feat: allow reset-password script to reset a specific user by email - #5237

* chore: automate git worktree setup (shared node_modules, per-worktree dev port)

* chore: add SKILL.md for issue reproduction and verification process
chore: create .mcp.json for MCP server configuration

* chore: add install-worktree-deps.sh script for dependency installation

* chore: add script to spawn agent worktree with environment setup

* fix(server): allow plus, at, and valid path characters in readValidDirectory

* [autofix.ci] apply automated fixes

* fix: preserve ${VAR} interpolation in .env files

Escaping in prepareEnvironmentVariablesForFile escaped every $,
including inside a deliberate ${VAR} reference, breaking Compose's
documented .env variable interpolation. Only escape $ that isn't
part of a ${IDENTIFIER} sequence.

Fixes Dokploy#5151

* fix: preserve parameter expansion (${VAR:-default}) in .env interpolation

* fix: detect network delete/recreate by Docker ID during sync

Network sync compared only by name, so a network deleted and
recreated with the same name but different attributes (driver,
attachable, etc.) was reported as already in sync.

Store Docker's network Id (dockerId column) and compare it against
the live Id during sync. A name match with a dockerId mismatch is
now surfaced as a new "changed" state, with an Update action to
refresh the DB row from the live network.

Fixes Dokploy#5179

* docs: add CLAUDE.md code style notes

* [autofix.ci] apply automated fixes

* fix: prevent unsaved organization form fields from resetting on window focus

* chore: remove obsolete .mcp.json configuration file

* fix: correct network monitoring chart labels and units

Network chart showed values labeled as KB/s, but the underlying data
is MB totals accumulated since boot. Convert to GB and relabel as
Network Total (since Boot).

Fixes Dokploy#5115

* fix: resolve relative bind mounts against code dir for git-based compose deploys

Compose deployments using a git provider (GitHub/GitLab/Gitea/Bitbucket/
custom Git) clone the repo verbatim, so composePath can point into a
subdirectory (e.g. deploy/docker-compose.yml). Docker Compose resolves
relative bind mounts (../files) against the compose file's own directory,
not against the code/ dir where file mounts are actually written, so the
mount silently binds an empty directory instead of the configured content.

Pin --project-directory to code/ when building the docker compose command
so relative mounts always resolve the same way raw deployments already do.

Fixes Dokploy#5181

* fix: remove empty routers/services traefik config instead of writing invalid yaml

Attaching Basic Auth or a Redirect to an application with no domains
wrote an empty routers/services block to the app's dynamic config
file. Traefik's file provider rejects that as invalid and aborts its
watcher, blocking config updates for every other application.

Fixes Dokploy#5189

* fix: mkdir parent dir before writing file mount updates

Fixes Dokploy#5152. updateFileMount wrote directly to the target path without
ensuring its parent directory existed, and silently swallowed errors
instead of surfacing them. If the path already existed as a directory
(e.g. Docker pre-creating a bind mount target), the write silently
failed and left an empty directory instead of the file.

* fix: enhance error handling and directory management in updateFileMount function

* Add journal entry for granting terminal permission to read roles

* fix: apply watch path negations as a pattern set

* [autofix.ci] apply automated fixes

* Revert "[autofix.ci] apply automated fixes"

This reverts commit a66684a.

* [autofix.ci] apply automated fixes

* fix: keep native log container id in sync when Swarm/compose replaces it

Closes Dokploy#5134. The container list queries in the Logs tab only fetched
once on mount, so if the underlying container was replaced (restart,
reschedule, redeploy) while the page stayed open, the native log
WebSocket kept streaming from the stale id and either froze or failed
with 'No such container'.

Poll the container list every 5s and reconcile the selected id against
it, matching the pattern already used for automatic selection.

* fix: disable delete/unlink user button while mutation is pending

Prevents double-submit when clicking Confirm on the Delete/Unlink User
dialog before the request resolves (issue Dokploy#5063).

