **security** — Matched manual webhooks to the exact repository only - **fixed** — Fixed source selection during repository setup - **fixed** — Fixed service pages opening in the correct project and environment - **fixed** — Improved GitHub App setup, installation, and reinstall flow - **added** — Added Cloudflare DDNS template - **added** — Added EMQX service template - **added** — Added OpenObserve template - **added** — Added Hermes Agent and WebUI one-click service - **changed** — Pinned Ryot, Jellyfin, Audiobookshelf, Grocy, and Mealie to stable image versions - **changed** — Updated Gitea Runner to v1.0.6 - **changed** — Improved the configuration changes modal readability and spacing ##### What's Changed ###### Security & Fixes - Restricted source and private key selection to the current team (#10348) - Restricted environment deletion to the current team (#10349) - Restricted server and network selection to the current team (#10352) - Fixed source selection during repository setup (#10354) - Hardened API token permission handling (#10355) - Fixed service pages opening in the correct project and environment (#10358) - Matched manual webhooks to the exact repository only (#10361) - Improved GitHub App setup, installation, and reinstall flow (#10362) ###### New Services & Templates - Added Cloudflare DDNS template (#8099) - Added EMQX service template (#9568) - Added OpenObserve template (#10279, closes #6328) - Added Hermes Agent and WebUI one-click service (#10283) ###### Improvements - Pinned Ryot, Jellyfin, Audiobookshelf, Grocy, and Mealie to stable image versions (#10116) - Updated Gitea Runner to v1.0.6 (#10282) - Improved the configuration changes modal readability and spacing (#10365) ##### What's Changed (Github) * fix(source): scope private key and source selection to current team by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10348 * fix(destination): scope server and network selection to current team by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10352 * fix(environment): scope DeleteEnvironment lookups to current team by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10349 * Fix source selection flow by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10354 * Harden token permission handling by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10355 * Refine service resource routing by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10358 * fix(webhook): match manual webhook repositories exactly by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10361 * fix(github): improve GitHub App setup and installation flow by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10362 * fix(ui): improve configuration changes modal values, colors and spacing by @ShadowArcanist in https://github.com/coollabsio/coolify/pull/10365 * feat(templates): add Hermes Agent + WebUI one-click service by @toanalien in https://github.com/coollabsio/coolify/pull/10283 * chore(service): bumped gitea-runner version by @michalzarddev in https://github.com/coollabsio/coolify/pull/10282 * feat(service): add openobserve template by @afurculita in https://github.com/coollabsio/coolify/pull/10279 * feat(service): add EMQX by @MohmmadQunibi in https://github.com/coollabsio/coolify/pull/9568 * feat(template): add cloudflare-ddns template by @nktnet1 in https://github.com/coollabsio/coolify/pull/8099 * chore(service): pin services to static version instead of using latest tag by @kiterwork in https://github.com/coollabsio/coolify/pull/10116 * v4.1.1 by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10357 ##### New Contributors * @toanalien made their first contribution in https://github.com/coollabsio/coolify/pull/10283 * @afurculita made their first contribution in https://github.com/coollabsio/coolify/pull/10279 * @MohmmadQunibi made their first contribution in https://github.com/coollabsio/coolify/pull/9568 * @kiterwork made their first contribution in https://github.com/coollabsio/coolify/pull/10116 **Full Changelog**: https://github.com/coollabsio/coolify/compare/v4.1.0...v4.1.1 ### v4.1.0 - Date: 2026-05-18 - Version: v4.1.0 - Original notes: https://github.com/coollabsio/coolify/releases/tag/v4.1.0 - Permalink: https://whatsnew.fyi/product/coolify/releases/v4.1.0 - **added** — Added Railpack as a beta build pack option with build-time environment support, config merging, examples, and deployment smoke coverage - **added** — Added configurable application stop grace periods for manual stops, previews, and deployments - **added** — Added structured audit logging for API mutations, webhook events, authentication, and authorization outcomes - **added** — Added per-server configurable SSH connection timeouts exposed through the API and UI - **added** — Added deployment skipping for webhook commits and PR/MR titles containing [skip ci] or [skip cd] - **added** — Added instance-level MCP support with read-only tools for Coolify resources and API/UI enablement controls - **added** — Added application deployment configuration diff tracking to surface pending changes and build-impacting changes before