Breaking Changes

• Removed the "Remove from Coolify only" service delete option. A normal delete now works when the server is unreachable, and the services API rejects delete_from_coolify_only with 422.
• Removed the Highlight log drain because the service ended. Coolify stops its running containers.

Features

• (Self-hosted only) Limited first root account registration to ten minutes after Coolify starts. Restart Coolify to open the window again.
• Let team owners and admins require 2FA for all team members.
• Skipped the Compose image build when the images match the build inputs, so runtime-only changes no longer rebuild.
• Added a four-color custom theme dialog with presets and share codes.
• Let admins drag project and server zones on the canvases.
• Reworked the dashboard layout and showed live CPU and memory in the server table.
• Synced metric chart tooltips across charts and added local or UTC tooltip times.
• Made live refresh a toggle for every metrics and analytics range.
• Added compact traffic metrics with scaled latency units.
• Replaced native number spinners with a branded stepper.
• Moved the file browser container picker to a header dropdown.
• Added # coolify: flag directives (literal, buildtime, runtime) to the developer view of environment variables (#12349).
• Added a "Use path-style URLs" setting to S3 storages for providers that need virtual-hosted-style URLs.

Improvements

• Stopped 502 errors during rolling updates with proxy retries and a configurable drain time (#8627).
• Made metrics faster with one Sentinel SSH command and Sentinel-side bucketing (#12300).
• Stopped syncing file storages on every Compose parse.
• Made canvas pan and zoom faster.
• Added a confirmation when you clone with volume data, and stopped the source while data is copied.
• Verified helper downloads by SHA256 and updated Docker CLI, Compose, Buildx, and Railpack.
• Updated Sentinel images to 1.1.3.
• Updated Laravel to 12.70.1, the PHP image to v5.0.3, and Nginx to 1.31.8.
• Hid container tooling user agents in traffic analytics by default (#12335).
• Added a DNS menu to the domains toolbar.
• Explained what 100% CPU means in chart tooltips.
• Retried connection failures of idempotent HTTP requests, including Cloudflare API calls.
• Updated Fluent Bit for log drains from 2.0 to 5.1, and restarted running drains when their files change.
• Fetched Sentinel analytics dashboards of all servers at the same time.
• Validated new cloud servers automatically when they are running.

Fixes

• Security: enforced resource permissions for stored secrets and hid locked and admin-only secrets in forms, Compose, and the API.
• Security: closed holes in server transfer import, claim, and archives.
• Security: blocked PostgreSQL restore scan bypasses and stopped restores on SQL errors (#12333).
• Security: enforced GitHub App webhook signatures in the local environment.
• Security: limited system-wide Gitea sources to instance admins and source app lists to the current team.
• Security: hid database URLs in API create responses without sensitive access (#12297, fixes #11190).
• Security: scoped database backup API endpoints to the database type (#12279).
• Security: used the Cloudflare client IP for API allow-lists and audit logs (#12301).
• Wrote the generated Compose file after the image build (#12331).
• Wrote regular deployment files when the repository has symlinks (#12324).
• Prevented Git fetches from hanging (#12321, fixes #10316).
• Read the Compose file from Git objects and from Git submodules (#12320, fixes #11018).
• Allowed safe percent-encoded repository paths (#12319).
• Stripped paths and ports from COOLIFY_FQDN in env files (#12245, fixes #9649).
• Used SSH user registry credentials for host image pulls (#12216, fixes #12205).
• Rebuilt when a build secret value changed.
• Replaced the Dockerfile HEALTHCHECK when the healthcheck was enabled (#10974).
• Kept the healthy new container when a rolling update failed late (#12253).
• Stopped false pending changes (#11101, #12284).
• Found the current rollback image for containers with any name (#12296).
• Reported a failed application stop (#11063).
• Parsed mode suffixes in long-form bind targets.
• Created one Compose service on repeated submits and rejected Compose without services (#11078).
• Skipped the PORT mismatch warning when readonly labels were disabled (#10941).
• Deployed previews with their own environment variables (#12325).
• Kept custom preview domains on redeploy (#6536).
• Built the PR commit on manual Bitbucket preview redeploys (#10806).
• Keyed preview Docker tags by preview ID and stopped the DNS poll from re-queuing sync jobs.
• Kept open preview volumes out of stale Compose volumes (#10855).
• Kept locked variables and their preview copies locked with their values (#12299).
• Kept omitted values and flags when patching env variables through the API (#12240, fixes #9977).
• Included Infisical imported secrets (#12267).
• Regenerated proxy labels when the API changed exposed ports (#12334, fixes #11074).
• Saved is_auto_deploy_enabled for Docker image and Dockerfile apps created by the API (#12339).
• Wrote file storage content to the server on API PATCH (#12248, fixes #11759).
• Accepted API settings that the UI can change (#11092).
• Showed only permitted MCP tools and actions in help and hints (#12295).
• Kept privileges in PostgreSQL backups (#12244).
• Signed S3 uploads with the storage region (#12264).
• Saved removed databases in the backup list (#11548) and explained dumps that stopped without an error (#11549).
• Identified the instance database backup by ID.
• Used the instance URL in volume backup notifications (#12285).
• Kept the proxy status current and stopped auto-start during proxy restarts.
• Validated servers without a proxy (#11048) and explained Docker Engine version check failures (#11089).
• Blocked server migration when the target proxy is not running.
• Replaced wedged SSH multiplexing masters (#12241, fixes #10077, #11130).
• Proxied realtime and terminal WebSockets on the dashboard port (#11707).
• Kept new images during Docker cleanup (#11069) and skipped scheduled cleanups during deployments (#12183).
• Removed orphaned legacy realtime containers.
• Kept a detected public IP when the other IP family's lookup timed out (#12275).
• Quoted root credentials in the installer .env (#12276) and kept operator SSH keys that mention coolify (#12278).
• Reported a failed manual update check (#12266).
• Passed the cloudflared Access service token to the terminal SSH (#12312).
• Browsed files in containers without a shell (#12305).
• Trimmed Telegram bot tokens and chat IDs (#12323).
• Showed the server timezone in scheduled task help (#10904).
• Listed production, staging, and development environments first (#12317).
• Hid deleted resources on the environment page after the redirect.
• Showed held-back package updates separately.
• Fixed the filtered tag count in pagination.
• Recreated the Mosquitto password file on each start (#11691).
• Updated the Reactive Resume template to v6 (#12282).
• Fixed server online status (#12289), disk detection (#12315), chart density (#12281), and loading on slow servers in metrics.
• Fixed checkbox clicks in confirmation dialogs (#12338).
• Fixed the database image picker (#12337) and server IDs in the new resource wizard (#12327).
• Floated listbox panels over modals (#11529) and fell back to the default for invalid theme colors (#12287).
• Fixed sidebar, tooltip, canvas, chart, list, and Compose loading issues in the UI.
• Kept member API tokens when a member is promoted (#12342).
• Returned success: false on API access denied responses (#12343).
• Documented database and resource list responses in OpenAPI, and stopped requiring both environment_name and environment_uuid on create endpoints (#10449).
• Allowed environment variable references in image tags (#10642).
• Kept quoted values when saving the developer view of environment variables (#10406).
• Reported Compose files with no parsed services during deployments.
• Stopped containers again while they restart past their restart limit (#10761).
• Showed container logs that contain invalid UTF-8 (#10628).
• Fixed terminal connections that closed with "Missing required tokens" when the session cookie name was custom.
• Updated breadcrumb names after a rename (#12341).
• Showed why Hetzner, DigitalOcean, and Vultr API requests fail, stopped duplicate Hetzner create requests, and deleted unsaved VPS instances.
• Recreated database TCP proxies that run an outdated configuration.
• Skipped Git LFS downloads when Git LFS is disabled (#10360).
• Kept the base directory in new repository applications (#10319).
• Kept saving applications with unchanged legacy build commands.
• Used the owner/repo slug for GitHub API calls with SSH repository URLs (#10175).
• Showed GitHub App errors when loading repositories (#10174).
• Fixed terminal authentication when a sibling subdomain sets another XSRF-TOKEN cookie.
• Added an Axiom edge domain setting to log drains, so EU datasets work.
• Hid out-of-stock and deprecated Hetzner server types, or showed them as disabled.
• Let password managers autofill the confirmation password (#9963).
• Checked out short commit SHAs with shallow clones (#9926).
• Replaced the clone suffix instead of adding one for each clone (#9976).
• Kept port-suffixed SERVICE_URL and SERVICE_FQDN variables in sync with the domain (#9877).
• Returned logs of stopped containers through the API, like the UI.
• Renamed the old Security labels to Keys & Tokens.