* [autofix.ci] apply automated fixes

* fix: close terminal websocket when local container shell exits

* fix: report remote-node containers correctly in stack monitoring

Free monitoring resolved containers via a local Dockerode listContainers()
call, which only sees containers scheduled on the host running Dokploy.
For Stack services with tasks on other Swarm nodes, this always fell into
the "Container not running" branch even when the task was healthy
elsewhere, since local docker.listContainers() can't see remote-node
containers.

Now falls back to `docker service ps` (Swarm-aggregated, works from any
manager regardless of task placement) to tell a genuinely stopped
container apart from one running on another node, and reports that
distinction in the WS close reason instead of the misleading message.

Also fixes a client-side race where the stats websocket connected with
an empty appName on first mount (before the container selector settled),
and surfaces the close reason as a toast instead of only logging it.

* fix: domain validation false negative on servers with multiple IPs

Validate against the server's SSH IP plus its detected public egress
IP, instead of only the stored SSH address.

Fixes Dokploy#4658

* fix: satisfy HttpRouter type in traefik config test

Test routers were missing the required "service" field, and
mock.calls[0] destructuring failed under noUncheckedIndexedAccess.

* fix: verify server ownership before running IP detection

validateDomain accepted an arbitrary serverId and used it to look up
the server and SSH into it, without checking it belonged to the
caller's active organization. A member with domain:read could probe
other orgs' servers and get their SSH/detected IPs back in the
response.

Addresses greptile review on Dokploy#5214

* feat: add OpenPanel analytics to cloud version

* Bump version from v0.30.2 to v0.30.3

* fix: detect billing plan across all active Stripe subscriptions

getCurrentPlanForUser and getProducts only inspected subscriptions.data[0],
so a customer with more than one active Stripe subscription (e.g. Startup
plus a separately purchased additional server) could have their plan
resolved from the wrong subscription, resulting in currentPlan !== "startup"
and the HubSpot chat bubble not rendering.

* fix: only sum currentPriceAmount from the identified plan subscription

Summing across all active subscriptions could mix amounts with
different billing intervals (isAnnualCurrent only reflects the
matched plan subscription), producing an inconsistent total.

* fix/docker-context-path-default: Placeholder with name attribute "dockerContextPath" lied that the default path is ".", while being the Dockerfile directory.

* feat: allow reset-password script to target a specific user by email

Previously reset-password only reset the owner account's password.
Passing an email as an argument now resets that specific user's
password instead, while omitting it keeps the existing owner-reset
behavior.

Also scopes the update to the credential (password-based) account
row via providerId, and fixes the success check to verify a row was
actually updated instead of always reporting success.

* [autofix.ci] apply automated fixes

* fix: normalize email argument before lookup in reset-password

Trims and lowercases the CLI email arg to match the normalization
used elsewhere for user emails, so a differently-cased or
whitespace-padded email no longer falsely reports "User not found".

* fix: surface the error state instead of "No results." when the log query fails

The loading branch added in the previous commit split the fallback cell
two ways: spinner while in flight, "No results." otherwise. That second
branch also catches the failure case -- when readStatsLogs errors,
statsLogs stays undefined and isLoading goes false, so a failed request
renders as a successful empty response.

The query's isError/error were not destructured. The cell now branches
three ways and reports the error through AlertBlock, matching how
ShowTraefikSystem surfaces a failed readDirectories query.

* fix: prevent deployment commit hash overflow on mobile

* [autofix.ci] apply automated fixes

* Merge pull request Dokploy#5237 from shuv-o/feat/reset-password-by-email

feat: allow reset-password script to reset a specific user by email
(cherry picked from commit 5345c00)

[skip ci]

* fix failing test

* fix: only pin --project-directory when compose has mounts

--project-directory was added unconditionally in 87b9149 to fix
relative bind mount resolution for git-based compose deploys with a
nested composePath (Dokploy#5181). It also moves where build.context and the
generated .env resolve, breaking any compose file in a subdirectory
that has context: . alongside its Dockerfile (Dokploy#5230), or interpolates
env vars (Dokploy#5242).

