This release includes 3 security fixes for security teams reviewing exposed deployments.
Topics
+12 more
Affected surfaces
ReleasePort's take
Moderate signalThe release includes hardened API token checks and multiple bug fixes affecting deployment pipelines, webhooks, and UI components.
Why it matters: Hardened API token checks improve security posture; fixing deploy‑key overwrites prevents SSH root key loss. All changes are included in version v4.1.2 released 2026-06-04.
Summary
AI summarySecurity hardening, bug fixes across deployment, webhook, UI components, and new services & templates improve Healthchecks, Chatwoot, Gitea runner.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | High |
Hardened API token team checks. Hardened API token team checks. Source: llm_adapter@2026-06-04 Confidence: high |
— |
| Security | Medium |
Improves input validation for image, branch, proxy, and deployment data. Improves input validation for image, branch, proxy, and deployment data. Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Feature | Medium |
Adds Healthchecks as a one‑click service. Adds Healthchecks as a one‑click service. Source: llm_adapter@2026-06-04 Confidence: high |
— |
| Feature | Medium |
Makes exposed ports optional for portless apps. Makes exposed ports optional for portless apps. Source: llm_adapter@2026-06-04 Confidence: high |
— |
| Feature | Low |
Adds configurable application restart loop limits. Adds configurable application restart loop limits. Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Feature | Low |
Adds standalone database health check settings. Adds standalone database health check settings. Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Feature | Low |
Adds resource details view with easier UUID access. Adds resource details view with easier UUID access. Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Feature | Low |
Adds destination resource listings showing deployed resources. Adds destination resource listings showing deployed resources. Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Feature | Low |
Adds environment variable search functionality. Adds environment variable search functionality. Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Feature | Low |
Moves Sentinel metrics into its own tab and improves refresh. Moves Sentinel metrics into its own tab and improves refresh. Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Feature | Low |
Improves configuration changes modal for redeployments of Git‑based Compose apps. Improves configuration changes modal for redeployments of Git‑based Compose apps. Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Feature | Low |
Adds scrollable behavior to modals for smaller screens. Adds scrollable behavior to modals for smaller screens. Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Feature | Low |
Keeps long‑running terminal sessions connected. Keeps long‑running terminal sessions connected. Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Feature | Low |
Adds mobile terminal control interface. Adds mobile terminal control interface. Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Feature | Low |
Supports custom Docker DNS option (--dns). Supports custom Docker DNS option (--dns). Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Feature | Low |
Improves GitHub App setup flow. Improves GitHub App setup flow. Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Feature | Low |
Updates team invitation flow. Updates team invitation flow. Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Bugfix | Medium |
Fixes log copying on non‑HTTPS instances. Fixes log copying on non‑HTTPS instances. Source: llm_adapter@2026-06-04 Confidence: high |
— |
| Bugfix | Medium |
Fixes deploy keys overwriting server root SSH keys. Fixes deploy keys overwriting server root SSH keys. Source: llm_adapter@2026-06-04 Confidence: low |
— |
| Bugfix | Medium |
Fixes generated Compose environment variables breaking preview deployments. Fixes generated Compose environment variables breaking preview deployments. Source: llm_adapter@2026-06-04 Confidence: low |
— |
| Bugfix | Medium |
Fixes registry image tags being pushed for preview deployments. Fixes registry image tags being pushed for preview deployments. Source: llm_adapter@2026-06-04 Confidence: low |
— |
| Bugfix | Medium |
Fixes Git repository imports for large repositories. Fixes Git repository imports for large repositories. Source: llm_adapter@2026-06-04 Confidence: low |
— |
| Bugfix | Medium |
Fixes GitLab SSH webhook matching with custom ports. Fixes GitLab SSH webhook matching with custom ports. Source: llm_adapter@2026-06-04 Confidence: low |
— |
| Bugfix | Medium |
Fixes unsafe HTML showing in the log viewer. Fixes unsafe HTML showing in the log viewer. Source: llm_adapter@2026-06-04 Confidence: low |
— |
| Bugfix | Medium |
Fixes in‑progress form edits being wiped by live updates. Fixes in‑progress form edits being wiped by live updates. Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Bugfix | Medium |
Prevents 500 error when deleting the current team. Prevents 500 error when deleting the current team. Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Bugfix | Low |
Fixes skipped service database backup links. Fixes skipped service database backup links. Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Bugfix | Low |
