github/dokku
0
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
14,032 Commits 2 Branches 347 Tags
dc802ddd192da2484d5ac53fcae214cbd660732e
Commit Graph

14032 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Jose Diaz-Gonzalez
dc802ddd19 feat: support per-app letsencrypt emails on k3s 
The `letsencrypt-email-prod` and `letsencrypt-email-stag` properties can now be set per app in addition to globally, resolving app-level before the global value for the app's selected `letsencrypt-server`. An app that sets its own email renders a namespaced cert-manager `Issuer` using that email, while apps without an override continue to use the shared `ClusterIssuer` with the global email.
 2026-07-19 03:31:55 -04:00
Jose Diaz-Gonzalez
05ce8fb68e Merge pull request #8848 from dokku/host-command-execution-via-eval-of-unsanitized-docker-options-in-dockerargs 
Prevent command injection via docker options eval
 2026-07-19 02:42:39 -04:00
Jose Diaz-Gonzalez
1a376c3622 fix: prevent command injection via docker options eval 
Values supplied through docker options, `--ttl-seconds`, and `-e` flowed into a Bash `eval` during build, deploy, and run, letting a low-privileged user execute arbitrary commands on the host as the dokku user. These arguments are now tokenized and passed through to the container verbatim, without shell expansion. A one-time migration repairs stored labels whose backticks were saved with a stray backslash so Traefik-style rules stay valid on the next deploy.
 2026-07-19 01:42:12 -04:00
Dokku Bot
730fa85d03 Release 0.38.24 
# History

## 0.38.24

Install/update via the bootstrap script:

```shell
wget -NP . https://dokku.com/install/v0.38.24/bootstrap.sh
sudo DOKKU_TAG=v0.38.24 bash bootstrap.sh
```

### Documentation

- #8836: @josegonzalez Link herokuish buildpack references to buildpack management page

### Tests

- #8841: @dependabot[bot] chore(deps): bump ruby from 4.0.5 to 4.0.6 in /tests/apps/dockerfile-entrypoint
- #8843: @dependabot[bot] chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 in /tests/apps/gogrpc

### Dependencies

- #8845: @dependabot[bot] chore(deps): bump github.com/mattn/go-isatty from 0.0.22 to 0.0.23 in /plugins/app-json
- #8844: @dependabot[bot] chore(deps): bump github.com/melbahja/goph from 1.5.1 to 1.5.2 in /plugins/common
- #8842: @dependabot[bot] chore(deps): bump timberio/vector from 0.56.0-debian to 0.57.0-debian in /plugins/logs
- #8838: @dokku-bot chore: bump pack to 0.40.8
- #8846: @dependabot[bot] chore(deps): bump traefik from v3.7.7 to v3.7.8 in /plugins/traefik-vhosts
- #8839: @dependabot[bot] chore(deps): bump actions/setup-node from 6 to 7
- #8834: @dokku-bot chore: bump dokku-event-listener to 0.20.0
v0.38.24 		2026-07-18 01:39:15 +00:00
Jose Diaz-Gonzalez
2950292309 Merge pull request #8845 from dokku/dependabot/go_modules/plugins/app-json/github.com/mattn/go-isatty-0.0.23 
chore(deps): bump github.com/mattn/go-isatty from 0.0.22 to 0.0.23 in /plugins/app-json
 2026-07-17 21:34:41 -04:00
dependabot[bot]
fb5a1e12e6 chore(deps): bump github.com/mattn/go-isatty in /plugins/app-json 
Bumps [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty) from 0.0.22 to 0.0.23.
- [Commits](https://github.com/mattn/go-isatty/compare/v0.0.22...v0.0.23)

