github/dokku
0
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
14,048 Commits 2 Branches 347 Tags
878ca3c2f74f8da3e8c044fc602804432e98dcb3
Commit Graph

14048 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
dependabot[bot]
878ca3c2f7 chore(deps): bump immutable from 5.1.5 to 5.1.9 in /tests/apps/multi 
Bumps [immutable](https://github.com/immutable-js/immutable-js) from 5.1.5 to 5.1.9.
- [Release notes](https://github.com/immutable-js/immutable-js/releases)
- [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/immutable-js/immutable-js/compare/v5.1.5...v5.1.9)

---
updated-dependencies:
- dependency-name: immutable
  dependency-version: 5.1.9
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-22 07:13:25 +00:00
Jose Diaz-Gonzalez
d39064058b Merge pull request #8857 from dokku/dependabot/npm_and_yarn/tests/apps/checks-root/body-parser-2.3.0 
chore(deps): bump body-parser from 2.2.1 to 2.3.0 in /tests/apps/checks-root
 2026-07-22 03:12:12 -04:00
Jose Diaz-Gonzalez
3c5b03f4ec Merge pull request #8854 from dokku/dependabot/docker/docs/_build/python-3.15.0b4-alpine 
chore(deps): bump python from 3.15.0b3-alpine to 3.15.0b4-alpine in /docs/_build
 2026-07-22 03:12:04 -04:00
Jose Diaz-Gonzalez
46b6057e97 Merge pull request #8853 from dokku/dependabot/docker/tests/apps/dockerfile-release/python-3.15.0b4-bookworm 
chore(deps): bump python from 3.15.0b3-bookworm to 3.15.0b4-bookworm in /tests/apps/dockerfile-release
 2026-07-22 03:11:53 -04:00
dependabot[bot]
3542acc271 chore(deps): bump body-parser in /tests/apps/checks-root 
Bumps [body-parser](https://github.com/expressjs/body-parser) from 2.2.1 to 2.3.0.
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](https://github.com/expressjs/body-parser/compare/v2.2.1...v2.3.0)

---
updated-dependencies:
- dependency-name: body-parser
  dependency-version: 2.3.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-21 19:58:27 +00:00
dependabot[bot]
c4af39ff8f chore(deps): bump python in /docs/_build 
Bumps python from 3.15.0b3-alpine to 3.15.0b4-alpine.

---
updated-dependencies:
- dependency-name: python
  dependency-version: 3.15.0b4-alpine
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-21 13:53:18 +00:00
dependabot[bot]
e746ea98f8 chore(deps): bump python in /tests/apps/dockerfile-release 
Bumps python from 3.15.0b3-bookworm to 3.15.0b4-bookworm.

---
updated-dependencies:
- dependency-name: python
  dependency-version: 3.15.0b4-bookworm
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-21 13:53:08 +00:00
Jose Diaz-Gonzalez
491fae6c00 Merge pull request #8852 from dokku/dependabot/pip/docs/_build/soupsieve-2.9 
chore(deps): bump soupsieve from 2.8.4 to 2.9 in /docs/_build
 2026-07-20 12:12:39 -04:00
Jose Diaz-Gonzalez
2fc0a0ee9c Merge pull request #8851 from dokku/dependabot/pip/docs/_build/mkdocs-material-9.7.7 
chore(deps): bump mkdocs-material from 9.7.6 to 9.7.7 in /docs/_build
 2026-07-20 12:12:33 -04:00
Jose Diaz-Gonzalez
636558bb28 Merge pull request #8850 from dokku/dependabot/github_actions/actions/setup-python-7 
chore(deps): bump actions/setup-python from 6 to 7
 2026-07-20 12:12:24 -04:00
dependabot[bot]
43f097e62f chore(deps): bump soupsieve from 2.8.4 to 2.9 in /docs/_build 
Bumps [soupsieve](https://github.com/facelessuser/soupsieve) from 2.8.4 to 2.9.
- [Release notes](https://github.com/facelessuser/soupsieve/releases)
- [Commits](https://github.com/facelessuser/soupsieve/compare/2.8.4...2.9)

