Changelog
Every release across the platform, API and dashboard — features, fixes and improvements as they ship.
NEXT_PUBLIC_ABUSE_CONTACT_EMAIL (default [email protected]), defined once in lib/contact.ts. Some mail hosts reserve abuse@, so it can now be any address you can receive. Keep it equal to the backend's ABUSE_CONTACT_EMAIL (backend beta.102). It is read at build time, so rebuild after changing it./acceptable-use (English, approved 2026-10-10): - §1: what is prohibited everywhere; - §2: what is additionally prohibited on managed servers, shared infrastructure and *.pushify.dev addresses (§2.1 proxy/VPN/tunnel/relay services, §2.2 network and port scanning). Legal use on your own server with your own domain is not affected; - §3: how it is enforced: no traffic contents or environment values are read, and a person reviews every case before suspension; - §4–6: reporting, appeals and changes. The section numbers match the clauses cited in suspension emails./abuse: a form (URL, email, category, details; honeypot) that feeds the admin review queue (backend beta.101), plus [email protected].ABUSE_DETECTION_ENABLED / ABUSE_AUTO_SUSPEND, both off by default.*.db.test.ts) share one database, and the deletion purge sweeps every organization that is due, so another file's rows sometimes showed up in its counts and it failed at random. vitest.workspace.ts now runs those files one at a time; unit tests still run in parallel. npm run test -- --run (CI) picks this up unchanged.eslint src, 0 errors): - unused imports removed from sso.service.ts; - the resolver filter in runner-isolation.ts now sends the intended ^127\. to the shell. Same effect for IPv4 nameservers.resolveProjectServerId / pickRunnerServerId). - Side effects of the zeros, now gone: auto-sleep could judge such a project idle however busy it was, autoscale saw 0 % CPU, and Acceptable Use egress fell back to nginx bytes only.resolveDeployServerForCleanup searched only the customer organization's servers, and the runner belongs to Pushify, so nothing was found. Pause then fell back to the control plane's local Docker, stopped nothing and still reported success. It now resolves a project without a server to the runner the deploy used (pickRunnerServerId). Pause checks that none of the project's containers is still running and reports false otherwise. In production, a project with no server found is reported as not stopped instead of "paused". A suspension now shows the real result ("containers could not be reached") in the admin panel.npm run abuse:scan -- --enqueue now exits when it is done. The operator emails it queues opened a Redis connection that kept the process running; the flags had already been written.ABUSE_CONTACT_EMAIL, as the suspension email already did. Some mail hosts reserve abuse@; set the variable to the address you can receive (and the frontend's NEXT_PUBLIC_ABUSE_CONTACT_EMAIL to the same).ABUSE_DETECTION_ENABLED=true, so self-hosted installs carry none of it. Applies to projects on managed servers, on shared runners, or reachable on the platform subdomain; a project on its own server with only its own domains is not covered. Needs migration 0071 (abuse_flags, abuse_actions, projects.suspended_*, two activity_action values; additive). - Deploy-time scan. After the clone, the source is checked against config/abuse-rules.yaml; after a successful build, the build log is too. Image deploys are matched by their image reference. The rules cover proxy/VPN/tunnel software (Xray, V2Ray, sing-box, Trojan, Shadowsocks, Hysteria, MTProxy, GOST, Tor relays), known proxy panels, share-link and inbound-config patterns, open proxies and network/SNI scanners. The result is a score with reasons. One strong signal, or two different medium ones, is needed to flag; weak signals (WebSockets, the word "proxy") never flag on their own. Environment files, keys and lockfiles are never read, and reasons record only the rule, file and line — not the matched text. Nothing is written to the customer's deploy log, and a scan can never fail a deploy. - Runtime signals every 5 minutes: 24-hour egress (container counters and nginx bytes sent), the relay pattern (in ≈ out at high volume) and sustained long-lived connections (ss counts per container — counts only). Each is a medium signal. - Review queue for platform admins: GET /admin/abuse/flags, dismiss, suspend (reason, policy clause, optional duration) and unsuspend. Findings are queued and admins are emailed (abuse.flagged). Nothing is stopped automatically unless ABUSE_AUTO_SUSPEND=true (default off), and then only on a strong, high-scoring deploy scan. - Suspension reuses the pause: containers stop, the project is marked suspended, and its owner can neither resume, deploy nor wake it. Visitors see a neutral "This app is suspended" page. The owner is emailed the reason, the policy section, the duration and the appeal address (ABUSE_CONTACT_EMAIL, default [email protected]). Every decision is written to abuse_actions and the activity log. - Abuse reports: POST /api/v1/abuse/reports (rate-limited, honeypot) for the new /abuse page. Reports are matched to a project by host and land in the same queue. - npm run abuse:scan -- --dry-run (read-only): scans every live project with the same rules and prints what would be flagged. It clones each repository at the deployed commit into a temporary directory, scans the latest build log, and writes nothing. --enqueue instead puts flagged covered projects into the review queue (no suspension), so projects that were live before this release can be reviewed.compose_path) ran docker compose down before up -d --build, so a broken build: step left no container and nginx answered 502 until the next