- New features
- 33
- Improvements
- 30
- Fixes
- 37
Highlights
Choose your maintenance window
Pick the 4-hour slot for routine maintenance on each website, CoreCluster or your whole company. It is 00:00–04:00 UK time unless you change it.
Firewall: choose who can reach your environments
Add your IP address once for your company, a website, one environment or just for yourself, with Add my IP on the environment's page. It opens SSH, and on CoreStack and CoreCluster it also lets you past HTTP authentication and maintenance mode.
SSH keys: one place for every level
On CoreStack and CoreCluster, add SSH keys for your agency, company, website or a single environment in one place, in the Corefinity control panel or through its API, and see every key that can reach an environment and where it came from.
Your own SSH username
On CoreStack and CoreCluster, everyone with access to an environment can log in over SSH with their own username and personal key, alongside the shared web username.
Restore a snapshot into another environment
When you restore a snapshot, you can now choose another environment of your website as the destination, for example to restore a production snapshot into a staging environment. You confirm the destination by typing its name before anything in it is replaced.
Varnish full-page cache for Magento on CoreStack and CoreCluster
Magento 2 sites on CoreStack and CoreCluster can now serve pages from Varnish. Switch it on or off, choose its version, purge it by URL, tag or pattern, add your own VCL with validation, history and revert, and follow its hit ratio in the Corefinity control panel, the API and the MCP tools; deployments purge it for you.
Everything in this release
New features 27
A redirect rule can now apply to chosen domains of a site instead of all of them, so two shops on one site can each keep their own redirects. On its domains a limited rule runs before the rules for every domain.
On every CoreStack environment you can now run a separate PHP application in a folder of your site (such as a WordPress admin), serve a folder of files, block a path, or limit a path or host name to a list of addresses, from the Nginx tab. Only the PHP files you list ever run, and every change is checked before it goes live.
Each CoreStack environment has a Database tab with its connection details and database users: add read-only or read-write logins for tools inside the site, or turn on external access to give an outside system its own login from addresses you choose, on a fixed address for £15.00 / month.
Our error pages now show for 500, 502, 503 and 504 responses, with your app's API and JSON responses left untouched. In Error pages you can turn ours off per code, use your own HTML with live preview, and test it against your site.
The control panel API can now read, check, preview, save, revert, reset, copy and retry an environment's error and maintenance pages, follow each change, and switch maintenance mode on or off, with the same permissions, checks and limits as the control panel and the AI assistant tools.
The API now reads, checks, saves, restores and copies an environment's custom nginx rules, explains which rule answers an address and converts .htaccess files, with the same checks and answers as the Nginx tab.
The API can now list and read your sites, websites and CoreClusters, follow a new site or CoreCluster, see what needs attention, check capacity, create or delete a CoreCluster and delete or restore a site. It can manage environments, show the preview login, reset an administrator, change a package, add-ons or server type, and follow, retry or reveal operations and apply or cancel pending changes, with the same checks as the control panel and the MCP tools.
The API now reads and changes an environment's PHP and Node.js: versions, extensions, settings, PHP-FPM, Xdebug, php.ini checks and tests, history and restore, copies to other environments, and Node.js packages, with the same checks and answers as the PHP and Node.js tabs.
PHPThe API now reads and saves an environment's redirects, HTTP authentication (revealing a login's password to the token's own user) and domains, checks and points DNS, changes the main domain, attaches a domain to go live and manages the Cloudflare connection, zone, SSL mode and cache purge, with the same checks and answers as the control panel.
SecurityHome is now a dashboard you arrange yourself. Add widgets for your sites, CoreClusters, deployments, support tickets, billing and more, drag and resize them, and set one time range for every chart. Start from a ready-made template (agencies also get one for their clients), chart your log lines and errors or follow them live, and show a dashboard on a wall screen through a read-only display link you can revoke at any time.
SSH and SFTP users and their keys on a site's Access tab can now be read, added, changed and removed with the API, with the same rules as the control panel.
Your team, roles and company notification settings can now be managed through the public API and by AI agents connected to the control panel, with the same rules as the Team, Roles and My Company pages. Another company's user or role ids now answer Not found.
