Dokploy Files

What's Changed

• fix: validate API key name length to prevent opaque 500 by @tanaymishra in https://github.com/Dokploy/dokploy/pull/4806
• fix(compose): preserve named-volume access mode when adding suffix by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4823
• fix(ui): disambiguate repos with the same name in the repository selector by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4826
• fix(settings): allow clearing the server domain by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4825
• fix(ui): typos by @EvanSchleret in https://github.com/Dokploy/dokploy/pull/4800
• fix(security): OS command injection in git clone across all providers by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4855
• fix(security): git provider credential disclosure via cross-org IDOR (.one endpoints) by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4856
• fix(security): SSH private key disclosure via server read endpoints by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4857
• fix(security): cross-org IDOR + nodeId injection in swarm read endpoints by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4858
• fix(security): git provider secret disclosure via application.one by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4859
• fix(security): OS command injection in docker build/pull commands by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4860
• fix(security): OS command injection via dockerImage in database service deploys by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4861
• fix(security): OS command injection in database backup/restore commands by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4862
• fix(security): OS command injection via compose path and custom command by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4863
• fix(security): OS command injection via swarm nodeId and registry tag by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4864
• fix(security): missing authorization on docker/terminal WebSocket handlers (member -> root) by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4865
• fix(security): host-schedule owner/admin bypass via applicationId (member → root) by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4869
• fix(security): missing authorization on GitHub App setup callback (unauth cross-org write) by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4870
• refactor(providers): inline quote() in git clone commands, drop shellWord helper by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4871
• fix(security): escape user-controlled values across command-injection sinks (quote sweep) by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4873
• fix(security): command injection in registry.testRegistry / testRegistryById by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4875
• fix(security): cross-org authorization bypass in server.remove by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4874
• fix(ui): organization menu clipped when sidebar is collapsed by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4876
• fix(2fa): show correct error message for invalid TOTP code by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4877
• fix: rename compose "Reload" action to "Rebuild" by @ANSUJKMEHER in https://github.com/Dokploy/dokploy/pull/4847
• fix(auth): enable email verification for SSO and user creation by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4880
• feat(ai): allow organizations to define custom AI provider presets by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4882

New Contributors

• @tanaymishra made their first contribution in https://github.com/Dokploy/dokploy/pull/4806
• @EvanSchleret made their first contribution in https://github.com/Dokploy/dokploy/pull/4800
• @ANSUJKMEHER made their first contribution in https://github.com/Dokploy/dokploy/pull/4847

Full Changelog: https://github.com/Dokploy/dokploy/compare/v0.29.12...v0.29.13