Starstruk Logo MarkStarstruk

v0.26.6

Dokploy/dokployv0.26.6Jan 27, 2026by github-actions[bot]

AI Summary

This security-focused release addresses 3 security advisories, introduces a proprietary license, and adds security headers and WebSocket validation improvements.

Key Highlights

  • Fix 3 security issues (GHSA-c94j-8wgf-2q9q, GHSA-jr65-3j3w-gjmc, GHSA-vx6x-6559-x35r)
  • Introduce proprietary license and update core license
  • Add security headers to enhance application security
  • Add container ID validation for WebSocket security
  • Add directory validation for WebSocket server log paths

New Features

  • Security vulnerability fixes
  • Proprietary license
  • Security headers
  • WebSocket container ID validation
  • WebSocket directory validation
  • Swarm settings converted to form
  • Prevent malicious bash execution

Full Release Notes

## ⚠️ Security Issues

1. https://github.com/Dokploy/dokploy/security/advisories/GHSA-c94j-8wgf-2q9q
2. https://github.com/Dokploy/dokploy/security/advisories/GHSA-jr65-3j3w-gjmc
3. https://github.com/Dokploy/dokploy/security/advisories/GHSA-vx6x-6559-x35r

Please run the following command, after you upgrade your dokploy instance to v0.26.6, no breaking changes, but we strongly recommend upgrading and running this command  because in the future versions we will remove the compability code

```curl -sSL https://dokploy.com/security/0.26.6.sh | bash```




## What's Changed
* Fix environment variable resolution for Stack compose deployments by @Copilot in https://github.com/Dokploy/dokploy/pull/3457
* feat(server): add monitoring configuration for cloud setup by @Siumauricio in https://github.com/Dokploy/dokploy/pull/3462
* Remove lefthook and commitlint by @bdkopen in https://github.com/Dokploy/dokploy/pull/3460
* feat: make projects clickable in breadcrumbs by @Bima42 in https://github.com/Dokploy/dokploy/pull/3479
* Delete apps/dokploy/drizzle/0057_damp_prism.sql by @amirhmoradi in https://github.com/Dokploy/dokploy/pull/3448
* Feat/convert swarm settings into form by @Siumauricio in https://github.com/Dokploy/dokploy/pull/3486
* feat(dashboard): hide builder section for Docker source type by @Siumauricio in https://github.com/Dokploy/dokploy/pull/3488
* fix: break long project description to avoid ellipse shift by @mikaoelitiana in https://github.com/Dokploy/dokploy/pull/3484
* fix: allow users to open projects with accessible environments by @Konders in https://github.com/Dokploy/dokploy/pull/3395
* feat(db): enhance database configuration with environment variable su… by @Siumauricio in https://github.com/Dokploy/dokploy/pull/3496
* feat(config): add security headers to enhance application security by @Siumauricio in https://github.com/Dokploy/dokploy/pull/3500
* feat(license): introduce proprietary license and update core license … by @Siumauricio in https://github.com/Dokploy/dokploy/pull/3501
* Fix/prevent send malicious bash by @Siumauricio in https://github.com/Dokploy/dokploy/pull/3528
* fix(wss): add container ID validation to enhance security in WebSocke… by @Siumauricio in https://github.com/Dokploy/dokploy/pull/3529
* feat(wss): add directory validation for WebSocket server log paths by @Siumauricio in https://github.com/Dokploy/dokploy/pull/3530
* fix: profile firstName field not updating by @p8008d in https://github.com/Dokploy/dokploy/pull/3527
* Update docker-compose command to always pull images by @gentslava in https://github.com/Dokploy/dokploy/pull/3524
* fix: zod object for assign domain by @Bima42 in https://github.com/Dokploy/dokploy/pull/3504

## New Contributors
* @mikaoelitiana made their first contribution in https://github.com/Dokploy/dokploy/pull/3484
* @Konders made their first contribution in https://github.com/Dokploy/dokploy/pull/3395
* @p8008d made their first contribution in https://github.com/Dokploy/dokploy/pull/3527

**Full Changelog**: https://github.com/Dokploy/dokploy/compare/v0.26.5...v0.26.6