---
updated-dependencies:
- dependency-name: soupsieve
  dependency-version: '2.9'
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-20 13:53:37 +00:00
dependabot[bot]
e3c329c96b chore(deps): bump mkdocs-material from 9.7.6 to 9.7.7 in /docs/_build 
Bumps [mkdocs-material](https://github.com/squidfunk/mkdocs-material) from 9.7.6 to 9.7.7.
- [Release notes](https://github.com/squidfunk/mkdocs-material/releases)
- [Changelog](https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG)
- [Commits](https://github.com/squidfunk/mkdocs-material/compare/9.7.6...9.7.7)

---
updated-dependencies:
- dependency-name: mkdocs-material
  dependency-version: 9.7.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-20 13:53:32 +00:00
dependabot[bot]
c9e35498be chore(deps): bump actions/setup-python from 6 to 7 
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6 to 7.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/v6...v7)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-20 13:52:34 +00:00
Dokku Bot
0537c8d153 Release 0.38.25 
# History

## 0.38.25

Install/update via the bootstrap script:

```shell
wget -NP . https://dokku.com/install/v0.38.25/bootstrap.sh
sudo DOKKU_TAG=v0.38.25 bash bootstrap.sh
```

### Security

- #8848: @josegonzalez Prevent command injection via docker options eval

### New Features

- #8849: @josegonzalez Support per-app letsencrypt emails on k3s
v0.38.25 		2026-07-19 09:36:27 +00:00
Jose Diaz-Gonzalez
7b8c8169e7 Merge pull request #8849 from dokku/k3s-per-app-letsencrypt 2026-07-19 05:34:57 -04:00
Jose Diaz-Gonzalez
90831a5504 fix: guard k3s issuer template against absent values 
The `issuer.yaml` chart template dereferenced `.Values.global.issuer.enabled` without guarding against the value being absent, which yaml serialization omitted for apps without a per-app email, causing a nil-pointer render error that broke every k3s web deploy.
 2026-07-19 04:34:40 -04:00
Jose Diaz-Gonzalez
dc802ddd19 feat: support per-app letsencrypt emails on k3s 
The `letsencrypt-email-prod` and `letsencrypt-email-stag` properties can now be set per app in addition to globally, resolving app-level before the global value for the app's selected `letsencrypt-server`. An app that sets its own email renders a namespaced cert-manager `Issuer` using that email, while apps without an override continue to use the shared `ClusterIssuer` with the global email.
 2026-07-19 03:31:55 -04:00
Jose Diaz-Gonzalez
05ce8fb68e Merge pull request #8848 from dokku/host-command-execution-via-eval-of-unsanitized-docker-options-in-dockerargs 
Prevent command injection via docker options eval
 2026-07-19 02:42:39 -04:00
Jose Diaz-Gonzalez
1a376c3622 fix: prevent command injection via docker options eval 
Values supplied through docker options, `--ttl-seconds`, and `-e` flowed into a Bash `eval` during build, deploy, and run, letting a low-privileged user execute arbitrary commands on the host as the dokku user. These arguments are now tokenized and passed through to the container verbatim, without shell expansion. A one-time migration repairs stored labels whose backticks were saved with a stray backslash so Traefik-style rules stay valid on the next deploy.
 2026-07-19 01:42:12 -04:00
Dokku Bot
730fa85d03 Release 0.38.24 
# History

## 0.38.24

Install/update via the bootstrap script:

```shell
wget -NP . https://dokku.com/install/v0.38.24/bootstrap.sh
sudo DOKKU_TAG=v0.38.24 bash bootstrap.sh
```

### Documentation

- #8836: @josegonzalez Link herokuish buildpack references to buildpack management page

### Tests

- #8841: @dependabot[bot] chore(deps): bump ruby from 4.0.5 to 4.0.6 in /tests/apps/dockerfile-entrypoint
- #8843: @dependabot[bot] chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 in /tests/apps/gogrpc

