All notable changes to Runtipi for ASUSTOR are documented here.
🚨 Critical security patch - Update strongly recommended
| Type |
Description |
| 🔒 Security |
Fix unauthenticated path traversal and potential RCE vulnerability (GHSA-mwg8-x997-cqw6) |
| 🔧 Hardening |
All code paths using user-provided values are now properly sanitized |
| Area |
Description |
| 🐳 Docker |
Update Runtipi image v4.7.1 → v4.7.2 |
🚨 Critical security patch - Update strongly recommended
| Type |
Description |
| 🔒 Security |
Fix authenticated RCE vulnerability via backup filenames (GHSA-vrgf-rcj5-6gv9) |
| ✨ Feature |
Native docker-compose.yml support with x-runtipi meta tags for custom apps |
| ✨ Feature |
View docker-compose and app.env files in new "Files" tab |
| ✨ Feature |
"Force Pull" option to force Docker image download |
| 🐛 Fix |
Fix UDP ports regression in generated compose files |
| Area |
Description |
| 🐳 Traefik |
Update v3.6.1 → v3.6.7 (CVE-2025-66490, CVE-2025-66491, CVE-2026-22045) |
| 🔄 ENV Mapping |
Fix listenIp → INTERNAL_IP (was incorrectly mapped to SERVER_ADDR) |
| ➕ Variable |
Add MAX_BACKUPS support to limit backup retention |
📦 Package revision - Runtipi version unchanged (v4.6.5)
| Fix |
Description |
| 🔄 Sync Workflow |
Fixed authentication and push issues in sync-upstream workflow |
| 🛠️ Build Path |
Fixed artifact path issue in sync-upstream workflow |
| 🏪 Custom Store |
Fixed custom store hook execution in start-stop script |
📦 Package revision - Runtipi version unchanged (v4.6.5)
| Feature |
Description |
| 🖥️ Compatible Models |
Added compatibility table for ASUSTOR NAS models in README |
| 📝 tipi-compose.yml |
Auto-created during install for correct Traefik volume mounts |
| 🔄 Sync tipi-compose.yml |
User config file now synced between AppCentral and RunTipi paths |
| Area |
Description |
| 🐳 Docker |
Minimum version lowered to 28.0.0 (was 28.1.1) |
| 🔨 Build System |
Changelog now manually maintained (no longer auto-generated) |
| Issue |
Description |
| 🔧 Traefik Volumes |
Fixed Traefik config path mounting via tipi-compose.yml |
| Issue |
Workaround |
memory-advice |
Temporarily removed from config.json due to ASUSTOR App Central bug (#91706) |
- Update traefik to v3.6.1. This fixes an upstream issue that was preventing the use of latest Docker v29
./runtipi-cli update v4.6.5
This is the first public release on GitHub!
| Feature |
Description |
| 💾 Auto Backup |
Automatic pre-upgrade backup before package updates |
| 🌐 Cloudflare DNS |
Setup script (scripts/cloudflare-setup.sh) |
| 📦 Enhanced Backup |
--full, --destination, --max-backups options |
| 🔄 Enhanced Restore |
--list, --dry-run, --file options |
| 🏗️ ARM64 Support |
For AS33xx, AS11xx, AS67xx series |
| ⚙️ Environment Variables |
RUNTIPI_BACKUP_PATH and RUNTIPI_MAX_BACKUPS |
| 🔗 CLI Symlink |
Symbolic link for runtipi-cli in /usr/local/bin |
| 🤖 GitHub Actions |
CI/CD workflows for automation |
| 🔨 Build System |
Cross-platform APK builder (build.py v1.5.0) |
| 🧪 Dev Builds |
Dev build mode with auto-increment counter |
| Area |
Description |
| 📊 Logging |
Separate log files - package.log for package, cli.log for CLI |
| 🎨 Emoji Logging |
Unified emoji logging across all scripts |
| 📋 CLI Output |
Parsed for clean logging |
| 📝 Changelog |
Auto-generated from GitHub releases + package notes |
| 🐚 POSIX |
POSIX/sh compatibility for all scripts (ADM 5.x BusyBox) |
| 🔍 Port Detection |
Port conflict detection before service start |
| 🔐 Security |
Sensitive variables masking in logs |
| 📚 Documentation |
Comprehensive README with upgrade guide and Cloudflare setup |
| Issue |
Description |
| 📄 Line Endings |
CRLF line endings in shell scripts (build validation) |
| 🖼️ Icon Size |
Icon size validation (90x90 per ASUSTOR spec) |
| 📁 Paths |
CONTROL_DIR paths in start-stop.sh |