Use apt_update_safe instead of aborting on a failed apt update

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

.github/workflows/scripts/generate-app-headers.sh

@@ -22,7 +22,9 @@ generate_headers() {
   for script in "${file_list[@]}"; do
     [[ -f "$script" ]] || continue
 
-    app_name=$(grep -oP '^APP="\K[^"]+' "$script" 2>/dev/null)
+    # -m1: a script that sets APP twice (the second carrying ${var_version})
+    # otherwise yields both lines, and the filename gets a newline in it.
+    app_name=$(grep -m1 -oP '^APP="\K[^"]+' "$script" 2>/dev/null)
     if [[ -n "$app_name" ]]; then
       # core.func/vm-core.func look the header up as "${APP,,}" without spaces,
       # so the generated file has to be named after APP - not after the script.

CHANGELOG.md

@@ -546,6 +546,72 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-09-23
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - immich: keep geodata linked and the build deps present on update [@MickLesk](https://github.com/MickLesk) ([#17438](https://github.com/community-scripts/ProxmoxVE/pull/17438))
+
+### 💾 Core
+
+  - VM-Core: decide console autologin from the image, not USE_CLOUD_INIT [@MickLesk](https://github.com/MickLesk) ([core#63](https://github.com/community-scripts/core/pull/63))
+- VM-Core: report failed image steps and restore tty1 autologin without cloud-init [@MickLesk](https://github.com/MickLesk) ([core#62](https://github.com/community-scripts/core/pull/62))
+- tools: raise pnpm/yarn fetch timeout and lower network concurrency [@MickLesk](https://github.com/MickLesk) ([core#59](https://github.com/community-scripts/core/pull/59))
+- VM-Core: stop discarding cloud-init error messages [@MickLesk](https://github.com/MickLesk) ([core#60](https://github.com/community-scripts/core/pull/60))
+
+## 2026-09-22
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(invoiceshelf): re-link storage during update [@owenvoke](https://github.com/owenvoke) ([#17431](https://github.com/community-scripts/ProxmoxVE/pull/17431))
+    - fix(alpine-it-tools): write the version file after a successful update [@Houtek](https://github.com/Houtek) ([#17421](https://github.com/community-scripts/ProxmoxVE/pull/17421))
+    - Umami: Align pnpm with engines.pnpm on update [@ReneNulschDE](https://github.com/ReneNulschDE) ([#17404](https://github.com/community-scripts/ProxmoxVE/pull/17404))
+
+  - #### 🔧 Refactor
+
+    - several scripts: let uv see the project before syncing it | refactor some scripts that use uv [@MickLesk](https://github.com/MickLesk) ([#17436](https://github.com/community-scripts/ProxmoxVE/pull/17436))
+
+### 💾 Core
+
+  - setup_uv: honour a project's required-version pin [@MickLesk](https://github.com/MickLesk) ([core#58](https://github.com/community-scripts/core/pull/58))
+- fix(motd): repair legacy 00_lxc-details.sh header and dead color placeholders [@BadFlo](https://github.com/BadFlo) ([core#53](https://github.com/community-scripts/core/pull/53))
+- meilisearch: take the raw binary, not the .deb [@MickLesk](https://github.com/MickLesk) ([core#57](https://github.com/community-scripts/core/pull/57))
+
+### 📚 Documentation
+
+  - github: Stop generating header filenames with a newline in them [@MickLesk](https://github.com/MickLesk) ([#17435](https://github.com/community-scripts/ProxmoxVE/pull/17435))
+
+### ❔ Uncategorized
+
+  - chore(ct): sync cloudflare-ddns defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17446](https://github.com/community-scripts/ProxmoxVE/pull/17446))
+
+## 2026-09-21
+
+### 🆕 New Scripts
+
+  - AudioMuse-AI ([#17415](https://github.com/community-scripts/ProxmoxVE/pull/17415))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(portabase): meet the default admin password rules [@maksimtech](https://github.com/maksimtech) ([#17384](https://github.com/community-scripts/ProxmoxVE/pull/17384))
+    - truenas-vm: strip the G before the storage allocation [@MickLesk](https://github.com/MickLesk) ([#17407](https://github.com/community-scripts/ProxmoxVE/pull/17407))
+    - Librenms - Fix local snmpd community string setup [@dopch](https://github.com/dopch) ([#17363](https://github.com/community-scripts/ProxmoxVE/pull/17363))
+    - fix(iventoy): preserve release data and migrate legacy service launchers [@Msprg](https://github.com/Msprg) ([#17161](https://github.com/community-scripts/ProxmoxVE/pull/17161))
+    - xyops: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17398](https://github.com/community-scripts/ProxmoxVE/pull/17398))
+
+### 💾 Core
+
+  - Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#56](https://github.com/community-scripts/core/pull/56))
+- github-api: take the release the maintainer marked as latest [@MickLesk](https://github.com/MickLesk) ([core#55](https://github.com/community-scripts/core/pull/55))
+- general: prune old Rust toolchains [@MickLesk](https://github.com/MickLesk) ([core#52](https://github.com/community-scripts/core/pull/52))
+- Ask when the preselected storage cannot hold the content [@MickLesk](https://github.com/MickLesk) ([core#51](https://github.com/community-scripts/core/pull/51))
+
 ## 2026-09-20
 
