v1.58.4 — Fixes and improvements

What's Changed

• dash: Ensure column order is maintained in db browser by @ekerfelt in #2550
• docs: remove docs now that they're maintained elsewhere by @simon-johansson in #2552
• dockerbuild: exclude volatile pnpm metadata from the deps layer by @Zei33 in #2496

New Contributors

• @Zei33 made their first contribution in #2496

Full Changelog: v1.58.3...v1.58.4

v1.58.3 — Minor improvements

What's Changed

• go 1.27
• improve CLI recovery hints for uninitialized and unlinked apps by @ivancernja in #2527
• cli: typo in validation allowlist by @fredr in #2546
• clippy lints by @fredr in #2548

Full Changelog: v1.58.2...v1.58.3

v1.58.2 — Fixes and improvements

What's Changed

• go 1.26.6
• windows: properly look up executable by @fredr in #2535
• devdash: reveal and open items in object store by @fredr in #2538
• daemon: fixes for origin checks by @ngalaiko in #2537

New Contributors

• @ngalaiko made their first contribution in #2537

Full Changelog: v1.58.1...v1.58.2

v1.58.1 — Fixes for config generation and the object explorer

What's Changed

• docs: fix outdated contribution link by @AradhyaSharma31 in #2532
• generate config CUE during build by @fredr in #2533
• object explorer: fix prefix rollup by @fredr in #2534

New Contributors

• @AradhyaSharma31 made their first contribution in #2532

Full Changelog: v1.58.0...v1.58.1

v1.58.0 — Object Explorer

Object Explorer

Working with object storage just got a lot easier. This release adds an Object Explorer to both the local development dashboard and Encore Cloud, so you can inspect the contents of your buckets without leaving Encore.

• Browse objects and folders in any bucket, with search to find what you're looking for
• Download objects, or preview them directly in the browser
• Upload new objects and create folders
• Delete objects you no longer need

It works the same way locally and in the cloud — the local explorer talks to Encore's built-in object storage emulator, so you get the same experience during development as you do against your deployed environments.

Other improvements

• docs: fix undefined params.ID in errs.Builder example by @boutahuss in #2521
• Remove context7.json by @ivancernja with @Copilot in #2323
• [daemon] Fix unbounded memory/fd growth from eager watching, codegen-regen, and leaked runs by @djeer in #2520
• docs: Add docs for Cloud Run static IPs by @ekerfelt in #2523
• runtimes/core: set etag for static assests by @fredr in #2518
• daemon: bucket browser api by @fredr in #2528

New Contributors

• @boutahuss made their first contribution in #2521
• @ivancernja with @Copilot made their first contribution in #2323

Full Changelog: v1.57.13...v1.58.0

v1.57.13: Security Release

This security release is part of a new AI-driven security research effort at Encore to continuously and proactively find and fix security vulnerabilities. We have no indication these vulnerabilities are being exploited, but we’re sharing this release in the interest of transparency. We recommend all users to upgrade their Encore CLI with encore version update.

As this effort continues to ramp up over the coming weeks, there will likely be more frequent security updates than before.

Security Advisories

• CRITICAL: Encore CLI daemon exposes localhost-bound development servers to cross-origin browser requests
• MODERATE: Path traversal in the local object storage emulator
• LOW: Code injection via adversarial doc comments for encore gen client

v1.57.11: Security Release

This release contains remediations for two separate security vulnerabilities. We recommend all users to upgrade their Encore CLI with encore version update. If you are self-hosting Encore we recommend you upgrade to v1.57.11 and re-deploy your application.

One vulnerability affected the Encore CLI and one with the potential of affecting deployed applications. We have already rolled out a fixed runtime for all applications managed by Encore Cloud that were potentially affected.

From our telemetry we are quite confident these vulnerabilities have not been exploited in the wild. They were reported privately by a security researcher through our responsible disclosure program.

Security Advisories

• CRITICAL: Spoofed internal metadata headers accepted by the API gateway
• HIGH: CLI cross-origin WebSocket
• MODERATE: Decimal DoS

v1.57.10 — Fixes and improvements

What's Changed

• go1.26.5
• Add docs for external vaults and JIT by @ekerfelt in #2498
• core: Add support for splitting secret payload across multiple env vars by @ekerfelt in #2499
• go: Add support for splitting the appsecrets across multiple env vars by @ekerfelt in #2500
• core: Fix logging field format for GCP by @ekerfelt in #2501
• docs: Add section about AWS in JIT/vaults docs by @ekerfelt in #2503
• docs: Add docs for importing topics & buckets by @ekerfelt in #2504
• runtimes/{core,js}: various fixes by @fredr in #2502
• Add option to load runtime config from buckets by @ekerfelt in #2506
• satisfy clippy by @fredr in #2512
• update domain: encore.cloud -> encore.dev by @fredr in #2511
• runtimes/{go,core,js}: add multiSet operation for redis by @fredr in #2513
• bump cmake by @fredr in #2514

Full Changelog: v1.57.9...v1.57.10

v1.57.9 — Fixes and improvements

What's Changed

• runtimes/js: error when converting too deeply nested payloads by @fredr in #2480
• Add support for external secret vaults by @ekerfelt in #2479
• runtimes/core: avoid exit-time teardown race on shutdown by @fredr in #2482
• bump deps by @fredr in #2476
• dockerbuild: layer image by @fredr in #2483
• runtimes/core: fix raw endpoint status code in traces by @fredr in #2489
• docs: reframe overviews as infrastructure SDK; add development workflow page by @marcuskohlberg in #2488
• docs: update Security & Compliance with SOC 2 prep status by @marcuskohlberg in #2494

Full Changelog: v1.57.8...v1.57.9

v1.57.8 — Fixes and improvements

What's Changed

• Have notFoundStatus 200 return 304s appropriately by @ekerfelt in #2472
• cli/daemon: add trace search filters to get_traces MCP tool by @simon-johansson in #2470
• Fix broken email link in migration docs (mail: -> mailto:) by @ivancernja in #2474
• update esbuild by @fredr in #2475
• docs/go/self-host: fix inverted databases map-key and name descriptions by @harsha-cpp in #2471
• infracfg: propagate push_config.id into PubSubSubscription.rid (fix self-host push 404) by @vendoshi in #2450
• runtimes/core: fix raw endpoint status code in metrics by @fredr in #2477
• fix test by @fredr in #2478

New Contributors

• @harsha-cpp made their first contribution in #2471
• @vendoshi made their first contribution in #2450

Full Changelog: v1.57.6...v1.57.8