Starstruk Logo MarkStarstruk

v0.29.13

Dokploy/dokployv0.29.13Jul 21, 2026by github-actions[bot]

AI Summary

This release focuses on critical security hardening to address OS command injection vulnerabilities and authorization bypasses across various providers and services. It also introduces customizable AI provider presets and improves UI usability.

Key Highlights

  • Critical security fixes for OS command injection in git clone, docker build, and database commands.
  • Resolved authorization bypasses and credential disclosure vulnerabilities across multiple endpoints.
  • Introduced custom AI provider presets for organizations.
  • Improved repository selector to disambiguate repos with the same name.
  • Enhanced server domain management by allowing clearing of server domains.

New Features

  • Allow organizations to define custom AI provider presets

Full Release Notes

## What's Changed
* fix: validate API key name length to prevent opaque 500 by @tanaymishra in https://github.com/Dokploy/dokploy/pull/4806
* fix(compose): preserve named-volume access mode when adding suffix by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4823
* fix(ui): disambiguate repos with the same name in the repository selector by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4826
* fix(settings): allow clearing the server domain by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4825
* fix(ui): typos by @EvanSchleret in https://github.com/Dokploy/dokploy/pull/4800
* fix(security): OS command injection in git clone across all providers by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4855
* fix(security): git provider credential disclosure via cross-org IDOR (.one endpoints) by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4856
* fix(security): SSH private key disclosure via server read endpoints by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4857
* fix(security): cross-org IDOR + nodeId injection in swarm read endpoints by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4858
* fix(security): git provider secret disclosure via application.one by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4859
* fix(security): OS command injection in docker build/pull commands by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4860
* fix(security): OS command injection via dockerImage in database service deploys by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4861
* fix(security): OS command injection in database backup/restore commands by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4862
* fix(security): OS command injection via compose path and custom command by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4863
* fix(security): OS command injection via swarm nodeId and registry tag by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4864
* fix(security): missing authorization on docker/terminal WebSocket handlers (member -> root) by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4865
* fix(security): host-schedule owner/admin bypass via applicationId (member → root) by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4869
* fix(security): missing authorization on GitHub App setup callback (unauth cross-org write) by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4870
* refactor(providers): inline quote() in git clone commands, drop shellWord helper by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4871
* fix(security): escape user-controlled values across command-injection sinks (quote sweep) by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4873
* fix(security): command injection in registry.testRegistry / testRegistryById by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4875
* fix(security): cross-org authorization bypass in server.remove by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4874
* fix(ui): organization menu clipped when sidebar is collapsed by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4876
* fix(2fa): show correct error message for invalid TOTP code by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4877
* fix: rename compose "Reload" action to "Rebuild"  by @ANSUJKMEHER in https://github.com/Dokploy/dokploy/pull/4847
* fix(auth): enable email verification for SSO and user creation by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4880
* feat(ai): allow organizations to define custom AI provider presets by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4882

## New Contributors
* @tanaymishra made their first contribution in https://github.com/Dokploy/dokploy/pull/4806
* @EvanSchleret made their first contribution in https://github.com/Dokploy/dokploy/pull/4800
* @ANSUJKMEHER made their first contribution in https://github.com/Dokploy/dokploy/pull/4847

**Full Changelog**: https://github.com/Dokploy/dokploy/compare/v0.29.12...v0.29.13