---
updated-dependencies:
- dependency-name: github.com/mattn/go-isatty
  dependency-version: 0.0.23
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-17 21:33:26 -04:00
Jose Diaz-Gonzalez
e3ad4b3bcc Merge pull request #8844 from dokku/dependabot/go_modules/plugins/common/github.com/melbahja/goph-1.5.2 
chore(deps): bump github.com/melbahja/goph from 1.5.1 to 1.5.2 in /plugins/common
 2026-07-17 21:32:08 -04:00
Jose Diaz-Gonzalez
debb1b8f27 chore: bump go modules 2026-07-17 21:21:55 -04:00
Jose Diaz-Gonzalez
7c7af5767a Merge pull request #8842 from dokku/dependabot/docker/plugins/logs/timberio/vector-0.57.0-debian 
chore(deps): bump timberio/vector from 0.56.0-debian to 0.57.0-debian in /plugins/logs
 2026-07-17 10:45:11 -04:00
Jose Diaz-Gonzalez
f1f90233f6 Merge pull request #8841 from dokku/dependabot/docker/tests/apps/dockerfile-entrypoint/ruby-4.0.6 
chore(deps): bump ruby from 4.0.5 to 4.0.6 in /tests/apps/dockerfile-entrypoint
 2026-07-17 10:45:05 -04:00
Jose Diaz-Gonzalez
3402185c6f Merge pull request #8838 from dokku/chore/bump-pack-0.40.8 
chore: bump pack to 0.40.8
 2026-07-17 10:44:59 -04:00
Jose Diaz-Gonzalez
63b9a93e4e Merge pull request #8843 from dokku/dependabot/go_modules/tests/apps/gogrpc/google.golang.org/grpc-1.82.1 
chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 in /tests/apps/gogrpc
 2026-07-17 10:43:18 -04:00
Jose Diaz-Gonzalez
7f33ac8edf Merge pull request #8846 from dokku/dependabot/docker/plugins/traefik-vhosts/traefik-v3.7.8 
chore(deps): bump traefik from v3.7.7 to v3.7.8 in /plugins/traefik-vhosts
 2026-07-17 10:41:08 -04:00
dependabot[bot]
177cc81dae chore(deps): bump traefik in /plugins/traefik-vhosts 
Bumps traefik from v3.7.7 to v3.7.8.

---
updated-dependencies:
- dependency-name: traefik
  dependency-version: v3.7.8
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-16 13:54:04 +00:00
dependabot[bot]
3124fdc2b0 chore(deps): bump github.com/melbahja/goph in /plugins/common 
Bumps [github.com/melbahja/goph](https://github.com/melbahja/goph) from 1.5.1 to 1.5.2.
- [Release notes](https://github.com/melbahja/goph/releases)
- [Commits](https://github.com/melbahja/goph/compare/v1.5.1...v1.5.2)

---
updated-dependencies:
- dependency-name: github.com/melbahja/goph
  dependency-version: 1.5.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-16 13:53:44 +00:00
dependabot[bot]
22718c10d7 chore(deps): bump google.golang.org/grpc in /tests/apps/gogrpc 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.82.0 to 1.82.1.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.82.0...v1.82.1)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.82.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-16 13:52:23 +00:00
dependabot[bot]
0f54c6f26e chore(deps): bump timberio/vector in /plugins/logs 
Bumps timberio/vector from 0.56.0-debian to 0.57.0-debian.

---
updated-dependencies:
- dependency-name: timberio/vector
  dependency-version: 0.57.0-debian
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-15 13:53:35 +00:00
dependabot[bot]
90d76060fe chore(deps): bump ruby in /tests/apps/dockerfile-entrypoint 
Bumps ruby from 4.0.5 to 4.0.6.

