v1.15.0

What's Changed

• fix: Removed backticks from migration script to fix issues with MariaDB connection type. by @Sanic5238 in #5688
• Update docker compose command to v2 by @smashyalts in #5250

New Contributors

• @Sanic5238 made their first contribution in #5688
• @smashyalts made their first contribution in #5250

Full Changelog: v1.14.1...v1.15.0

v1.14.1

Full Changelog: v1.14.0...v1.14.1

v1.14.0

Full Changelog: v1.13.0...v1.14.0

v1.13.0

What's Changed

• fix/apikey-overflow by @MagicDevM in #5563
• ​Fix: Admin API mobile layout & bulk button states by @NyxObscura in #5614
• Update Laravel validation doc links to 11.x by @voidvalue-dev in #5575
• Handle server maintenance status in ServerRow by @voidvalue-dev in #5525

New Contributors

• @MagicDevM made their first contribution in #5563
• @NyxObscura made their first contribution in #5614

Full Changelog: v1.12.4...v1.13.0

v1.12.4

What's Changed

• wait for lock properly by @robertdrakedennis in #5638

Full Changelog: v1.12.3...v1.12.4

v1.12.3

Fixed

• Adds a rate limit when changing email addresses on an account to prevent account enumeration.
• Fixes backups, databases, and allocation creation to properly acquire a lock before checking if users can create more resources on a server.

Changed

• Added Java 25 as an option to the default Minecraft eggs.
• Updates Paper install script and adds support for Java 25 to default egg.
• JWTs now require at least one JwtScope enum value to be set when generating. Failure to provide a scope will result in an exception being raised.

v1.12.2

Fixed

• Fixes task execution jobs to correctly dispatch the next job in the chain.
• Fixes dropdown menu not appearing correctly inside modal when transferring a server.
• Fixes startup variables logging as changed in the activity log even when no change was actually made.
• Fixes multiple issues with the docker image.
• Fixes server transfers getting stuck due to incorrect permission checks in the API.

v1.12.1

Fixed

• CVE-2026-26016
• GHSA-hr7j-63v7-vj7g
• Fixes bug where presigned URLs would fail to generate if the environment variable was parsed as a string and not an integer.
• Fixes issue where certain input values would cause the activity log screen to stop rendering properly due to improper element encoding.
• Fixes improper display of unicode characters in console output.
• Fixes page number not resetting when toggling between "Show My Servers" and "Show All Servers" on the dashboard.

Changed

• SFTP sessions are now revoked on nodes when a user changes their password or their account is deleted.
• Remote node access tokens are now scoped to only allow access to servers that belong to the same node. Previously a node could access information and control the installation status for any server in the system.
• The default rate limit for the client API was bumped from 128 to 256 requests per minute.

Added

• HTTP responses now include default security headers if not otherwise set.
• Adds modal popup when running a Hytale server that requires additional auth.
• Adds support for administrators to view any application API key that has been created, regardless of the owning account.

v1.12.0

Fixed

• CVE-2025-68954
• CVE-2025-69197
• CVE-2025-69198
• Fixes a self-XSS issue when entering random data into boxes while creating a new database host.
• Fixes missing HttpForbiddenException import in the backup status controller.
• Fixes issue where scheduled tasks would execute every minute regardless of their configured cron syntax.
• Pressing Ctrl+Z to undo while editing a file no longer deletes the initial file content.
• Fixed incorrect error message being returned when attempting to delete your own account as an admin.
• Fixes node description not being settable via the API.
• Fixes 0-bytes files returning an error when attempting to upload.
• Fixes nodes displaying the first available location even when that field was not edited and the node has a different value set.
• Fixes allocation notes not being reset when a server is deleted. (#5157)

Changed

• Minimum NodeJS version updated to 22 for building.
• Updated all JS and PHP dependencies to their latest versions (where feasible).
• The endpoint for disabling 2FA on an account using the client API changed from DELETE /api/client/account/two-factor to POST /api/client/account/two-factor/disable
• ^C in an egg's stop configuration no longer rewrites itself into the default stop configuration.
• IBM Plex Sans font is now bundled with the local assets instead of loading from Google CDNs.
• Upload size on nodes is no longer restricted to a max of 1024MB, any positive integer value can be used.
• Administrators are now listed first when viewing a list of all users on the system.
• Websocket no longer endlessly polls when connection issues are encountered, or when Wings disconnects the user for a reason that should not be re-attempted.

v1.11.11

Fixed

• Fixed CVE-2025-49132

SHA256 Checksum

157e0e46cd639a031e9b4dd046c6e655c276382fb73785afe3194300ed3cfd07  panel.tar.gz