chore: merge upstream canary into AgentHits-Dev (2026-10-23)

.devcontainer/Dockerfile

@@ -1,5 +1,5 @@
 # Dockerfile for DevContainer
-FROM node:24.4.0-bullseye-slim
+FROM node:24.22.1-bookworm-slim
 
 # Install essential packages
 RUN apt-get update && apt-get install -y \

.github/workflows/dokploy.yml

@@ -207,7 +207,7 @@ jobs:
 
       - uses: actions/setup-node@v7
         with:
-          node-version: 24.21.0
+          node-version: 24.22.1
           cache: pnpm
 
       - name: Generate OpenAPI specification

.github/workflows/pull-request.yml

@@ -30,7 +30,7 @@ jobs:
       - uses: actions/setup-node@v7
         if: ${{ !cancelled() }}
         with:
-          node-version: 24.21.0
+          node-version: 24.22.1
       - run: bun install --frozen-lockfile
         if: ${{ !cancelled() }}
       - run: bun run server:build
@@ -54,7 +54,7 @@ jobs:
           bun-version: 1.4.2
       - uses: actions/setup-node@v7
         with:
-          node-version: 24.21.0
+          node-version: 24.22.1
 
       - name: Install Nixpacks
         if: matrix.job == 'test' && runner.environment == 'github-hosted'

.github/workflows/sync-openapi-docs.yml

@@ -29,7 +29,7 @@ jobs:
           bun-version: 1.4.2
       - uses: actions/setup-node@v7
         with:
-          node-version: 24.21.0
+          node-version: 24.22.1
 
       - name: Install dependencies
         run: bun install --frozen-lockfile

.nvmrc

@@ -1 +1 @@
-24.4.0
+24.22.1

CONTRIBUTING.md

@@ -53,7 +53,7 @@ feat: add new feature
 
 Before you start, please make the clone based on the `canary` branch, since the `main` branch is the source of truth and should always reflect the latest stable release, also the PRs will be merged to the `canary` branch.
 