The API now takes, reads and deletes snapshots and sets snapshot frequencies and CoreCluster snapshot settings, with the same checks and answers as the Snapshots tab. Listing an environment's snapshots and changing a snapshot's note or keeping it now work through the API too.
Open, read, reply to, close and reopen your support tickets, attach files to a reply, change a ticket's priority and choose who follows it, through the API and an AI assistant connected with MCP, with the same rules as the ticket page.
A CoreStack or CoreCluster site's deployments, deployment pipeline, variables and registry secrets, and your company's deployment templates, variables and registry secrets, can now be read and changed from the API as in the control panel: deploy, stop, retry and roll back, edit, copy, restore, rehearse and reset pipelines, save templates and reveal a value, with the same checks, messages and limits as the control panel and the MCP tools.
The API now reads your billing account, balance, usage, ledger, invoices and their PDFs, credit notes, credits, payment methods, contracts, the price catalogue, quotes and your orders, with the same rights and answers as the Billing pages and Company › Orders. AI assistants can list your orders too, and filter your invoices as the Invoices page does.
The API can now check and start a copy of an environment onto another environment of the same website, or onto production (push to live), with the same checks, refusals and token scopes as the control panel and AI agents. The new Copies page of the API documentation shows how to follow a copy as it runs.
CoreStack Enterprise deployments can now be listed, deployed, cancelled, retried and rolled back from the API and from MCP tools, with the same checks and messages as the control panel. In the API, another company's environment or deployment ids, and environments the control panel hides from you, now answer Not found, exactly as ids that do not exist.
Your sites' scheduled tasks, a Shopware shop's store token, storefront domains, health, Security Plugin and search, PageSpeed Insights tests, the browser terminal's history and recordings, and a site's own database login can now be used through the API with a personal access token, and feedback can be sent through it too, with the same rules and answers as the control panel and AI assistants.
ShopwareThe API now searches a website's logs and reads their fields, facets, histogram, context, saved queries and usage, and exports log lines to a file, with the same checks and answers as the Logs tab.
You can now read and change a CoreStack Enterprise environment's deployment settings (pipeline on or off, deployment source, manual or automatic git deploys) and its git repositories through the API and the MCP server, with the same rules as the environment page.
A path app can now limit how many requests a second each visitor may make, and a new kind of path app shows another website, such as a blog hosted elsewhere, under a path of your own address over https. Both are on the environment's Nginx tab, in the REST API and in the MCP tools.
A Magento site can send each store's mail through its own verified sending domain, chosen by the From address.
MagentoThe control panel detects a Bedrock WordPress project and deploys, copies, clones and changes its address the Bedrock way. A WordPress site's managing agency can turn Corefinity's platform plugins off; the tools that need them then say why, in the panel, the API and MCP.
WordPressYou can now list, read, create and run your company's performance audits through the control panel API and MCP, with the run followed until it finishes; audited sites' HTTP passwords are never shown. Agencies can also read their partner referrals and refer new leads, and read their agency page and ask for changes to it, the same way.
PerformanceThe change log entries and announcements on the What's new? page can now be listed, read and marked as read through the API and by AI assistants connected to the control panel, with the same rules as the page.
New Magento 2 sites on CoreStack and CoreCluster now start with Varnish full-page cache switched on, and new environments follow their site's Varnish setting. You can switch it off or choose its version when you create the site, or at any time afterwards, in the Corefinity control panel, the API or the MCP tools.
MagentoImprovements 30
The progress steps shown while a change is applied to a site, such as a PHP, domain or email change, now say plainly what is happening, for example "Applying the change" and "Change applied". The badge beside a change says when it takes effect.
A new Shopware 5 site created at 16 GB or more now includes Elasticsearch 7.17 search, which runs inside the site; smaller sites search through the database. Until its first search index is built, the storefront searches through the database, so search keeps working throughout.
ShopwareNew sites and environments are now created only on PHP versions with the latest security fixes. PHP 7.4, 8.0 and 8.1 are available for new CoreStack and CoreCluster sites on patched images; existing sites are unaffected.
PHPA new website now shows as Active on Managed Websites from the moment it is added, rather than Pending setup or Onboarding. A site that is still being created shows Creating… until it is ready.
When you create a site, a cluster or an environment, the platform, version, PHP, database, package and size choices now show only the options you can select, instead of greyed-out ones you could not click. The recommended choice is still picked for you.
