Merge remote-tracking branch 'origin/next' into unreachable-server-backoff

Author: andrasbacsai

.github/workflows/pr-quality.yaml

@@ -40,7 +40,10 @@ jobs:
           max-emoji-count: 2
           max-code-references: 5
           require-linked-issue: false
-          blocked-terms: "STRAWBERRY"
+          blocked-terms:  |
+            STRAWBERRY
+            🤖 Generated with Claude Code
+            Generated with Claude Code
           blocked-issue-numbers: 8154
 
           # PR Template Checks
@@ -97,7 +100,7 @@ jobs:
           exempt-pr-milestones: ""
 
           # PR Success Actions
-          success-add-pr-labels: "quality/verified"
+          success-add-pr-labels: ""
 
           # PR Failure Actions
           failure-remove-pr-labels: ""

CHANGELOG.md

@@ -43,7 +43,7 @@ npm run build                   # production build
 - **Models/** — Eloquent models extending `BaseModel` which provides auto-CUID2 UUID generation. Key models: `Server`, `Application`, `Service`, `Project`, `Environment`, `Team`, plus standalone database models (`StandalonePostgresql`, `StandaloneMysql`, etc.). Common traits: `HasConfiguration`, `HasMetrics`, `HasSafeStringAttribute`, `ClearsGlobalSearchCache`.
 - **Services/** — Business logic services (ConfigurationGenerator, DockerImageParser, ContainerStatusAggregator, HetznerService, etc.). Use Services for complex orchestration; use Actions for single-purpose domain operations.
 - **Helpers/** — Global helpers loaded via `bootstrap/includeHelpers.php` from `bootstrap/helpers/` — organized into `shared.php`, `constants.php`, `versions.php`, `subscriptions.php`, `domains.php`, `docker.php`, `services.php`, `github.php`, `proxy.php`, `notifications.php`.
-- **Data/** — Spatie Laravel Data DTOs (e.g., `CoolifyTaskArgs`, `ServerMetadata`).
+- **Data/** — Spatie Laravel Data DTOs (e.g., `ServerMetadata`).
 - **Enums/** — PHP enums (TitleCase keys). Key enums: `ProcessStatus`, `Role` (MEMBER/ADMIN/OWNER with rank comparison), `BuildPackTypes`, `ProxyTypes`, `ContainerStatusTypes`.
 - **Rules/** — Custom validation rules (`ValidGitRepositoryUrl`, `ValidServerIp`, `ValidHostname`, `DockerImageFormat`, etc.).
 

CLAUDE.md

@@ -37,12 +37,13 @@ public function create(array $input): User
         if (User::count() == 0) {
             // If this is the first user, make them the root user
             // Team is already created in the database/seeders/ProductionSeeder.php
-            $user = User::create([
+            $user = (new User)->forceFill([
                 'id' => 0,
                 'name' => $input['name'],
                 'email' => $input['email'],
                 'password' => Hash::make($input['password']),
             ]);
+            $user->save();
             $team = $user->teams()->first();
 
             // Disable registration after first user is created

app/Actions/CoolifyTask/PrepareCoolifyTask.php

@@ -21,7 +21,7 @@ public function reset(User $user, array $input): void
             'password' => ['required', Password::defaults(), 'confirmed'],
         ])->validate();
 
-        $user->forceFill([
+        $user->fill([
             'password' => Hash::make($input['password']),
         ])->save();
         $user->deleteAllSessions();

app/Actions/Fortify/CreateNewUser.php

@@ -24,7 +24,7 @@ public function update(User $user, array $input): void
             'current_password.current_password' => __('The provided password does not match your current password.'),
         ])->validateWithBag('updatePassword');
 
-        $user->forceFill([
+        $user->fill([
             'password' => Hash::make($input['password']),
         ])->save();
     }

app/Actions/Fortify/ResetUserPassword.php

@@ -35,7 +35,7 @@ public function update(User $user, array $input): void
         ) {
             $this->updateVerifiedUser($user, $input);
         } else {
-            $user->forceFill([
+            $user->fill([
                 'name' => $input['name'],
                 'email' => $input['email'],
             ])->save();
@@ -49,7 +49,7 @@ public function update(User $user, array $input): void
      */
     protected function updateVerifiedUser(User $user, array $input): void
     {
-        $user->forceFill([
+        $user->fill([
             'name' => $input['name'],
             'email' => $input['email'],
             'email_verified_at' => null,

app/Actions/Fortify/UpdateUserPassword.php

@@ -30,7 +30,8 @@ public function handle(Server $server)
         ]);
         ['uptime' => $this->uptime, 'error' => $error] = $server->validateConnection();
         if (! $this->uptime) {
-            $this->error = 'Server is not reachable. Please validate your configuration and connection.<br>Check this <a target="_blank" class="text-black underline dark:text-white" href="https://coolify.io/docs/knowledge-base/server/openssh">documentation</a> for further help. <br><br><div class="text-error">Error: '.$error.'</div>';
+            $sanitizedError = htmlspecialchars($error ?? '', ENT_QUOTES, 'UTF-8');
+            $this->error = 'Server is not reachable. Please validate your configuration and connection.<br>Check this <a target="_blank" class="text-black underline dark:text-white" href="https://coolify.io/docs/knowledge-base/server/openssh">documentation</a> for further help. <br><br><div class="text-error">Error: '.$sanitizedError.'</div>';
             $server->update([
                 'validation_logs' => $this->error,
             ]);

app/Actions/Fortify/UpdateUserProfileInformation.php

@@ -33,7 +33,7 @@ public function handle(Service $service, bool $deleteVolumes, bool $deleteConnec
                     }
                 }
                 foreach ($storagesToDelete as $storage) {
-                    $commands[] = "docker volume rm -f $storage->name";
+                    $commands[] = 'docker volume rm -f '.escapeshellarg($storage->name);
                 }
 
                 // Execute volume deletion first, this must be done first otherwise volumes will not be deleted.