Validates S3 storage before scheduling backups. Validates S3 storage before scheduling backups. Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
| Bugfix | Low |
Fixes private submodule authentication during deployments. Fixes private submodule authentication during deployments. Source: granite4.1:30b@2026-06-04-audit Confidence: low |
— |
Full changelog
What's Changed
Security & Fixes
- Fixed private submodule authentication during deployments (#8900, fixes #2731)
- Fixed deploy keys overwriting server root SSH keys (#10440, fixes #10203)
- Improved fork pull request safety for preview deployments (#10457, fixes #10342)
- Hardened API token team checks (#10505)
- Improved image, branch, proxy, and deployment input validation (#10501, #10502, #10503, #10504)
- Fixed generated Compose environment variables breaking preview deployments (#10186, fixes #7552)
- Fixed registry image tags being pushed for preview deployments (#10185, fixes #7616)
- Fixed Git repository imports for large repositories (#10528, fixes #5251)
- Fixed GitLab SSH webhook matching with custom ports (#10479, fixes #10450)
- Fixed log copying on non-HTTPS instances (#8942)
- Fixed unsafe HTML showing in the log viewer (#10346, fixes #10345)
- Fixed deployment and container log timestamps to use the server timezone (#10165, fixes #8003)
- Fixed in-progress form edits being wiped by live updates (#10321, fixes #6062, #6354, #9695)
- Fixed skipped service database backup links (#10527, fixes #10526)
- Fixed S3 backup storage validation before scheduling (#10389)
- Fixed current team deletion errors (#10353, fixes #10351)
- Fixed self-hosted server cleanup preserving server IPs (#10480, fixes #10471)
- Fixed API server private key updates (#10416)
- Fixed SSH usernames with dots (#9951)
- Fixed stale page loading cloak after navigation (#10518, fixes #10506)
- Fixed password field keyboard focus order (#10519, fixes #10486)
- Fixed Railpack Buildx cache metadata persistence (#10511, fixes #10507)
New Services & Templates
- Added Healthchecks as a one-click service (#10335)
- Fixed Garage startup by using the correct RPC secret length (#10425)
- Updated Chatwoot support for private API inbox webhooks (#10426)
- Fixed Hermes Agent with Web UI image tag (#10445)
- Updated Gitea runner to v1.0.7 (#10500)
- Fixed ownCloud trusted-domain login issues (#10508, fixes #9944)
Improvements
- Made exposed ports optional for portless apps (#9182, fixes #9170)
- Added configurable application restart loop limits (#9231, fixes #8669)
- Added standalone database health check settings (#10481, fixes #10444)
- Added resource details with easier access to UUIDs (#9756)
- Added destination resource listings (#9757)
- Added environment variable search (#10421, fixes #10413)
- Moved Sentinel into its own tab and improved metrics refresh (#9544)
- Improved the configuration changes modal for redeployments (#10461, fixes #10367)
- Added scrollable modals for smaller screens (#9647, fixes #9618)
- Kept long-running terminal sessions connected (#10482)
- Added mobile terminal controls (#10498)
- Added custom Docker DNS option support (#10516)
- Improved the GitHub App setup flow (#10524)
- Updated the team invitation flow (#10510)
What's Changed
- fix(livewire): stop broadcast handlers from wiping in-progress form by @adiologydev in https://github.com/coollabsio/coolify/pull/10321
- fix(service): set correct image tag for hermes-agent-with-webui by @ShadowArcanist in https://github.com/coollabsio/coolify/pull/10445
- fix(service): Chatwoot Support allowlisted private API inbox webhooks by @kunumigab in https://github.com/coollabsio/coolify/pull/10426
- chore(deps): bump symfony/polyfill-intl-idn from 1.37.0 to 1.38.1 by @dependabot[bot] in https://github.com/coollabsio/coolify/pull/10442
- chore(deps): bump ws from 8.19.0 to 8.20.1 in /docker/coolify-realtime by @dependabot[bot] in https://github.com/coollabsio/coolify/pull/10424
- fix(team): prevent 500 when deleting the current team by @Firsak in https://github.com/coollabsio/coolify/pull/10353
- fix(webhook): skip preview deployments for fork PRs by @ShadowArcanist in https://github.com/coollabsio/coolify/pull/10457
- fix(webhook): match GitLab SSH repos with custom ports by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10479
- fix(cleanup): preserve self-hosted server IPs by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10480
- feat(database): configure standalone health checks by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10481
- fix(terminal): keep long-running sessions connected by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10482
- fix(backups): validate S3 storage before scheduling by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10389
- fix(deployments): filter generated compose service env vars by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10186
- feat(terminal): add mobile shell controls by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10498
- chore(deps): bump ws from 8.19.0 to 8.20.1 in /docker/coolify-realtime by @dependabot[bot] in https://github.com/coollabsio/coolify/pull/10456
- fix(deployments): skip registry image tag for previews by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10185
- fix(git): ensure ssh credentials are propagated to submodule operations by @andrasbacsai in https://github.com/coollabsio/coolify/pull/8900
