Deprecation Schedule

This page lists every deprecated feature, the version it will be removed in, and how to migrate. Until removal, deprecated features continue to work. Detection methods and warning behavior vary by feature; check the applicable Detection row and the detection summary.

Removal in v1.5.0

Legacy aggregate container stats endpoint

GET /api/v1/containers/stats was removed when fleet-level stats moved to the dedicated stats API. Current releases catch the old path and return 410 Gone with migration targets instead of treating stats as a container id.

Implicit wildcard CORS origin

Older drydock releases allowed DD_SERVER_CORS_ENABLED=true without DD_SERVER_CORS_ORIGIN and treated it like * (all origins). Since v1.5.0-rc.9, drydock fails closed instead: startup throws an error and the server does not start.

v1.6.0 removals and deferrals

Unversioned API paths (/api/*)

The unversioned /api/* path was a backward-compatible alias for /api/v1/*. As of v1.6.0, /api/* requests return 410 Gone with a JSON body pointing at the /api/v1/ equivalent, except the four whitelisted wud-card compatibility endpoints — those keep working at /api/* when DD_COMPAT_WUDCARD=true, served by their own router rather than by falling through to the removed alias, so they're unaffected by this removal (three return WUD's bare-array response shape instead of drydock's envelope; the fourth passes through unmodified). Two standalone auth aliases are unaffected for the same reason, unconditionally: GET /api/auth/methods (registered directly on the app, removed on its own v1.7.0 timeline) and GET /api/auth/status (also registered directly on the app, a permanent compatibility alias for GET /api/v1/auth/status with no removal scheduled).

Legacy WUD_* environment variables

WUD_* prefixed environment variables are ignored as of v1.6.0. Only DD_* variables are loaded at runtime; the migration CLI still recognizes old names so it can rewrite existing files.

Legacy wud.* container labels

wud.* prefixed Docker labels are ignored as of v1.6.0. Only dd.* labels affect container discovery, display, grouping, hooks, rollback, webhooks, and trigger behavior.

Legacy template variable aliases

Simple template aliases (id, name, watcher, kind, semver, local, remote, link) and the batch alias count are no longer supplied to templates.

PUT /api/settings

The PUT method on /api/settings is a compatibility alias for PATCH. Responses include Deprecation and Sunset HTTP headers.

HTTP OIDC discovery URLs

OIDC providers configured with http:// discovery URLs are rejected. Identity Providers must serve discovery over HTTPS.

Legacy password hash formats

SHA-1, APR1/MD5 (Apache), crypt, and plain-text password hashes are rejected. Basic authentication accepts only the documented argon2id hash format.

Kafka clientId configuration key

The camelCase clientId key is rejected by Kafka trigger validation.

DD_WATCHER_*_WATCHDIGEST environment variable

Per-watcher digest watching via environment variable has been removed.

DD_WATCHER_*_WATCHATSTART environment variable

Watching at startup is always scheduled. WATCHATSTART is no longer part of watcher configuration, including the former false suppression behavior.

Token-only Hub/DHI PUBLIC_TOKEN configuration

Hub/DHI public instances that provide PUBLIC_TOKEN without the matching PUBLIC_LOGIN are rejected instead of silently falling back to anonymous access. The TOKEN key itself remains supported as part of a complete LOGIN+TOKEN pair.

Removal in v1.7.0

curl in Docker image

The official Docker image keeps curl available in v1.5.x and v1.6.x for backward compatibility with custom healthcheck overrides. The default built-in HEALTHCHECK uses the lightweight static binary (/bin/healthcheck) instead.

DD_TRIGGER_* environment variable prefix

The DD_TRIGGER_* prefix is being replaced by semantic prefixes that distinguish action triggers from notification triggers.

dd.trigger.include / dd.trigger.exclude container labels

These labels are being replaced by semantic equivalents.

A legacy label applies to both trigger categories, but only as a fallback: for a given category it is consulted only when that category's own scoped label is absent from the container. It is never merged with a scoped label that is present. So dd.action.include=docker plus dd.trigger.include=slack filters action triggers by docker and notification triggers by slack.

Manual updates bypass dd.action.include / dd.action.exclude

In v1.5.x, the trigger-not-included and trigger-excluded eligibility reasons are soft blockers: the UI shows a Trigger filtered / Trigger excluded pill, but clicking the per-row Update button still queues the update after a confirmation step. In v1.7.0 these reasons become hard blockers and the Update button is locked when the labels filter out the action trigger.

Unversioned GET /api/auth/methods alias

GET /api/auth/methods is a legacy, unversioned auth-discovery alias kept unauthenticated so the login screen can render before a session exists. It's registered directly on the app, ahead of the /api mounts, so it survived the /api/* path removal in v1.6.0 and keeps working on its own separate v1.7.0 timeline.

Agent-less Home Assistant MQTT topic layout (multi-agent)

The current Home Assistant MQTT topic layout (<topic>/<watcher>/<container> and the watcher-level sensor topics) has no agent segment. In a multi-agent deployment where the controller and one or more agents all use the default watcher name local, two containers with the same name on different agents publish to — and overwrite — the same MQTT topic, and watcher-level sensor counts sum across all agents.

Removal in v1.8.0

Legacy auth strategies response shape

GET /auth/strategies returns the older { strategies, warnings } response shape. The canonical replacement, GET /api/v1/auth/status (also available at /api/auth/status and /auth/status), returns { providers, errors } — the same provider list plus structured startup registration errors. Its unversioned alias, GET /api/auth/methods, is removed outright in v1.7.0 (see above), ahead of this response-shape migration deadline.

Enforced security changes (no deprecation window)

These behaviors were removed immediately rather than going through a grace period, because the deprecated behavior was itself the vulnerability. They're listed here for upgrade visibility, not because they're still active.

Implicit reverse-proxy header trust for CSRF origin checks

Command trigger process-environment inheritance

HTTP trigger requests to cloud metadata endpoints

Detection summary

Drydock provides multiple channels for discovering deprecated feature usage: