sync: upstream v0.30.6

[AminDhouib]

Syncs the fork to upstream release tag v0.30.6 (121 upstream commits since v0.30.5). Version set to v0.30.6-community.1.

Merge commit, never a rebase, per docs/UPSTREAM_SYNC.md. Do not merge this yet — merge, release and deploy are the maintainer's call.

Summary

Headline upstream features in this release:

• Infomaniak and OVH DNS providers (DnsProviderType += infomaniak, ovh)
• AWS Parameter Store vault provider (VaultProviderType += aws-parameter-store)
• Infisical secret-reference expansion + folder paths
• Whitelabeling security fixes — </style> tag XSS breakout scrub (including </style/> and whitespace variants), SVG sanitising on upload — plus OG metadata (ogImageUrl, absolute fallback OG image for social scrapers)
• Organization logo drag-and-drop upload with resize-to-WebP, and org-name truncation polish in the sidebar
• SSO enforcement on the server-side sign-in endpoints: blocks password, social and passkey sign-in and email signup when enforceSSO is on; SSO account-linking trust
• DNS upsert content-matching fixes
• Domain validation now includes the server's interface addresses (not just its public IP), and resolves both A and AAAA records
• Server-health address-pool detection now reads docker info over the socket instead of /etc/docker/daemon.json (which isn't mounted into the container)
• nanoid bump; trial 14 → 7 days (cloud-only, no effect self-hosted)

Also notable: v0.30.6 (8c9e473b4) reverts the v0.30.5 default Docker build-context break. getDockerContextPath returns null again when unset and builders/docker-file.ts restores the fallback to the Dockerfile's own directory. That break only ever shipped in v0.30.5-community.1. Users who set dockerContextPath explicitly to work around it are unaffected — an explicit context is still honoured — and do not need to revert their config.

Conflicts and resolutions (16 files)

File	Resolution
.claude/skills/fix-issue/SKILL.md	modify/delete → kept deleted. The fork removes upstream's .claude skill files on purpose. Verified .claude/settings.json was not resurrected either.
drizzle/meta/0191..0195_snapshot.json (add/add ×5)	ours. See Migrations below.
apps/dokploy/package.json	version → v0.30.6-community.1. Kept the fork's #213 security pins (next 16.3.3 > upstream's 16.3.0, plus the sharp@<0.35.4 and js-yaml@4 overrides); took upstream's other dependency changes.
pages/_document.tsx	theirs (same-change collision, see below).
server/api/routers/proprietary/whitelabeling.ts	theirs (same-change collision).
components/dashboard/organization/handle-organization.tsx	theirs, then re-applied the fork's organization-description feature on top.
pages/index.tsx	upstream's structure, fork behaviours re-applied.
pages/register.tsx	upstream's structure + self-hosted social login.
pages/invitation.tsx	upstream's structure + await router.push(...).
pages/send-reset-password.tsx	upstream's structure, minus the !IS_CLOUD redirect (self-hosted password reset).
components/dashboard/application/domains/handle-domain.tsx	ours, with upstream's small 0f28775a1 diff applied onto it.
packages/server/src/lib/auth.ts	both sides kept.

Same-change collisions

The fork had already ported two upstream PRs before they merged upstream — Dokploy#4769 (whitelabeling FOUC, fork commit 2035eed43) and Dokploy#4765 (org logo drag-and-drop, 625b42dff), both by Yash Kumar. Upstream's further-developed versions now win. Taken wholesale: upstream's extracted utils/image-processing.ts, utils/sanitize-svg.ts, utils/create-server-helpers.ts, components/shared/truncate-tooltip.tsx, and the removal of whitelabeling-provider.tsx (confirmed zero remaining references). Upstream also adopted the fork's classNameContent prop on components/ui/dropzone.tsx verbatim, so that file is now byte-identical to upstream and both fork callers still work.

Two behavioural deltas accepted under theirs-wins, both documented in the playbook:

1. The fork's port inlined the favicon as a base64 data URI so it was present in the first HTML response; upstream emits the raw faviconUrl. Upstream's version is otherwise a superset (OG metadata + the XSS/SVG fixes).
2. whitelabelingConfig.metaTitle is gone — upstream drives the document title from appName and adds ogImageUrl.