-We use Node v24.4.0 and recommend this specific version. If you have nvm installed, you can run `nvm install 24.4.0 && nvm use` in the root directory.
+We use Node v24.22.1 and recommend this specific version. If you have nvm installed, you can run `nvm install 24.22.1 && nvm use` in the root directory.
 We use Bun v1.4.2 as the package manager and recommend this specific version. The lockfile requires Bun >=1.4.2.
 
 ```bash

Dockerfile

@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1
-FROM node:24.21.0-slim AS base
+FROM node:24.22.1-bookworm-slim AS base
 ENV BUN_INSTALL="/root/.bun"
 ENV PATH="$BUN_INSTALL/bin:$PATH"
 RUN apt-get update \

Dockerfile.cloud

@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1
-FROM node:24.21.0-slim AS base
+FROM node:24.22.1-bookworm-slim AS base
 ENV BUN_INSTALL="/root/.bun"
 ENV PATH="$BUN_INSTALL/bin:$PATH"
 RUN apt-get update \

Dockerfile.monitoring

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 # Build stage
-FROM golang:1.21-alpine3.19 AS builder
+FROM golang:1.24-alpine3.22 AS builder
 
 # Instalar dependencias necesarias
 RUN apk add --no-cache gcc musl-dev sqlite-dev

Dockerfile.schedule

@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1
-FROM node:24.21.0-slim AS base
+FROM node:24.22.1-bookworm-slim AS base
 ENV BUN_INSTALL="/root/.bun"
 ENV PATH="$BUN_INSTALL/bin:$PATH"
 RUN apt-get update \

Dockerfile.server

@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1
-FROM node:24.21.0-slim AS base
+FROM node:24.22.1-bookworm-slim AS base
 ENV BUN_INSTALL="/root/.bun"
 ENV PATH="$BUN_INSTALL/bin:$PATH"
 RUN apt-get update \

README.md

@@ -263,6 +263,7 @@ Dokploy includes multiple features to make your life easier.
 - **Templates**: Deploy open-source templates (Plausible, Pocketbase, Calcom, etc.) with a single click.
 - **Traefik Integration**: Automatically integrates with Traefik for routing and load balancing.
 - **Real-time Monitoring**: Monitor CPU, memory, storage, and network usage for every resource.
+- **Logs & Metrics**: Ship container logs and host/container metrics to Grafana (Loki, Prometheus/Mimir), Datadog, New Relic, InfluxDB, VictoriaMetrics, Better Stack, Elasticsearch/OpenSearch, Splunk, or AWS CloudWatch, tagged by project/environment/application.
 - **Docker Management**: Easily deploy and manage Docker containers.
 - **CLI/API**: Manage your applications and databases using the command line or through the API.
 - **Notifications**: Get notified when your deployments succeed or fail (via Slack, Discord, Telegram, Email, etc.).

apps/api/package.json

@@ -33,7 +33,7 @@
 	},
 	"packageManager": "bun@1.4.2",
 	"engines": {
-		"node": "^24.4.0",
+		"node": "^24.22.1",
 		"bun": ">=1.4.2"
 	}
 }

apps/dokploy/__test__/backup/rclone-command-boundary.test.ts

@@ -61,6 +61,7 @@ vi.mock("@dokploy/server/services/deployment", () => ({
 
 vi.mock("@dokploy/server/services/destination", () => ({
 	findDestinationById: mocks.findDestinationById,
+	findDestinationByIdForOrganization: mocks.findDestinationById,
 }));
 
 vi.mock("@dokploy/server/services/environment", () => ({

apps/dokploy/__test__/backups/backup-destination-organization.test.ts

@@ -0,0 +1,213 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+	createBackup: vi.fn(),
+	findBackupById: vi.fn(),
+	updateBackupById: vi.fn(),
+	findPostgresById: vi.fn(),
+	restorePostgresBackup: vi.fn(),
+	restoreWebServerBackup: vi.fn(),
+	findDestinationRow: vi.fn(),
+	findRestoreBackups: vi.fn(),
+}));
+
+vi.mock("@dokploy/server/db", () => ({
+	db: {
+		query: {
+			backups: { findMany: mocks.findRestoreBackups },
+			destinations: { findFirst: mocks.findDestinationRow },
+		},
+	},
+}));
+
+vi.mock("@dokploy/server/services/permission", () => ({
+	checkPermission: vi.fn(async () => undefined),
+	checkServicePermissionAndAccess: vi.fn(async () => undefined),
+}));
+
+vi.mock("@dokploy/server", async (importOriginal) => ({
+	...(await importOriginal<typeof import("@dokploy/server")>()),
+	IS_CLOUD: false,
+	createBackup: mocks.createBackup,
+	findBackupById: mocks.findBackupById,
+	updateBackupById: mocks.updateBackupById,
+	findPostgresById: mocks.findPostgresById,
+	scheduleBackup: vi.fn(),
+	removeScheduleBackup: vi.fn(),
+}));
+
+vi.mock("@dokploy/server/lib/auth", () => ({
+	validateRequest: vi.fn(),
+}));
+
+vi.mock("@dokploy/server/utils/restore", () => ({
+	restorePostgresBackup: mocks.restorePostgresBackup,
+	restoreWebServerBackup: mocks.restoreWebServerBackup,
+}));
+
+vi.mock("@dokploy/server/utils/backups/compose", () => ({
+	runComposeBackup: vi.fn(),
+}));
+
+vi.mock("@dokploy/server/utils/backups/utils", () => ({
+	getS3Credentials: vi.fn(),
+	normalizeS3Path: vi.fn(() => ""),
+}));
+
