[Bl4ckBl1zZ]

What is this PR about?

This PR integrates Dokploy upstream canary through 53464e909 (2026-10-16). The fork last synced at 931f5c133 in #41, so the range is 931f5c133..53464e909: 30 commits across 7 upstream PRs.

Upstream changes:

• Security:
  • Traefik file path traversal fix (fix(settings): confine Traefik file read/write to the Traefik config directory Dokploy/dokploy#5070).
  • Dependabot high-severity dependency bumps (Dependabots alerts fixes Dokploy/dokploy#5517, chore(deps): fix high-severity Dependabot alerts in emails lockfile Dokploy/dokploy#5684): Next 16.3.4 → 16.3.8, nodemailer 6 → 10, esbuild 0.20 → 0.25, ws 8.21, toml 4, adm-zip 0.6, lodash 4.18.1, drizzle-orm 0.45.2 and inngest 3.54. There are also about 20 new transitive pnpm.overrides (hono, axios, sharp, uuid, postcss, …).
• Logs & Metrics (feat(logs-and-metrics): ship container logs and metrics to external providers via Vector Dokploy/dokploy#5624, new): org-level telemetry providers (Loki, Datadog, Better Stack, Elasticsearch, Splunk HEC, AWS CloudWatch, Prometheus remote-write, New Relic, InfluxDB). Containers on each server ship logs and metrics through two new Swarm services, dokploy-vector (timberio/vector:0.58.0-alpine) and dokploy-cadvisor (ghcr.io/google/cadvisor:v0.60.6). The page is Settings → Logs & Metrics, guarded by the new telemetryProvider permission.
• AI permissions (feat(permissions): add AI module to enterprise custom roles Dokploy/dokploy#5489): the AI router moves from adminProcedure/protectedProcedure to a new ai permission resource, which can be granted through custom roles. There is a new withAnyPermission procedure helper.
• Fixes:
  • Members without server.read get a minimal server list for pickers (fix(server): let members list servers in server pickers Dokploy/dokploy#5613).
  • Template card tags no longer overflow (fix(templates): cap visible tags so the Create button stays visible Dokploy/dokploy#5661).
  • remote-stream.test.ts gets 30s timeouts, and the source stdout gets an error handler. This did not fix the underlying hang; see the fork fix below.

Integration review

I resolved 7 conflicts by hand:

• Imports where both sides added something:
  • root.ts and db/schema/index.ts keep the fork's Tailscale router/schema and add upstream's telemetry provider.
  • services/server.ts combines the drizzle helpers both sides use (isNull from the fork, desc and isNotNull from upstream).
  • routers/server.ts keeps the fork's getWebServerSettings import next to upstream's hasPermission.
• Removed license gating:
  • The upstream hasValidLicense imports in routers/organization.ts and routers/server.ts are dropped. Nothing in the merged code calls the function.
  • enterprise-only-resources.test.ts stays deleted; upstream had modified it.
  • In access-control.ts, the "Enterprise-only" comment block stays removed. Upstream's ai entry in enterpriseOnlyResources is kept: in the fork that set only lets owner/admin skip role resolution, with no license check, so ai works on every install.
  • A grep for hasValidLicense, isEnterpriseCloud and licenseKey in non-test code finds nothing. packages/server/src/lib/auth-cli.ts still lists enableEnterpriseFeatures/isValidEnterpriseLicense as better-auth CLI schema fields, but those lines were already on main and this merge doesn't touch them.
• GHCR / monitoring: the two new Swarm service images are third-party, so the fork's GHCR image policy does not apply to them. The fork's ghcr.io/bl4ckbl1zz/dokploy-monitoring images are unchanged.
• Unchanged areas: the range does not touch the Cloudflare and Tailscale integrations, Halifax CI, the GHCR publish/release workflows, self-update or versioning. The app version stays 0.43.0.

CLAUDE.md is updated:

• Product Overview: the Logs & Metrics feature and the AI permission are added.
• Settings sidebar list: "Logs & Metrics" is added.
• Tool versions: Next 16.3.8, Drizzle 0.45.2, nodemailer 10, esbuild 0.25, ws 8.21.

Fork fix: pipeBetweenServers hang

The first hosted test run failed remote-stream.test.ts > pipeBetweenServers > reports a target failure with its stderr by timing out at 30s. That 30s timeout is upstream's new, longer one, so this was a hang rather than slowness.

Root cause: when the target process exits before the source has finished writing, its stdin returns EPIPE. pipe() then unpipes and pauses the source's stdout, so the source's EOF is never consumed. The child's close event never fires, and from.exit, and with it the whole transfer, never resolves.

