Coolify 4.5.0 Encrypts Stored Secrets and Breaks Three Things Self-Hosters May Rely On
Software / news
Coolify 4.5.0 Encrypts Stored Secrets and Breaks Three Things Self-Hosters May Rely On
The self-hosted PaaS shipped 4.5.0 on Oct. 23, two days after a security release for PHP2Shell. The changelog buries the API and Compose changes under about 100 items.
Coolify, the open-source self-hosted alternative to Heroku and Vercel, released v4.5.0 on Oct. 23. The release encrypts plaintext secrets at rest, adds beta automatic server patching, and carries three changes that can break an existing setup.
The release page lists about 100 items with pull request numbers. Most readers will scroll past the three that matter, so they come first here.
The three breaking changes in Coolify 4.5.0
The notes list them under breaking changes. Anyone who scripts deployments against the Coolify API should read them before pressing update.
- API tokens now need the
deployability for several actions. - The endpoint
POST /api/v1/enablewas removed. - Compose files with
scaleorreplicasabove one are rejected.
The third is the one most likely to surprise someone. A Compose file that ran two replicas on 4.4.7 will be rejected on 4.5.0, and the release page does not say what to use instead.
A fourth change is not labelled breaking but alters behaviour. Environment variable values now reach containers exactly as entered, while existing variables keep the old escaping (pull request #12024, which closes issue #7635). Old and new variables with identical text can therefore be escaped differently.
Secrets encryption and the new reencrypt command
The security section says "Plaintext secrets are now encrypted at rest." It gives no detail on the mechanism, so how strong the scheme is cannot be judged from the release page.
What the notes do say is operational. A new command, app-key:reencrypt, is needed after rotating APP_KEY. Anyone who rotates that key should run it as part of the same change.
Server patching, MCP tools and the rest
The headline feature is beta server patching: automatic security updates per server, warnings for reboots and risky packages, and patch status in the server list. The notes do not describe how it works beyond that.
Coolify also gained MCP tools for managing resources (pull request #12163, closing issues #11281 and #11881). The MCP endpoint now enforces allowed IPs, and API token creation for MCP works even with the REST API disabled.
Other additions are Gitea app sources, passkey sign-in, a fleet Metrics page, a file browser, Cloudflare tunnel setup and a Coolify database backup before each update. The release thanks three first-time contributors: @johandenhollander, @anakafeel and @praetoros.
What shipped in the three weeks before
The 4.5.0 update lands after a run of patch releases that self-hosters on older lines may have missed.
| Version | Date | What it did |
|---|---|---|
| v4.5.0 | Oct. 23 | Secrets encryption, server patching, three breaking changes |
| v4.4.7 | Oct. 21 | Security release: PHP 8.4.27, Node.js 24.22.1, cloudflared 2026.10.3, Sentinel 1.1.2 |
| v4.4.6 | Oct. 9 | Pinned PHP base image to fix startup failures |
| v4.4.5 | Oct. 9 | Removed the 5 GB free disk requirement that blocked updates |
The v4.4.7 notes tell users to "update immediately." They name CVE-2026-109618 and CVE-2026-109619, the PHP2Shell flaws, and CVE-2026-111943 for Sentinel. Our report on the third PHP flaw covers the PHP side, and PHP's own changelog lists 8.4.27, though the portion fetched did not show the CVE identifiers.
Coolify disabled its PHP service templates for the two CVEs before re-enabling them with patched images, according to the 4.5.0 notes. The cloudflared bump is tied in the notes to the eMudhra certificate compromise, which our eMudhra report covers.
Who has to do what
Installs on stable v4.0 through v4.3 got backports: v4.3.24, v4.2.1, v4.1.3 and v4.0.1 on Oct. 21. Beta or older v4 installs must first install v4.0.1 by hand, then upgrade to v4.4.7. The notes recommend moving to 4.4.7 anyway, because it carries security fixes that were not backported.
Updates run from Settings, then Update, in the dashboard.
Sources
More in Software
- 01Respan Rewrites Its LiteLLM-Based AI Gateway in Rust, With Every Feature a PluginThe Y Combinator company says a 100,000-line wrapper pushed it off LiteLLM. Its own benchmark table is vendor-supplied, and the launch thread left cost accounting unanswered.
- 02Corgi and JetBrains' ThinkRail Both Want to Be Where You Run Coding Agents. One Is a Multiplexer, One an IDE.Corgi (MIT, 141 stars) wraps Claude Code and Codex in a terminal; ThinkRail (Apache-2.0, 1.2k stars) builds an IDE around the pi agent. What each README says and leaves out.
- 03Astral Adds uv check, and ty Will Read PEP 723 Script MetadataThe integration is experimental, and environment setup for scripts is opt-in because installing dependencies can run third-party code.
- 04TornadoVM 7.3 Drops JNI for Java's FFM API and Ships Three Releases in Nine DaysInfoQ's write-up of the Java GPU framework gives no benchmark figures, while the project's own pages supply speedups of 6x, 99x and 117 tokens a second.