Only pin --project-directory when the compose actually has mounts
configured; otherwise build.context and .env resolve against the
compose file's own directory like plain docker compose. Also pass
--env-file explicitly pointing at the generated .env next to the
compose file, so it's found even when --project-directory is pinned
(credit: tonnenpinguin, PR Dokploy#5235).

Fixes Dokploy#5230
Fixes Dokploy#5242

* fix: persist serverThreshold for gotify/ntfy and guard teams dispatch

* fix: use updateJob to replace repeatable schedule job on update in cloud

Fixes Dokploy#5233. Updating an enabled schedule (cron/timezone change) called
schedule() (create-backup), which only adds a new repeatable job and
never removes the one registered under the old cron pattern, leaving
an orphaned BullMQ job running in Redis indefinitely. Switched to
updateJob() (update-backup), which looks up the currently registered
repeatable pattern, removes it, then re-adds — same pattern already
used in backup.ts for backups.

* fix: pass timezone when removing repeatable schedule job

removeJob() for type 'schedule' computed the BullMQ repeatable key
using only the cron pattern, without the timezone. scheduleJob()
always registers the repeatable job with tz set (job.timezone || UTC),
so BullMQ's repeat key (name:jobId:endDate:tz:pattern) never matched
on removal — removeRepeatable silently no-op'd and the job kept
firing forever, surviving disable, delete, and reboots.

Forward timezone through removeJob (queue.ts), the /update-backup
lookup (index.ts), and the disable/delete call sites in the
schedule router.

* [autofix.ci] apply automated fixes

* fix: write remote traefik config via SFTP instead of exec+base64

Embedding the full YAML (base64-encoded) into a single SSH exec command
silently fails once the payload passes the SSH transport's packet size
ceiling (~90-100KB), truncating the dynamic config with no error
surfaced anywhere. Switch to SFTP, which has no such limit.

* fix: verify swarm task convergence before marking db deploys done

* Remove unused journal entry for phase vault provider from _journal.json

* Add entry for volatile piledriver in journal with version 7

* [autofix.ci] apply automated fixes

* refactor: remove DnsPageTransition component and update loading indicators in DNS-related components

* Remove unused journal entry for porkbun DNS provider from _journal.json

* Add new journal entry for wooden_nextwave version 7

* bump version to v0.30.4 in package.json

* feat: bulk import secrets from vault providers

Adds a modal to select and import multiple secrets from an assigned
vault provider at once, instead of typing each ${{vault.x.y}} reference
by hand. Existing keys are skipped by default and can be overridden per
row; also adds an "Access all" shortcut to the vault provider assignment
picker.

* test: fix stale traefik remote-write test expectation

writeTraefikConfigRemote moved from an execAsyncRemote echo command to
writeFileRemote (SFTP) a while back; the test still mocked the old
execAsyncRemote path and asserted on an echo command that no longer runs.

* feat: list associated services in delete server modal

Show the services attached to a remote server directly in its delete
confirmation modal, with a link to each service and a per-service
delete action, instead of only showing a generic 'has active
services' blocker.

* fix: don't leak git provider secrets to non-owner org members

gitlab.one, github.one, gitea.one and bitbucket.one returned the full
DB record (OAuth access/refresh tokens, client secrets, private keys,
webhook secrets, app passwords) to any org member who merely had
access to *use* a shared provider (sharedWithOrganization: true),
not just its owner or an org owner/admin.

Add canViewGitProviderSecrets() and null out the secret fields in
each .one response when the caller isn't the provider owner or an
org owner/admin.

* fix: strip git provider secrets from compose.one response

findComposeById embedded the full github/gitlab/bitbucket/gitea
relations (client secrets, OAuth tokens, private keys, app passwords)
and compose.one only used canEditDeployGitSource to set a
hasGitProviderAccess flag, never to hide the fields — so any member
with read access to a compose service got the connected git
provider's raw credentials, regardless of their access to that
provider itself.

