v2.7.0

Important

Project variable resolution now matches the Docker Compose CLI

Previously, environment variables set on Arcane's own container (such as PORT) could be picked up when resolving ${VARIABLE} references in your projects' compose files. This could cause surprising results — for example, a project using ${PORT:-8191} could end up binding to Arcane's own port instead of its default (#3499).

Starting with this release, variable references in a project's compose file resolve only from:

• your global Variables (.env.global)
• the project's own .env file
• defaults in the compose file itself (${VAR:-default})
• timezone and locale from Arcane's environment (TZ, LANG, LANGUAGE, LC_ALL)

This means a project deployed through Arcane now resolves its variables the same way as running docker compose up in the project directory, and projects can no longer accidentally pick up Arcane's own configuration.

If a project referenced a variable that was only defined on Arcane's container, add it under Customization → Variables to share it with all projects, or to that project's .env file. No other action is needed.

New features

• simplify build registry image references (#3243 by @traeli)
• add gated admin password reset to interal CLI (#3470 by @kmendell)
• per user passkey mfa / passwordless login support (#3493 by @kmendell)
• custom payload generic webhooks and google chat notifications (#3417 by @khanhx)
• bump docker/compose to v5.4.0, gate diverged-volume recreation behind deploy option, pull pre_start hook and image-volume images (#3502 by @kmendell)

Bug fixes

• synchronize structured log toggle state (#3418 by @Kstateag)
• project log timestamps (#3456 by @Kstateag)
• improve lifecycle permission diagnostics (#3404 by @Kstateag)
• gate image event watcher to prevent registry rate limits (#3467 by @kmendell)
• serialize bulk deletes and refresh image data (#3466 by @kmendell)
• refresh image labels during self-upgrade (#3479 by @kmendell)
• forward icon catalog setting over tunnel endpoints (#3495 by @kmendell)
• update overridden env keys in place in effective .env instead of appending duplicates (#3496 by @kmendell)
• bulk remove doing nothing on non-HTTPS deployments (#3498 by @kmendell)
• stale environment bootstrap API keys accumulating and being undeletable (#3501 by @kmendell)
• sheet panel animation restarting on hover during open (#3503 by @kmendell)
• only grant default admin role during bootstrap or zero-admin recovery, not to any account named arcane (#3504 by @kmendell)
• enforce configured password policy on all password creation and reset paths (#3505 by @kmendell)
• stop leaking Arcane's own process environment into compose variable interpolation (#3508 by @kmendell)

CLI - Bug fixes

• allow self updating for riscv64(7fc48a3 by @kmendell)

Dependencies

• bump the tanstack-table group across 1 directory with 2 updates (#3435 by @dependabot[bot])
• bump svelte from 5.56.7 to 5.56.8 (#3448 by @dependabot[bot])
• bump marked from 18.0.6 to 18.0.7 (#3449 by @dependabot[bot])
• bump @tanstack/virtual-core from 3.17.5 to 3.17.6 (#3453 by @dependabot[bot])
• bump @tanstack/svelte-query from 6.1.37 to 6.1.38 (#3440 by @dependabot[bot])
• bump docker/login-action from 4 to 4.5.2 (#3432 by @dependabot[bot])
• bump github.com/mattn/go-runewidth from 0.0.24 to 0.0.27 in /cli (#3433 by @dependabot[bot])
• bump react-dom from 19.2.7 to 19.2.8 (#3450 by @dependabot[bot])
• bump github.com/moby/moby/client from 0.5.0 to 0.5.1 in /types (#3434 by @dependabot[bot])
• bump react-email from 6.9.0 to 6.9.1 (#3455 by @dependabot[bot])
• bump github.com/moby/buildkit from 0.31.2 to 0.32.0 in /backend (#3436 by @dependabot[bot])
• bump github.com/moby/moby/client from 0.5.0 to 0.5.1 in /backend (#3438 by @dependabot[bot])
• bump react from 19.2.7 to 19.2.8 (#3446 by @dependabot[bot])
• bump tailwind-variants from 3.2.2 to 3.3.0 (#3451 by @dependabot[bot])
• bump @codemirror/view from 6.43.6 to 6.43.7 in the codemirror group across 1 directory (#3437 by @dependabot[bot])
• bump github.com/docker/cli to v29.7.1+incompatible(c5d6abc by @kmendell)
• bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2 in /backend (#3474 by @dependabot[bot])
• bump gorm.io/driver/postgres from 1.6.0 to 1.6.1 in /backend (#3477 by @dependabot[bot])
• bump github.com/nicholas-fedor/shoutrrr from 0.16.2 to 0.16.3 in /backend (#3476 by @dependabot[bot])
• bump the aws-sdk-go-v2 group in /backend with 3 updates (#3473 by @dependabot[bot])
• bump @sveltejs/kit from 3.0.0-next.11 to 3.0.0-next.13 (#3444 by @dependabot[bot])
• bump github.com/getarcaneapp/arcane/types/v2 from 2.5.0 to 2.6.0 in /cli (#3472 by @dependabot[bot])
• bump github.com/danielgtaylor/huma/v2 from 2.39.0 to 2.39.1 in /backend (#3475 by @dependabot[bot])
• bump github.com/compose-spec/compose-go/v2 from 2.13.0 to 2.14.0 in /backend (#3482 by @dependabot[bot])
• bump @tanstack/virtual-core from 3.17.6 to 3.17.7 (#3484 by @dependabot[bot])
• bump the tanstack-table group across 1 directory with 2 updates (#3483 by @dependabot[bot])
• bump google.golang.org/grpc from 1.82.1 to 1.83.0 in /backend (#3481 by @dependabot[bot])
• bump pnpm to v11.20.0(8bfd331 by @kmendell)
• bump fast-uri to v3.1.5(eaf4eec by @kmendell)
• bump brace-expansion to v5.0.9(014a972 by @kmendell)
• bump postcss to v8.5.23(b9ec592 by @kmendell)

Other

• move to coder/websocket library as it is actively maintained (#3431 by @kmendell)
• move automation logic to use actors (#3458 by @kmendell)

Full Changelog: v2.6.0...v2.7.0