A website whose production environment is on CoreStack Enterprise now shows as CoreStack Enterprise, and is listed under that tab, even when its staging environment runs on CoreStack. Each environment still shows where it runs.
A Magento 2 site that runs more than one store can now have each store answer on its own address, a platform address or a domain of its own, with the right store shown on each. Ask support to set it up for your site.
MagentoA website with more than three environments now shows three of them and an All button. It opens a list of every environment, grouped into Production, Staging, UAT and Development, that you can search as you type; pin the ones you use most to keep them on the row.
The Cluster / Region column is gone from Managed Websites, leaving more room for each website and its environments. Where a website runs still shows on its own page.
Your deployments now continue as normal while we update the control panel, and queued deployments start as usual. Anything you start at the moment of an update is queued for a moment and starts by itself within about a minute, so there are no more pauses to wait for.
You can now take up to 20 one-off snapshots of a site each hour (sites on Google disks stay limited to 6 an hour by Google). The Snapshots tab no longer shows how many are left this hour.
Every deployment from an uploaded archive now checks the unpacked release against a list of files known to be malicious, and stops before anything is built or changed if it finds one, naming the files to remove. Magento 2 releases also get a warning when they hold PHP files under pub/ that are not Magento's own.
SecurityIf your billing is arranged with Corefinity outside the control panel, you can now upgrade a site's package, add capacity, change its server type and resize its staging environments yourself. No price is quoted in the control panel for these changes; they are invoiced as part of your existing arrangement.
Retrying a deployment that is not the newest on its environment now tells you which commit it will put live and which deployment is the newest, and goes ahead only once you confirm. The API and the MCP tool ask for the same confirmation, sent as confirm_older.
The menu groups Organisation, Billing, Tools and agency pages, and Tickets is now Support. Site, cluster, billing, organisation, profile and role pages share one layout with a section menu, every list and table has search and filters that stay in the page address, agencies can search and star clients in the client switcher, and dialogs, buttons and links are tidier and more consistent.
Reading a deployment pipeline through the API or the MCP server now lists, for a classic pipeline, every command it runs in the order a deployment runs them, under the names the deployment page uses, including the commands it inherits from the platform's shared pipeline. Credentials stay hidden.
Every refusal from the public API now carries a code equal to its reason, and every endpoint answers a field that is missing or wrong with 422 invalid, naming the field. A typed confirmation that does not match, such as the environment's name when turning external database access off, is confirm_mismatch in the same words the AI assistant tools use.
The release archive of each deployment is now kept for 30 days, and always for an environment's 10 most recent deployments and its newest successful one. An older deployment whose archive has been removed can no longer be retried or rolled back: deploy again from its branch or commit instead.
Reading or changing PHP settings on a site whose settings the control panel does not manage now refuses with not_available, and a command the control panel will not run refuses with invalid_arguments. Both carry a code, in the same words and with the same code as the AI assistant tools.
When a CoreStack Enterprise environment moving to CoreStack needs a larger staging size than its disk suggests, you can now see the question and answer it through the API and the MCP server, as well as on the environment's page. Accepting a size that costs more asks you to confirm the extra cost.
When a CoreStack Enterprise environment on our AWS cluster moves to CoreStack, its staging size is now suggested from the memory it actually used, as it already is for environments on Google Cloud. If it needs a larger size than its disk suggests, you are asked to choose, and the question says how many days of figures it is based on.
The billing routes of the API now take account_id, the name the AI assistant tools use, as well as account to choose a billing account, with the same answers either way.
The usage charts that AI assistants show through the control panel's MCP server now name memory and disk in GB, MB and TB, like the rest of the control panel. The figures themselves are unchanged.
The usage history charts on a site's Overview and on a cluster's usage card now use the control panel's new chart style. They follow light and dark mode as you switch, can be shown as a table and keep the limit and guaranteed labels apart.
The site check that AI assistants run through the control panel's MCP server now names response sizes in KB and MB, as the rest of the control panel does. Cluster and site pages name memory and disk in GB for every user. The figures themselves are unchanged.
The dashboard's 30-day PageSpeed trend and a site's PageSpeed history now use the panel's charts: hover or use the arrow keys to read each day's medians and each run's score, band and metrics, failed runs are marked on the axis, and both follow dark mode.