Exclude the same secret columns findApplicationById already excludes.
Deploys are unaffected: the actual clone step always re-fetches the
provider fresh by id (findGithubById/findGitlabById/...), it never
reads secrets off the embedded relation.

* feat: add Infomaniak DNS provider support

Adds Infomaniak alongside Cloudflare, AWS Route53 and Porkbun, following the
existing DnsClient interface in packages/server/src/utils/dns/.

- infomaniak.ts implements listZones, listRecords, upsertRecord, updateRecord,
  deleteRecord and testConnection against the Infomaniak API. Zones come from
  /1/product?service_name=domain and records from the v2 /2/zones/{zone}/records
  endpoints, which are keyed by zone name rather than by product id.
- A new `infomaniak` value was added to the DnsProviderType enum along with an
  infomaniakDnsConfigSchema (apiToken) in the discriminated union, plus the
  Drizzle migration for the enum change.
- The token is masked/merged like the other providers in services/dns-provider.ts.
- UI: Infomaniak icon and API Token field in the DNS provider dialog, plus
  registration in the provider selector.

Infomaniak's `source` is relative to the zone (empty for the apex), so record
names are translated between Dokploy's fully-qualified format and Infomaniak's
subdomain-only format internally, with the trailing dot handled. TXT targets are
stored quoted by the API and are unquoted on read / quoted on write so that
editing a record does not stack quotes on every save.

Also fills in the missing Porkbun label in show-dns-providers.tsx, which fell
back to displaying the raw enum value.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

* feat: add OVHcloud DNS provider support

Adds OVHcloud alongside Cloudflare, AWS Route53 and Porkbun, following the
existing DnsClient interface in packages/server/src/utils/dns/.

- ovh.ts implements listZones, listRecords, upsertRecord, updateRecord,
  deleteRecord and testConnection against the /domain/zone endpoints of the
  OVHcloud API, on any of its seven regional endpoints (ovh-eu/ca/us, kimsufi
  and soyoustart).
- A new `ovh` value was added to the DnsProviderType enum along with an
  ovhDnsConfigSchema (endpoint, applicationKey, applicationSecret, consumerKey)
  in the discriminated union, plus the Drizzle migration for the enum change.
- The application secret and the consumer key are masked/merged like the other
  providers' secrets in services/dns-provider.ts.
- UI: OVHcloud icon, an endpoint selector and the three credential fields in the
  DNS provider dialog, plus registration in the provider selector.

Three OVH-specific behaviours are handled explicitly:

- Requests are signed with `$1$` + sha1(applicationSecret+consumerKey+method+
  url+body+timestamp). The timestamp comes from the API's own clock via an
  unauthenticated GET /auth/time, since a host clock a few seconds off would get
  every call rejected; the measured drift is cached per endpoint for an hour.
- OVH only applies zone changes once the zone is explicitly refreshed, so every
  successful create, update and delete is followed by POST /domain/zone/{zone}
  /refresh.
- The record update payload carries no fieldType, so changing a record's type
  replaces the record (DELETE then POST) and returns the new id.

The record listing endpoint returns ids only, so each record is fetched
individually with the fan-out capped at 8 concurrent requests.

Also fills in the missing Porkbun label in show-dns-providers.tsx, which fell
back to displaying the raw enum value.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

* fix(dns): represent the Infomaniak apex as a root dot

Verified against a live Infomaniak account: the API returns `source: "."` for
apex records, not "" as assumed.

Reading them back produced a doubled dot ("..example.com"), and writing "" meant
an apex upsert never matched the existing record, so it would have created a
duplicate apex record instead of updating it.

toSource now emits "." for the apex and toFqdn accepts ".", "" and "@" so a
hand-written record still round-trips.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

* fix(dns): match apex records stored under any apex spelling

toSource always writes the apex as ".", but listRecords already accepted "" and
"@" as apex spellings on read. The upsert lookup compared sources strictly, so a
record stored under one of the other spellings would not have matched and the
upsert would have created a duplicate apex record instead of updating it.