Fork behaviours re-applied on top of upstream's files

• index.tsx — getPostLoginDestination(router.query) replaces every /dashboard/home literal (4 client redirects + 2 getServerSideProps redirects) so the validated post-login target survives password, passkey, 2FA, backup-code, social and SSO sign-in. This is the MCP consent return path (ec4e90253, 4af3e723d) — losing it would break the remote-MCP OAuth flow. Plus SocialLoginButtons on self-hosted when GitHub/Google env vars are configured (9e63ae180), callbackURL threaded into both <SignInWithSSO> branches, and the per-branch setIsLoading(false) calls that keep the button spinning across the awaited redirect (94be4ca34).
• register.tsx — self-hosted social login (9e63ae180).
• send-reset-password.tsx — password reset allowed on self-hosted (03d51628c).
• invitation.tsx — await router.push(...) (94be4ca34).
• handle-organization.tsx — organization descriptions (d8ff0a7a7), stored in better-auth's opaque metadata JSON. The fork's {!isControlled && <DialogTrigger>} guard was deliberately not re-applied: upstream ships the same controlled open/onOpenChange props and renders the trigger unconditionally, and no caller uses controlled mode.
• handle-domain.tsx — every fork domain feature kept (wildcard domains + Traefik v3 HostRegexp, user-owned wildcard base, wildcard domain restriction, Cloudflare Tunnel publishing + Cloudflare Access, custom certificate provider display). Upstream's diff — defer the AddDomain queries until the dialog opens — was applied onto ours; the resulting diff vs canary is exactly upstream's five enabled: changes and nothing else.
• auth.ts — both sides survive. Upstream's SSO enforcement runs first in hooks.before (a hard deny for the whole request), then the fork's MCP OAuth gates (/mcp/register DCR policy, /mcp/authorize consent proof); the fork's hooks.after refresh-rotation clamp, buildMemberSession, 30-day sliding sessions and session-rejection logging are untouched. The two path sets are disjoint, so ordering is readability, not behaviour.

Migrations

Fourth application of the playbook's Drizzle rule 4. Upstream added 0191_cool_christian_walker, 0192_light_lake, 0193_chemical_the_liberteens, 0194_acoustic_prima and 0195_classy_whirlwind — but the fork has released migrations at all five of those numbers, so instances have already run the fork's copies and taking upstream's would strand production. Upstream's five .sql files, five snapshots and five _journal.json entries were dropped, and the schema delta regenerated into the fork's next free slot as 0201_steep_sage:

-- Re-issue of upstream v0.30.6 migrations 0191_cool_christian_walker,
-- 0192_light_lake, 0193_chemical_the_liberteens, 0194_acoustic_prima and
-- 0195_classy_whirlwind in a fork slot: the fork had already released
-- migrations at 0191-0195, so upstream's copies were dropped and their schema
-- delta regenerated here. Guarded with IF NOT EXISTS so instances that somehow
-- already have these objects are a no-op.
ALTER TYPE "public"."DnsProviderType" ADD VALUE IF NOT EXISTS 'infomaniak';--> statement-breakpoint
ALTER TYPE "public"."DnsProviderType" ADD VALUE IF NOT EXISTS 'ovh';--> statement-breakpoint
ALTER TYPE "public"."VaultProviderType" ADD VALUE IF NOT EXISTS 'aws-parameter-store' BEFORE 'doppler';--> statement-breakpoint
ALTER TABLE "webServerSettings" ALTER COLUMN "whitelabelingConfig" SET DEFAULT '{"appName":null,"appDescription":null,"logoUrl":null,"faviconUrl":null,"customCss":null,"loginLogoUrl":null,"supportUrl":null,"docsUrl":null,"errorPageTitle":null,"errorPageDescription":null,"footerText":null,"ogImageUrl":null}'::jsonb;--> statement-breakpoint
ALTER TABLE "sso_provider" ADD COLUMN IF NOT EXISTS "domain_verified" boolean DEFAULT true NOT NULL;

Guards follow the 0199_complex_mantis pattern (ADD VALUE IF NOT EXISTS / ADD COLUMN IF NOT EXISTS); the SET DEFAULT is naturally idempotent. None of the five upstream migrations is a data backfill, so nothing had to be hand-carried this time.