 ### 🆕 New Scripts

ct/2fauth.sh

@@ -33,7 +33,7 @@ function update_script() {
   fi
   setup_mariadb
   if check_for_gh_release "2fauth" "Bubka/2FAuth"; then
-    $STD apt update
+    apt_update_safe
     $STD apt -y upgrade
 
     msg_info "Creating Backup"

ct/alpine-it-tools.sh

@@ -40,6 +40,7 @@ function update_script() {
     cp -r /tmp/dist/* /usr/share/nginx/html
     rm -rf /tmp/dist
     rm -f it-tools.zip
+    echo "${RELEASE}" >/opt/${APP}_version.txt
     msg_ok "Updated successfully!"
   else
     msg_ok "No update required. ${APP} is already at ${RELEASE}"

ct/apache-cassandra.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating Apache Cassandra"
-  $STD apt update
+  apt_update_safe
   $STD apt install -y --only-upgrade cassandra cassandra-tools
   msg_ok "Updated Apache Cassandra"
   msg_ok "Updated successfully!"

ct/apache-couchdb.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating Apache CouchDB"
-  $STD apt-get update
+  apt_update_safe
   $STD apt-get install -y --only-upgrade couchdb
   msg_ok "Updated Apache CouchDB"
   msg_ok "Updated successfully!"

ct/apt-cacher-ng.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating Apt-Cacher-NG"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated Apt-Cacher-NG"
   msg_ok "Updated successfully!"

ct/aria2.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating Aria2"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated Aria2"
   msg_ok "Updated successfully!"

ct/audiobookshelf.sh

@@ -32,7 +32,7 @@ function update_script() {
   fi
 
   msg_info "Updating AudiobookShelf"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated AudiobookShelf"
   msg_ok "Updated successfully!"

ct/audiomuse-ai.sh

@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/NeptuneHub/AudioMuse-AI
+
+APP="AudioMuse-AI"
+var_tags="${var_tags:-music;ai}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-8192}"
+var_disk="${var_disk:-20}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/audiomuse-ai ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "audiomuse-ai" "NeptuneHub/AudioMuse-AI"; then
+    msg_info "Stopping Services"
+    systemctl stop audiomuse-ai audiomuse-ai-worker audiomuse-ai-worker-high audiomuse-ai-janitor audiomuse-ai-control
+    msg_ok "Stopped Services"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "audiomuse-ai" "NeptuneHub/AudioMuse-AI" "tarball"
+
+    AUDIOMUSE_BACKEND="$(cat /opt/audiomuse-ai_data/.backend 2>/dev/null || echo cpu)"
+    REQ_COMMON="common.txt"
+    case "$AUDIOMUSE_BACKEND" in
+    gpu)
+      REQ_ACCEL="gpu.txt"
+      [[ "$(uname -m)" == "aarch64" ]] && REQ_ACCEL="gpu-arm64.txt"
+      ;;
+    cpu-noavx2)
+      REQ_COMMON="common-noavx2.txt"
+      REQ_ACCEL="cpu-noavx2.txt"
+      ;;
+    *)
+      REQ_ACCEL="cpu.txt"
+      ;;
+    esac
+
+    msg_info "Updating Python Environment (${AUDIOMUSE_BACKEND})"
+    cd /opt/audiomuse-ai
+    $STD uv venv --seed --python 3.12 /opt/audiomuse-ai/.venv
+    $STD uv pip install --python /opt/audiomuse-ai/.venv \
+      -r "/opt/audiomuse-ai/requirements/${REQ_COMMON}" \
+      -r "/opt/audiomuse-ai/requirements/${REQ_ACCEL}"
+    msg_ok "Updated Python Environment (${AUDIOMUSE_BACKEND})"
+
+    msg_info "Starting Services"
+    systemctl start audiomuse-ai audiomuse-ai-worker audiomuse-ai-worker-high audiomuse-ai-janitor audiomuse-ai-control
+    msg_ok "Started Services"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8000${CL}"