Normalize the candidate's source before comparing, so read and match agree.

Reported by Greptile on Dokploy#5257.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

* fix(dns): restore the original OVH record when a type change fails

Changing a record's type deletes the record then recreates it with the new type,
because OVH's update payload carries no fieldType. If the creation failed the
name was left with nothing and no rollback.

The delete still has to come first, since OVH rejects a CNAME that would sit
alongside other data on the same name. So on a failed creation the original
record is put back from the copy already fetched before the delete, and the
original error is rethrown. If the restore fails too, the error names the record
that has to be recreated by hand.

Reported by Greptile on Dokploy#5258.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

* Cleanup leftover unused code in side.tsx

* fix(dns): paginate the documented Infomaniak products endpoint

listZones used /1/product, which lego uses but the API docs don't: it is the
legacy singular route, it returns no pagination metadata, and it 401s for at
least some tokens. The documented /1/products returns `total`, `pages`,
`items_per_page` and `page`, and defaults to 15 domains per page, so an account
with more domains than that would silently lose zones.

Switch to the plural endpoint and walk every page. Verified against a live
account: forcing per_page=2 collects all 5 domains across 3 pages with no
duplicates.

Also inline the single-use createdId helper.

Both reported by @narcisonunez on Dokploy#5257.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

* fix(dns): spell out the OVH right that lists zones

OVH matches access rules per exact path: a `GET /domain/zone/*` rule grants the
subtree but not the bare `GET /domain/zone` that listZones and testConnection
call. Verified against a live account with a consumer key carrying that single
wildcard rule:

    GET /domain/zone                     -> 403 This call has not been granted
    GET /domain/zone/                    -> 200
    GET /domain/zone/{zone}/record       -> 200

The form only asked for rights on `/domain/zone/*`, so a token created by
following it could not list zones at all, and the failure surfaced as a bare
"This call has not been granted" that points nowhere.

The hint now lists the five rights verbatim, and a token missing the root one
gets an error that names it instead of echoing OVH's message.

Reported by @narcisonunez on Dokploy#5258.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

* fix: resolve security vulnerabilities in whitelabeling

- Sanitize customCss in _document.tsx to prevent XSS breakouts by stripping </style> tags.
- Remove SSR favicon fetching to prevent SSRF and internal network scanning, falling back to client-side fetching.

* [autofix.ci] apply automated fixes

* fix: account for whitespace in style tag regex to prevent XSS

* fix: account for all style end-tag variants like </style/>

* [autofix.ci] apply automated fixes

* fix: resolve SVG unicode base64 encoding error and image upload race conditions

* [autofix.ci] apply automated fixes

* chore(api): add local Inngest dev server script

* feat: cloud onboarding wizard, billing trial card, and post-checkout server setup

- Onboarding wizard (Welcome -> Plan -> Project -> Server -> Deploy ->
  Complete), shown once to an org owner with zero projects and no active
  plan/trial; skippable per step or entirely
- Billing page shows the org's current plan, and a no-card 14-day trial
  card when eligible
- Post-checkout "Welcome to Dokploy Cloud" modal simplified to reuse the
  onboarding wizard's own project/server/deploy steps behind a modal
  instead of its previous standalone 6-step flow, using the app's regular
  typography instead of the wizard's display serif
- Onboarding wizard validates a persisted project still exists before
  resuming a stale session, and the dashboard layout no longer gets stuck
  redirecting to /dashboard/home once the local onboarding-active flag
  goes stale mid-session
- onboardingCompletedAt column on user, with a backfill so existing users
  aren't shown the wizard
- pnpm reset-onboarding dev script to reset a test account's onboarding
  state end to end

* [autofix.ci] apply automated fixes

* feat(vault): add AWS Parameter Store provider

* [autofix.ci] apply automated fixes

* bump version to v0.30.5

* Remove unused journal entry for wide Korg from _journal.json

* Remove unused journal entry for tag "0190_nappy_anita_blake" from _journal.json

* test: fix CI failures and improve local test robustness

* [autofix.ci] apply automated fixes

* fix: Fix server card title overflow for responsiveness

* fix(domains): include server interface addresses in validation

* refactor: extract createServerSideHelpers into a reusable function

* fix: address PR feedback (SVG helper & AddOrganization crash)

* refactor: extract resizeImage to shared utility

* chore(deps): bump nanoid

Bumps the npm_and_yarn group with 1 update in the /packages/server directory: [nanoid](https://github.com/ai/nanoid).


