Andras Bacsai
d32d7cf3d2
Improve application URL handling ( #10836 )
2026-07-02 18:41:13 +02:00
Andras Bacsai
c6c7ec1c31
fix(security): validate application domains safely
...
Use shared domain validation and normalization for application, service, and
preview domains so unsafe host input is rejected consistently.
Cover command-substitution payloads in application domain tests.
2026-07-02 17:47:04 +02:00
Andras Bacsai
cc4f666ba2
Merge remote-tracking branch 'origin/next' into improve-application-url-handling
2026-07-02 17:40:31 +02:00
Andras Bacsai
954c1e369c
fix(env-vars): avoid service preview variable lookups ( #10837 )
2026-07-02 17:39:16 +02:00
Andras Bacsai
d5395f0500
fix(services): preserve template keys for selection
2026-07-02 17:16:40 +02:00
Andras Bacsai
ed6352682e
Merge remote-tracking branch 'origin/next' into improve-application-url-handling
2026-07-02 16:57:14 +02:00
Andras Bacsai
cd95ac3d0d
test: cover case-sensitive application URL paths
2026-07-02 16:56:49 +02:00
Andras Bacsai
bbff70c8d0
fix: improve application URL handling
2026-07-02 16:52:07 +02:00
Andras Bacsai
ec34c5192f
Add internal endpoint controls ( #10835 )
2026-07-02 16:49:14 +02:00
Andras Bacsai
3988ad6921
fix(webhooks): resolve hostnames using custom DNS servers
...
Keep webhook SSRF DNS checks active when general DNS validation is disabled, and include localhost loopback resolution in safe URL validation.
2026-07-02 16:47:55 +02:00
Andras Bacsai
0bf97df9af
feat: add internal endpoint controls
2026-07-02 16:35:39 +02:00
Andras Bacsai
7a853efa79
chore: inspect PR context ( #10834 )
2026-07-02 16:27:06 +02:00
Andras Bacsai
c4772cce49
chore: improve contributor guidelines and issue templates ( #8577 )
2026-07-02 16:22:25 +02:00
Andras Bacsai
438eeefa73
feat(api): add REST endpoints for destinations ( #10405 )
2026-07-02 15:34:30 +02:00
Andras Bacsai
70021c8d5e
fix(api): handle destination create races as conflicts
2026-07-02 15:33:01 +02:00
Andras Bacsai
ae839198d6
feat(mcp): add per-team server toggle ( #10771 )
2026-07-02 15:19:07 +02:00
Andras Bacsai
88d5aff018
Merge remote-tracking branch 'origin/next' into team-level-mcp-enablement
2026-07-02 15:15:11 +02:00
Andras Bacsai
4ef884e1ac
Merge remote-tracking branch 'origin/next' into feat/api-destinations
2026-07-02 15:14:13 +02:00
Andras Bacsai
5b1ac432c7
Improve S3 storage handling ( #10832 )
2026-07-02 15:07:00 +02:00
Andras Bacsai
20b5b90cf9
Merge remote-tracking branch 'origin/next' into improve-s3-storage-handling
2026-07-02 15:06:11 +02:00
Andras Bacsai
78d9244caa
fix: improve s3 storage handling
2026-07-02 15:05:05 +02:00
Andras Bacsai
bed058b826
Improve outbound URL validation ( #10833 )
2026-07-02 15:02:37 +02:00
Andras Bacsai
558520ce75
Improve storage mount path handling ( #10831 )
2026-07-02 15:01:33 +02:00
Andras Bacsai
a06c1a7bf5
Improve storage mount path handling
2026-07-02 14:54:38 +02:00
Andras Bacsai
c7f014017b
Improve outbound URL validation
2026-07-02 14:46:46 +02:00
Andras Bacsai
39ae16de42
Improve team resource route handling ( #10829 )
2026-07-02 14:34:27 +02:00
Andras Bacsai
a121386ab4
Merge branch 'next' into improve-resource-route-handling
2026-07-02 13:25:47 +02:00
Andras Bacsai
fb2d477e48
fix: improve team resource route handling
2026-07-02 13:05:27 +02:00
Andras Bacsai
74f4d04f53
fix(backups): default S3 storage for backup schedules
...
Show the S3 storage selector even when S3 backups are disabled, save
storage changes immediately, and improve responsive confirmation buttons.
2026-07-02 12:47:54 +02:00
Andras Bacsai
76d429fb74
fix(sidebar): center unread badge in settings menu
2026-07-02 12:35:28 +02:00
Andras Bacsai
22b31f5671
fix(backups): require valid S3 storage selection
...
Preserve S3 backups when a single valid storage is available, require
explicit selection when multiple storages exist, and disable S3 when none
are available.
Make backup action controls responsive on narrow screens.
2026-07-01 11:14:20 +02:00
Andras Bacsai
b93a91cc00
docs(security): document deployment command trust boundary
2026-06-30 15:48:22 +02:00
Andras Bacsai
78374b566a
fix members smtp pw update
2026-06-30 15:29:19 +02:00
Andras Bacsai
63d6d835a9
Align resource creation permissions ( #10799 )
2026-06-29 15:59:46 +02:00
Andras Bacsai
29445bf177
fix: align resource creation permissions
2026-06-29 15:57:17 +02:00
Andras Bacsai
f2d11d9300
fix(railpack): interpolate build-time env variables by sourcing build… ( #10768 )
2026-06-29 11:08:19 +02:00
Andras Bacsai
9f36a8df31
Harden database backup imports ( #10796 )
2026-06-29 10:36:31 +02:00
Andras Bacsai
7d65a4b496
Merge remote-tracking branch 'origin/next' into harden-database-import-files
2026-06-29 10:35:35 +02:00
Andras Bacsai
f4c863bc34
fix(service): correct Convex origin env vars and expose HTTP actions port ( #10646 )
2026-06-29 10:27:55 +02:00
Andras Bacsai
0194a6f104
feat(service): add Inngest one-click service template ( #10612 )
2026-06-29 10:27:37 +02:00
Andras Bacsai
84bf96ce76
chore(service): gitea-runner patch version bump ( #10566 )
2026-06-29 10:27:20 +02:00
Andras Bacsai
2d63d51237
fix: harden database backup imports
2026-06-29 10:27:01 +02:00
Andras Bacsai
9a64b2ea0a
Merge remote-tracking branch 'origin/next' into fix/railpack-buildtime-env-interpolation
2026-06-29 10:20:07 +02:00
Andras Bacsai
2dc34f61ff
fix(railpack): create empty build-time env file
2026-06-29 10:19:22 +02:00
Andras Bacsai
fe9b43be7c
fix(deploy): preserve private key command metadata ( #10795 )
2026-06-29 10:17:57 +02:00
Andras Bacsai
a630532308
fix(deploy): preserve deploy key command metadata
2026-06-29 10:17:09 +02:00
Andras Bacsai
3729b5c074
improve github webhook
2026-06-28 15:25:58 +02:00
Andras Bacsai
1a5b8d3612
fix(deploy): skip logging deploy key commands
2026-06-28 13:15:18 +02:00
Andras Bacsai
dcb235f831
Validate environment variable keys ( #10773 )
2026-06-25 18:34:59 +02:00
Andras Bacsai
87d4744390
Validate environment variable keys
2026-06-25 18:19:58 +02:00