ct/authelia.sh

@@ -34,7 +34,7 @@ function update_script() {
   fi
 
   if check_for_gh_release "authelia" "authelia/authelia"; then
-    $STD apt update
+    apt_update_safe
     $STD apt -y upgrade
     fetch_and_deploy_gh_release "authelia" "authelia/authelia" "binary"
     msg_ok "Updated successfully!"

ct/authentik.sh

@@ -45,7 +45,6 @@ function update_script() {
 
   NODE_VERSION="26" NODE_MODULE=pnpm@12 setup_nodejs
   $STD uv cache clean
-  UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.7" setup_uv
   RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
   setup_yq
 
@@ -95,6 +94,7 @@ function update_script() {
     fi
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
+    UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.7" UV_PROJECT_DIR="/opt/authentik" setup_uv
     GO_VERSION="$(grep -m1 '^go ' /opt/authentik/go.mod | awk '{print $2}')" setup_go
 
     msg_info "Configuring rust"

ct/autocaliweb.sh

@@ -31,8 +31,6 @@ function update_script() {
     exit
   fi
 
-  setup_uv
-
   RELEASE=$(get_latest_codeberg_release "gelbphoenix/autocaliweb")
   if check_for_codeberg_release "autocaliweb" "gelbphoenix/autocaliweb"; then
     msg_info "Stopping Services"
@@ -43,6 +41,7 @@ function update_script() {
     export VIRTUAL_ENV="${INSTALL_DIR}/venv"
     $STD tar -cf ~/autocaliweb_bkp.tar "$INSTALL_DIR"/{metadata_change_logs,dirs.json,.env,scripts/ingest_watcher.sh,scripts/auto_zipper_wrapper.sh,scripts/metadata_change_detector_wrapper.sh}
     fetch_and_deploy_codeberg_release "autocaliweb" "gelbphoenix/autocaliweb" "tarball" "latest" "/opt/autocaliweb"
+    setup_uv $INSTALL_DIR
     
     msg_info "Updating Autocaliweb"
     cd "$INSTALL_DIR" 

ct/baserow.sh

@@ -39,6 +39,7 @@ function update_script() {
 
     create_backup /opt/baserow/.env
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "baserow" "baserow/baserow" "tarball"
+    UV_PROJECT_DIR="/opt/baserow/backend" setup_uv
     restore_backup
 
     msg_info "Configuring Baserow"

ct/beaverhabits.sh

@@ -40,6 +40,7 @@ function update_script() {
     create_backup /opt/beaverhabits/.user
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "beaverhabits" "daya0576/beaverhabits" "tarball"
+    PYTHON_VERSION="3.14" UV_PROJECT_DIR="/opt/beaverhabits" setup_uv
 
     msg_info "Syncing Dependencies"
     cd /opt/beaverhabits

ct/bunkerweb.sh

@@ -39,7 +39,7 @@ Package: bunkerweb
 Pin: version ${RELEASE}
 Pin-Priority: 1001
 EOF
-    $STD apt update
+    apt_update_safe
     $STD apt-mark unhold bunkerweb nginx
     $STD apt install -y --allow-downgrades bunkerweb="${RELEASE}"
     msg_ok "Updated BunkerWeb"

ct/byparr.sh

@@ -37,6 +37,7 @@ function update_script() {
     msg_ok "Stopped Service"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Byparr" "ThePhaseless/Byparr" "tarball" "latest"
+    UV_PROJECT_DIR="/opt/Byparr" setup_uv
 
     if ! dpkg -l | grep -q ffmpeg; then
       msg_info "Installing dependencies"

ct/caddy.sh

@@ -40,7 +40,7 @@ update_deb_based() {
   fi
 
   msg_info "Updating Caddy LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated Caddy LXC"
 

ct/casaos.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating ${APP} LXC"
-  $STD apt-get update
+  apt_update_safe
   $STD apt-get -y upgrade
   msg_ok "Updated ${APP} LXC"
   msg_ok "Updated successfully!"

ct/cloudflare-ddns.sh

@@ -9,8 +9,8 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 
 APP="Cloudflare-DDNS"
 var_tags="${var_tags:-network}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-1024}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-512}"
 var_disk="${var_disk:-3}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"

ct/cloudflared.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating $APP LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated $APP LXC"
   msg_ok "Updated successfully!"