PerformanceEach result now shows how long the server took to answer, apart from the time spent connecting, so a slow connection no longer makes a fast site look slow. It is in the control panel, the API and for AI assistants.
PerformancePerformance audits can now be edited, deleted and shared, and their GTmetrix reports generated and read, through the public API and the MCP tools, the same way as in the control panel. A delete asks for the audit's name, and GTmetrix reports for the number of tests, to confirm.
PerformanceBefore a copy replaces an existing environment, the copy dialog now asks you to type that environment's name.
The CoreClusters widget shows each cluster as a tile with its CPU, memory and storage, Moving to CoreStack fits the sites it lists, links and buttons on dashboards show the pointer again, the Clients card's attention count opens Client health with each reason, and the Add widget gallery is easier to browse. Cluster answers in the Control Panel, the API and MCP no longer include node counts; capacity is shown as CPU, memory and storage.
Fixes 37
You can continue straight away; choose a different package if you need more.
On an environment's SSH access card, the options that open from Add my IP were cut off at the bottom of the card, so the Add button could not be reached. They now show in full and you can scroll down to Add.
Signing in, or entering your two-factor code, could fail with "Unauthenticated." when another control panel tab in the same browser was loading at the same time. Your new sign-in now stays in place. Signing in with Google or GitHub for an email without an account now links you to the order page.
When a build line failed, its deployment kept only which line failed, so once the live output had gone there was no way to see why. The build now keeps what its commands printed, up to the last 512 KiB, so the deployment page still shows the failing command's own messages. A successful build keeps its output the same way.
While a change was being made to a site, the sites table on a cluster page could show it as a MariaDB version change with a missing version. It now names the change itself, such as SSH keys or PHP configuration, and shows the old and new versions only for a PHP or MariaDB version change.
On a site that deploys from Git, the Deploy button at the top of the page did nothing while the Deployments tab was open. It now opens that tab when needed and asks you to confirm deploying the branch, with the pipeline to use when there are several, and says why when a deployment cannot start.
A release archive uploaded through the deployment API was refused on a CoreStack environment, including one moved from CoreStack Enterprise. Anyone who can deploy the site from the control panel can now upload to it with their API token, as before, and each upload is recorded in the site's activity.
On some CoreStack sites every save of custom nginx rules failed its check, even when the rules were valid, because the check was missing one of the site's own platform files. The check now uses every file the site does, so valid rules save again.
A pre-built release installed without Composer's platform check now deploys to CoreStack even when some of its packages declare a PHP range outside the site's PHP: each one is listed as a warning on the "Checking PHP requirements" step. Missing PHP extensions, your composer.json's own PHP range, and releases that ship the platform check are still refused.
PHPA Shopware 5 repository without custom/plugins or custom/project (Git does not keep empty folders) now deploys: each deployment creates the folders Shopware 5 needs before the new release goes live, instead of the release failing its health check.
ShopwareNew Shopware 5 shops are installed with laminas/laminas-code 4.11.0, the PHP 8.2 version Shopware allows, so deploying the shop's own code from Git is no longer refused, and the standard build runs on a Shopware release tree. Where a site's platform offers no other PHP version, a refused deployment now says which package or requirement to update.
ShopwareSteps from your own pipeline are named by where they sit in it, for example Build command 3, and show the command that ran, on the deployment page, in Slack alerts and in tickets raised from a failed deployment.
A site's and a cluster's usage graphs now add CPU and memory readings every 10 minutes, each within about 20 minutes of being measured, and disk readings every 20 minutes, within about 40. Before, they could lag by close to an hour, and disk by more.
A site whose staging environment has moved to the platform while its live site still runs on the old hosting is no longer shown as down, and no longer raises a "Site is down" alert or Node.js, PHP or application version warnings about the live site, which the platform does not run yet. Its environments on the platform are checked as before.
After a planned maintenance pause ended, new deploys on a busy cluster could stay Queued for a long time. Now only the deploys that waited during the pause are started a few at a time, and once those are on their way, new deploys start straight away.
While planned maintenance pauses deploys, a queued deploy's page now says it is queued and will start by itself, with the expected time when there is one, and that there is no need to cancel it or deploy again. Once the pause ends it says the deploy is starting shortly.
