Features

• Added Gitea App sources to deploy private Gitea repositories (#12234)
• Added server patching (beta) with automatic security updates per server, reboot and risky package warnings, and patch status in the server list
• Added a fleet Metrics page with server and container tables, trend charts, and one-click enable (#11867, #12162)
• Added disk, network, and load charts to the server metrics page (#11867)
• Added a Canvas view on the dashboard with interactive resource views, active deployments, and team avatars (#12160)
• Added a file browser for applications, services, and databases (#11518, fixes #6519)
• Added passkey sign-in (#12154)
• Added custom proxy error pages and maintenance mode for applications and services (#12112)
• Added hashing options for HTTP basic authentication on the proxy (#12086)
• Added optional permanent redirects for applications and services (#12233, closes #6032)
• Added a configurable Traefik certificate resolver per server, with an override per resource
• Added server creation on Hostinger VPS (#11176)
• Added Cloudflare tunnel setup with stored API tokens (#12157)
• Added an automatic backup of the Coolify database before an update (#12093)
• Server transfers to another Coolify instance now run in the background (#12180)
• Added deployments from GitLab system hooks, so each project no longer needs its own webhook (#12185)
• Added MCP tools to manage resources (#12163, closes #11281, #11881)
• Added Smart scan to detect the build pack, Dockerfiles, and environment variables for new Git projects (#8502)
• Added a cache flush for Redis, KeyDB, and Dragonfly databases (#11513)
• Added city-level traffic analytics with sortable tables (#12158)
• Added rollback to Docker registry images of recent deployments
• Added an interactive console mode (docker attach) to container terminals (#11538)
• Added an AWS CloudWatch (awslogs) log drain (#11972)
• Added opt-in commit details to deployment emails (#12030)
• Added a per-resource option to restore the Coolify default environment variables
• Added a configurable request timeout for Infisical and Vault secret managers (#12270)
• Added the app-key:reencrypt command to re-encrypt stored secrets after an APP_KEY rotation
• Added server GPU detection in the GPU settings
• Added a Detect button for the instance public IPs
• Added connecting resources to a tag from the tag page
• Added a text view for logs and grouped the log toolbar into menus
• Added a compact deployment history beside the deployment logs, with switching between deployments without a page load
• Added log exports with secrets hidden, and redacted application secrets in the full log download
• Added Deployment and Service selectors for runtime logs, with replica containers merged into one stream (discussion #12176)
• Added YAML syntax highlighting for dynamic proxy configurations and file mounts
• Added pagination with an adjustable page size for Docker images on a server
• Added a copy button to password inputs

Fixes

Security

• Plaintext secrets are now encrypted at rest
• PHP-based service templates were disabled for CVE-2026-109618 and CVE-2026-109619, then enabled again with patched images (#12268)
• System-wide Git sources are now restricted to instance admins (#12164)
• Deployment queries are now scoped to the applications of the team (#12195)
• The MCP endpoint now enforces the allowed IPs
• Server transfer bundle exports now require update access
• Read-only credentials are no longer saved from client input
• S3-compatible avatars and icons no longer use unauthenticated public URLs (#11865, fixes #11806)
• Custom log drain configurations are now validated (#12197)
• URL redaction no longer spans multiple log lines (#12238, fixes #11066)

Deployments and builds

• Railpack builds no longer leave an idle BuildKit builder running (#12097, fixes #11770, #12077)
• Environment variable values are now passed to containers exactly as entered, and existing variables keep the old escaping (#12024, fixes #7635)
• Build pack variables set at start time are kept in the runtime environment (#12025, fixes #11628)
• Transient GitHub token and clone failures are now retried
• Same-repository PR previews deploy regardless of the author association
• GitHub watch paths now use the net change of a push and paginate PR files
• GitHub webhooks are routed to the source of their app installation
• Closed Bitbucket, GitLab, and Gitea pull requests are cleaned up after a target branch change (#12008, #12012, #12013, fixes #12007, #12010, #12011)
• Compose preview storage records are deleted on cleanup (#12006, fixes #12005)
• Preview URL templates no longer have a doubled scheme
• Locally built Compose images are no longer pulled before a stop
• A deployment timeout now logs the configured timeout
• Deploy key setup works with a custom SSH username, and ssh:// repository URLs accept custom ports
• GPU settings now work in Docker Compose deployments

Docker Compose and storage

• Compose environment variable semantics are preserved (#11794, fixes #12057)
• Long bind options and non-creating bind sources are preserved (#12135, fixes #11882, #12036, #12079)
• ${VAR:-default} bind sources are resolved, and long-form bind sources with variable or vault references are kept (#12227, fixes #8854)
• ../ bind sources are resolved in raw Compose mode
• A UTF-8 BOM is removed before Compose YAML is parsed (#12223, fixes #6777)
• Compose commands use explicit file paths and remove volumes by name (#12199)
• Quoted and hyphenated custom Docker option values are parsed correctly (#12208, fixes #8173)
• SERVICE_URL_* stays on the named service domain, and a SERVICE_FQDN_ twin is treated as a copy
• Service URLs set through the API persist across Compose re-parses