good deploy — the one path the blue-green "old container stays live" guarantee did not cover. Images are now pulled and built (compose build) while the previous stack keeps serving; only a successful build stops it, and up no longer rebuilds. A build failure is reported as Docker build failed (classified as a build error, not a crash).awake before it builds. When the build failed, no new container existed and the previous one was still stopped by the sweeper, yet the project read awake, so the wake endpoint answered a permanent 502 and nothing ever started the container again. A failed deploy of an app that was asleep now puts it back to sleeping and wakes it, so the previous container serves again. If it cannot start, it stays sleeping and the next visit tries again.NANO (1 vCPU / 1 GB), which backend beta.99 offers on every paid plan when Hetzner has no cheaper 2 GB server in stock. Sizes under 1.5 GB carry a note that they come with 2 GB of swap and that large builds can be slow. The Servers doc describes it. Pricing tables already read live sizes, so Hobby's "server, included" line shows 1 vCPU / 1 GB when nano is the cheapest option.node_modules as a symlink to a developer's local path. Checking it out tries to replace the real node_modules directory, so the Jenkins checkout failed with cannot unlink 'node_modules/…': Permission denied. The symlink is removed, and .gitignore now ignores node_modules whether it is a directory or a link.nano size for when Hetzner has no cheap 2 GB+ server in stock (cx23 sold out). It is open on every paid plan, from Hobby up, and sits inside Hobby's included monthly credit. When an xs server is in stock for the same price or less, nano is not listed, because xs is then the better buy. Needs migration 0067 (server_size enum gains nano; additive)./datacenters API (announced 2026-06-02, now answering 410 API functionality was removed). Stock was read from it, so GET /servers/providers/hetzner/sizes, /regions, the server quote and create flow and GET /public/managed-server-prices all failed. Stock now comes from each server type's locations[].available in /server_types.datacenter; the region and coordinates now come from the top-level location. Sync, status and the server list read servers through this path.X-Pushify-Signature is, and a Node.js (Express) example that checks it against the raw body in constant time. Matches backend 0.2.0-beta.95, which now signs the exact body it sends.content/docs/*.md and rendered on the server. - Each page has a sidebar, an "on this page" list and previous/next links. - Every page was checked against the code on 2026-09-30./docs#<section> links forward there. - /docs/quickstart, /docs/deploy and /docs/preview redirect to their new pages. - The temporary redirects that sent /docs/servers, /docs/cli and others to anchors or to npm are gone.isSecret defaults to false, not true; the scope list adds projects:delete and metrics:read./confirm-deletion, which starts the deletion and shows its date. For an account deletion, it also signs this browser out. Needs backend 0.2.0-beta.89.pushify-<slug>-blue), so replicas (-blue-2, -blue-3, …) kept running and serving traffic while the project showed as sleeping. It now matches every replica of either slot, leaving workers, previews and the database sidecar alone. Wake used to count as done as soon as one container was running. It now starts all of them and succeeds only when none is left stopped, retrying within the 30 s window.src/lib/project-limits.ts): 10 cron jobs per project (timeout 10–600 s, default 120), 5 volumes, 5 workers. A pushify.yaml over these limits is reported as invalid in the deploy log and ignored, like any other invalid file.npm run limits:over (read-only): lists projects that already hold more cron jobs, volumes or workers than the limits, and cron jobs whose timeout is outside 10–600 s. Nothing is changed.X-Pushify-Signature was computed over the event payload, but the request body wraps it ({ event, timestamp, data }), so a receiver checking the signature against the body it received always failed. The signature is now sha256= + HMAC-SHA256 of the exact request body, keyed with the channel's secret. Receivers that worked around the old behaviour by re-serialising `data` must switch to the raw body. A Node.js verification example is in the docs (Monitoring & alerts)..env from pushify env pull sent ab****yz for every secret and replaced the real value; an unchanged mask now leaves the variable as it is (action: "unchanged"). isSecret is only changed when the request sets it, and the response reports the stored value instead of false.npm run env:masked-values (read-only) lists variables whose stored value looks like a mask — the ones this may have hit — by project and key, never the values.lib/org-access.ts: viewer < member < admin < owner). Owners and admins only: - database credentials and backup downloads; - buying and transferring domains and taking their transfer code; - server power; - invoices and wallet history; - the activity log. Member and up: - deploying, rolling back, cancelling and promoting; - scheduled tasks (which run commands in the container); - creating, pausing and resuming projects; - notifications, health checks, volumes and the site editor. Viewers see environment variable names only.logs:read, metrics:read included).0065_stopped_servers adds servers.stopped_at and stop_warning_step.0064_retention_indexes adds created_at indexes on activity_logs and deployments.202 { confirmationSent: true }. - The link goes through POST /auth/deletion/confirm, which checks everything again (still the owner, nothing already scheduled)..old/<name>-*. Until now only the container was removed.