### Dependencies

- #8845: @dependabot[bot] chore(deps): bump github.com/mattn/go-isatty from 0.0.22 to 0.0.23 in /plugins/app-json
- #8844: @dependabot[bot] chore(deps): bump github.com/melbahja/goph from 1.5.1 to 1.5.2 in /plugins/common
- #8842: @dependabot[bot] chore(deps): bump timberio/vector from 0.56.0-debian to 0.57.0-debian in /plugins/logs
- #8838: @dokku-bot chore: bump pack to 0.40.8
- #8846: @dependabot[bot] chore(deps): bump traefik from v3.7.7 to v3.7.8 in /plugins/traefik-vhosts
- #8839: @dependabot[bot] chore(deps): bump actions/setup-node from 6 to 7
- #8834: @dokku-bot chore: bump dokku-event-listener to 0.20.0
v0.38.24 		2026-07-18 01:39:15 +00:00
Jose Diaz-Gonzalez
2950292309 Merge pull request #8845 from dokku/dependabot/go_modules/plugins/app-json/github.com/mattn/go-isatty-0.0.23 
chore(deps): bump github.com/mattn/go-isatty from 0.0.22 to 0.0.23 in /plugins/app-json
 2026-07-17 21:34:41 -04:00
dependabot[bot]
fb5a1e12e6 chore(deps): bump github.com/mattn/go-isatty in /plugins/app-json 
Bumps [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty) from 0.0.22 to 0.0.23.
- [Commits](https://github.com/mattn/go-isatty/compare/v0.0.22...v0.0.23)

---
updated-dependencies:
- dependency-name: github.com/mattn/go-isatty
  dependency-version: 0.0.23
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-17 21:33:26 -04:00
Jose Diaz-Gonzalez
e3ad4b3bcc Merge pull request #8844 from dokku/dependabot/go_modules/plugins/common/github.com/melbahja/goph-1.5.2 
chore(deps): bump github.com/melbahja/goph from 1.5.1 to 1.5.2 in /plugins/common
 2026-07-17 21:32:08 -04:00
Jose Diaz-Gonzalez
debb1b8f27 chore: bump go modules 2026-07-17 21:21:55 -04:00
Jose Diaz-Gonzalez
7c7af5767a Merge pull request #8842 from dokku/dependabot/docker/plugins/logs/timberio/vector-0.57.0-debian 
chore(deps): bump timberio/vector from 0.56.0-debian to 0.57.0-debian in /plugins/logs
 2026-07-17 10:45:11 -04:00
Jose Diaz-Gonzalez
f1f90233f6 Merge pull request #8841 from dokku/dependabot/docker/tests/apps/dockerfile-entrypoint/ruby-4.0.6 
chore(deps): bump ruby from 4.0.5 to 4.0.6 in /tests/apps/dockerfile-entrypoint
 2026-07-17 10:45:05 -04:00
Jose Diaz-Gonzalez
3402185c6f Merge pull request #8838 from dokku/chore/bump-pack-0.40.8 
chore: bump pack to 0.40.8
 2026-07-17 10:44:59 -04:00
Jose Diaz-Gonzalez
63b9a93e4e Merge pull request #8843 from dokku/dependabot/go_modules/tests/apps/gogrpc/google.golang.org/grpc-1.82.1 
chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 in /tests/apps/gogrpc
 2026-07-17 10:43:18 -04:00
Jose Diaz-Gonzalez
7f33ac8edf Merge pull request #8846 from dokku/dependabot/docker/plugins/traefik-vhosts/traefik-v3.7.8 
chore(deps): bump traefik from v3.7.7 to v3.7.8 in /plugins/traefik-vhosts
 2026-07-17 10:41:08 -04:00
dependabot[bot]
177cc81dae chore(deps): bump traefik in /plugins/traefik-vhosts 
Bumps traefik from v3.7.7 to v3.7.8.

