Portainer Release Notes

Known issues

On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot

Known issues with Podman support

Podman environments aren't supported by auto-onboarding script

It's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)

Support for only CentOS 9, Podman 5 rootful

Changes

New and improved features

Added advanced Kubernetes node drain options with agent failover

Added native Portainer APIs for writing Kubernetes secrets, configmaps, deployments and persistent volume claims, replacing direct kube-apiserver proxy calls

Added a generic Kubernetes manifest dry-run API

Edge Compute settings can now be configured during initial setup and via cli flags

Authentication events now record the real client IP from X-Forwarded-For when the request comes through a trusted proxy

The namespace YAML tab now shows every resource quota in the namespace

Added GetCharts() support to the async Edge agent, so chart data syncs on agent startup

Edge agent connectivity checks now report progress while probing, and wait longer before failing

Creating a git source now skips the source type selection step

The source form now explains git polling versus webhook triggers, and exposes the polling interval setting that was missing from the UI

Removed the redundant single-tab handle from the workflow details view

Reworded the registry creation tooltip to make the default behaviour obvious

Clarified that Portainer supports Podman through its Docker-compatible API only

Security improvements

Fixed a critical Docker proxy authorization bypass. Unrecognised API version prefixes like /v1.47.0/ or /v01.47/ skipped access control entirely, letting non-admin users reach the Docker API directly

Closed a remaining gap in the CVE-2026-44849 (GHSA-5fxq-qcf3-244w) fix and broadened bind-mount restrictions for non-admin users, now including Compose and Swarm stack deployments

Single-namespace Kubernetes endpoints now check the caller’s namespace authorization instead of running as admin

Read-only and Helpdesk users can no longer view Kubernetes secret data

Standard users can no longer manage registry access

Kubernetes authorization denials now return HTTP 403 instead of 500

Fixed a Kubernetes shell authorization flaw. Caller-supplied query parameters could override the server's pod target, letting a standard user run commands in any pod on Agent-managed Kubernetes environments

Updated the Go toolchain to 1.26.6, fixing CVE-2026-39821 (Critical, 9.6), an IDNA validation bypass of hostname-based access controls, along with CVE-2026-42505, CVE-2026-39822, CVE-2026-56862, CVE-2026-56860, CVE-2026-56859, CVE-2026-56858, CVE-2026-56853, CVE-2026-46600 and CVE-2026-33818

Updated oras.land/oras-go/v2 to 2.6.2, fixing CVE-2026-50163

Updated github.com/go-git/go-git/v5 to 5.19.2, fixing CVE-2026-71556 and CVE-2026-71557

Updated go.opentelemetry.io/otel to 1.44.0, fixing CVE-2026-41178

Updated github.com/klauspost/compress to 1.18.7, fixing GHSA-259r-337f-4rfw

Upgraded libcurl to 8.21.0-r0 in the kubectl-shell image to address the following CVEs: CVE-2026-11856, CVE-2026-10536, CVE-2026-11564, CVE-2026-12064, CVE-2026-11586, CVE-2026-11352, CVE-2026-9547, CVE-2026-9546, CVE-2026-9545, CVE-2026-9080, CVE-2026-9079, CVE-2026-8932, CVE-2026-8927, CVE-2026-8926, CVE-2026-8925, CVE-2026-8924, CVE-2026-8458, and CVE-2026-8286.

Upgraded c-ares to 1.34.8-r0 in the kubectl-shell image to address CVE-2026-33630

Bug fixes

Removing a stack now uninstalls the underlying Helm release, which used to be left running

Fixed Edge stack workloads staying up after deletion on Kubernetes. The entry file and namespace are now sent on removal

Fixed collisions during Edge stack removal and reassignment. The old stack is now removed before the new one deploys

Fixed Lstat /data/edge_stacks/<id>/v1: no such file or directory on Kubernetes async agents by persisting the artifact commit hash before creating the Edge stack

Fixed Azure Blob backup settings not saving, by resolving redacted credentials on write

Fixed manual team-membership sync diverging from login-time sync by sharing a single implementation

Fixed server-managed API key metadata fields being wiped on policy update

Fixed spaces in setup policy names causing Kubernetes label errors

Fixed the Policies card on the Kubernetes dashboard not counting all applied policy types

Policy operations now return a meaningful error when the policy isn’t found, instead of a bare 404

Fixed the Edit button being disabled for a Helm chart stack deployed from GitHub

Fixed the browser title bar staying stuck on “Loading” after a page refresh

Fixed multiple error toasts appearing for a metrics time range over 31 days, and stopped the request over-retrying

Fixed alert modal validation desyncing from the input

Fixed the “Open in OneUptime” navigation using an incorrect URL

Fixed the Uninstall button being enabled in the add-on list but disabled in the detail view while an install was running

The Restart button is no longer shown for failed add-on installs

Deprecated and removed features

Deprecated features

None.