---
updated-dependencies:
- dependency-name: ruby
  dependency-version: 4.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-15 13:52:31 +00:00
Dokku Bot
ce76bcd772 chore: bump pack to 0.40.8 2026-07-15 06:46:10 +00:00
Jose Diaz-Gonzalez
0bf2df49c2 Merge pull request #8839 from dokku/dependabot/github_actions/actions/setup-node-7 
chore(deps): bump actions/setup-node from 6 to 7
 2026-07-14 14:01:01 -04:00
dependabot[bot]
2352c09d2a chore(deps): bump actions/setup-node from 6 to 7 
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6 to 7.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/v6...v7)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-14 13:52:30 +00:00
Jose Diaz-Gonzalez
9847412990 Merge pull request #8836 from dokku/8835-herokuish-documentation-references-the-wrong-page-for-buildpack-management 
Link herokuish buildpack references to buildpack management page
 2026-07-12 21:26:28 -04:00
Jose Diaz-Gonzalez
9f8ef83a02 docs: link herokuish buildpack references to buildpack management page 
The Herokuish Buildpacks doc linked buildpack topics to anchors on the process management page that do not exist, so those links resolved to the wrong page. Point them at the corresponding sections of the buildpack management page and add that page to the sidebar so it is reachable.
 2026-07-12 21:24:38 -04:00
Jose Diaz-Gonzalez
9021ddcdca Merge pull request #8834 from dokku/chore/bump-dokku-event-listener-0.20.0 
chore: bump dokku-event-listener to 0.20.0
 2026-07-11 05:07:23 -04:00
Dokku Bot
5880ebc298 chore: bump dokku-event-listener to 0.20.0 2026-07-11 06:46:30 +00:00
Dokku Bot
0764529d23 Release 0.38.23 
# History

## 0.38.23

Install/update via the bootstrap script:

```shell
wget -NP . https://dokku.com/install/v0.38.23/bootstrap.sh
sudo DOKKU_TAG=v0.38.23 bash bootstrap.sh
```

### Bug Fixes

- #8833: @josegonzalez Parse cert CN and subject on OpenSSL 3.x

### Tests

- #8825: @dependabot[bot] chore(deps): bump golang from 1.26.4 to 1.26.5 in /tests/apps/zombies-dockerfile-no-tini
- #8823: @dependabot[bot] chore(deps): bump golang from 1.26.4 to 1.26.5 in /tests/apps/zombies-dockerfile-tini
- #8820: @dependabot[bot] chore(deps-dev): bump heroku/heroku-buildpack-php from 292 to 293 in /tests/apps/php
- #8821: @dependabot[bot] chore(deps): bump golang from 1.26.4 to 1.26.5 in /tests/apps/go-fail-predeploy
- #8822: @dependabot[bot] chore(deps): bump golang from 1.26.4 to 1.26.5 in /tests/apps/gogrpc
- #8824: @dependabot[bot] chore(deps): bump golang from 1.26.4 to 1.26.5 in /tests/apps/go-fail-postdeploy

### Dependencies

- #8831: @dependabot[bot] chore(deps): bump helm.sh/helm/v3 from 3.21.2 to 3.21.3 in /plugins/scheduler-k3s
- #8830: @dependabot[bot] chore(deps): bump github.com/fluxcd/pkg/kustomize from 1.37.0 to 1.38.0 in /plugins/scheduler-k3s
- #8826: @dependabot[bot] chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 in /plugins/common
- #8827: @dependabot[bot] chore(deps): bump github.com/cert-manager/cert-manager from 1.20.3 to 1.21.0 in /plugins/scheduler-k3s
- #8828: @dependabot[bot] chore(deps): bump traefik from v3.7.6 to v3.7.7 in /plugins/traefik-vhosts
- #8829: @dependabot[bot] chore(deps): bump github.com/go-openapi/jsonpointer from 0.24.0 to 1.0.0 in /plugins/scheduler-k3s
v0.38.23 		2026-07-10 22:48:15 +00:00
Jose Diaz-Gonzalez
e40d325996 Merge pull request #8833 from dokku/8832-cn-and-subject-parsing-broken-on-openssl-3-x-get-ssl-hostnames-reportsslhostnames-reportsslsubject 
Parse cert CN and subject on OpenSSL 3.x
 2026-07-10 17:45:02 -04:00
Jose Diaz-Gonzalez
5496029e07 fix: parse cert CN and subject on OpenSSL 3.x 
The `certs` plugin extracted a certificate's Common Name and formatted its subject using string assumptions that only held for pre-3.x OpenSSL output, so a certificate with only a Common Name and no Subject Alternative Name reported no hostnames from `certs:report` and was not recognized during nginx config generation, while the subject report retained the `subject=` prefix and used the wrong separators. Normalizing the subject with `-nameopt` before parsing makes the extraction version independent across OpenSSL and LibreSSL.
 2026-07-10 15:05:27 -04:00
Jose Diaz-Gonzalez
e47bae8f55 Merge pull request #8831 from dokku/dependabot/go_modules/plugins/scheduler-k3s/helm.sh/helm/v3-3.21.3 
chore(deps): bump helm.sh/helm/v3 from 3.21.2 to 3.21.3 in /plugins/scheduler-k3s
 2026-07-10 12:22:36 -04:00
Jose Diaz-Gonzalez
b01ec9be48 Merge pull request #8830 from dokku/dependabot/go_modules/plugins/scheduler-k3s/github.com/fluxcd/pkg/kustomize-1.38.0 
chore(deps): bump github.com/fluxcd/pkg/kustomize from 1.37.0 to 1.38.0 in /plugins/scheduler-k3s
 2026-07-10 12:22:27 -04:00
dependabot[bot]
3ca52407ed chore(deps): bump helm.sh/helm/v3 in /plugins/scheduler-k3s 
Bumps [helm.sh/helm/v3](https://github.com/helm/helm) from 3.21.2 to 3.21.3.
- [Release notes](https://github.com/helm/helm/releases)
- [Commits](https://github.com/helm/helm/compare/v3.21.2...v3.21.3)

