Cloudron Forum

[1.118.1] Update gitlab-foss to 19.2.1 Full Changelog Fix self-managed admin/owner cannot enroll namespaces into Orbit Restore AI infrastructure settings after upgrade Remove --unlink-first and --recursive-unlink from tar extract Fix keys org_id NOT NULL constraint on Self-Managed/Dedicated Enforce admin Duo lock on group settings update Use self-hosted TLS setting in DWS flow validation and metadata Enforce artifact access control on pipeline test reports feat: Implement Workhorse JWT for all senddata requests Fix virtual registry redirect handler and file request service Fix reflected XSS in oAuth apps list page

[1.17.11] Update pocketbase to 0.39.10 Full Changelog Reverted the auto panic recover handling for the cli commands to preserve the old behavior and allow panic to force exit with non-zero code (#7781). Minor UI improvements (added placeholder loader for the logs chart, npm dev deps update, etc.). Updated modernc.org/sqlite to v1.55.0 (doc changes).

[1.8.0] Update twenty to 2.25.0 Full Changelog Relation field widgets on record pages can now display related records as a kanban board, calendar, or grouped table. (#23112) Dashboard charts grouped by a relation field now show the related record's name instead of a raw database ID. (#23163) Records that changed while disconnected now re-appear automatically on reconnect, without needing a page refresh. (#23357) Full-page record tabs (Timeline, Tasks, Notes, Files, Emails, Calendar) now support drag-and-drop widget editing and behave consistently with the rest of the layout editor. (#23109) by @FelixMalfait Email settings now let you configure a display name for outgoing emails and manage your unsubscriber list. (#23180) by @neo773 Google and Microsoft sign-in no longer puts a long-lived refresh token in the redirect URL, browser history, or server access logs. (#23061) by @bosiraphael Transactional emails (workspace invites, password resets, email verifications) now have content again; they were being delivered with an empty body. (#23323) by @guillaume-flambard Upgrading a self-hosted instance from 2.23 to 2.24 no longer fails on startup with a missing keyValuePair.applicationId column error. (#23272) by @prastoin Roles that explicitly deny access to system objects (messages, calendar events) now enforce that restriction; it was previously silently bypassed. (#23280) by @thomtrp The onboarding flow no longer hangs indefinitely when a CSS chunk fails to preload, a regression that affected Mobile Safari. (#23359) by @bosiraphael

[1.19.0] Update minecraft-forge to 26.2-65.1.0

[1.138.2] Update synapse to 1.157.2 Full Changelog This security release addresses several vulnerabilities. Please upgrade when you can, particularly if your homeserver participates in open federation and/or has untrusted local users. Fix ELEMENTSEC-2026-1071 Fix ELEMENTSEC-2024-1520 Fix ELEMENTSEC-2026-1717 Fix ELEMENTSEC-2026-1721 Fix ELEMENTSEC-2026-1729 Fix ELEMENTSEC-2026-1740 Fix ELEMENTSEC-2026-1714 Fix ELEMENTSEC-2026-1718

[4.185.1] Update ghost to 6.54.1 Full Changelog Fixed settings preview interaction regressions (#29618) - Steve Larson

[1.10.13] Update grav to 2.0.13 Full Changelog Added an array_group_by Twig filter and function for grouping a list of items by one of their values (#4218). [security] A configuration admin can no longer run code on the server by pointing a dynamic field's data provider at a built-in routine named as a class-and-method pair, a form that slipped past the safety check because it only inspected the single-string spelling; both forms are now vetted the same way (GHSA-r94f-hx44-8jqf). [security] A page editor without super-admin rights can no longer store an event-handler script that runs for site visitors by hiding it behind a > placed inside a quoted HTML attribute; the content security scan now reads quoted attribute values the same way a browser does (GHSA-269c-h76q-8cxw). [security] A backup profile's location is now confined to the site folder, so a profile pointing outside the Grav root can no longer pull external directories into the backup archive (GHSA-fch7-cpv4-w7hg). [security] Uploaded filenames may no longer contain the HTML characters <, >, or ", so a stored filename cannot carry markup that could run if it were later shown unescaped. [security] The find and sort Twig filters now reject a dangerous function name given as their callback, matching the protection already applied to map, filter, and reduce, so template values cannot use them to run code (GHSA-xx48-97m4-h7qm). The bundled nginx.conf security rules are now anchored to the start of the path like the .htaccess rules already are, so the admin's Tools Logs viewer works on nginx instead of being blocked (#4223). On non-FastCGI setups Grav no longer sends an invalid Content-Encoding: none header, which some strict HTTP clients rejected outright; it now closes the connection cleanly without the bogus value (#2619).

[2.31.4] Update NodeBB to 4.14.4 Full Changelog trust_proxy upgrade script writes to wrong config.json when started with --config (breaks Docker logins) (#14527) (29f90de)