Escape service application lifecycle command arguments for deploy, restart, stop, and log status checks.
Validate API update payloads from JSON/form data before applying allowed fields, preserving explicit boolean and null values.
Add coverage for service application API authorization, team isolation, validation, and command escaping.
Authorize stored Hetzner cloud provider tokens before fetching
firewalls or networks, hide provider error details, and keep server
creation intact if backup activation fails.
Collapse advanced Hetzner server options by default while preserving
visibility when advanced values are selected.
Normalize tag names before attaching them, reject names that are too short
after sanitization, and return 404 when removing tags not attached to the
resource.
Adds a per-team unique tag-name index and migrates duplicate tags onto the
kept record before creating the constraint.
Privileged API tokens can read hidden resource fields in environment and
resource responses, including instance-admin team tokens with team_id 0.
Configuration hashes now include hidden environment variable values so
secret edits trigger restart detection.
Clamp log line counts, parse timestamp flags consistently, and filter
service subcontainers by Coolify labels. Document log endpoint timestamp
parameters and database/service log routes in OpenAPI.
Expose GitHub app secrets and file storage content only when the request has sensitive read access. Hide LocalFileVolume content by default and resolve application UUIDs from route parameters.
Require admin team membership for destination mutations, return invalid-token
responses for tokenless requests, and remove standalone Docker networks when
deleting destinations.
PHP's FILTER_VALIDATE_URL rejects underscores in the host, so domains
like https://myapp_service.example.com were rejected by the API and
never got a Let's Encrypt certificate. Add an isValidDomainUrl() helper
that validates a copy with underscores replaced by hyphens, and route
domain validation in the Applications and Services API controllers
through it.
Fixes#10597
