--- title: "December 2025 | Phase Changelog" description: "Secret referencing fixes, backend performance optimization with dynamic gunicorn workers, production Docker improvements, and more." url: https://phase.dev/changelog/december-2025/ --- [Changelog](https://phase.dev/changelog/) 2025.12.31 # December 2025 Secret referencing fixes, backend performance optimization with dynamic gunicorn workers, production Docker improvements, and more. [console](https://phase.dev/changelog/tag/console/)[cli](https://phase.dev/changelog/tag/cli/)[performance](https://phase.dev/changelog/tag/performance/)[secrets](https://phase.dev/changelog/tag/secrets/)[self-hosting](https://phase.dev/changelog/tag/self-hosting/) December was a stability and reliability month. We resolved a series of secret referencing edge cases across both Console and CLI, shipped a significant backend performance optimization, improved Docker images for self-hosted deployments, and fixed several bugs. Here's the recap. * * * ## Secret Referencing Fixes We identified and fixed a series of edge cases in the secret referencing engine across both the Console and CLI: - **Cross-environment references from within folders** — Fixed an issue where references to secrets in other environments would fail to resolve when the referencing secret was inside a folder - **Cross-app references without a defined environment** — The CLI now correctly requires cross-app secret references to include an explicit environment, preventing ambiguous resolutions - **Double-brace syntax detection** — References using `${{VAR}}` syntax (common in GitHub Actions templates) are now properly ignored by the Phase referencing engine instead of being treated as invalid Phase references - **Inconsistent string matching** — Fixed string matching issues in the CLI's secret referencing engine that could cause incorrect substitutions These fixes affect both the Console reference resolution and the CLI's `phase run` / `phase shell` commands. Available in [Console v2.56.0](https://github.com/phasehq/console/releases/tag/v2.56.0), [v2.56.1](https://github.com/phasehq/console/releases/tag/v2.56.1), and [CLI v1.21.2](https://github.com/phasehq/cli/releases/tag/v1.21.2). * * * ## Backend Performance — Dynamic Gunicorn Workers The Phase backend now dynamically sets the number of gunicorn workers based on available CPU cores (`cores × 2 + 1`). Internal benchmarks showed approximately 25% faster response times for large secret fetches. Additionally, SSE (Server-Sent Events) environment crypto computations have been optimized, reducing the computational overhead for real-time secret sync events. Available in [Console v2.56.0](https://github.com/phasehq/console/releases/tag/v2.56.0). * * * ## Production Docker Improvements Several improvements to the Docker images for self-hosted deployments: - **Frontend `STOPSIGNAL`** — Added `STOPSIGNAL` to the frontend Dockerfile for cleaner and faster container shutdown behavior These changes result in smaller, more reliable container images. Available in [Console v2.56.2](https://github.com/phasehq/console/releases/tag/v2.56.2). * * * ## Bulk User Invites Admins can now invite multiple users to their organization more efficiently. The invite flow has been streamlined to support batch operations. * * * ## Other improvements and fixes - **Fix role validation for invites** — Fixed a mismatch between the frontend (allowing custom roles) and backend (hardcoded role whitelist) when creating member invites - **Fix invite emails without sender name** — The "Invited by" field now correctly falls back to the inviting user's email when their OAuth account has no display name - **Fix WebAuth error handling** — Enhanced error handling in the WebAuth component for malformed URLs - **Fix AWS IAM external identities region** — Fixed region configuration for AWS IAM external identity authentication - **Fix email invite handler** — Corrected the invite handler to properly fall back to user email addresses - **CLI build improvements** — Upgraded macOS builds to `macos-15` runners and fixed ASCII art text escaping - **Security patches** — Updated Django to 4.2.27, urllib3 to 2.6.0, and other dependency updates * * * All features are live on [Phase Cloud](https://console.phase.dev) and available in the latest releases for self-hosted users. As always, we'd love your feedback — come say hi on [Slack](https://slack.phase.dev) or [GitHub](https://github.com/phasehq). RoadmapCommunity-driven Request a feature We build features based on community requests and feedback. Looking for a specific feature or have a use-case in mind? Reach out to us. [Feature request](https://github.com/phasehq/console/issues/new?template=feature_request.md) DeploymentSelf-hosted / Cloud Get started ## Keep your secrets Self-host or start on fully managed Cloud in under a minute. Self-hosted Run Phase on your own infrastructure. Free and open source. AI agent deployment skill [![Docker Compose logo](https://phase.dev/assets/images/docker.svg)](https://docs.phase.dev/self-hosting/docker-compose)[![Kubernetes logo](https://phase.dev/assets/images/kubernetes.svg)](https://docs.phase.dev/self-hosting/kubernetes)[![AWS logo](https://phase.dev/assets/images/aws.svg)](https://docs.phase.dev/self-hosting/aws-eks)[![GCP logo](https://phase.dev/assets/images/gcp.svg)](https://docs.phase.dev/self-hosting/gcp)[![Azure logo](https://phase.dev/assets/images/azure.svg)](https://docs.phase.dev/self-hosting/azure)[![Railway logo](https://phase.dev/assets/images/railway.svg)](https://docs.phase.dev/self-hosting/railway)[![Raspberry Pi logo](https://phase.dev/assets/images/raspberry.svg)](https://docs.phase.dev/self-hosting/raspberrypi) [Self-hosting guide](https://docs.phase.dev/self-hosting) Cloud Fully managed. From signup to your first secret in 60 seconds. Sign up with [Google](https://console.phase.dev/login?provider=google)[GitHub](https://console.phase.dev/login?provider=github)[GitLab](https://console.phase.dev/login?provider=gitlab)