redeploy - **added** — Added a collapsible sidebar with persisted state, tooltips, and a compact team menu - **added** — Added a Gitea runner service template - **fixed** — Fixed OAuth user matching by normalizing email addresses before lookup - **fixed** — Fixed SMTP notification validation by setting a default encryption value - **fixed** — Fixed database backup max storage validation to allow decimal values - **fixed** — Fixed Dockerfile build pack builds by using BuildKit-supported host networking - **fixed** — Fixed generated HEX magic environment secrets so encoded values have the expected length - **fixed** — Fixed server reachability notifications by dispatching them through an event path without blocking retry loops - **fixed** — Fixed large file-volume editing in the UI by blocking editable payloads over 5 MiB - **fixed** — Fixed deployment commit resolution to use the application git_commit_sha when no commit is explicitly provided - **fixed** — Fixed database imports to allow .dmp files - **fixed** — Fixed invalid or undecryptable Sentinel tokens by regenerating them automatically - **fixed** — Fixed scheduled task server resolution when relationships are missing ##### Features - Added Railpack as a beta build pack option with build-time environment support, config merging, examples, and deployment smoke coverage (#9117, resolves #5282). - Added configurable application stop grace periods for manual stops, previews, and deployments (#9746, fixes #5620). - Added structured audit logging for API mutations, webhook events, authentication, and authorization outcomes (#9842). - Added per-server configurable SSH connection timeouts and exposed the setting through the API and UI (#9844). - Added deployment skipping for webhook commits and PR/MR titles containing `[skip ci]` or `[skip cd]` (#9861). - Added instance-level MCP support with read-only tools for Coolify resources and API/UI enablement controls (#9862). - Added application deployment configuration diff tracking so pending changes and build-impacting changes are surfaced before redeploy (#10183, fixes #8357). - Added a collapsible sidebar with persisted state, tooltips, and a compact team menu (#9945). - Added a Gitea runner service template (#9961). ##### Fixes - Fixed OAuth user matching by normalizing email addresses before lookup (#9488, fixes #9487). - Fixed SMTP notification validation by setting a default encryption value (#9543). - Fixed database backup max storage validation to allow decimal values (#9801, fixes #9794). - Fixed Dockerfile build pack builds by using BuildKit-supported host networking (#9811, fixes #9804). - Fixed generated HEX magic environment secrets so encoded values have the expected length (#9820). - Fixed server reachability notifications by dispatching them through an event path without blocking retry loops (#9843, fixes #9830). - Fixed large file-volume editing in the UI by blocking editable payloads over 5 MiB (#9851, fixes #4701). - Fixed deployment commit resolution to use the application `git_commit_sha` when no commit is explicitly provided (#9865, closes #9204). - Fixed database imports to allow `.dmp` files (#9869). - Fixed invalid or undecryptable Sentinel tokens by regenerating them automatically (#9874). - Fixed scheduled task server resolution when relationships are missing (#9922, fixes #9916). - Fixed preview image tags so different commits on the same PR do not reuse shared tags (#10066, fixes #5538). - Fixed custom nginx configuration updates from the API by correctly decoding payloads and supporting clearing the value (#10067, fixes #9975). - Fixed API token expiration warnings so sent-warning state persists and failed notifications can retry (#10184). - Fixed terminal reliability with heartbeat handling, idle timeouts, reconnect replay, and preserved scrollback. - Fixed deployment and log views so auto-scroll pauses when users scroll up and resumes at the bottom. - Fixed realtime server dependencies by replacing Axios with the native HTTP client (#10065). - Fixed nginx Docker images to use patched official packages and HTTPS package repositories (#10026). - Fixed Docmost templates to require a mail driver before startup. ##### Improvements - Improved Railpack behavior with Docker buildx validation, safer shell argument handling, scoped build-time variables, better port handling, and updated helper versions (#9117, resolves #5282). - Improved MCP resource listing performance and changed enable/disable routes to POST for state-changing actions (#9862). - Improved standalone database lookup coverage for KeyDB, Dragonfly, and ClickHouse (#9862). - Suppressed noisy Horizon failed-job entries for expected deployment and timeout failures on cloud instances (#9871). - Synced service templates from `next` and disabled the stale LiteQueen template (#9884, #10006). - Bumped `follow-redirects` in the realtime Docker package to 1.16.0 (#9690). - Bumped `phpseclib/phpseclib` to 3.0.52 (#9952). - Improved Vite dev-server host, port, and CORS configuration for local development. - Improved collapsed sidebar