---
updated-dependencies:
- dependency-name: traefik
  dependency-version: v3.7.8
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-16 13:54:04 +00:00
dependabot[bot]
3124fdc2b0 chore(deps): bump github.com/melbahja/goph in /plugins/common 
Bumps [github.com/melbahja/goph](https://github.com/melbahja/goph) from 1.5.1 to 1.5.2.
- [Release notes](https://github.com/melbahja/goph/releases)
- [Commits](https://github.com/melbahja/goph/compare/v1.5.1...v1.5.2)

---
updated-dependencies:
- dependency-name: github.com/melbahja/goph
  dependency-version: 1.5.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-16 13:53:44 +00:00
dependabot[bot]
22718c10d7 chore(deps): bump google.golang.org/grpc in /tests/apps/gogrpc 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.82.0 to 1.82.1.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.82.0...v1.82.1)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.82.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-16 13:52:23 +00:00
dependabot[bot]
0f54c6f26e chore(deps): bump timberio/vector in /plugins/logs 
Bumps timberio/vector from 0.56.0-debian to 0.57.0-debian.

---
updated-dependencies:
- dependency-name: timberio/vector
  dependency-version: 0.57.0-debian
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-15 13:53:35 +00:00
dependabot[bot]
90d76060fe chore(deps): bump ruby in /tests/apps/dockerfile-entrypoint 
Bumps ruby from 4.0.5 to 4.0.6.

---
updated-dependencies:
- dependency-name: ruby
  dependency-version: 4.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-15 13:52:31 +00:00
Dokku Bot
ce76bcd772 chore: bump pack to 0.40.8 2026-07-15 06:46:10 +00:00
Jose Diaz-Gonzalez
0bf2df49c2 Merge pull request #8839 from dokku/dependabot/github_actions/actions/setup-node-7 
chore(deps): bump actions/setup-node from 6 to 7
 2026-07-14 14:01:01 -04:00
dependabot[bot]
2352c09d2a chore(deps): bump actions/setup-node from 6 to 7 
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6 to 7.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/v6...v7)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-14 13:52:30 +00:00
Jose Diaz-Gonzalez
9847412990 Merge pull request #8836 from dokku/8835-herokuish-documentation-references-the-wrong-page-for-buildpack-management 
Link herokuish buildpack references to buildpack management page
 2026-07-12 21:26:28 -04:00
Jose Diaz-Gonzalez
9f8ef83a02 docs: link herokuish buildpack references to buildpack management page 
The Herokuish Buildpacks doc linked buildpack topics to anchors on the process management page that do not exist, so those links resolved to the wrong page. Point them at the corresponding sections of the buildpack management page and add that page to the sidebar so it is reachable.
 2026-07-12 21:24:38 -04:00
Jose Diaz-Gonzalez
9021ddcdca Merge pull request #8834 from dokku/chore/bump-dokku-event-listener-0.20.0 
chore: bump dokku-event-listener to 0.20.0
 2026-07-11 05:07:23 -04:00
Dokku Bot
5880ebc298 chore: bump dokku-event-listener to 0.20.0 2026-07-11 06:46:30 +00:00
Dokku Bot
0764529d23 Release 0.38.23 
# History

## 0.38.23

Install/update via the bootstrap script:

```shell
wget -NP . https://dokku.com/install/v0.38.23/bootstrap.sh
sudo DOKKU_TAG=v0.38.23 bash bootstrap.sh
```

### Bug Fixes

- #8833: @josegonzalez Parse cert CN and subject on OpenSSL 3.x

### Tests

- #8825: @dependabot[bot] chore(deps): bump golang from 1.26.4 to 1.26.5 in /tests/apps/zombies-dockerfile-no-tini
- #8823: @dependabot[bot] chore(deps): bump golang from 1.26.4 to 1.26.5 in /tests/apps/zombies-dockerfile-tini
- #8820: @dependabot[bot] chore(deps-dev): bump heroku/heroku-buildpack-php from 292 to 293 in /tests/apps/php
- #8821: @dependabot[bot] chore(deps): bump golang from 1.26.4 to 1.26.5 in /tests/apps/go-fail-predeploy
- #8822: @dependabot[bot] chore(deps): bump golang from 1.26.4 to 1.26.5 in /tests/apps/gogrpc
- #8824: @dependabot[bot] chore(deps): bump golang from 1.26.4 to 1.26.5 in /tests/apps/go-fail-postdeploy