Updates `nanoid` from 3.3.11 to 3.3.18
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md)
- [Commits](ai/nanoid@3.3.11...3.3.18)

---
updated-dependencies:
- dependency-name: nanoid
  dependency-version: 3.3.18
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>

* fix: sync pnpm-lock.yaml with nanoid 3.3.18

The nanoid specifier in packages/server/package.json was bumped to
3.3.18 but the lockfile entry was not updated, causing
pnpm install --frozen-lockfile to fail in CI.

* fix(ui): truncate organization name properly in sidebar without clipping descenders

* [autofix.ci] apply automated fixes

* fix(auth): enforce SSO on server-side sign-in endpoints

Resolves Dokploy#5288.

- In better-auth hooks.before, reject /sign-in/email and /sign-in/social with FORBIDDEN when webServerSettings.enforceSSO is enabled
- Prevents direct API password authentication when SSO enforcement is enabled

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes

* docs: fix reset-password command invocation in CONTRIBUTING

* docs: drop stale .mcp.json reference in fix-issue skill

* chore: remove unused filterEmptyValues and hasValues utils

* fix(auth): block passkey authentication and email signup when SSO is enforced

- Include /sign-in/passkey, /passkey/verify-authentication, /passkey/generate-authenticate-options, and /sign-up/email in enforced SSO block
- Prevents registered passkeys from bypassing enforced SSO policies

* feat(ui): smart truncation tooltips, org name limits, and logo UI polish (Dokploy#5345)

* feat: add dynamic open graph metadata for enterprise whitelabeling

* chore: use compressed open graph image

* [autofix.ci] apply automated fixes

* fix: replace metaTitle with ogImageUrl in reset payloads

* fix: make fallback og image url absolute for social scrapers

* [autofix.ci] apply automated fixes

* chore: revert accidental package.json changes

* fix(dns): report an OVH zone refresh failure for what it is

refreshZone runs after the record write has already succeeded, so a failure
there means the change exists at the provider but is not being served yet. It
was left unguarded at all six call sites, so the caller saw a bare transport
error and would reasonably read it as "nothing was applied" — while a type
change had already deleted the old record and created its replacement.

Rolling the write back would destroy correct state over a publish failure, and
re-deleting after an uncertain network error is how records get lost. The error
now says what actually happened and how it resolves: the next successful change
to the zone publishes it, or the user can refresh the zone from the OVH manager.

Guarding the helper covers upsertRecord and deleteRecord too, not just the type
change Greptile pointed at.

Reported by Greptile on Dokploy#5258.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

* fix(dns): do not report a restored OVH record as lost

restoreRecord had the restore POST and its zone refresh inside one catch. That
was harmless while refreshZone swallowed failures, but the previous commit made
it throw, which brought a new case into that catch: the restore succeeds and
only the publication fails.

The message then told the user the record "has been deleted" and to recreate it
by hand. It exists at OVH, just unpublished, so following that advice duplicates
it as soon as the zone is refreshed.

The two failures are now reported separately. A failed POST still means the
record is really gone and prints what to recreate. A failed refresh after a
successful restore says the record is back but not served yet, and explicitly
says not to recreate it. Either way the original replacement error is kept, so
the user still learns why the type change failed.

Reported by Greptile on Dokploy#5258.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

* chore: drop local scratch files committed by mistake

A git add -A while merging canary swept in .watch/, a local scratch directory
holding monitoring scripts, screenshots and draft comment text. None of it
belongs in this PR.