Removed features

None

Community contributions since 2.39.0 LTS

A huge thank you to all our community contributors.

This LTS release rolls up work from the 2.40 to 2.44 STS releases, including fixes and improvements contributed by these community members:

Nguyen Quang Minh (@minhng99) - corrected the OAuth scope placeholder format

Zach (@zacxihu) - relative env_file: paths now resolve against the compose file's directory, fixing Git sub-directory stacks

Rian Moraes (@rshmdev) - env var descriptions now shown as tooltips in application templates

Siddam Vinay (@siddamvinay2001) - truncated published-port lists with a show-more badge, and made early async Swarm deploy failures surface instead of reporting success

Immanuel Tikhonov (@immanuwell) - fixed a registry cache type mismatch that meant the cache never hit

@ferreiraborgesaxel-design - fixed reversed markdown link syntax in the contributing docs

Ion Jaureguialzo Sarasola (@ijaureguialzo) - fixed a Kubernetes crash on malformed web-editor manifests

Du Feilong (@dfldylan) and Jerry (@jerry-yuan) - added Docker --security-opt support and Swarm cluster self-heal after manager reap

SRIKANTH K (@srikanth-karthi) - Portainer now tolerates malformed OAuth Content-Type headers from resource endpoints

Original source

Known issues

On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot

Known issues with Podman support

Podman environments aren't supported by auto-onboarding script

It's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)

Support for only CentOS 9, Podman 5 rootful

Changes

Fixed a critical Docker proxy authorization bypass. Unrecognised API version prefixes like /v1.47.0/ or /v01.47/ skipped access control entirely, letting non-admin users reach the Docker API directly

Closed a remaining gap in the CVE-2026-44849 (GHSA-5fxq-qcf3-244w) fix and broadened bind-mount restrictions for non-admin users, now including Compose and Swarm stack deployments

Deprecated and removed features

Deprecated features

None

Removed features

None

Original source

What's Changed

• fix(addons): fail early with the incorrect storage class configuration [r8s-1214] by @testA113 in #80
• feat(settings): fetch configuration from Portainer at runtime [R8S-1227] by @stevensbkang in #81
• feat(addons): redirect on invalid license [r8s-1200] by @testA113 in #82
• feat(addons): set as last viewed in local storage [r8s-1240] by @testA113 in #85
• feat(settings): authenticate to Portainer as the add-on [R8S-1228] by @RHCowan in #84
• feat(favicon): update favicon [R8S-1243] by @nickl-portainer in #86
• fix(settings): carry the encryption key across the upgrade [R8S-1253] by @RHCowan in #87
• feat(dev): develop this add-on inside a locally-run Portainer [R8S-1167] by @RHCowan in #79
• feat(credential): report a credential broken after startup [R8S-1278] by @RHCowan in #95

Full Changelog: 1.3.0...1.3.1

Original source

Known Issues

On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot

kubectl port-forward fails with Portainer kubeconfig in some configurations

Known issues with Podman

Support for only CentOS 9, Podman 5 rootful

Auto onboarding a Podman environment defaults to “Standard” and not “Podman”

It's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)

Known issues with Talos clusters managed by Omni (BE only)

Loading Omni specific information in the Cluster Details view and configuring an existing Talos cluster is currently restricted to Portainer Admins. Environment Admins will get a forbidden error when attempting to do this. This only applies to Omni configuration, and does not affect authentication for any other functionality in the cluster

New in this release

New and improved features

Added advanced Kubernetes node drain options with agent failover

Added native Portainer APIs for writing Kubernetes secrets, configmaps, deployments and persistent volume claims, replacing direct kube-apiserver proxy calls

Added a generic Kubernetes manifest dry-run API

Edge Compute settings can now be configured during initial setup and via cli flags

Authentication events now record the real client IP from X-Forwarded-For when the request comes through a trusted proxy

The namespace YAML tab now shows every resource quota in the namespace

Added GetCharts() support to the async Edge agent, so chart data syncs on agent startup

Edge agent connectivity checks now report progress while probing, and wait longer before failing