spacing, deployment indicator alignment, and _[Truncated at 4000 characters — full notes: https://github.com/coollabsio/coolify/releases/tag/v4.1.0]_ ### v4.0.0 - Date: 2026-04-27 - Version: v4.0.0 - Original notes: https://github.com/coollabsio/coolify/releases/tag/v4.0.0 - Permalink: https://whatsnew.fyi/product/coolify/releases/v4.0.0 - **fixed** — Fixed Rallly service environment variable defaults - **fixed** — Fixed Logto upgrade failure caused by missing database migration step - **fixed** — Fixed Jitsi Meet not working by rebuilding template with stable image and proper UDP/secrets - **fixed** — Fixed Twenty deployment failure from unhealthy worker dependency - **fixed** — Fixed mobile info popup not opening on tap and bubbling clicks to parent - **fixed** — Fixed SPA navigation race conditions causing stale state, broken buttons, and unsaved changes - **added** — Added Cap captcha service template - **added** — Re-enabled Plane service with updated docker-compose - **changed** — Updated Beszel and Beszel Agent to 0.18.7 - **removed** — Disabled Cal.com template as project went closed source - **added** — Added healthcheck to Langfuse worker Finally releasing v4.0. It was long overdue because we have been in beta for a long time. Thousands of companies and people have been using Coolify in production for 1-2 years. Of course, this does not mean it has no bugs, it has many, but we fix them every day. --- v5 is coming together, but we are not rushing it. The biggest feature will be full scalability in the core, so you will have cloud infrastructure, but with your own servers. I already have a working solution for the core and it is soo cool. Can't wait to start showing them to you. By the way, doing v5 does not mean we won't continue to support v4. We just want to push what is possible with servers and automations. Thank you to everyone who helped me reach this point 💜 Let's make cool stuff! 🫰 --- So the release notes: ##### What's Changed ###### Security & Fixes - Fixed Rallly service environment variable defaults (#9041, fixes #9615) - Fixed Logto upgrade failure caused by missing database migration step (#9376) - Fixed Jitsi Meet not working — rebuilt template with stable image and proper UDP/secrets (#9594, fixes #4813) - Fixed Twenty deployment failure from unhealthy worker dependency (#9603, fixes #9574) - Fixed mobile info popup not opening on tap and bubbling clicks to parent (#9809, closes #4834) - Fixed SPA navigation race conditions causing stale state, broken buttons, and unsaved changes (#9742, closes #9732) ###### New Services & Templates - Added Cap captcha service template (#9729) - Re-enabled Plane service with updated docker-compose (#9641, fixes #8338) - Updated Beszel and Beszel Agent to 0.18.7 (#9775) - Disabled Cal.com template — project went closed source (#9776) ###### Improvements - Added healthcheck to Langfuse worker (#9772) ##### What's Changed (Github) * fix(navigation): replace wire:navigate.hover with wire:navigate by @andrasbacsai in https://github.com/coollabsio/coolify/pull/9742 * fix(helper): stop info icon click from propagating to parent on mobile by @andrasbacsai in https://github.com/coollabsio/coolify/pull/9809 * feat(service): disable calcom by @ShadowArcanist in https://github.com/coollabsio/coolify/pull/9776 * chore(service): update beszel to 0.18.7 by @ShadowArcanist in https://github.com/coollabsio/coolify/pull/9775 * feat(service): add healthcheck to langfuse-worker by @GauthierPLM in https://github.com/coollabsio/coolify/pull/9772 * feat(services): add Cap to templates by @tiagozip in https://github.com/coollabsio/coolify/pull/9729 * feat(service): enable plane by @DarkMaper in https://github.com/coollabsio/coolify/pull/9641 * fix(service): twenty fails to deploy due to dependency unhealthy by @ShadowArcanist in https://github.com/coollabsio/coolify/pull/9603 * fix(service): Jitsi Meet doesn't work by @miqonee in https://github.com/coollabsio/coolify/pull/9594 * fix(service): add missing database alteration step for Logto latest image by @FabioHAraujo in https://github.com/coollabsio/coolify/pull/9376 * fix(service): rally invalid next public url by @zupolgec in https://github.com/coollabsio/coolify/pull/9041 * v4.0.0 by @andrasbacsai in https://github.com/coollabsio/coolify/pull/9818 ##### New Contributors * @tiagozip made their first contribution in https://github.com/coollabsio/coolify/pull/9729 * @DarkMaper made their first contribution in https://github.com/coollabsio/coolify/pull/9641 * @miqonee made their first contribution in https://github.com/coollabsio/coolify/pull/9594 * @zupolgec made their first contribution in https://github.com/coollabsio/coolify/pull/9041 **Full Changelog**: https://github.com/coollabsio/coolify/compare/v4.0.0-beta.474...v4.0.0 ### v4.0.0-beta.474 - Date: 2026-04-21 - Version: v4.0.0-beta.474 - Original notes: https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.474 - Permalink: https://whatsnew.fyi/product/coolify/releases/v4.0.0-beta.474 - Labels: Pre-release - **security** — Prevent data loss when persistent containers (databases, apps, services) are accidentally pruned during service deletion - **fixed** — Fix S3 storage backup endpoints returning 500 in API context - **security** — Encrypt manual webhook secrets and strengthen HMAC signature verification - **fixed** — Fix Rocky Linux installer to use correct RHEL Docker repository - **security** — Harden authentication: upgrade email verification hash and fix invitation link login - **security** — Validate and rate-limit feedback endpoint - **security** — Tighten volume name and path validation with shell argument escaping - **security** — Validate backup upload file type and size limits - **security** — Tighten S3 endpoint URL validation - **security** — Harden dev helper version validation and build argument escaping - **security** — Strengthen team scoping across resource creation flows - **fixed** — Fix SSH repository URLs with custom ports being mangled - **fixed** — Fix healthcheck path validation rejecting commas and semicolons - **fixed** — Fix database credential validation and shell escaping across Postgres, MySQL, MariaDB - **security** — Improve shell command tokenization for install, build, and start commands - **changed** — Return stable generic error messages for API 5xx responses - **added** — Add optional expiration for API tokens with advance notification warning before expiry - **added** — Add DELETE API endpoint to remove preview deployments by pull request ID - **deprecated** — Mark Docker Swarm support as deprecated ahead of v5 removal - **changed** — Categorize application advanced settings into logical sections - **changed** — Improve service settings layout with dedicated advanced page and clearer headings ##### What's Changed ###### Security & Fixes - Prevent data loss when persistent containers (databases, apps, services) are accidentally pruned during service deletion (#9654, fixes #9582) - Fix S3 storage backup endpoints returning 500 in API context (#9655, fixes #9581) - Encrypt manual webhook secrets and strengthen HMAC signature verification (#9652) - Fix Rocky Linux installer to use correct RHEL Docker repository (#9541, fixes #8730) - Harden authentication: upgrade email verification hash and fix invitation link login (#9672) - Validate and rate-limit feedback endpoint (#9653) - Tighten volume name and path validation with shell argument escaping (#9666) - Validate backup upload file type and size limits (#9667) - Tighten S3 endpoint URL validation (#9668) - Harden dev helper version validation and build argument escaping (#9670) - Strengthen team scoping across resource creation flows (#9651) - Fix SSH repository URLs with custom ports being mangled (#9425) - Fix healthcheck path validation rejecting commas and semicolons (#9223) - Fix database credential validation and shell escaping across Postgres, MySQL, MariaDB (#9674, #9676, #9681, #9682) - Improve shell command tokenization for install, build, and start commands (#9684) - Return stable generic error messages for API 5xx responses (#9669) ###### Improvements - Add optional expiration for API tokens with advance notification warning before expiry (#9677) - Add DELETE API endpoint to remove preview deployments by pull request ID (#9614) - Mark Docker Swarm support as deprecated ahead of v5 removal (#9621) - Categorize application advanced settings into logical sections (#9234) - Improve service settings layout with dedicated advanced page and clearer headings (#9027) - Display memory limit fields in a single row (#9232) - Add info callout to clone resource section listing excluded items (#9233) - Add architecture warning for service templates with platform limitations (#8390) - Improve domain port+path format documentation in the UI (#8331) ##### What's Changed (Github) * fix(installer): use RHEL Docker repo for Rocky Linux by @andrasbacsai in https://github.com/coollabsio/coolify/pull/9541 * fix(dev): add Docker volume path mapping to testing-host for database deployments by @cyface in https://github.com/coollabsio/coolify/pull/9534 * feat(ui): categorize application advanced settings into logical sections by @ShadowArcanist in https://github.com/coollabsio/coolify/pull/9234 * feat(ui): add info callout to clone resource section about excluded items by @ShadowArcanist in https://github.com/coollabsio/coolify/pull/9233 * feat(ui): display memory limit fields in single row by @ShadowArcanist in https://github.com/coollabsio/coolify/pull/9232 * fix(healthcheck): user input is rejected if path contains comma and semicolon by @ShadowArcanist in https://github.com/coollabsio/coolify/pull/9223 * feat(ui): improve service settings UX, headings, and helper text for clarity by @ShadowArcanist in https://github.com/coollabsio/coolify/pull/9027 * feat(services): add architecture warning by @Cinzya in https://github.com/coollabsio/coolify/pull/8390 * Added extra documentation on format for port+path for domains by @JamesPeters98 in https://github.com/coollabsio/coolify/pull/8331 * fix(git): preserve ssh scheme URLs with custom ports by @Iisyourdad in https://github.com/coollabsio/coolify/pull/9425 * refactor: tighten team scoping on resource creation and admin nav by @andrasbacsai in https://github.com/coollabsio/coolify/pull/9651 * build(deps-dev): bump follow-redirects from 1.15.11 to 1.16.0 by @dependabot[bot] in https://github.com/coollabsio/coolify/pull/9580 * refactor(webhook): encrypt manual webhook secrets and tighten HMAC verification by @andrasbacsai in https://github.com/coollabsio/coolify/pull/9652 * feat(api): add DELETE endpoint for preview deployments by PR id by @andrasbacsai in https://github.com/coollabsio/cooli _[Truncated at 4000 characters — full notes: https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.474]_ ### v4.0.0-beta.473 - Date: 2026-04-13 - Version: v4.0.0-beta.473 - Original notes: https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.473 - Permalink: https://whatsnew.fyi/product/coolify/releases/v4.0.0-beta.473 - Labels: Pre-release - **fixed** — Fixed the upgrade modal to show the correct target version and cleared stale upgrade notifications when the instance was already up to date - **fixed** — Fixed user deletion cleanup so team-owned Git app sources were handled safely, while instance-wide sources were preserved for the root team - **fixed** — Fixed dashboard homepage add buttons so they remained visible in light mode - **fixed** — Fixed port mapping validation to accept protocol suffixes like /tcp, /udp, /sctp and IP-bound mappings - **changed** — Updated phpseclib/phpseclib to 3.0.51 - **changed** — Updated axios to 1.15.0 for development dependencies - **changed** — Updated axios to 1.15.0 in coolify-realtime ###### Fixes - Fixed the upgrade modal to show the correct target version and cleared stale upgrade notifications when the instance was already up to date. (#7774, fixes #6039, #8707) - Fixed user deletion cleanup so team-owned Git app sources were handled safely, while instance-wide sources were preserved for the root team. (#9435, fixes #8172) - Fixed dashboard homepage add buttons so they remained visible in light mode. (#9456, fixes #9454) - Fixed port mapping validation to accept protocol suffixes like `/tcp`, `/udp`, `/sctp` and IP-bound mappings. (#9503, fixes #9501, #9504) ###### Improvements - Updated `phpseclib/phpseclib` to `3.0.51`. (#9500) - Updated `axios` to `1.15.0` for development dependencies. (#9515) - Updated `axios` to `1.15.0` in `coolify-realtime`. (#9516) ##### What's Changed (Github) * fix(ui): Initialize latestVersion in Upgrade component mount by @andrasbacsai in https://github.com/coollabsio/coolify/pull/7774 * fix(user-deletion): safely clean up team-owned Git app sources by @andrasbacsai in https://github.com/coollabsio/coolify/pull/9435 * fix(ui): dashboard homepage add buttons are invisible in light mode by @rosslh in https://github.com/coollabsio/coolify/pull/9456 * fix(validation): allow protocol suffix and ip in port mappings (/tcp, /udp, /sctp) by @ShadowArcanist in https://github.com/coollabsio/coolify/pull/9503 * build(deps): bump phpseclib/phpseclib from 3.0.50 to 3.0.51 by @dependabot[bot] in https://github.com/coollabsio/coolify/pull/9500 * build(deps-dev): bump axios from 1.13.2 to 1.15.0 by @dependabot[bot] in https://github.com/coollabsio/coolify/pull/9515 * build(deps): bump axios from 1.13.6 to 1.15.0 in /docker/coolify-realtime by @dependabot[bot] in https://github.com/coollabsio/coolify/pull/9516 * v4.0.0-beta.473 by @andrasbacsai in https://github.com/coollabsio/coolify/pull/9521 ##### New Contributors * @rosslh made their first contribution in https://github.com/coollabsio/coolify/pull/9456 **Full Changelog**: https://github.com/coollabsio/coolify/compare/v4.0.0-beta.472...v4.0.0-beta.473 ### v4.0.0-beta.472 - Date: 2026-04-09 - Version: v4.0.0-beta.472 - Original notes: https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.472 - Permalink: https://whatsnew.fyi/product/coolify/releases/v4.0.0-beta.472 - Labels: Pre-release - **security** — Patched Alpine packages in helper, realtime, and development Docker images - **security** — Bumped Alexandrie images to address upstream security advisory - **added** — Added Grimmory one-click service, the successor to Booklore - **changed** — Updated Supabase template to latest versions - **added** — Allow overriding GOTRUE_SITE_URL in Supabase for separate frontend domains - **changed** — Added sensible CORS defaults to Directus templates - **changed** — Updated Rivet template to v2.2.0 - **changed** — Updated Convex to current latest version - **fixed** — Fixed LibreChat healthcheck and upgraded Meilisearch image - **fixed** — Fixed n8n task-runners health check - **fixed** — Increased Nextcloud healthcheck interval to prevent worker exhaustion - **changed** — Updated Nextcloud healthcheck endpoint to /status.php - **fixed** — Fixed Netbird client volume path so settings persist across restarts - **fixed** — Corrected Minecraft template category to games - **fixed** — Corrected several template categories that were set incorrectly - **fixed** — Allow quoted arguments in custom Docker run options - **removed** — Removed Algora bounty program references from community