Changelog
What changed in each release
The Xudbin Panel changelog. Every item is based on a change on GitHub.
-
- SecurityThe medium and low findings of the independent security review are fixed: SSRF filtering for addresses entered by members, secrets only for users with write access, server details only for admins, GitHub App tokens only for approved repositories, upload limits, per-account login limits, 2FA and SSO hardening; unexpected errors are only detailed in the log.
- SecurityThe host root is no longer mounted into the panel container and its privileges are dropped; pull request previews no longer receive production environment variables; the Cloudflare Tunnel token is passed as a file; the panel image base is pinned by digest.
- SecurityDatabase and volume backups are stored encrypted by default.
- NewWAF on the panel address too (default: detect only) and the real client IP in logs; automatic bans only count WAF and panel login events, IP lists accept CIDR.
- NewLogging in over SSH shows the panel address (or the setup link if setup is not finished).
- NewThe panel can also be opened at https://<ip>:8443 using the server IP (self-signed certificate).
- FixThe push webhook no longer starts a deploy on the ping sent when the webhook is added or on events other than push.
- FixIf the Caddy configuration fails to load, the previous configuration is restored.
-
- SecurityInstall and update only from release tags; the panel and Caddy images are not installed unless their signatures verify, otherwise the update stops and the old version keeps running. On panels updated from 1.3.0 this protection applies from the next update.
- SecurityPermission and isolation fixes for project roles, Compose files, writing to repository files and stored git tokens (the critical and high findings of an independent security review).
- FixSecurity claims in the docs now match what the code actually does.
- NewTurkish and English user guide; a demo build of the interface with sample data.
-
- NewSidebar reorganized: Deployments, Databases, Templates, Monitoring, Backups, Scheduled jobs, Git sources, SSH keys.
- NewClearer image scans: "what to do" steps, base image vs. app split, per-package results.
- NewGitHub App: warning for local/private addresses, missing-response checks and guiding hints.
- FixGitHub App creation failed: the CSP header blocked form submission to github.com.
-
- FixServer commands can reach systemd: in-panel updates and the security score work again.
-
- FixDatabase migrations are safe when several processes start at once.
- FixPHP/Laravel: disabled the base image's false "unhealthy" health check.
-
- NewLoad balancing across servers and a separate build server.
- NewGitHub App integration and pull request preview environments.
- NewSingle sign-on (SSO) with OpenID Connect.
- NewYour own wildcard domain, DNS checks and Cloudflare Tunnel.
- NewScheduled jobs, background workers and multiple replicas.
- New14 one-click app templates.
- NewPersistent volume backups.
- NewLive log filtering and history search (last hour to 14 days).
- NewIn-panel updates, time zone and monitoring settings.
- Newxb command-line tool, signed images and release notifications.
- NewPer-project roles, audit log and API tokens.
- NewTraffic analytics and downtime alerts (including email).
-
- NewFirst releases: one-command install, framework-aware deploys, databases, attack protection, light/dark theme.
- NewDeploy Doctor: post-deploy HTTP check, error diagnosis and one-click fixes.
- NewBackups: S3/R2/B2 remote storage, encrypted panel backup and restore testing.
- NewAlmaLinux/Rocky/RHEL support, English interface.
- SecurityCompose host-access permission, symlink/path traversal protection, Docker ports bound to the firewall.