### Dependencies

- #8831: @dependabot[bot] chore(deps): bump helm.sh/helm/v3 from 3.21.2 to 3.21.3 in /plugins/scheduler-k3s
- #8830: @dependabot[bot] chore(deps): bump github.com/fluxcd/pkg/kustomize from 1.37.0 to 1.38.0 in /plugins/scheduler-k3s
- #8826: @dependabot[bot] chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 in /plugins/common
- #8827: @dependabot[bot] chore(deps): bump github.com/cert-manager/cert-manager from 1.20.3 to 1.21.0 in /plugins/scheduler-k3s
- #8828: @dependabot[bot] chore(deps): bump traefik from v3.7.6 to v3.7.7 in /plugins/traefik-vhosts
- #8829: @dependabot[bot] chore(deps): bump github.com/go-openapi/jsonpointer from 0.24.0 to 1.0.0 in /plugins/scheduler-k3s
v0.38.23 		2026-07-10 22:48:15 +00:00
Jose Diaz-Gonzalez
e40d325996 Merge pull request #8833 from dokku/8832-cn-and-subject-parsing-broken-on-openssl-3-x-get-ssl-hostnames-reportsslhostnames-reportsslsubject 
Parse cert CN and subject on OpenSSL 3.x
 2026-07-10 17:45:02 -04:00
Jose Diaz-Gonzalez
5496029e07 fix: parse cert CN and subject on OpenSSL 3.x 
The `certs` plugin extracted a certificate's Common Name and formatted its subject using string assumptions that only held for pre-3.x OpenSSL output, so a certificate with only a Common Name and no Subject Alternative Name reported no hostnames from `certs:report` and was not recognized during nginx config generation, while the subject report retained the `subject=` prefix and used the wrong separators. Normalizing the subject with `-nameopt` before parsing makes the extraction version independent across OpenSSL and LibreSSL.
 2026-07-10 15:05:27 -04:00
Jose Diaz-Gonzalez
e47bae8f55 Merge pull request #8831 from dokku/dependabot/go_modules/plugins/scheduler-k3s/helm.sh/helm/v3-3.21.3 
chore(deps): bump helm.sh/helm/v3 from 3.21.2 to 3.21.3 in /plugins/scheduler-k3s
 2026-07-10 12:22:36 -04:00
Jose Diaz-Gonzalez
b01ec9be48 Merge pull request #8830 from dokku/dependabot/go_modules/plugins/scheduler-k3s/github.com/fluxcd/pkg/kustomize-1.38.0 
chore(deps): bump github.com/fluxcd/pkg/kustomize from 1.37.0 to 1.38.0 in /plugins/scheduler-k3s
 2026-07-10 12:22:27 -04:00
dependabot[bot]
3ca52407ed chore(deps): bump helm.sh/helm/v3 in /plugins/scheduler-k3s 
Bumps [helm.sh/helm/v3](https://github.com/helm/helm) from 3.21.2 to 3.21.3.
- [Release notes](https://github.com/helm/helm/releases)
- [Commits](https://github.com/helm/helm/compare/v3.21.2...v3.21.3)

---
updated-dependencies:
- dependency-name: helm.sh/helm/v3
  dependency-version: 3.21.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-10 13:53:59 +00:00
dependabot[bot]
2191bafd77 chore(deps): bump github.com/fluxcd/pkg/kustomize 
Bumps [github.com/fluxcd/pkg/kustomize](https://github.com/fluxcd/pkg) from 1.37.0 to 1.38.0.
- [Commits](https://github.com/fluxcd/pkg/compare/kustomize/v1.37.0...kustomize/v1.38.0)

---
updated-dependencies:
- dependency-name: github.com/fluxcd/pkg/kustomize
  dependency-version: 1.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-10 13:53:51 +00:00
Jose Diaz-Gonzalez
e79dd1b493 Merge pull request #8826 from dokku/dependabot/go_modules/plugins/common/golang.org/x/crypto-0.54.0 
chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 in /plugins/common
 2026-07-09 21:34:30 -04:00
Jose Diaz-Gonzalez
5da5f1dfe6 chore: bump go modules 2026-07-09 21:16:42 -04:00