* perf(dns): filter Infomaniak records server-side when upserting

upsertRecord pulled every record of a zone just to find the one it was about to
write. The API can filter, so ask it to.

The match is still verified locally, because filter[source] matches substrings
rather than exact values. Verified against a live account:

    filter[source]=autoconfig  -> [autoconfig]
    filter[source]=auto        -> [autoconfig, autodiscover]
    filter[source]=disco       -> [autodiscover]

Letting the filter decide would therefore have upserted "auto" onto the existing
"autoconfig" record. The filter narrows what is transferred; the exact
comparison still decides. Covered by a test that fails if the first candidate is
trusted.

The apex was the other thing worth checking, since Infomaniak writes it as ".":
filter[source]=. does return the apex records, and an upsert on an existing apex
TXT returns its id rather than creating a second one.

Suggested by @narcisonunez on Dokploy#5257.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

* Remove unused journal entry for "confused_rocket_racer" from _journal.json

* Add new journal entry for "0193_chemical_the_liberteens" with version 7

* fix(ui): align close button in web server update modal

Keep the close control in the header row so it lines up with the title and version badge instead of overlapping them.

* fix(vault): expand Infisical secret references when listing secrets

A secret in Infisical can reference another one (`${env.folder.KEY}`), which
is the only way to keep a value in one place and read it from several folders.
The Infisical client fetches `/api/v3/secrets/raw` without
`expandSecretReferences`, and that endpoint leaves references untouched by
default. The referencing secret therefore arrives as the literal `${...}`
string, is written to the generated `.env`, and the deployment still reports
success — the service just receives a placeholder instead of its value.

This is easy to miss because the single-secret endpoint (`/raw/{name}`) does
expand by default, so the Infisical UI and API show the resolved value while
only Dokploy sees the literal.

Adds the parameter and the first tests for this client: the list request now
asserts the flag, a missing secret and an auth failure. Without the fix the
new test fails with `expected null to be 'true'`.

* Reduce trial duration from 14 to 7 days

* fix(domains): don't fetch AddDomain queries until the dialog opens

Fixes Dokploy#5279. The Domains table (and grid) view mounts one AddDomain
instance per row for the edit action. Its 4 queries (domain.one,
application.one/compose.one, domain.canGenerateTraefikMeDomains,
compose.loadServices) ran unconditionally on mount instead of only
when the edit dialog is open, so any table interaction that causes a
re-render (typing in the host filter, sorting, toggling columns) fired
all 4 queries for every domain row again.

* fix(billing): update server inclusion descriptions for clarity

* feat(trial-banner): add trial banner component to display trial status in sidebar

* fix(sso): trust admin-configured SSO providers for account linking

better-auth's account-linking guard requires either the IdP asserting
email_verified or the sso_provider row being domainVerified before it
will link an SSO login to an existing local user with the same email.
Entra ID never asserts email_verified (neither via its OIDC userinfo
endpoint nor via SAML attributes), and Dokploy never persisted
domainVerified at all, so linking was permanently impossible for any
Entra-backed provider (OIDC or SAML) regardless of the local user's
own emailVerified state.

Add the domainVerified column, defaulting to true — Dokploy already
scopes providers to an admin-configured domain and gates registration
behind enterprise/admin permissions, so that domain match (still
enforced by better-auth's validateEmailDomain check) is trust enough.

Fixes Dokploy#5099

* fix(dns): match record content in upsertRecord to prevent overwriting existing records

Previously, upsertRecord matched only by type and name, silently
overwriting any existing record of the same type/name with different
content. This caused data loss when users had multiple records of the
same type (e.g. multiple TXT records for SPF + site verification).

Now upsertRecord also checks the record content/target before deciding
to update. If the content differs, a new record is created alongside
the existing one instead of replacing it.

Affected providers: Cloudflare, Porkbun, Infomaniak, OVH.
Tests updated accordingly.