ct/cockpit.sh

@@ -32,7 +32,7 @@ function update_script() {
   fi
 
   msg_info "Updating ${APP} LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated ${APP} LXC"
 

ct/ddclient.sh

@@ -33,7 +33,7 @@ function update_script() {
   fi
 
   msg_info "Updating ddclient"
-  $STD apt update
+  apt_update_safe
   $STD apt install --only-upgrade -y ddclient
   $STD systemctl restart ddclient
   msg_ok "Updated ddclient"

ct/debian.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating $APP LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated $APP LXC"
   msg_ok "Updated successfully!"

ct/deconz.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating deCONZ"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated deCONZ"
   msg_ok "Updated successfully!"

ct/defguard.sh

@@ -33,7 +33,7 @@ function update_script() {
   fi
 
   msg_info "Updating Defguard"
-  $STD apt update
+  apt_update_safe
   $STD apt install -y defguard defguard-proxy
   msg_ok "Updated Defguard"
 

ct/deluge.sh

@@ -32,7 +32,7 @@ function update_script() {
   fi
   msg_info "Updating Deluge"
   ensure_dependencies python3-setuptools
-  $STD apt update
+  apt_update_safe
   $STD pip3 install deluge[all] "pyopenssl<25" --upgrade
   msg_ok "Updated Deluge"
   msg_ok "Updated successfully!"

ct/devuan.sh

@@ -32,7 +32,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating Devuan LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated Devuan LXC"
   exit

ct/dispatcharr.sh

@@ -32,7 +32,6 @@ function update_script() {
     exit
   fi
 
-  setup_uv
   NODE_VERSION="24" setup_nodejs
   if [[ -f "/etc/nginx/sites-available/dispatcharr.conf" ]] && ! grep -q "real_forwarded_proto" "/etc/nginx/sites-available/dispatcharr.conf"; then
     msg_info "Migrating Nginx Configuration"
@@ -146,6 +145,7 @@ EOF
     msg_ok "Backup created: $BACKUP_FILE"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "dispatcharr" "Dispatcharr/Dispatcharr" "tarball"
+    UV_PROJECT_DIR="/opt/dispatcharr" setup_uv
 
     restore_backup
 

ct/docker.sh

@@ -36,7 +36,7 @@ catch_errors
 
 update_deb_based() {
   msg_info "Updating base system"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Base system updated"
 

ct/dotnetaspwebapi.sh

@@ -31,7 +31,7 @@ function update_script() {
         exit
     fi
     msg_info "Updating ${APP} LXC"
-    $STD apt-get update
+    apt_update_safe
     $STD apt-get -y upgrade
     msg_ok "Updated successfully!"
     exit

ct/drawio.sh

@@ -37,7 +37,7 @@ function update_script() {
     msg_ok "Service stopped"
 
     msg_info "Updating Debian LXC"
-    $STD apt update
+    apt_update_safe
     $STD apt upgrade -y
     msg_ok "Updated Debian LXC"
 

ct/elasticsearch.sh

@@ -33,7 +33,7 @@ function update_script() {
   fi
 
   msg_info "Updating ${APP}"
-  $STD apt update
+  apt_update_safe
   $STD apt install -y elasticsearch
   msg_ok "Updated ${APP}"
 

ct/elementsynapse.sh

@@ -34,7 +34,7 @@ function update_script() {
   NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
 
   msg_info "Updating LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated LXC"
 

ct/evcc.sh

@@ -40,7 +40,7 @@ function update_script() {
       "main"
   fi
   msg_info "Updating evcc LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt --only-upgrade install -y evcc
   msg_ok "Updated successfully!"
   exit

ct/fhem.sh

@@ -32,7 +32,7 @@ function update_script() {
     fi
 
     msg_info "Updating FHEM"
-    $STD apt update
+    apt_update_safe
     $STD apt upgrade -y
     msg_ok "Updated FHEM"
     msg_ok "Updated successfully!"