---
updated-dependencies:
- dependency-name: helm.sh/helm/v3
  dependency-version: 3.21.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-10 13:53:59 +00:00
dependabot[bot]
2191bafd77 chore(deps): bump github.com/fluxcd/pkg/kustomize 
Bumps [github.com/fluxcd/pkg/kustomize](https://github.com/fluxcd/pkg) from 1.37.0 to 1.38.0.
- [Commits](https://github.com/fluxcd/pkg/compare/kustomize/v1.37.0...kustomize/v1.38.0)

---
updated-dependencies:
- dependency-name: github.com/fluxcd/pkg/kustomize
  dependency-version: 1.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-10 13:53:51 +00:00
Jose Diaz-Gonzalez
e79dd1b493 Merge pull request #8826 from dokku/dependabot/go_modules/plugins/common/golang.org/x/crypto-0.54.0 
chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 in /plugins/common
 2026-07-09 21:34:30 -04:00
Jose Diaz-Gonzalez
5da5f1dfe6 chore: bump go modules 2026-07-09 21:16:42 -04:00
dependabot[bot]
26914b2fc0 chore(deps): bump golang.org/x/crypto in /plugins/common 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.53.0 to 0.54.0.
- [Commits](https://github.com/golang/crypto/compare/v0.53.0...v0.54.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-09 21:16:29 -04:00
Jose Diaz-Gonzalez
7bd866efee Merge pull request #8825 from dokku/dependabot/docker/tests/apps/zombies-dockerfile-no-tini/golang-1.26.5 
chore(deps): bump golang from 1.26.4 to 1.26.5 in /tests/apps/zombies-dockerfile-no-tini
 2026-07-09 21:14:44 -04:00
Jose Diaz-Gonzalez
4205871cec Merge pull request #8823 from dokku/dependabot/docker/tests/apps/zombies-dockerfile-tini/golang-1.26.5 
chore(deps): bump golang from 1.26.4 to 1.26.5 in /tests/apps/zombies-dockerfile-tini
 2026-07-09 21:14:36 -04:00
Jose Diaz-Gonzalez
16ba93f9e2 Merge pull request #8820 from dokku/dependabot/composer/tests/apps/php/heroku/heroku-buildpack-php-293 
chore(deps-dev): bump heroku/heroku-buildpack-php from 292 to 293 in /tests/apps/php
 2026-07-09 21:14:26 -04:00
Jose Diaz-Gonzalez
e2781c0553 Merge pull request #8821 from dokku/dependabot/docker/tests/apps/go-fail-predeploy/golang-1.26.5 
chore(deps): bump golang from 1.26.4 to 1.26.5 in /tests/apps/go-fail-predeploy
 2026-07-09 21:14:17 -04:00
Jose Diaz-Gonzalez
91025ee23e Merge pull request #8822 from dokku/dependabot/docker/tests/apps/gogrpc/golang-1.26.5 
chore(deps): bump golang from 1.26.4 to 1.26.5 in /tests/apps/gogrpc
 2026-07-09 21:14:04 -04:00
Jose Diaz-Gonzalez
06a79b3f5c Merge pull request #8824 from dokku/dependabot/docker/tests/apps/go-fail-postdeploy/golang-1.26.5 
chore(deps): bump golang from 1.26.4 to 1.26.5 in /tests/apps/go-fail-postdeploy
 2026-07-09 21:13:53 -04:00
Jose Diaz-Gonzalez
71ce14feca Merge pull request #8827 from dokku/dependabot/go_modules/plugins/scheduler-k3s/github.com/cert-manager/cert-manager-1.21.0 