* fix(dns): apply content normalization in upsert match logic to prevent duplicates

* fix(dns): fallback to data fields comparison for cloudflare structured SRV/CAA records

* fix(dns): extract and normalize prio for porkbun MX/SRV records to prevent duplicates

* [autofix.ci] apply automated fixes

* Update packages/server/src/utils/dns/porkbun.ts

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

* [autofix.ci] apply automated fixes

* feat(vault): address an Infisical folder from the reference

An Infisical provider is pinned to one non-recursive `secretPath`, so reading
two folders means two providers, two machine identities and two sets of
credentials to rotate. This lets a reference name the folder instead:

    ${{vault.my-provider.external/sentry:SENTRY_DSN}}

`<path>:<KEY>` mirrors the HashiCorp client in this directory, which already
documents that exact format. A relative path resolves against the provider's
`secretPath`, a leading slash is absolute, and a ref without a colon keeps its
current meaning — the whole ref is the secret name at the provider's own path.

A dot cannot be the separator here: Infisical accepts dots inside secret names
(`A.B.C` is a valid key), so `provider.a.b.C` cannot be split unambiguously
and would silently break anyone using such a name.

Refs are grouped by resolved path so each path is listed once, and the login
happens once per batch rather than once per path.

Tests cover the bare ref, relative and absolute paths, a provider at `/`,
grouping with a single login, the error naming the path, and a malformed ref.

* fix(server-health): detect custom default-address-pools via docker info

/etc/docker/daemon.json isn't mounted into the dokploy container, only
docker.sock is, so cat-ing it always failed silently. Read the effective
config over the already-mounted socket instead.

Fixes Dokploy#5383

* Merge pull request Dokploy#5358 from KingIronMan2011/patch-1

feat: added missing Railpack versions
(cherry picked from commit 3269088)

[skip ci]

* Merge pull request Dokploy#5477 from Dokploy/feat/trial-expiration-emails

fix(billing): pick a plan for the trial and warn before it expires

(cherry picked from commit d7d75f7)

[skip ci]

* chore: release v0.30.7

* Merge pull request Dokploy#5538 from Dokploy/fix/hubspot-chat-widget

fix(cloud): load HubSpot chat widget for startup plan users

(cherry picked from commit d0ec74f)

[skip ci]

* chore: release v0.30.8

* Merge pull request Dokploy#5661 from manozzo/fix/template-card-tags-overflow

fix(templates): cap visible tags so the Create button stays visible

(cherry picked from commit d9fe046)

[skip ci]

* chore: release v0.30.9

* Merge pull request Dokploy#5738 from Dokploy/chore/bump-node-24.22.1

chore: bump Node.js to 24.22.1 (security release)
(cherry picked from commit eb98876)

[skip ci]

* chore: release v0.30.10

* chore: rebase retained fork patches onto Dokploy v0.30.10

* chore: preserve historical fork artifacts without running them

* fix: preserve Nano ID security floor during upstream rebase

* fix: scope provider credentials to the configured Git origin

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: Mauricio Siu <[email protected]>
Co-authored-by: Mauricio Siu <[email protected]>
Co-authored-by: somuai <[email protected]>
Co-authored-by: Shuvo <[email protected]>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Narciso E. Núñez Arias <[email protected]>
Co-authored-by: Lucas Manchine <[email protected]>
Co-authored-by: drago1520 <[email protected]>
Co-authored-by: Romain PINSOLLE <[email protected]>
Co-authored-by: Shivam Gupta <[email protected]>
Co-authored-by: Rakesh Bhugra <[email protected]>
Co-authored-by: Dokploy Bot <[email protected]>
Co-authored-by: Yash Kumar <[email protected]>
Co-authored-by: Guillaume Juge <[email protected]>
Co-authored-by: Claude Opus 5 (1M context) <[email protected]>
Co-authored-by: Felix <[email protected]>
Co-authored-by: Bogdan Covrig <[email protected]>
Co-authored-by: Philippe Parage <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: detail-app[bot] <180357370+detail-app[bot]@users.noreply.github.com>
Co-authored-by: kcybe <[email protected]>
Co-authored-by: Artur Spatari <[email protected]>
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>