ct/fireshare.sh

@@ -39,6 +39,7 @@ function update_script() {
 
     create_backup /opt/fireshare/fireshare.env
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "fireshare" "ShaneIsrael/fireshare" "tarball"
+    UV_PROJECT_DIR="/opt/fireshare" setup_uv
     restore_backup
     rm -f /usr/local/bin/fireshare
 

ct/flatnotes.sh

@@ -38,10 +38,10 @@ function update_script() {
 
     create_backup /opt/flatnotes/.env /opt/flatnotes/data
 
-    PYTHON_VERSION="3.13" setup_uv
     NODE_VERSION="24" setup_nodejs
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "flatnotes" "dullage/flatnotes" "tarball"
+    PYTHON_VERSION="3.13" UV_PROJECT_DIR="/opt/flatnotes" setup_uv
 
     restore_backup
 

ct/gitlab.sh

@@ -33,7 +33,7 @@ function update_script() {
   fi
 
   msg_info "Updating GitLab (Patience)"
-  $STD apt update
+  apt_update_safe
   $STD apt install -y gitlab-ce
   msg_ok "Updated GitLab"
 

ct/globaleaks.sh

@@ -31,7 +31,7 @@ function update_script() {
   fi
 
   msg_info "Updating $APP LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated $APP LXC"
   msg_ok "Updated successfully!"

ct/grafana.sh

@@ -49,7 +49,7 @@ update_deb_based() {
   fi
 
   msg_info "Updating Grafana LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt --only-upgrade install -y grafana
   msg_ok "Updated successfully!"
 }

ct/graylog.sh

@@ -43,17 +43,17 @@ function update_script() {
     MONGO_VERSION="8.2" setup_mongodb
 
     msg_info "Updating Graylog"
-    $STD apt update
+    apt_update_safe
     $STD apt upgrade -y
     curl -fsSL "https://packages.graylog2.org/repo/packages/graylog-7.0-repository_latest.deb" -o "graylog-7.0-repository_latest.deb"
     $STD dpkg -i graylog-7.0-repository_latest.deb
-    $STD apt update
+    apt_update_safe
     ensure_dependencies graylog-server graylog-datanode
     rm -f graylog-7.0-repository_latest.deb
     msg_ok "Updated Graylog"
   elif dpkg --compare-versions "$CURRENT_VERSION" ge "7.0"; then
     msg_info "Updating Graylog"
-    $STD apt update
+    apt_update_safe
     $STD apt upgrade -y
     msg_ok "Updated Graylog"
   fi

ct/haproxy.sh

@@ -33,7 +33,7 @@ function update_script() {
   fi
 
   msg_info "Updating ${APP}"
-  $STD apt update
+  apt_update_safe
   $STD apt install -y haproxy
   msg_ok "Updated ${APP}"
 

ct/headers/audiomuse-ai

@@ -0,0 +1,6 @@
+    ___             ___       __  ___                      ___    ____
+   /   | __  ______/ (_)___  /  |/  /_  __________        /   |  /  _/
+  / /| |/ / / / __  / / __ \/ /|_/ / / / / ___/ _ \______/ /| |  / /  
+ / ___ / /_/ / /_/ / / /_/ / /  / / /_/ (__  )  __/_____/ ___ |_/ /   
+/_/  |_\__,_/\__,_/_/\____/_/  /_/\__,_/____/\___/     /_/  |_/___/   
+                                                                      

ct/homarr.sh

@@ -63,7 +63,7 @@ EOF
     fi
 
     msg_info "Updating Nodejs"
-    $STD apt update
+    apt_update_safe
     $STD apt upgrade nodejs -y
     msg_ok "Updated Nodejs"
 

ct/homeassistant.sh

@@ -63,7 +63,7 @@ function update_script() {
   fi
   if [ "$UPD" == "3" ]; then
     msg_info "Installing Home Assistant Community Store (HACS)"
-    $STD apt update
+    apt_update_safe
     cd /var/lib/docker/volumes/hass_config/_data
     $STD bash <(curl -fsSL https://get.hacs.xyz)
     msg_ok "Installed Home Assistant Community Store (HACS)"

ct/homebridge.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating ${APP} LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt install -y homebridge
   msg_ok "Updated successfully!"
   exit

ct/hyperhdr.sh

@@ -32,7 +32,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating $APP LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated $APP LXC"
   msg_ok "Updated successfully!"

ct/hyperion.sh

@@ -32,7 +32,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating ${APP} LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt install -y hyperion
   msg_ok "Updated successfully!"
   exit

ct/immich.sh

@@ -56,7 +56,7 @@ Pin:release a=testing
 Pin-Priority: 450
 EOF
     [[ -f /etc/apt/preferences.d/immich ]] && rm /etc/apt/preferences.d/immich
-    $STD apt update
+    apt_update_safe
     msg_ok "Added Debian Testing repo"
   fi
 