On environments whose SSH access is managed by the control panel, deployments built from some VSF images stopped at the Create Ssh Key step with a permission error. The build now prepares the web user's SSH folder itself, so these deployments run again, and deployment output no longer shows a misleading "no mount point specified" line.
The Nginx tab failed to load on Shopware 5 environments. It now opens and checks your rules the same way as on the other platforms.
ShopwareWhen GitHub, GitLab or Bitbucket refuses the webhook that starts a deployment on each push, the repository now says so and why, with what to do about it, instead of showing the webhook as being added. Reconnecting the account, or connecting the repository again, tries again.
Some buttons were not shown: Edit on the company and cluster maintenance window cards, Change and Choose another in the restore wizard, Restore to on the Snapshots page, Copy known_hosts and the host key rotation buttons, and Retry and Show older on several lists. They all show and work again.
When several deployments were queued on one pipeline, they could run in a different order from the one they were started in, so an older commit could finish last and stay live. They now always run in the order they were started, and a waiting deployment's output names the deployment it is waiting for.
When you ask the API or the MCP tools for upcoming maintenance across all your sites, the answer now includes your CoreStack sites that are not in a CoreCluster, and a token limited to particular sites lists every one of them however many sites you have. Before, some sites could be left out, so the list could come back empty.
Attaching a domain could fail at its last step, the cache flush, when the PHP Redis extension was switched off. The flush no longer needs it, and a site with no Redis skips the flush and records that. A staging or development environment now keeps its outgoing mail held when a domain is attached.
PerformanceWhen a CoreStack Enterprise environment's move to panel-managed SSH keys is on hold, its SSH page, the API and the AI tools no longer say it switches over on a date that will not happen. They show the date again once the switch-over is planned.
An id that does not exist and an id you cannot see now get the same 404 answer, {"message": "Not found."}, from every part of the API.
Listing an environment's repositories through the API now hides a repository connected with a git account you cannot use, as the control panel does, and reports each repository's pipeline correctly.
A whole copy (files and database) into an environment with a smaller disk is now sized by the data the site actually uses, as files-only and database-only copies already were. A files-only Shopware copy into an environment that has no shop database yet no longer stops at the theme compile: the copy says the theme compiles once the database is copied, in the control panel, the API and the MCP server alike.
ShopwareWhen two environments run on one server and the control panel manages SSH on one of them, the other one's SSH page now says where its SSH is managed and links there. Adding, changing or removing that environment's own keys is refused with the same words in the control panel, the API and the AI tools.
Applying a site's pending changes, now or in the maintenance window, places the site on any server of its cluster that has room. Before, one full server could hold the changes back even when another server had room.
A Magento 2 deployment on Kubernetes now purges the Varnish cache once the new pods are online and before maintenance mode comes off, so pages from the previous release are not served after the switch. Purging everything in Varnish on a CoreStack or CoreCluster site now also clears files Magento does not tag, such as robots.txt and sitemaps.
PerformanceControl panel pages and the API's company answers no longer include other users' names, email addresses or mobile numbers. Your team's details are still on the team screens and the team API.
Deployments using the shared WordPress pipeline no longer run a build step that failed; environments with their own build or post-deploy commands are unchanged.
WordPressOn environments that use deployment pipeline version 2, a deployment now keeps WordPress's wp-content/uploads, and Laravel's storage folder and .env file, on the site's shared storage instead of replacing them with the release's own copies. Files already there are carried over once from the live site and never overwritten.
WordPressA redirect limited to some of a site's domains now updates by itself when the site's domains or address change: it starts working on a domain the site gains and stops on one it loses, without saving the redirects again.
While deleting is switched off for a moment, deleting a site or an environment or restoring a deleted site through the API now answers 503 switched_off, in the same words and with the same code as the AI assistant tools, instead of 404 feature_off.
A restore that can only run as a fast swap, onto an environment whose platform version cannot prepare it, is now refused straight away with a plain reason instead of stopping the environment for about 15 minutes and rolling back. Copies onto such an environment take the usual copy path.
A connection that needs re-authorising now offers Reconnect (Replace access token for self-hosted GitLab). Remove connection no longer deletes environments' repository settings: it names the environments that still deploy through the connection and waits for them. Connections can also be listed and removed through the API and MCP.