Verified:

• The generated SQL contains no DROP and touches no fork object — the proof that the schema merge preserved every fork column and table.
• Snapshot 0201 still has organization.wildcard_domain, project.wildcardDomain, project.useOrganizationWildcard, webServerSettings.domainRestrictionConfig, the three oauth_* MCP tables and the three build_policy_* tables from feat(build-policy): enforced remote builds, registry push, deploy-by-digest, queue coalescing, required checks #209's 0200.
• _journal.json is monotonic in when, carries no upstream 0191–0195 entries, and 0201 (1789444271863) sorts after 0200_handy_lifeguard (1789011785969).
• Drizzle files kept LF (.gitattributes enforces it).

Silent hazards found

• webServerSettings.domainRestrictionConfig was missing from the fork-columns ledger in the playbook, even though it is a fork column on an upstream-owned table — exactly the class of drift the ledger exists to prevent. It survived this merge, but it was surviving by luck rather than by check. Added to the ledger.
• The v0.30.5 BREAKING build-context section was stale: upstream reverted that change at v0.30.6. The playbook now says so, since it changes the release notes for this release.
• generateTraefikMeDomain (the v0.30.5 trap): both call sites still pass the fork's 4th projectId argument and read .domain. No new upstream call sites in this release.
• Only two upstream routers changed (organization.ts, whitelabeling.ts) and neither adds a procedure, so the fork's MCP scope map needed no new entries — confirmed by the tool→scope snapshot test passing unchanged. No scope was loosened.
• organization.ts auto-merged correctly: upstream's name: z.string().min(1) landed on both create and update while the fork's description input survived on both.

A delta audit (fork's diff-vs-upstream before the merge vs after) flagged only 13 files as having lost fork lines, and every one is accounted for: the 5 discarded upstream drizzle snapshots, the 4 same-change collision files (delta correctly → 0), and the 4 login pages + handle-organization.tsx where upstream absorbed boilerplate and only the genuine fork behaviours remain. No fork code was lost anywhere else.

Verification

Check	Result
pnpm install	clean, exit 0
pnpm --filter=dokploy run typecheck	pass (app + packages/server, no output)
pnpm --filter=dokploy run build-server	pass
pnpm --filter=dokploy test -- run	2366 passed / 11 failed / 13 skipped (218 files)
__test__/mcp/ (scopes + tool→scope snapshot)	112/112 pass
lockfile resolves the #213 security pins	next@16.3.3, sharp@0.35.4, js-yaml@4.3.2 ✅

The 11 local failures are in 5 files, all of which the merge does not touch — neither the test files nor their subjects — and are the known Windows/Docker environment class the playbook documents:

• __test__/deploy/application.real.test.ts (5) — needs Docker, git and nixpacks
• __test__/server/server-setup.test.ts (3) — command -v awk (no POSIX shell)
• __test__/backups/restore-use-statement.test.ts (1) — execSync of a sed/awk pipeline
• __test__/compose/compose-project-directory.test.ts (1) — POSIX path assertions
• __test__/wss/readValidDirectory.test.ts (1) — POSIX path assertions

CI on Linux is the authority for these.

Release notes input

• The v0.30.5 Docker build-context break is fixed. Upstream reverted it; the default context is the Dockerfile's own directory again. If you set dockerContextPath to work around the v0.30.5 regression you can leave it as-is — explicit contexts are still honoured.
• New DNS providers: Infomaniak and OVH.
• New vault provider: AWS Parameter Store. Infisical gains secret-reference expansion and folder paths.
• Whitelabeling security: custom CSS can no longer break out of the <style> tag, and uploaded SVG logos are sanitised. New Open Graph metadata (custom OG image, description) so shared links render your branding.
• Organization logos can now be drag-and-dropped; raster images are resized to 256×256 WebP. Long organization names truncate with a tooltip in the sidebar.
• SSO enforcement is now enforced server-side — with enforceSSO on, password, social and passkey sign-in and email signup are rejected at the auth layer, not just hidden in the UI. Note this also disables the fork's self-hosted social login buttons when enabled.
• Domain validation now checks the server's own interface addresses and AAAA records, so validation stops failing on hosts behind NAT or on IPv6-only records.
• Server health address-pool detection works again inside the container.
• Security: the fork's patched next 16.3.3 (two critical RCE advisories), sharp and js-yaml pins are carried forward over upstream's older next 16.3.0.
• Fork features preserved and worth re-testing after deploy: MCP OAuth consent redirect, self-hosted social login, self-hosted password reset, organization descriptions, and the whole wildcard-domain / Cloudflare Tunnel domain dialog.