+vi.mock("@dokploy/server/utils/process/execAsync", () => ({
+	execAsync: vi.fn(),
+	execAsyncRemote: vi.fn(),
+}));
+
+vi.mock("@/server/api/utils/audit", () => ({
+	audit: vi.fn(async () => undefined),
+}));
+
+vi.mock("@/server/api/utils/plan-limits", () => ({
+	assertDatabaseBackupLimit: vi.fn(),
+}));
+
+vi.mock("@/server/utils/backup", () => ({
+	removeJob: vi.fn(),
+	schedule: vi.fn(),
+	updateJob: vi.fn(),
+}));
+
+const { backupRouter } = await import("@/server/api/routers/backup");
+
+const caller = backupRouter.createCaller({
+	session: { activeOrganizationId: "org-a" },
+	user: { id: "user-1", email: "user@example.com", role: "owner" },
+} as Parameters<typeof backupRouter.createCaller>[0]);
+
+const ownDestination = { destinationId: "dest-a", organizationId: "org-a" };
+const foreignDestination = { destinationId: "dest-b", organizationId: "org-b" };
+
+const createInput = {
+	schedule: "0 0 * * *",
+	prefix: "/",
+	database: "app",
+	databaseType: "postgres" as const,
+	backupType: "database" as const,
+	postgresId: "pg-1",
+	enabled: false,
+};
+
+const updateInput = {
+	backupId: "backup-1",
+	schedule: "0 0 * * *",
+	enabled: false,
+	prefix: "/",
+	database: "app",
+	keepLatestCount: 0,
+	serviceName: null,
+	metadata: {},
+	databaseType: "postgres" as const,
+};
+
+const restoreInput = {
+	databaseId: "pg-1",
+	databaseType: "postgres" as const,
+	backupType: "database" as const,
+	databaseName: "app",
+	backupFile: "app/2024.sql.gz",
+};
+
+const drain = async (stream: unknown) => {
+	for await (const _ of stream as AsyncIterable<string>) {
+	}
+};
+
+describe("backup endpoints scope destinations to the active organization", () => {
+	beforeEach(() => {
+		vi.clearAllMocks();
+		mocks.createBackup.mockResolvedValue({ backupId: "backup-1" });
+		mocks.findBackupById.mockResolvedValue({
+			backupId: "backup-1",
+			postgresId: "pg-1",
+			destinationId: "dest-a",
+			enabled: false,
+			databaseType: "postgres",
+			backupType: "database",
+		});
+		mocks.findPostgresById.mockResolvedValue({ postgresId: "pg-1" });
+		// The fork only restores objects under a schedule of the same database.
+		mocks.findRestoreBackups.mockResolvedValue([
+			{ appName: "app", prefix: "/", postgres: { appName: "app" } },
+		]);
+	});
+
+	it("rejects creating a backup on a destination from another organization", async () => {
+		mocks.findDestinationRow.mockResolvedValue(foreignDestination);
+
+		await expect(
+			caller.create({ ...createInput, destinationId: "dest-b" }),
+		).rejects.toMatchObject({
+			message: "You don't have access to this destination.",
+		});
+		expect(mocks.createBackup).not.toHaveBeenCalled();
+	});
+
+	it("creates a backup on a destination of the active organization", async () => {
+		mocks.findDestinationRow.mockResolvedValue(ownDestination);
+
+		await caller.create({ ...createInput, destinationId: "dest-a" });
+
+		expect(mocks.createBackup).toHaveBeenCalledTimes(1);
+	});
+
+	it("rejects moving a backup to a destination from another organization", async () => {
+		mocks.findDestinationRow.mockResolvedValue(foreignDestination);
+
+		await expect(
+			caller.update({ ...updateInput, destinationId: "dest-b" }),
+		).rejects.toMatchObject({
+			message: "You don't have access to this destination.",
+		});
+		expect(mocks.updateBackupById).not.toHaveBeenCalled();
+	});
+
+	it("rejects restoring from a destination of another organization", async () => {
+		mocks.findDestinationRow.mockResolvedValue(foreignDestination);
+
+		const stream = await caller.restoreBackupWithLogs({
+			...restoreInput,
+			destinationId: "dest-b",
+		});
+
+		await expect(drain(stream)).rejects.toMatchObject({
+			code: "UNAUTHORIZED",
+		});
+		expect(mocks.restorePostgresBackup).not.toHaveBeenCalled();
+	});
+
+	it("restores from a destination of the active organization", async () => {
+		mocks.findDestinationRow.mockResolvedValue(ownDestination);
+
+		const stream = await caller.restoreBackupWithLogs({
+			...restoreInput,
+			destinationId: "dest-a",
+		});
+		await drain(stream);
+
+		expect(mocks.restorePostgresBackup).toHaveBeenCalledTimes(1);
+	});
+
+	// Upstream leaves service-less web-server schedules unscoped; the fork
+	// scopes their destination like every other schedule.
+	it("rejects web-server schedules on a destination from another organization", async () => {
+		mocks.findDestinationRow.mockResolvedValue(foreignDestination);
+
+		await expect(
+			caller.create({
+				...createInput,
+				postgresId: undefined,
+				databaseType: "web-server",
+				destinationId: "dest-b",
+			}),
+		).rejects.toMatchObject({
+			message: "You don't have access to this destination.",
+		});
+		expect(mocks.createBackup).not.toHaveBeenCalled();
+	});
+});