- fix(api): validate token team context by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10505
- Improve proxy configuration validation by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10503
- Improve application branch validation by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10502
- Improve application image validation by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10501
- Improve deployment input handling by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10504
- chore(service): Update Gitea runner image to version 1.0.7 by @Twest2 in https://github.com/coollabsio/coolify/pull/10500
- fix(service): Garage doesn't start due to RPC secret being wrong length by @derdaele in https://github.com/coollabsio/coolify/pull/10425
- feat(service): add Healthchecks as a service by @viticodotdev in https://github.com/coollabsio/coolify/pull/10335
- Update team invitation flow by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10510
- fix(deploy): persist Railpack Buildx metadata by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10511
- fix(forms): focus password fields before visibility toggles by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10519
- fix(navigation): remove stale cloak after Livewire navigation by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10518
- Improve GitHub App setup flow by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10524
- fix(service): owncloud login doesn't work by @abesmon in https://github.com/coollabsio/coolify/pull/10508
- fix(ui): configuration changes modal doesn't go away after redeployment for git based compose apps by @ShadowArcanist in https://github.com/coollabsio/coolify/pull/10461
- fix(dev): testing host downloads wrong arch docker binaries on linux by @ShadowArcanist in https://github.com/coollabsio/coolify/pull/10462
- fix(logs): use server timezone in deployment and container logs by @ShadowArcanist in https://github.com/coollabsio/coolify/pull/10165
- feat(ui): add resource details view by @ShadowArcanist in https://github.com/coollabsio/coolify/pull/9756
- feat: support --dns custom Docker option by @tikimo in https://github.com/coollabsio/coolify/pull/10516
- feat(application): make ports_exposes optional for portless apps by @ShadowArcanist in https://github.com/coollabsio/coolify/pull/9182
- feat(applications): add configurable restart loop limit by @ShadowArcanist in https://github.com/coollabsio/coolify/pull/9231
- feat(ui): move sentinel to new tab by @ShadowArcanist in https://github.com/coollabsio/coolify/pull/9544
- feat(destination): show resources that are deployed on the destination by @ShadowArcanist in https://github.com/coollabsio/coolify/pull/9757
- fix(modal): add missing scrolling behavior for better user experience… by @JanThiel in https://github.com/coollabsio/coolify/pull/9647
- fix(server): allow dots in ssh username by @ShadowArcanist in https://github.com/coollabsio/coolify/pull/9951
- fix(ui): models and slide-overs to use the same Close (x) icon button styles by @gianpaj in https://github.com/coollabsio/coolify/pull/9393
- fix(logs): handle missing clipboard API in non-HTTPS contexts by @devrim-1283 in https://github.com/coollabsio/coolify/pull/8942
- fix(scheduled-jobs): link skipped service database backups by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10527
- fix(git): force HTTP/1.1 for repository imports by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10528
- fix(logs): html tags is removed in log viewer by @alexzvn in https://github.com/coollabsio/coolify/pull/10346
- feat(ui): add search functionality for environment variables by @rohittiwari-dev in https://github.com/coollabsio/coolify/pull/10421
- fix(api): apply private_key_uuid in update_server by @yaroslavnovykov in https://github.com/coollabsio/coolify/pull/10416
- fix(git): write deploy key to per-deployment path, not root's id_rsa by @ofaruksahintr in https://github.com/coollabsio/coolify/pull/10440
- v4.1.2 by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10452
New Contributors
- @Firsak made their first contribution in https://github.com/coollabsio/coolify/pull/10353
- @viticodotdev made their first contribution in https://github.com/coollabsio/coolify/pull/10335
- @abesmon made their first contribution in https://github.com/coollabsio/coolify/pull/10508
- @tikimo made their first contribution in https://github.com/coollabsio/coolify/pull/10516
- @JanThiel made their first contribution in https://github.com/coollabsio/coolify/pull/9647
- @gianpaj made their first contribution in https://github.com/coollabsio/coolify/pull/9393
- @yaroslavnovykov made their first contribution in https://github.com/coollabsio/coolify/pull/10416
- @ofaruksahintr made their first contribution in https://github.com/coollabsio/coolify/pull/10440
Full Changelog: https://github.com/coollabsio/coolify/compare/v4.1.1...v4.1.2
Security Fixes
- Hardened API token team checks (#10505)
- Improved fork pull request safety for preview deployments (#10457, fixes #10342)
- Improved image, branch, proxy, and deployment input validation (issues #10501‑#10504)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About coolify
An open-source, self-hostable PaaS alternative to Vercel, Heroku & Netlify that lets you easily deploy static sites, databases, full-stack applications and 280+ one-click services on your own servers.
Beta — feedback welcome: [email protected]