docs and templates ##### What's Changed ###### Security & Fixes - Allow quoted arguments in custom Docker run options (#9481, fixes #9343) - Patched Alpine packages in helper, realtime, and development Docker images (#9437) - Bumped Alexandrie images to address upstream security advisory (#9434) ###### New Services & Templates - Added Grimmory one-click service, the successor to Booklore (#9109) - Comprehensive Supabase template update to latest versions (#8316) - Allow overriding GOTRUE_SITE_URL in Supabase for separate frontend domains (#9079, fixes #5581) - Added sensible CORS defaults to Directus templates (#9081, fixes #5024) - Updated Rivet template to v2.2.0 (#9378) - Updated Convex to current latest version (#9392) - Fixed LibreChat healthcheck and upgraded Meilisearch image (#9358) - Fixed n8n task-runners health check (#9309, fixes #9306) - Increased Nextcloud healthcheck interval to prevent worker exhaustion (#9440, fixes #9439) - Updated Nextcloud healthcheck endpoint to `/status.php` (#9470) - Fixed Netbird client volume path so settings persist across restarts (#9484) - Corrected Minecraft template category to games (#9387) - Corrected several template categories that were set incorrectly (#9449) ###### Improvements - Removed Algora bounty program references from community docs and templates (#9436) ##### What's Changed (Github) * fix(services): bump images of alexandrie to fix security issue by @Smaug6739 in https://github.com/coollabsio/coolify/pull/9434 * feat(service): update Convex to current latest version by @sebous in https://github.com/coollabsio/coolify/pull/9392 * fix(template): Minecraft was on wrong category by @Iisyourdad in https://github.com/coollabsio/coolify/pull/9387 * feat(service): update Rivet to v2.2.0 by @yipfram in https://github.com/coollabsio/coolify/pull/9378 * fix(service): fix librechat healthcheck and update dependencies by @GauthierPLM in https://github.com/coollabsio/coolify/pull/9358 * fix(service): n8n task-runners health check fails by @frank-netkey in https://github.com/coollabsio/coolify/pull/9309 * feat(service): add grimmory by @RickyWanga in https://github.com/coollabsio/coolify/pull/9109 * fix(service): directus cors not applied in preflight requests by @xidik12 in https://github.com/coollabsio/coolify/pull/9081 * feat(service): update Supabase to current latest versions by @Vadko in https://github.com/coollabsio/coolify/pull/8316 * fix(service): allow overriding GOTRUE_SITE_URL in Supabase template by @xidik12 in https://github.com/coollabsio/coolify/pull/9079 * fix(service): nextcloud workers exhaustion due to low interval healthcheck by @ShadowArcanist in https://github.com/coollabsio/coolify/pull/9440 * fix(docker): add apk upgrade to helper, realtime, and development Dockerfiles by @andrasbacsai in https://github.com/coollabsio/coolify/pull/9437 * chore(community): remove Algora bounty program references by @andrasbacsai in https://github.com/coollabsio/coolify/pull/9436 * chore(service): update nextcloud healthcheck endpoint by @ShadowArcanist in https://github.com/coollabsio/coolify/pull/9470 * fix(validation): allow quoted docker run options in custom config by @andrasbacsai in https://github.com/coollabsio/coolify/pull/9481 * build(deps-dev): bump vite from 7.3.0 to 7.3.2 by @dependabot[bot] in https://github.com/coollabsio/coolify/pull/9457 * fix(service): Several templates on wrong catagory. by @Iisyourdad in https://github.com/coollabsio/coolify/pull/9449 * fix(service): netbird-client wrong volume path by @iamimmanuelraj in https://github.com/coollabsio/coolify/pull/9484 * v4.0.0-beta.472 by @andrasbacsai in https://github.com/coollabsio/coolify/pull/9492 ##### New Contributors * @sebous made their first contribution in https://github.com/coollabsio/coolify/pull/9392 * @Iisyourdad made their first contribution in https://github.com/coollabsio/coolify/pull/9387 * @frank-netkey made their first contribution in https://github. _[Truncated at 4000 characters — full notes: https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.472]_ ### v4.0.0-beta.471 - Date: 2026-04-09 - Version: v4.0.0-beta.471 - Original notes: https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471 - Permalink: https://whatsnew.fyi/product/coolify/releases/v4.0.0-beta.471 - Labels: Pre-release - **security** — Harden model mass assignment protection across all models - **security** — Scope server and project queries to current team - **security** — Harden GetLogs component with locked properties and input validation - **security** — Add validation and escaping for Docker network names - **security** — Add URL validation for notification webhook fields - **security** — Use server-side config for password reset URL generation - **security** — Add input validation for install/build/start command fields - **security** — Add input validation for resource limit fields - **security** — Add IP validation for custom DNS servers input - **security** — Add URL validation for proxy redirect input - **security** — Add input validation for server advanced settings page - **security** — Add input validation for sentinel configuration - **security** — Add input validation for database backup timeout - **security** — Add input validation for emails configuration - **security** — Add input validation for database public port and proxy timeout - **security** — Add validation to block unsafe webhook URLs - **security** — Use random_int() for email change verification codes - **security** — Move admin route into middleware group - **security** — Enforce team-scoped project/env lookups in onboarding - **security** — Add input validation for port exposes and port mappings fields - **added** — Added ElectricSQL template - **fixed** — Fix intermittent pre-deployment command failures - **fixed** — Fix Grafana GF_SERVER_DOMAIN using FQDN instead of URL - **fixed** — Fix listmonk db config env typo - **fixed** — Fix Langfuse by pinning ClickHouse version to avoid init errors - **fixed** — Fix cloning persistent volumes with missing uuid - **fixed** — Fix redirect value not persisting in setRedirect - **fixed** — Fix cloud subscription notification links - **fixed** — Fix slash branches in public repo URLs - **fixed** — Fix shared env vars resolving on wrong server - **fixed** — Fix database SSL/status state and clone writes - **fixed** — Fix auto-generate missing CA cert on SSL regeneration - **fixed** — Fix backup notification failures affecting backup status - **fixed** — Fix backup retention enforcement and stale execution cleanup - **fixed** — Fix password visibility toggle using Alpine state - **fixed** — Fix GitHub branch state when refreshing repositories - **added** — Shared server environment variables - **added** — Refresh repos on private GitHub app - **added** — Support Docker image tags for preview deployments - **added** — Add preserve repository option to deployment API - **added** — Implement exponential backoff for unreachable servers - **changed** — Improve scheduled task single view UX - **added** — Add two-step confirmation to enable self-registration - **added** — Add public port timeout configuration for databases - **changed** — Make textarea monospace opt-in and improve multiline toggle ##### What's Changed ###### Security & Fixes - Harden model mass assignment protection across all models (#9282) - Scope server and project queries to current team (#9230) - Harden GetLogs component with locked properties and input validation (#9229) - Add validation and escaping for Docker network names (#9228) - Add URL validation for notification webhook fields (#9224) - Use server-side config for password reset URL generation (#9193) - Add input validation for install/build/start command fields (#9227) - Add input validation for resource limit fields (#9238) - Add IP validation for custom DNS servers input (#9239) - Add URL validation for proxy redirect input (#9241) - Add input validation for server advanced settings page (#9242) - Add input validation for sentinel configuration (#9243) - Add input validation for database backup timeout (#9245) - Add input validation for emails configuration (#9259) - Add input validation for database public port and proxy timeout - Add validation to block unsafe webhook URLs - Use random_int() for email change verification codes (#9226) - Move admin route into middleware group (#9225) - Enforce team-scoped project/env lookups in onboarding - Add input validation for port exposes and port mappings fields ###### New Services & Templates - Added ElectricSQL template (#8190) ###### Fixes - Fix intermittent pre-deployment command failures (#9165, fixes #9076) - Fix Grafana GF_SERVER_DOMAIN using FQDN instead of URL (#9080, fixes #5307) - Fix listmonk db config env typo (#9250) - Fix Langfuse by pinning ClickHouse version to avoid init errors - Fix cloning persistent volumes with missing uuid (#9290, fixes #9270) - Fix redirect value not persisting in setRedirect (#9279) - Fix cloud subscription notification links (#9296) - Fix slash branches in public repo URLs - Fix shared env vars resolving on wrong server - Fix database SSL/status state and clone writes - Fix auto-generate missing CA cert on SSL regeneration - Fix backup notification failures affecting backup status (fixes #9088) - Fix backup retention enforcement and stale execution cleanup - Fix password visibility toggle using Alpine state - Fix GitHub branch state when refreshing repositories ###### Improvements - Shared server environment variables (#7764) - Refresh repos on private GitHub app (#8621) - Support Docker image tags for preview deployments - Add preserve repository option to deployment API (#8371) - Implement exponential backoff for unreachable servers (#9184) - Improve scheduled task single view UX (#9266) - Add two-step confirmation to enable self-registration (#9277) - Add public port timeout configuration for databases - Make textarea monospace opt-in and improve multiline toggle ##### What's Changed (Github) * fix(backup): prevent notification failures from affecting backup status by @andrasbacsai in https://github.com/coollabsio/coolify/pull/9162 * fix(preview-env): ensure auto-created