Creating a git source now skips the source type selection step

The source form now explains git polling versus webhook triggers, and exposes the polling interval setting that was missing from the UI

Removed the redundant single-tab handle from the workflow details view

Reworded the registry creation tooltip to make the default behaviour obvious

Clarified that Portainer supports Podman through its Docker-compatible API only

Reworked the datastore, Edge polling and activity-logging hot paths to support large fleets. Simulated against 500,000 Edge devices through deployment, redeployment and steady state

Added an Edit Workflow wizard so GitOps workflows can be changed after creation

Added a Scale action for the Operator and Namespace Operator roles

Upgraded the embedded OneUptime Kubernetes agent chart to 11.7.1, which decouples node metrics collection from logs mode

Improve deployment type detection in GitOps workflows by inferring the deployment type from file content instead of relying on the filename alone

When Edge Compute isn’t configured, workflow creation now blocks with a clear path to enable it

Removed the “coming soon” placeholders from GitOps force sync and pause

Added a kill switch for hung Omni cluster provisioning requests

Updated the Omni client SDK to v1.8.2

The add-on catalog is now fetched dynamically, so new add-ons no longer require a Portainer patch release

Add-ons can now be installed from a private registry, which supports airgapped deployments

Add-on access can now be denied per team during install. The add-on list appears in team create and edit, and a notification fires when team access changes

Added a dedicated view for users with no active add-ons, so team deny rules can no longer soft-lock someone out of Portainer

Added an admin-only settings store for add-ons

Added a machine authentication token and API for the add-on store

Add-ons no longer require a local Kubernetes environment to be present

The add-on store now surfaces an invalid credential and offers a repair action

The add-on image tag can now be typed in rather than picked from the list

The last viewed add-on is now remembered across logins for multi-portal setups

Add-on list and detail views now link to the official documentation

Reworded the add-on team access toggle to make clear it applies to add-ons only

Changed the add-on icon to a puzzle piece

Security improvements

Fixed a critical Docker proxy authorization bypass. Unrecognised API version prefixes like /v1.47.0/ or /v01.47/ skipped access control entirely, letting non-admin users reach the Docker API directly

Closed a remaining gap in the CVE-2026-44849 (GHSA-5fxq-qcf3-244w) fix and broadened bind-mount restrictions for non-admin users, now including Compose and Swarm stack deployments

Single-namespace Kubernetes endpoints now check the caller’s namespace authorization instead of running as admin

Read-only and Helpdesk users can no longer view Kubernetes secret data

Standard users can no longer manage registry access

Kubernetes authorization denials now return HTTP 403 instead of 500

Fixed a Kubernetes shell authorization flaw. Caller-supplied query parameters could override the server's pod target, letting a standard user run commands in any pod on Agent-managed Kubernetes environments

Updated the Go toolchain to 1.26.6, fixing CVE-2026-39821 (Critical, 9.6), an IDNA validation bypass of hostname-based access controls, along with CVE-2026-42505, CVE-2026-39822, CVE-2026-56862, CVE-2026-56860, CVE-2026-56859, CVE-2026-56858, CVE-2026-56853, CVE-2026-46600 and CVE-2026-33818

Updated oras.land/oras-go/v2 to 2.6.2, fixing CVE-2026-50163

Updated github.com/go-git/go-git/v5 to 5.19.2, fixing CVE-2026-71556 and CVE-2026-71557

Updated go.opentelemetry.io/otel to 1.44.0, fixing CVE-2026-41178

Updated github.com/klauspost/compress to 1.18.7, fixing GHSA-259r-337f-4rfw

Restored admin-only access to the /users, /teams, and /roles list endpoints, which had regressed in 2.39.0 to allow any authenticated user to enumerate non-administrator accounts, teams and the full role catalogue. Together with the team-membership fix shipped in 2.44.0, this closes the directory-enumeration surface for non-admin users

portainer-helpdesk and portainer-cluster-operator now use namespace-scoped RoleBindings instead of ClusterRoleBindings, so namespaced resources no longer leak cross-namespace access

Removed namespace-scoped resources (endpoints, metrics.k8s.io pods and namespaces, CNPG clusters) from portainer-basic, which is bound cluster-wide. Namespaced reads now come from portainer-view, bound per assigned namespace

Namespace Operators now are only given view RoleBindings in namespaces assigned to them

Operator and Helpdesk roles no longer see system namespaces in list results

Stale namespace RoleBindings are now cleared when a team loses access

Fix the issue where Kubernetes RoleBindings remain stale after a user is removed from a team with environment access granted through an environment group