A standalone reproduction of the local-process path hung in 4 of 20 runs. With the fix it hung in 0 of 60, across the original case plus delayed and large-payload variants.

The fix is commit 5a8f5ce0f, one line in packages/server/src/utils/process/remoteStream.ts: to.stdin.on("unpipe", () => from.stdout.resume()). It applies to SSH channels as well as local processes. In production, a service transfer whose target command fails, for example a full disk or a bad path, would otherwise hang forever instead of reporting the error. This fix should go upstream.

Behavior change for members

The AI endpoints members used to reach (analyzeLogs, suggest, deploy, getEnabledProviders, getModels) now require ai permissions, and memberRole gets ai: []. Members lose the AI log analysis and compose suggestions until an owner grants ai.read through a custom role. Owners and admins are unaffected. This is upstream's intent, and it is consistent with the fork, since custom roles have no license gate.

Migrations, dependencies, environment

• Migrations: upstream's 0197_logs_and_metrics collided with the fork's chain, which ends at 0183. I dropped it, restored the fork's _journal.json, and generated 0184_sloppy_solo.sql. Its DDL is identical, statement for statement, to upstream's 0197:

  • the TelemetryProviderType enum
  • the telemetryProvider table, with an FK to organization (cascade on delete)
  • server.telemetryProviderIds and webServerSettings.telemetryProviderIds, both text[] defaulting to {}
  • webServerSettings.vectorAgentOrganizationId, with an FK set to null on delete

  It is additive only, and the second generation run reported no drift.

• Dependencies: the merged lockfile passes pnpm install --frozen-lockfile as-is. The only package.json changes are upstream's bumps (listed above) plus @aws-sdk/client-cloudwatch and @aws-sdk/client-cloudwatch-logs. @types/nodemailer, @types/adm-zip and @types/shell-quote were removed upstream.

• Environment: no new variables.

• OpenAPI: regenerated, 640 → 650 endpoints.

Verification (local)

• pnpm install --frozen-lockfile: pass, using the auto-merged lockfile with no regeneration
• Migration generation twice: pass. 0184 matches upstream 0197, and the second run reported no drift.
• generate:openapi: pass (650 endpoints)
• pnpm run format-and-lint: pass (0 errors)
• Typecheck for packages/server, apps/dokploy, apps/api and apps/schedules: pass. This ran as pnpm run typecheck --checkers 2. With the default checker count, TypeScript 7 thrashed on this 8 GB machine and never finished.
• Vitest: 1341 passed, 11 skipped, 4 failed. The 4 are application.real.test.ts REAL deployment tests. They need docker build / nixpacks build, and this machine has neither binary. These are infra-only failures, the same as in chore(sync): integrate Dokploy canary through 5df820a #38–chore(sync): integrate Dokploy canary through 931f5c1 #41; the hosted test job runs them.
• remote-stream.test.ts, with the fix below: 5/5 runs pass.
• Production build with an ephemeral BETTER_AUTH_SECRET (never printed or stored): pass, including the esbuild 0.25 server bundle.
• Migration 0184 was not applied to a live Postgres; none is available on this machine.

Hosted checks

On 5a8f5ce0f, pr-check (build), pr-check (test) and pr-check (typecheck) all pass. The hosted test job also runs the real Docker deployment tests that can't run locally.

The first run, on 539c6b556 before the fork fix, failed only the remote-stream hang described above. It was fixed rather than re-run.

Risk / rollout / rollback

Risk is medium. The range contains a large dependency bump (including a major nodemailer version and the esbuild that builds the server bundle), a new feature that deploys Swarm services, the AI permission change for members, and a one-line fork fix in the service-transfer pipe. Its only behavior change is that the transfer no longer hangs when the target exits non-zero.

• Rollout:

  1. Back up the database and deploy.
  2. Confirm that migration 0184 applied.
  3. Send a test email from Notifications to exercise nodemailer 10 over SMTP.
  4. If members use AI log analysis, grant ai.read through a custom role.

  Logs & Metrics does nothing until a provider is configured. When one is, it deploys dokploy-vector/dokploy-cadvisor and needs a Swarm manager.

• Rollback: roll back the application image. Migration 0184 is additive, and the previous image ignores the new table and columns, so there is no need to reverse it.

Checklist

• You created a dedicated branch based on the canary branch. (This branch is based on the fork's main and integrates upstream canary.)
• You have read the suggestions in the CONTRIBUTING.md file https://github.com/Dokploy/dokploy/blob/canary/CONTRIBUTING.md#pull-request
• You have tested this PR in your local instance. (Automated checks and a production build ran locally; no live Dokploy instance was changed.)

Issues related (if applicable)

Not applicable for this upstream integration PR.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: a546c40e-68a0-4b30-9f52-962f5c125415

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}