dokploy

v0.29.8 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 1mo Deployment Automation

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 3 known CVEs

Topics

backend backup databases deployment devops docker

+8 more

frontend mariadb mongodb mysql nextjs postgresql self-hosted vps

Affected surfaces

auth rbac

ReleasePort's take

Moderate signal

editorial:auto 1mo

Version v0.29.8 of dokploy removes secrets from API responses and error logs, enforces docker:read permission on container mutation endpoints, and uses the swarm advertise address in join commands.

Why it matters: Security fixes strip credentials from API responses and error messages; permission enforcement blocks unauthorized container actions; correct Swarm join addresses prevent misconfigurations. Severity scores of 80 (security) and 40 (bugfix) indicate high‑impact changes that affect all deployments.

Summary

AI summary

Fixes ensure secrets are stripped from API responses, enforce docker:read permission on container actions, and use swarm advertise address when joining a Docker Swarm.

Changes in this release

Type	Severity	Summary	CVE
Security	High	Strip credentials from service-level API responses. Strip credentials from service-level API responses. Source: llm_adapter@2026-06-08 Confidence: high	—
Security	High	Strip credentials from gitProvider.getAll API response. Strip credentials from gitProvider.getAll API response. Source: llm_adapter@2026-06-08 Confidence: high	—
Feature	Medium	Add Docker cleanup toggle to remote server creation. Add Docker cleanup toggle to remote server creation. Source: llm_adapter@2026-06-08 Confidence: high	—
Feature	Medium	Add Forward Auth SSO support. Add Forward Auth SSO support. Source: llm_adapter@2026-06-08 Confidence: high	—
Bugfix
Bugfix	Medium	Prevent registry password from appearing in error messages and shell commands. Prevent registry password from appearing in error messages and shell commands. Source: llm_adapter@2026-06-08 Confidence: high	—
Bugfix	Medium	Scope dokploy-server schedules to organization instead of user. Scope dokploy-server schedules to organization instead of user. Source: llm_adapter@2026-06-08 Confidence: high	—
Bugfix	Medium	Reset swarm health check fields to default values on change. Reset swarm health check fields to default values on change. Source: llm_adapter@2026-06-08 Confidence: high	—
Bugfix	Medium	Enforce docker:read permission on container start/stop/kill/restart mutations. Enforce docker:read permission on container start/stop/kill/restart mutations. Source: llm_adapter@2026-06-08 Confidence: high	—
Bugfix	Medium	Use swarm advertise address in Docker Swarm join command. Use swarm advertise address in Docker Swarm join command. Source: llm_adapter@2026-06-08 Confidence: high	—
Bugfix	Medium	Respect gitProviders permissions in Git provider UI. Respect gitProviders permissions in Git provider UI. Source: llm_adapter@2026-06-08 Confidence: high	—

Full changelog

What's Changed

🚀 Release v0.29.6 by @github-actions[bot] in https://github.com/Dokploy/dokploy/pull/4514
fix: scope dokploy-server schedules to organization instead of user by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4526
Feat/forward auth sso by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4555
fix: swarm health check fields not resetting to default values by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4558
fix: add docker cleanup toggle to remote server creation by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4559
fix: use stop-first update order for database services by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4560
fix: respect gitProviders permissions in git provider UI by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4561
fix: strip credentials from service-level API responses by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4564
refactor: improve restore logging for database backups by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4566
fix: use swarm advertise address in docker swarm join command by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4567
fix: enforce docker:read on container start/stop/kill/restart mutations by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4568
fix: strip credentials from gitProvider.getAll API response by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4569
fix: correct git provider access check for existing deploys by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4570
fix: prevent registry password from appearing in error messages and shell commands by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4579

Full Changelog: https://github.com/Dokploy/dokploy/compare/v0.29.6...v0.29.8

Security Fixes

Strip credentials from service-level API responses
Strip credentials from gitProvider.getAll API response
Prevent registry password from appearing in error messages and shell commands

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track dokploy

Get notified when new releases ship.

About dokploy

Open Source Alternative to Vercel, Netlify and Heroku.

All releases →