coolify

v4.1.1 Security

This release includes 4 security fixes for security teams reviewing exposed deployments.

Published 7d Deployment Automation

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 4 known CVEs

Topics

coolify databases deployment docker inertiajs laravel

+12 more

mariadb mysql nextjs nodejs php postgresql redis self-hosted server static-site svelte svelte5

Affected surfaces

auth rbac

Summary

AI summary

Broad release touches New Services & Templates, Security & Fixes, service, and Github.

Full changelog

What's Changed

Security & Fixes

Restricted source and private key selection to the current team (#10348)
Restricted environment deletion to the current team (#10349)
Restricted server and network selection to the current team (#10352)
Fixed source selection during repository setup (#10354)
Hardened API token permission handling (#10355)
Fixed service pages opening in the correct project and environment (#10358)
Matched manual webhooks to the exact repository only (#10361)
Improved GitHub App setup, installation, and reinstall flow (#10362)

New Services & Templates

Added Cloudflare DDNS template (#8099)
Added EMQX service template (#9568)
Added OpenObserve template (#10279, closes #6328)
Added Hermes Agent and WebUI one-click service (#10283)

Improvements

Pinned Ryot, Jellyfin, Audiobookshelf, Grocy, and Mealie to stable image versions (#10116)
Updated Gitea Runner to v1.0.6 (#10282)
Improved the configuration changes modal readability and spacing (#10365)

What's Changed (Github)

fix(source): scope private key and source selection to current team by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10348
fix(destination): scope server and network selection to current team by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10352
fix(environment): scope DeleteEnvironment lookups to current team by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10349
Fix source selection flow by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10354
Harden token permission handling by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10355
Refine service resource routing by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10358
fix(webhook): match manual webhook repositories exactly by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10361
fix(github): improve GitHub App setup and installation flow by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10362
fix(ui): improve configuration changes modal values, colors and spacing by @ShadowArcanist in https://github.com/coollabsio/coolify/pull/10365
feat(templates): add Hermes Agent + WebUI one-click service by @toanalien in https://github.com/coollabsio/coolify/pull/10283
chore(service): bumped gitea-runner version by @michalzarddev in https://github.com/coollabsio/coolify/pull/10282
feat(service): add openobserve template by @afurculita in https://github.com/coollabsio/coolify/pull/10279
feat(service): add EMQX by @MohmmadQunibi in https://github.com/coollabsio/coolify/pull/9568
feat(template): add cloudflare-ddns template by @nktnet1 in https://github.com/coollabsio/coolify/pull/8099
chore(service): pin services to static version instead of using latest tag by @kiterwork in https://github.com/coollabsio/coolify/pull/10116
v4.1.1 by @andrasbacsai in https://github.com/coollabsio/coolify/pull/10357

New Contributors

@toanalien made their first contribution in https://github.com/coollabsio/coolify/pull/10283
@afurculita made their first contribution in https://github.com/coollabsio/coolify/pull/10279
@MohmmadQunibi made their first contribution in https://github.com/coollabsio/coolify/pull/9568
@kiterwork made their first contribution in https://github.com/coollabsio/coolify/pull/10116

Full Changelog: https://github.com/coollabsio/coolify/compare/v4.1.0...v4.1.1

Security Fixes

Restricted source and private key selection to the current team (#10348)
Restricted environment deletion to the current team (#10349)
Restricted server and network selection to the current team (#10352)
Hardened API token permission handling (#10355)

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track coolify

Get notified when new releases ship.

About coolify

An open-source, self-hostable PaaS alternative to Vercel, Heroku & Netlify that lets you easily deploy static sites, databases, full-stack applications and 280+ one-click services on your own servers.

All releases →