preview env vars inherit runtime/buildtime flags by @andrasbacsai in https://github.com/coollabsio/coolify/pull/9164 * fix(api): validate server ownership in domains endpoint and scope activity lookups by @andrasbacsai in https://github.com/coollabsio/coolify/pull/9166 * fix(backup): validate MongoDB collection names in backup input by @andrasbacsai in https://github.com/coollabsio/coolify/pull/9168 * fix(terminal): apply authorization middleware to terminal bootstrap routes by @andrasbacsai in https://github.com/coollabsio/coolify/pull/9169 * fix(livewire): add Locked attributes and consolidate container name validation by @andrasbacsai in https://github.com/coollabsio/coolify/pull/9171 * fix(livewire): add input validation to unmanaged container operations by @andrasbacsai in https://github.com/coollabsio/coolify/pull/9172 * feat(deployment): add command_hidden flag to hide command text in logs by @andrasbacsai in https://github.com/coollabsio/coolify/pull/9167 * f _[Truncated at 4000 characters — full notes: https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471]_ ### v4.0.0-beta.470 - Date: 2026-03-24 - Version: v4.0.0-beta.470 - Original notes: https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.470 - Permalink: https://whatsnew.fyi/product/coolify/releases/v4.0.0-beta.470 - Labels: Pre-release - **security** — Fixed proxy config validation to ensure stored config matches the current proxy type - **fixed** — Fixed environment variables being incorrectly resolved in compose files instead of preserving ${VAR} references - **fixed** — Fixed deployment issues with shell argument escaping in nixpacks commands - **fixed** — Fixed GitHub webhook errors for unsupported event types - **fixed** — Fixed server limit checks when using API tokens - **fixed** — Fixed hostname validation to be case-insensitive and allow more characters - **fixed** — Fixed duplicate subscription creation - **fixed** — Fixed environment variable refresh when variables are missing or stale - **fixed** — Fixed Docker cleanup logging when server is unreachable - **added** — Added EspoCRM one-click service template - **changed** — Improved mobile responsiveness for confirmation modals - **changed** — Simplified Docker installation process - **added** — Added storage API endpoints with UUID support for databases and services - **added** — Added Nightwatch monitoring support - **removed** — Disabled Booklore service template - **changed** — Bumped Sentinel and Traefik versions ##### What's Changed ###### Security & Fixes - Fixed proxy config validation to ensure stored config matches the current proxy type (#9146, fixes #9127) - Fixed environment variables being incorrectly resolved in compose files instead of preserving ${VAR} references (#9147, fixes #9136) - Fixed deployment issues with shell argument escaping in nixpacks commands (#9122, fixes #9042) - Fixed GitHub webhook errors for unsupported event types (#9119, fixes #9090) - Fixed server limit checks when using API tokens (#9123, fixes #9116) - Fixed hostname validation to be case-insensitive and allow more characters (#9134, fixes #9131) - Fixed duplicate subscription creation - Fixed environment variable refresh when variables are missing or stale - Fixed Docker cleanup logging when server is unreachable ###### New Services & Templates - Added EspoCRM one-click service template (#8658) ###### Improvements - Improved mobile responsiveness for confirmation modals - Simplified Docker installation process - Added storage API endpoints with UUID support for databases and services - Added Nightwatch monitoring support - Disabled Booklore service template (#9105) - Bumped Sentinel and Traefik versions ##### What's Changed (Github) * fix(github-webhook): handle unsupported event types gracefully by @andrasbacsai in https://github.com/coollabsio/coolify/pull/9119 * fix(deployment): properly escape shell arguments in nixpacks commands by @andrasbacsai in https://github.com/coollabsio/coolify/pull/9122 * fix(validation): make hostname validation case-insensitive and expand allowed name characters by @andrasbacsai in https://github.com/coollabsio/coolify/pull/9134 * fix(team): resolve server limit checks for API token authentication by @andrasbacsai in https://github.com/coollabsio/coolify/pull/9123 * chore(service): disable Booklore service by @Cinzya in https://github.com/coollabsio/coolify/pull/9105 * Add EspoCRM, provided by the official team by @tmachyshyn in https://github.com/coollabsio/coolify/pull/8658 * fix(parsers): preserve ${VAR} references in compose instead of resolving to DB values by @andrasbacsai in https://github.com/coollabsio/coolify/pull/9147 * fix(proxy): validate stored config matches proxy type by @andrasbacsai in https://github.com/coollabsio/coolify/pull/9146 * v4.0.0-beta.470 by @andrasbacsai in https://github.com/coollabsio/coolify/pull/9139 ##### New Contributors * @tmachyshyn made their first contribution in https://github.com/coollabsio/coolify/pull/8658 **Full Changelog**: https://github.com/coollabsio/coolify/compare/v4.0.0-beta.469...v4.0.0-beta.470