What's Changed

• fix(api): hide DB URLs in create responses without sensitive access by @andrasbacsai in https://github.com/coollabsio/coolify/pull/12297
• fix(deployments): strip paths and ports from COOLIFY_FQDN in env files by @andrasbacsai in https://github.com/coollabsio/coolify/pull/12245
• fix(compose): read the Compose file from Git objects by @andrasbacsai in https://github.com/coollabsio/coolify/pull/12320
• fix(git): allow safe percent-encoded repository paths by @andrasbacsai in https://github.com/coollabsio/coolify/pull/12319
• fix(ssh): bound mux control checks and replace wedged masters by @andrasbacsai in https://github.com/coollabsio/coolify/pull/12241
• fix(deployments): prevent Git fetches from hanging by @andrasbacsai in https://github.com/coollabsio/coolify/pull/12321
• fix(previews): deploy previews with their own environment variables by @andrasbacsai in https://github.com/coollabsio/coolify/pull/12325
• fix(deployments): write regular deployment files when the repository has symlinks by @andrasbacsai in https://github.com/coollabsio/coolify/pull/12324
• fix(new-resource): pass server ids in the resource wizard by @andrasbacsai in https://github.com/coollabsio/coolify/pull/12327
• fix(deployments): write generated compose file after image build by @andrasbacsai in https://github.com/coollabsio/coolify/pull/12331
• fix(api): write file storage content to server on PATCH by @andrasbacsai in https://github.com/coollabsio/coolify/pull/12248
• fix(postgres): block restore scan bypasses and stop on SQL errors by @andrasbacsai in https://github.com/coollabsio/coolify/pull/12333
• fix(deploy): use SSH user registry credentials for host image pulls by @andrasbacsai in https://github.com/coollabsio/coolify/pull/12216
• fix(analytics): hide container tooling user agents by default by @andrasbacsai in https://github.com/coollabsio/coolify/pull/12335
• fix(api): regenerate proxy labels when exposed ports change by @andrasbacsai in https://github.com/coollabsio/coolify/pull/12334
• perf(metrics): ask Sentinel to bucket metric history rows by @adiologydev in https://github.com/coollabsio/coolify/pull/12300
• feat(env): support variable flag directives in developer view by @andrasbacsai in https://github.com/coollabsio/coolify/pull/12349
• fix(api): preserve omitted env var values and flags on PATCH by @andrasbacsai in https://github.com/coollabsio/coolify/pull/12240

Full Changelog: https://github.com/coollabsio/coolify/compare/v4.5.0...v4.5.1