# Dokploy v0.29.13

- Product: Dokploy (https://whatsnew.fyi/product/dokploy)
- Vendor: Dokploy
- Date: 2026-07-21
- Version: v0.29.13
- Original notes: https://github.com/Dokploy/dokploy/releases/tag/v0.29.13
- Permalink: https://whatsnew.fyi/product/dokploy/releases/v0.29.13

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **fixed** — Validate API key name length to prevent opaque 500 errors
- **fixed** — Preserve named-volume access mode when adding suffix in compose
- **fixed** — Disambiguate repos with the same name in the repository selector
- **fixed** — Allow clearing the server domain in settings
- **fixed** — Fix UI typos
- **security** — Fix OS command injection in git clone across all providers
- **security** — Fix git provider credential disclosure via cross-org IDOR (.one endpoints)
- **security** — Fix SSH private key disclosure via server read endpoints
- **security** — Fix cross-org IDOR and nodeId injection in swarm read endpoints
- **security** — Fix git provider secret disclosure via application.one
- **security** — Fix OS command injection in docker build/pull commands
- **security** — Fix OS command injection via dockerImage in database service deploys
- **security** — Fix OS command injection in database backup/restore commands
- **security** — Fix OS command injection via compose path and custom command
- **security** — Fix OS command injection via swarm nodeId and registry tag
- **security** — Fix missing authorization on docker/terminal WebSocket handlers allowing member to root privilege escalation
- **security** — Fix host-schedule owner/admin bypass via applicationId allowing member to root privilege escalation
- **security** — Fix missing authorization on GitHub App setup callback allowing unauthenticated cross-org write
- **security** — Escape user-controlled values across command-injection sinks
- **security** — Fix command injection in registry.testRegistry and testRegistryById

##### What's Changed
* fix: validate API key name length to prevent opaque 500 by @tanaymishra in https://github.com/Dokploy/dokploy/pull/4806
* fix(compose): preserve named-volume access mode when adding suffix by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4823
* fix(ui): disambiguate repos with the same name in the repository selector by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4826
* fix(settings): allow clearing the server domain by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4825
* fix(ui): typos by @EvanSchleret in https://github.com/Dokploy/dokploy/pull/4800
* fix(security): OS command injection in git clone across all providers by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4855
* fix(security): git provider credential disclosure via cross-org IDOR (.one endpoints) by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4856
* fix(security): SSH private key disclosure via server read endpoints by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4857
* fix(security): cross-org IDOR + nodeId injection in swarm read endpoints by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4858
* fix(security): git provider secret disclosure via application.one by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4859
* fix(security): OS command injection in docker build/pull commands by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4860
* fix(security): OS command injection via dockerImage in database service deploys by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4861
* fix(security): OS command injection in database backup/restore commands by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4862
* fix(security): OS command injection via compose path and custom command by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4863
* fix(security): OS command injection via swarm nodeId and registry tag by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4864
* fix(security): missing authorization on docker/terminal WebSocket handlers (member -> root) by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4865
* fix(security): host-schedule owner/admin bypass via applicationId (member → root) by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4869
* fix(security): missing authorization on GitHub App setup callback (unauth cross-org write) by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4870
* refactor(providers): inline quote() in git clone commands, drop shellWord helper by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4871
* fix(security): escape user-controlled values across command-injection sinks (quote sweep) by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4873
* fix(security): command injection in registry.testRegistry / testRegistryById by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4875
* fix(security): cross-org authorization bypass in server.remove by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4874
* fix(ui): organization menu clipped when sidebar is collapsed by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4876
* fix(2fa): show correct error message for invalid TOTP code by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4877
* fix: rename compose "Reload" action to "Rebuild"  by @ANSUJKMEHER in https://github.com/Dokploy/dokploy/pull/4847
* fix(auth): enable email verification for SSO and user creation by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4880
* feat(ai): allow organizations to define custom AI provider presets by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4882

##### New Contributors
* @tanaymishra made their first contribution in https://github.com/Dokploy/dokploy/pull/4806
* @EvanSchleret made their first contribution in https://github.com/Dokploy/dokploy/pull/4800
* @ANSUJKMEHER made their first contribution in https://github.com/Dokploy/dokploy/pull/4847

**Full Changelog**: https://gith

_[Truncated at 4000 characters — full notes: https://github.com/Dokploy/dokploy/releases/tag/v0.29.13]_