@@ -105,6 +105,7 @@ EOF
     libraries=("libjxl" "jpegli" "libheif" "libraw" "imagemagick" "libvips")
     cd "$BASE_DIR"
     msg_warn "Checking for updates to custom image-processing libraries (recompile time: 2-15min per library)"
+    ensure_dependencies liblcms2-dev libjpeg62-turbo-dev libspng-dev libexif-dev
     $STD git pull
     for library in "${libraries[@]}"; do
       compile_"$library"
@@ -192,6 +193,8 @@ EOF
     export SHARP_FORCE_GLOBAL_LIBVIPS=true
     $STD pnpm --dir "$APP_DIR/node_modules/sharp" exec npm run build
 
+    ln -sfn "$GEO_DIR" "$APP_DIR/geodata"
+
     # Patch helmet.json: disable upgrade-insecure-requests for HTTP access
     if [[ -f "$APP_DIR/helmet.json" ]]; then
       jq '.contentSecurityPolicy.directives["upgrade-insecure-requests"] = null' "$APP_DIR/helmet.json" >"$APP_DIR/helmet.json.tmp" && mv "$APP_DIR/helmet.json.tmp" "$APP_DIR/helmet.json"

ct/infisical.sh

@@ -42,7 +42,7 @@ function update_script() {
   msg_ok "Created backup"
 
   msg_info "Updating Infisical"
-  $STD apt update
+  apt_update_safe
   $STD apt install -y infisical-core
   $STD infisical-ctl reconfigure
   msg_ok "Updated Infisical"

ct/influxdb.sh

@@ -32,7 +32,7 @@ function update_script() {
   fi
   
   msg_info "Updating InfluxDB"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated InfluxDB"
   msg_ok "Updated successfully!"

ct/inventree.sh

@@ -38,7 +38,7 @@ function update_script() {
   fi
 
   msg_info "Updating InvenTree"
-  $STD apt update
+  apt_update_safe
   $STD apt install --only-upgrade inventree -y
   msg_ok "Updated InvenTree"
   msg_ok "Updated successfully!"

ct/invoiceshelf.sh

@@ -54,6 +54,7 @@ function update_script() {
       $STD pnpm run build
     fi
     $STD php artisan migrate --force
+    $STD php artisan storage:link
     $STD php artisan optimize:clear
     chown -R www-data:www-data /opt/invoiceshelf
     msg_ok "Updated Application"

ct/iobroker.sh

@@ -34,7 +34,7 @@ function update_script() {
   NODE_VERSION="24" NPM_VERSION="11" setup_nodejs
 
   msg_info "Updating ${APP} LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated successfully!"
   exit

ct/itsm-ng.sh

@@ -34,7 +34,7 @@ function update_script() {
   setup_mariadb
 
   msg_info "Updating ITSM-NG"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   chown -R www-data:www-data /var/lib/itsm-ng
   mkdir -p /usr/share/itsm-ng/css/palettes

ct/iventoy.sh

@@ -33,15 +33,43 @@ function update_script() {
 
   if check_for_gh_release "iventoy" "ventoy/PXE"; then
     msg_info "Stopping iVentoy"
-    $STD /opt/iventoy/iventoy.sh stop
+    systemctl stop iventoy
     msg_ok "Stopped iVentoy"
 
-    create_backup /opt/iventoy/data /opt/iventoy/iso
+    # Only preserve user state; data/iventoy.dat must match the new executable.
+    create_backup /opt/iventoy/data/config.dat /opt/iventoy/iso /opt/iventoy/user
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "iventoy" "ventoy/PXE" "prebuild" "latest" "/opt/iventoy" "iventoy-*-linux-$(arch_resolve x86_64-free arm64-trial).tar.gz"
     restore_backup
 
