This release includes 2 security fixes for security teams reviewing exposed deployments.
Published 2d
Containers & Orchestration
✓ No known CVEs patched
This release patches 2 known CVEs
Topics
docker
docker-management
docker-management-tool
dockerfiles
Affected surfaces
deps
Summary
AI summaryUpdates What's new in v1.0.38, beta, and CVE-2026-42505 across a mixed release.
Full changelog
What's new in v1.0.38
- ✨ container/stacks backups (beta), gated with FEAT_BACKUPS_ENABLED
- ✨ view a Git stack's compose YAML and dependency graph read-only by clicking its name (PR#1294, @nenad)
- 🐛 deploy on a plain internal stack no longer 500s when the request has no body (#1271)
- 🐛 wider Activity event details modal (#1277)
- 🐛 container updates refresh image-provided env vars and labels, overrides are kept (#1226, #1256)
- 🐛 private repos with a token credential and no username now authenticate (#1273)
- 🐛 dashboard CPU history no longer spikes past 100% on busy/churny hosts (#1279)
- 🐛 failed updates (e.g. Docker Hub limits) show a 'check failed' instead of silently reporting no update (#1255)
- 🐛 git stacks reject uppercase names upfront instead of leaving an orphaned clone (#1284)
- 🐛 scan all images now covers untagged digest-pinned images instead of skipping them (#1286)
- 🐛 registry containers stuck on a moved tag are no longer misread as "local" and skipped from updates (#1288)
- 🐛 bump docker-compose 5.2.0-r0 -> 5.3.1-r1 (CVE-2026-42505)
- 🐛 bump Go 1.25.11 -> 1.25.12 (patches 4 stdlib CVEs)
- 🐛 volume prune now removes named unused volumes, keeping scanner caches (#1289)
- ✨ DNS_RESULT_ORDER=verbatim enables IPv6 fallback for outbound requests on IPv4-broken hosts (#1293)
- 🐛 OIDC/network errors now show the underlying cause instead of a bare "fetch failed" (#1293)
- 🐛 ntfy webhook with a trailing slash on the topic no longer fails with a 404 (#1300)
- 🐛 stack deploy and git sync notifications now actually fire on real deploys (#1295)
Docker image
docker pull fnsys/dockhand:v1.0.38
Also available as fnsys/dockhand:latest
Security Fixes
- CVE-2026-42505 — patched by bumping docker-compose from 5.2.0-r0 to 5.3.1-r1
- Go upgraded from 1.25.11 to 1.25.12, patching four stdlib CVEs
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]