Namespace input for registry and RBAC policies is now sanitized and validated

Creating, editing, deleting and connection-testing GitOps git sources is now recorded in the user activity log

Creating and updating a policy is now recorded in the user activity log

Updated helm.sh/helm/v3 to 3.20.2, fixing CVE-2026-35206

Updated github.com/google/cel-go to 0.29.0, fixing GHSA-gcjh-h69q-9w9g

Upgraded libcurl to 8.21.0-r0 in the kubectl-shell image to address the following CVEs: CVE-2026-11856, CVE-2026-10536, CVE-2026-11564, CVE-2026-12064, CVE-2026-11586, CVE-2026-11352, CVE-2026-9547, CVE-2026-9546, CVE-2026-9545, CVE-2026-9080, CVE-2026-9079, CVE-2026-8932, CVE-2026-8927, CVE-2026-8926, CVE-2026-8925, CVE-2026-8924, CVE-2026-8458, and CVE-2026-8286.

Upgraded c-ares to 1.34.8-r0 in the kubectl-shell image to address CVE-2026-33630

Bug fixes

Fixed a deadlock when an API client updated a Kubernetes stack without supplying stackName

Fixed a data race in the Agent cluster fan-out that misrouted requests, producing duplicate and missing resources in aggregated lists

Fixed Edge Agent containers failing to start on Swarm because of a closed-channel panic

Fixed the compose-unpacker image failing to pull from an authenticated private registry

Fixed GitOps sources becoming undeletable when orphaned workflow records remained, and stopped the scheduler polling deleted stacks

Fix the issue where a user's direct environment access is incorrectly removed when a team they belong to is deleted

Aborting a request mid-flight no longer logs a panic. ErrAbortHandler is now passed through to net/http instead of being caught by the panic logger

Fixed the Kubernetes proxy breaking after a service account token rotation. Local environments now reload the admin token every 30 seconds

Fixed login hanging on the “Authentication in progress” spinner when RETURN_URL pointed at the same path

Fixed “Invalid Swarm ID” errors when managing Swarm environments

Fix the issue where a Swarm stack retains a stale error status after the underlying deployment error has been resolved

Fixed volume browsing on rootless Docker, which now falls back to the default volume path when the mountpoint isn’t reachable

Fixed kubectl port-forward failing against older Kubernetes clusters when using a Portainer kubeconfig

Fixed node shell bash detection (hostHasBash) never working for agent and Edge environments

Fixed deleted environments and Edge groups leaving stale references in workflow artifact targets

Restored the missing option to assign users to an environment group

Fixed the Docker build proxy leaving multipart upload temp files behind after every successful image build

Helm applications are now identified by annotations as well as labels, so deployments deployed using helm dry-run manifests aren’t falsely identified as helm applications

The Applications list no longer shows unreachable ClusterIP addresses under Published URLs

Fixed volume sizes displaying and saving incorrectly by converting properly between base-2 and base-10 units

Updated internal and external documentation links that were redirecting to deprecated pages

Fixed the node drain status label being user-editable and undeleteable

Original source

What's Changed

Feature

Introduced a Prometheus-compatible metrics endpoint #176

Enable with --metrics-server; serves /metrics with control plane health gauges on 127.0.0.1:9105 (configurable via --metrics-bind-address)

Added support for attaching to a host-managed container runtime (containerd or CRI-O) #181

Set --container-runtime-endpoint (e.g. unix:///run/crio/crio.sock) to skip the embedded containerd; the host then supplies the runtime, OCI runtime, CNI plugin binaries and sandbox image

Added CPU manager support for latency-sensitive workloads #183

New --cpu-manager-policy, --cpu-manager-policy-options, --system-reserved and --reserved-cpus flags

For more details, refer to this docs

Auto-detect the network MTU, with an override via --mtu #179

Picks up reduced MTUs on VPN/tunnel/PPPoE links and applies them to the CNI bridge (cni0) and pod veth interfaces

For more details, refer to this docs

Portainer Edge Agent now tracks the lts tag, and the image is configurable via --portainer-edge-image #177

Any image other than the default is pulled from the registry rather than loaded from the embedded image

Fixes

Fixed an issue where the EXTERNAL-IP was not set when an existing service was changed to type LoadBalancer #178

Also added --load-balancer-ip to publish services on an address other than the node IP