+    # Migrate existing services that invoke the Bash launcher with sh.
+    mkdir -p /etc/systemd/system/iventoy.service.d
+    cat <<EOF >/etc/systemd/system/iventoy.service.d/launcher.conf
+[Service]
+ExecStart=
+ExecStart=/bin/bash /opt/iventoy/iventoy.sh -R start
+ExecStop=
+ExecStop=/bin/bash /opt/iventoy/iventoy.sh stop
+PIDFile=/run/iventoy.pid
+RestartSec=5
+EOF
+    systemctl daemon-reload
+
     msg_info "Starting iVentoy"
-    $STD /opt/iventoy/iventoy.sh -R start
+    systemctl reset-failed iventoy
+    systemctl start iventoy
+    # The launcher can return success before the daemon fails initialization.
+    local i ready=0
+    for ((i = 0; i < 90; i++)); do
+      if systemctl is-active --quiet iventoy && curl -fsS --max-time 2 "${IVENTOY_HEALTH_URL:-http://127.0.0.1:26000/}" >/dev/null 2>&1; then
+        ready=1
+        break
+      fi
+      sleep 2
+    done
+    if [[ "$ready" -ne 1 ]]; then
+      msg_error "iVentoy did not become ready; check journalctl -u iventoy and /opt/iventoy/log/log.txt"
+      exit 1
+    fi
     msg_ok "Started iVentoy"
     msg_ok "Updated Successfully"
   fi

ct/jdownloader.sh

@@ -33,7 +33,7 @@ function update_script() {
   fi
 
   msg_info "Updating Container OS"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated Container OS"
 

ct/jenkins.sh

@@ -34,7 +34,7 @@ function update_script() {
   JAVA_VERSION="21" setup_java
 
   msg_info "Updating Jenkins"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated Jenkins"
   msg_ok "Updated successfully!"

ct/jitsi-meet.sh

@@ -41,7 +41,7 @@ function update_script() {
   fi
 
   msg_info "Updating Jitsi Meet"
-  $STD apt update
+  apt_update_safe
   $STD apt install -y --only-upgrade \
     jitsi-meet \
     jicofo \

ct/journiv.sh

@@ -38,6 +38,7 @@ function update_script() {
     msg_ok "Stopped Services"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "journiv" "journiv/journiv-app" "tarball"
+    UV_PROJECT_DIR="/opt/journiv" setup_uv
 
     msg_info "Updating Python Environment"
     cd /opt/journiv

ct/keycloak.sh

@@ -44,7 +44,7 @@ function update_script() {
     msg_ok "Stopped Service"
 
     msg_info "Updating packages"
-    $STD apt-get update
+    apt_update_safe
     $STD apt-get -y upgrade
     msg_ok "Updated packages"
 

ct/kitchenowl.sh

@@ -42,6 +42,7 @@ function update_script() {
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "kitchenowl" "TomBursch/kitchenowl" "tarball" "latest" "/opt/kitchenowl"
     rm -rf /opt/kitchenowl/web
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "kitchenowl-web" "TomBursch/kitchenowl" "prebuild" "latest" "/opt/kitchenowl/web" "kitchenowl_Web.tar.gz"
+    PYTHON_VERSION="3.14" UV_PROJECT_DIR="/opt/kitchenowl/backend" setup_uv
 
     restore_backup
     sed -i 's/default=True/default=False/' /opt/kitchenowl/backend/wsgi.py

ct/kiwix.sh

@@ -35,7 +35,7 @@ function update_script() {
   CURRENT=$(dpkg-query -W -f='${Version}' kiwix-tools 2>/dev/null)
 
   msg_info "Updating Package Index"
-  $STD apt update
+  apt_update_safe
   msg_ok "Updated Package Index"
 
   CANDIDATE=$(apt-cache policy kiwix-tools | awk '/Candidate:/{print $2}')

ct/linkding.sh

@@ -40,6 +40,7 @@ function update_script() {
     create_backup /opt/linkding/data /opt/linkding/.env
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "linkding" "sissbruecker/linkding" "tarball"
+    UV_PROJECT_DIR="/opt/linkding" setup_uv
 
     restore_backup
     ln -sf /usr/lib/$(arch_resolve "x86_64-linux-gnu" "aarch64-linux-gnu")/mod_icu.so /opt/linkding/libicu.so

ct/livebook.sh

@@ -38,7 +38,7 @@ function update_script() {
     msg_info "Stopped Service"
 
     msg_info "Updating Container"
-    $STD apt update
+    apt_update_safe
     $STD apt upgrade -y
     msg_ok "Updated Container"
 

ct/lldap.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating lldap"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y lldap
   msg_ok "Updated lldap"
   msg_ok "Updated successfully!"

ct/loki.sh

@@ -51,7 +51,7 @@ update_deb_based() {
     msg_ok "Stopped Loki"
 
     msg_info "Updating Loki"
-    $STD apt update
+    apt_update_safe
     $STD apt install -y --only-upgrade loki
     msg_ok "Updated Loki"
 

ct/mariadb.sh

@@ -40,7 +40,7 @@ update_deb_based() {
   fi
   setup_mariadb
   msg_info "Updating ${APP} LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated successfully!"
 }

ct/matterbridge.sh

@@ -30,7 +30,7 @@ function update_script() {
     msg_error "No ${APP} Installation Found!"
     exit
   fi
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   NODE_VERSION="24" NODE_MODULE="matterbridge" setup_nodejs
   msg_ok "Updated successfully!"