Proxy and domains

• Running proxy status from Sentinel push updates is saved (#12237, fixes #11539)
• Server-Sent Events streams are excluded from Traefik compression (#12229, fixes #5586)
• The proxy check requires the coolify-proxy container name outside Swarm (#12225, fixes #7083)
• sslip.io domains resolve the server hostname to an IP
• noindex is applied to domains that include a port
• Absent Let's Encrypt resolvers are cleared during migration

Backups and scheduled tasks

• PostgreSQL healthchecks and backups set PGPASSWORD (#12224, fixes #6353)
• Backups use the configured databases when the container environment is missing (#12212, fixes #9417)
• S3-only volume backups send Content-MD5 for Object Lock buckets (#12215, fixes #12211) and no longer panic in the mc pipe
• Volume backups accept tar exit code 1 and skip containers removed during the scan
• Scheduled tasks run only in running application containers (#12226, fixes #7377) and skip a run while the previous run is still active
• Deleting a scheduled task no longer shows a 404
• Backup tables show exact execution times and sort again

API

• The fqdn field rejection now points to domains on application writes (#12217, fixes #9502)
• force_domain_override is honored for docker_compose_domains on create (#12032, fixes #12031)
• Application updates accept dockerfile and github_app_uuid
• Database updates apply redis_password and instant_deploy
• Service creation accepts connect_to_docker_network
• API token creation for MCP works when the REST API is disabled

Servers, Sentinel, and upgrades

• Upgrades keep Coolify running when Docker reports IPv6 gateways with a prefix
• Rate-limited image pulls are retried and automatic updates are spread over time
• The installer no longer restarts Docker with running containers, handles a stopped Docker daemon, and changes data directories only after checks and downloads (#12050)
• Sentinel starts on servers with a userns-remap Docker daemon
• OS derivatives are accepted through ID_LIKE in server validation
• SSH multiplexing orphans are reaped by socket ownership
• Docker cleanup removes old Coolify images on Docker 29 and fails executions orphaned by a killed worker
• Unreachable servers no longer block dashboard metrics charts
• Manually set instance public IPs are kept on restart
• Failed server validations are rate limited on Coolify Cloud

Services

• Fixed or updated the Appwrite, Forgejo, Hatchet, Hermes, Homepage (#12221, fixes #11758), Huly (#12209, fixes #11004), Langfuse (#12207, fixes #8797), Mixpost, Odoo (#12231, fixes #3441), RabbitMQ, Seafile, SigNoz, Supabase (#12001, #12002, fixes #11998, #11999), Sure (#12228, fixes #11756), Trigger (#12214, fixes #8638), Twenty (#12222, fixes #8381), and Weblate (#12220, fixes #4513) templates
• Templates that used removed MinIO images now use pgsty/silo
• Containers connect to the predefined network before they start
• The container terminal works for degraded services
• The Website button links to the project page

Other

• Interactive terminal programs no longer leak CPU after close (#12230, fixes #6125)
• Telegram test notifications show API errors (#12219, fixes #9978)
• Notification and log drain fields are required only when enabled (#12232, fixes #5631, #6123)
• Notification channels are disabled after repeated configuration failures
• Server names with whitespace work in log drains (#12239, fixes #6406)
• The manual Git webhook form is hidden for non-Git resources (#12218, fixes #7514), and GitLab App sources show the webhook setup
• Switched teams persist when concurrent requests save the session
• Database custom configurations apply on servers with a strict umask
• Firefox tab restore no longer switches the theme to custom
• Log deployment and service menus stay open on live updates
• Fullscreen logs now show above the sidebar and top bar

Improvements

• Refreshed the dark mode with the coolLabs purple brand (#12277)
• Strengthened secret redaction in logs, with admin controls (#12151)
• Reorganized resource settings and domain port editing
• Showed the full file path inline and warned about a repeated base directory (#12081)
• Backup views now refresh live
• Marked Nixpacks as deprecated and recommended Railpack
• Added a Projects page to the sidebar and refreshed cards, sidebar, and canvas layouts
• Linked to the related settings where a disabled API or a missing GitHub App blocks a feature
• Updated Traefik to 3.7.16 and 2.11.60
• Removed the Sentry integration

Breaking Changes

• API tokens now need the deploy ability to run scheduled tasks, change the proxy or custom log drains, and trigger server side effects such as resource deletion, storage access, provider operations, and database imports (#12194, #12198)
• API backup execution messages are hidden unless the token has the read:sensitive or root ability (#12151)
• Removed the POST /api/v1/enable API endpoint (#12163)
• Docker Compose files with scale or replicas greater than one are now rejected (#12213, fixes #5480)

New Contributors

• @johandenhollander made their first contribution in https://github.com/coollabsio/coolify/pull/12013
• @anakafeel made their first contribution in https://github.com/coollabsio/coolify/pull/11865
• @praetoros made their first contribution in https://github.com/coollabsio/coolify/pull/12032

Full Changelog: https://github.com/coollabsio/coolify/compare/v4.4.7...v4.5.0