Starstruk Logo MarkStarstruk

v0.29.13

teableio/teablev0.29.13Jul 21, 2026by github-actions[bot]

AI Summary

A security-centric release containing numerous fixes for command injection vulnerabilities across multiple providers, authorization bypasses, and credential disclosure issues.

Key Highlights

  • Fixed extensive OS command injection vulnerabilities in git clone and Docker operations
  • Fixed credential disclosure vulnerabilities via cross-org IDOR
  • Fixed authorization bypasses in server and application endpoints
  • Added custom AI provider presets for organizations
  • Improved compose volume access mode handling

New Features

  • Security hardening for OS command injection
  • Authorization fixes for server and GitHub App setups
  • UI improvements for repository selection
  • New AI provider presets feature

Full Release Notes

## What's Changed
* fix: validate API key name length to prevent opaque 500 by @tanaymishra in https://github.com/Dokploy/dokploy/pull/4806
* fix(compose): preserve named-volume access mode when adding suffix by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4823
* fix(ui): disambiguate repos with the same name in the repository selector by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4826
* fix(settings): allow clearing the server domain by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4825
* fix(ui): typos by @EvanSchleret in https://github.com/Dokploy/dokploy/pull/4800
* fix(security): OS command injection in git clone across all providers by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4855
* fix(security): git provider credential disclosure via cross-org IDOR (.one endpoints) by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4856
* fix(security): SSH private key disclosure via server read endpoints by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4857
* fix(security): cross-org IDOR + nodeId injection in swarm read endpoints by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4858
* fix(security): git provider secret disclosure via application.one by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4859
* fix(security): OS command injection in docker build/pull commands by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4860
* fix(security): OS command injection via dockerImage in database service deploys by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4861
* fix(security): OS command injection in database backup/restore commands by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4862
* fix(security): OS command injection via compose path and custom command by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4863
* fix(security): OS command injection via swarm nodeId and registry tag by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4864
* fix(security): missing authorization on docker/terminal WebSocket handlers (member -> root) by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4865
* fix(security): host-schedule owner/admin bypass via applicationId (member → root) by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4869
* fix(security): missing authorization on GitHub App setup callback (unauth cross-org write) by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4870
* refactor(providers): inline quote() in git clone commands, drop shellWord helper by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4871
* fix(security): escape user-controlled values across command-injection sinks (quote sweep) by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4873
* fix(security): command injection in registry.testRegistry / testRegistryById by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4875
* fix(security): cross-org authorization bypass in server.remove by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4874
* fix(ui): organization menu clipped when sidebar is collapsed by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4876
* fix(2fa): show correct error message for invalid TOTP code by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4877
* fix: rename compose "Reload" action to "Rebuild"  by @ANSUJKMEHER in https://github.com/Dokploy/dokploy/pull/4847
* fix(auth): enable email verification for SSO and user creation by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4880
* feat(ai): allow organizations to define custom AI provider presets by @Siumauricio in https://github.com/Dokploy/dokploy/pull/4882

## New Contributors
* @tanaymishra made their first contribution in https://github.com/Dokploy/dokploy/pull/4806
* @EvanSchleret made their first contribution in https://github.com/Dokploy/dokploy/pull/4800
* @ANSUJKMEHER made their first contribution in https://github.com/Dokploy/dokploy/pull/4847

**Full Changelog**: https://github.com/Dokploy/dokploy/compare/v0.29.12...v0.29.13