chore(deps): bump github.com/cert-manager/cert-manager from 1.20.3 to 1.21.0 in /plugins/scheduler-k3s
 2026-07-09 21:13:34 -04:00
Jose Diaz-Gonzalez
8986a27318 Merge pull request #8828 from dokku/dependabot/docker/plugins/traefik-vhosts/traefik-v3.7.7 
chore(deps): bump traefik from v3.7.6 to v3.7.7 in /plugins/traefik-vhosts
 2026-07-09 21:13:23 -04:00
Jose Diaz-Gonzalez
78977e3402 Merge pull request #8829 from dokku/dependabot/go_modules/plugins/scheduler-k3s/github.com/go-openapi/jsonpointer-1.0.0 
chore(deps): bump github.com/go-openapi/jsonpointer from 0.24.0 to 1.0.0 in /plugins/scheduler-k3s
 2026-07-09 21:13:16 -04:00
dependabot[bot]
7eaaaa7ac2 chore(deps): bump github.com/go-openapi/jsonpointer 
Bumps [github.com/go-openapi/jsonpointer](https://github.com/go-openapi/jsonpointer) from 0.24.0 to 1.0.0.
- [Release notes](https://github.com/go-openapi/jsonpointer/releases)
- [Commits](https://github.com/go-openapi/jsonpointer/compare/v0.24.0...v1.0.0)

---
updated-dependencies:
- dependency-name: github.com/go-openapi/jsonpointer
  dependency-version: 1.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-09 13:55:04 +00:00
dependabot[bot]
04486f18ca chore(deps): bump traefik in /plugins/traefik-vhosts 
Bumps traefik from v3.7.6 to v3.7.7.

---
updated-dependencies:
- dependency-name: traefik
  dependency-version: v3.7.7
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-09 13:55:00 +00:00
dependabot[bot]
19c167ca1f chore(deps): bump github.com/cert-manager/cert-manager 
Bumps [github.com/cert-manager/cert-manager](https://github.com/cert-manager/cert-manager) from 1.20.3 to 1.21.0.
- [Release notes](https://github.com/cert-manager/cert-manager/releases)
- [Changelog](https://github.com/cert-manager/cert-manager/blob/master/RELEASE.md)
- [Commits](https://github.com/cert-manager/cert-manager/compare/v1.20.3...v1.21.0)

---
updated-dependencies:
- dependency-name: github.com/cert-manager/cert-manager
  dependency-version: 1.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-09 13:54:58 +00:00
dependabot[bot]
5ff86ec977 chore(deps): bump golang in /tests/apps/zombies-dockerfile-no-tini 
Bumps golang from 1.26.4 to 1.26.5.

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.26.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-09 13:53:12 +00:00
dependabot[bot]
7e05d6cca4 chore(deps): bump golang in /tests/apps/go-fail-postdeploy 
Bumps golang from 1.26.4 to 1.26.5.

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.26.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-09 13:53:05 +00:00
dependabot[bot]
58f509ed0c chore(deps): bump golang in /tests/apps/zombies-dockerfile-tini 
Bumps golang from 1.26.4 to 1.26.5.

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.26.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-09 13:52:57 +00:00