Fixed kubesoloctl writing the kubeconfig to the wrong user's home directory #185

Ownership is now resolved only from an explicit sudo/doas escalation; in a plain root shell (e.g. after sudo su -) the kubeconfig goes to root's home rather than being attributed to the original login user

Fixed external-dependency builds embedding artifacts they do not use #184

Chore

Updated KubeSolo to track Kubernetes v1.35.7 and Kine v0.16.3 #180

Dropped the :latest container image tag and split CI publishing to be fork-safe #174

Images must now be pulled by an explicit version tag

Bumped google.golang.org/grpc 1.80.0 -> 1.82.1 #175

Bumped github.com/google/cel-go 0.26.0 -> 0.29.0 #182

New Contributors

@c92s made their first contribution in #184

Full Changelog: v1.1.9...v1.2.0

Original source

Known issues

On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot

Known issues with Podman support

Podman environments aren't supported by auto-onboarding script

It's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)

Support for only CentOS 9, Podman 5 rootful

Changes

Security improvements

Implemented an SSRF protection mechanism with a configurable allow-list in settings (off / audit / enforce modes)

Changed a default setting to enforce server-side EdgeID on first connection

Fixed path traversal in the swarm compose deployer, where configs/secrets file paths escaped the project root

Upgraded the Go toolchain from 1.25.11 to 1.25.12 to address the following CVEs:

CVE-2026-42505

CVE-2026-39822

Upgraded github.com/go-git/go-git/v5 to 5.19.2 to address the following CVEs:

CVE-2026-71556

CVE-2026-71557

Upgraded oras.land/oras-go/v2 to 2.6.2 to address CVE-2026-50163

Upgraded go.opentelemetry.io/otel to 1.44.0 to address CVE-2026-41178

Upgraded github.com/klauspost/compress to 1.18.7 to address GHSA-259r-337f-4rfw

Upgraded golang.org/x/net to 0.56.0 and golang.org/x/text to 0.39.0 in the Portainer updater to address the following CVEs:

CVE-2026-46600

CVE-2026-56852

Upgraded github.com/containerd/containerd (v1) to 1.7.33 to address the following CVEs:

CVE-2026-53488

CVE-2026-47262

Upgraded google.golang.org/grpc to 1.82.1 to address GHSA-hrxh-6v49-42gf

Bug fixes

Fixed a user's direct environment access being incorrectly removed when a team they belonged to was deleted

Fixed multiple "Cannot read properties of undefined (reading 'message')" error toasts appearing on Kubernetes application pages when an API call failed without a response (e.g. while pods are restarting after a redeploy)

Fixed an "Invalid Swarm ID" / 503 error when creating a stack from a Swarm worker node

Fixed Kubernetes Ingress service ports always showing 0

Fixed kubectl port-forward failing with "error upgrading connection" against Agent 2.35+ on older Kubernetes clusters

Fixed "This node is not a swarm manager" errors when starting/stopping a Swarm stack from within the swarm itself

Fixed Docker image builds failing with unauthorized against private registries referenced in a Dockerfile's FROM line (both the UI's "Build a new image" flow and the /docker/build API proxy)

Fixed Swarm stack deployments failing to re-pull private Docker Hub images on a forced re-pull, even with valid registry credentials configured

Fixed request-handler panics being logged as unexpected crashes when a client disconnected mid-request (e.g. a long-poll on a Kubernetes Jobs watch)

Deprecated and removed features

Deprecated features

None.

Removed features

None

Original source

Release v1.34.3

Bug Fixes

• portainer_stack: active = false now persists on repository stacks (#139) -
  the update path stopped the stack before the git redeploy, which restarted it,
  so active = false never took effect (perpetual true -> false diff). The stop
  now runs after the redeploy.

• portainer_environment: type = 4 creates a Docker Edge Agent, not Kubernetes
  (#140) - an Edge Agent create now sends ContainerEngine=docker, so Portainer
  provisions the requested Docker edge (type 4) instead of a Kubernetes edge (type 7).

