v0.29.13

landing-ai/ade-cliv0.29.13Jul 21, 2026by github-actions[bot]

AI Summary

A critical security update for Dokploy addressing multiple vulnerabilities including command injection and authorization bypasses, alongside UI and authentication improvements.

Key Highlights

Fixed OS command injection across multiple providers and Docker commands.
Fixed credential disclosure and IDOR vulnerabilities.
Added custom AI provider presets for organizations.
Fixed 2FA error messages and enabled email verification for SSO.

New Features

Allow organizations to define custom AI provider presets

Full Release Notes

## What's Changed
* fix: validate API key name length to prevent opaque 500 by @tanaymishra in https://github.com/Dokploy/dokploy/pull/4806
* fix(compose): preserve named-volume access mode when adding suffix by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4823
* fix(ui): disambiguate repos with the same name in the repository selector by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4826
* fix(settings): allow clearing the server domain by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4825
* fix(ui): typos by @EvanSchleret in https://github.com/Dokploy/dokploy/pull/4800
* fix(security): OS command injection in git clone across all providers by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4855
* fix(security): git provider credential disclosure via cross-org IDOR (.one endpoints) by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4856
* fix(security): SSH private key disclosure via server read endpoints by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4857
* fix(security): cross-org IDOR + nodeId injection in swarm read endpoints by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4858
* fix(security): git provider secret disclosure via application.one by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4859
* fix(security): OS command injection in docker build/pull commands by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4860
* fix(security): OS command injection via dockerImage in database service deploys by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4861
* fix(security): OS command injection in database backup/restore commands by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4862
* fix(security): OS command injection via compose path and custom command by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4863
* fix(security): OS command injection via swarm nodeId and registry tag by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4864
* fix(security): missing authorization on docker/terminal WebSocket handlers (member -> root) by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4865
* fix(security): host-schedule owner/admin bypass via applicationId (member → root) by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4869
* fix(security): missing authorization on GitHub App setup callback (unauth cross-org write) by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4870
* refactor(providers): inline quote() in git clone commands, drop shellWord helper by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4871
* fix(security): escape user-controlled values across command-injection sinks (quote sweep) by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4873
* fix(security): command injection in registry.testRegistry / testRegistryById by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4875
* fix(security): cross-org authorization bypass in server.remove by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4874
* fix(ui): organization menu clipped when sidebar is collapsed by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4876
* fix(2fa): show correct error message for invalid TOTP code by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4877
* fix: rename compose "Reload" action to "Rebuild"  by @ANSUJKMEHER in https://github.com/Dokploy/dokploy/pull/4847
* fix(auth): enable email verification for SSO and user creation by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4880
* feat(ai): allow organizations to define custom AI provider presets by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4882

## New Contributors
* @tanaymishra made their first contribution in https://github.com/Dokploy/dokploy/pull/4806
* @EvanSchleret made their first contribution in https://github.com/Dokploy/dokploy/pull/4800
* @ANSUJKMEHER made their first contribution in https://github.com/Dokploy/dokploy/pull/4847

**Full Changelog**: https://github.com/Dokploy/dokploy/compare/v0.29.12...v0.29.13