Original source

Known issues

On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot

Known issues with Podman support

Podman environments aren't supported by auto-onboarding script

It's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)

Support for only CentOS 9, Podman 5 rootful

Changes

New and improved features

Added a basic workflow details screen

Added GPU visibility in the Environment Details view

Made the Portainer setup token easier to spot in the installation logs

Tracked the Source, Workflow, and Artifact status persistently

Upgraded bbolt to v1.5.0 for performance and robustness improvements

Moved the build pipeline to BuildKit v0.31.2 (previously v0.27.0); image build provenance attestations moved to the SLSA v1.0 format (previously v0.2) — any tooling that parses attestations needed to be verified against the new format

Security improvements

Fixed unauthorized access via leftover service accounts

Fixed path traversal in the swarm compose deployer, where configs/secrets file paths escaped the project root

CVE remediation:

Upgraded oras.land/oras-go/v2 to 2.6.1 to remediate CVEs

Upgraded containerd to 1.7.33 / v2 2.2.5 to remediate CVEs

Upgraded google.golang.org/grpc to 1.82.1 to remediate GHSA-hrxh-6v49-42gf

Upgraded axios to 1.18.0 to remediate CVEs

Upgraded shell-quote to 1.8.4 to remediate CVEs

Bug fixes

Fixed the "This node is not a swarm manager" error message when running inside a swarm

Fixed image builds failing to authenticate against private registries in FROM lines by allowing the X-Registry-Config header through the proxy

Fixed a team with valid access not appearing in Config access control while another team with identical access was visible

Fixed AD/LDAP settings defects where special characters were stripped, the username format selection was invisible, the root domain was unpopulated, and the delete button was broken

Fixed an issue where [object Object] appeared as an element name on the Alerting page

Fixed a problem that caused sources to fail to load

Brought back shared Git credentials for GitOps Sources

Fixed an issue where a space-delimited list of scopes wasn't correctly requesting access to resources on the user's behalf, so the Google consent screen didn't show the expected permissions

Fixed the poll frequency selection dropdown staying on the default value

Fixed RBAC policy's datatable namespace input

Fixed the forced polling usage in Git sources

Fixed Helm chart uninstall showing cosmetic errors only

Fixed the tooltip rendering for environment variables in Portainer Application Templates

Fixed the Ingress service port number being displayed as 0 instead of the configured value

Fixed Kubernetes manifest deployments reporting success but silently failing when "Use namespace from manifest" was disabled

Fixed an output mismatch in the Kubectl shell between BE and CE

Fixed an issue where logout caused an infinite page reload

Fixed a missing source in the list until refresh

Fixed non-admin redeploy failing when numeric environment variables were quoted in a stack (invalid containerPort)

Fixed Portainer STS 2.42.0 showing "1 Agent needs upgrading" when none did

Fixed Docker stack deployments that exceeded the 15-minute timeout remaining stuck in the "Deploying" state and blocking further redeployments

Fixed RBAC policies not creating RoleBindings for grants with no namespace list (e.g. Operator, Helpdesk)

Fixed re-assigning an edge group to an edge stack bringing back old state

Fixed a regression where relative env_file: in Git sub-directory stacks resolved from the project root instead of the compose file's directory

Removed the hint box from the Applications page

Fixed Swarm stack and service deployments reporting success despite image pull failures caused by insufficient disk space

Fixed the issue where a standard user couldn't deploy a Git stack against an admin-created Source

Improved edge tunnel resiliency over high-latency/lossy network links

Fixed Swarm edge stacks with edge configs failing to deploy

Fixed Swarm image deletion inconsistencies

Fixed Swarm stack deployments failing to re-pull private Docker Hub images despite valid registry credentials

Improved the containers list to show only the first three published ports inline, collapsing the rest into a "+N more" badge, so containers with many ports no longer broke the table layout

Fixed a v2.43.0 migration related to stacks and sources

Fixed incorrect WebSocket handler error messages

Fixed dark mode styling issues on the Workflows page

Fixed the way ListRefs ignored request context, causing "context deadline exceeded" on large repos

Fixed SSRF protection ignoring Dialer timeouts

Deprecated and removed features

Deprecated features

None.

Removed features

None.

Original source

What's Changed

• feat(theme): load theme from portainer [R8S-1172] by @nickl-portainer in #61
• refactor(server): read the gateway-stamped Authorization header first by @RHCowan in #59
• feat(addons): use shortDescription in app switcher [R8S-1180] by @stevensbkang in #65
• feat(addons): use enabled filtering for user access [r8s-1191] by @testA113 in #64
• fix(theme): default highcontrast theme to dark [R8S-1190] by @nickl-portainer in #66
• fix(ui): deploy upload picker, nav cmd+click links, app breadcrumbs by @nathanpeck in #68
• fix(chart): base64-encode secret values so cleared keys are pruned [R8S-1188] by @stevensbkang in #67

Full Changelog: 1.2.9...1.2.10

Original source