ct/mattermost.sh

@@ -31,7 +31,7 @@ function update_script() {
         exit
     fi
     msg_info "Updating ${APP} LXC"
-    $STD apt update
+    apt_update_safe
     $STD apt -y upgrade
     msg_ok "Updated successfully!"
     exit

ct/mealie.sh

@@ -32,7 +32,6 @@ function update_script() {
     exit
   fi
   if check_for_gh_release "mealie" "mealie-recipes/mealie"; then
-    PYTHON_VERSION="3.12" setup_uv
 
     msg_info "Stopping Service"
     systemctl stop mealie
@@ -44,6 +43,7 @@ function update_script() {
     msg_ok "Backup completed"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "mealie" "mealie-recipes/mealie" "tarball"
+    PYTHON_VERSION="3.12" UV_PROJECT_DIR="/opt/mealie" setup_uv
 
     msg_info "Restoring Configuration"
     mv -f /opt/mealie.env /opt/mealie/mealie.env

ct/mediamanager.sh

@@ -31,14 +31,13 @@ function update_script() {
     exit
   fi
 
-  setup_uv
-
   if check_for_gh_release "mediamanager" "maxdorninger/MediaManager"; then
     msg_info "Stopping Service"
     systemctl stop mediamanager
     msg_ok "Stopped Service"
 
     fetch_and_deploy_gh_release "MediaManager" "maxdorninger/MediaManager" "tarball" "latest" "/opt/mediamanager"
+    UV_PROJECT_DIR="/opt/mediamanager" setup_uv
     msg_info "Updating MediaManager"
     MM_DIR="/opt/mm"
     export CONFIG_DIR="${MM_DIR}/config"

ct/meshcentral.sh

@@ -31,7 +31,7 @@ function update_script() {
         exit
     fi
     msg_info "Updating ${APP} LXC"
-    $STD apt update
+    apt_update_safe
     $STD apt -y upgrade
     msg_ok "Updated successfully!"
     exit

ct/metube.sh

@@ -53,6 +53,7 @@ function update_script() {
     create_backup /opt/metube/.env
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "metube" "alexta69/metube" "tarball" "latest"
+    UV_PROJECT_DIR="/opt/metube" setup_uv
 
     restore_backup
 

ct/minarca.sh

@@ -37,7 +37,7 @@ function update_script() {
   msg_ok "Stopped Service"
 
   msg_info "Updating ${APP} LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated ${APP} LXC"
 

ct/mongodb.sh

@@ -32,7 +32,7 @@ function update_script() {
     fi
     
     msg_info "Updating MongoDB LXC"
-    $STD apt update
+    apt_update_safe
     $STD apt upgrade -y
     msg_ok "Updated successfully!"
     exit

ct/mqtt.sh

@@ -41,7 +41,7 @@ function update_script() {
   fi
 
   msg_info "Updating MQTT"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated successfully!"
   exit

ct/mumble.sh

@@ -40,7 +40,7 @@ function update_script() {
     create_backup /etc/mumble/mumble-server.ini /var/lib/mumble-server/mumble-server.sqlite
 
     msg_info "Updating Mumble"
-    $STD apt update
+    apt_update_safe
     $STD apt install -y mumble-server
     cat <<EOF >~/.mumble
 $(get_latest_github_release "mumble-voip/mumble")

ct/mysql.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating ${APP} LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated successfully!"
   exit

ct/neo4j.sh

@@ -33,7 +33,7 @@ function update_script() {
   JAVA_VERSION="21" setup_java
 
   msg_info "Updating ${APP}"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated successfully!"
   exit

ct/netbird.sh

@@ -34,7 +34,7 @@ function update_script() {
   fi
 
   msg_info "Updating Netbird"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated successfully!"
   exit

ct/nextcloudpi.sh

@@ -31,7 +31,7 @@ function update_script() {
         exit
     fi
     msg_info "Updating ${APP} LXC"
-    $STD apt update
+    apt_update_safe
     $STD apt -y upgrade
     msg_ok "Updated successfully!"
     exit

ct/nextpvr.sh

@@ -37,7 +37,7 @@ function update_script() {
   msg_ok "Stopped Service"
 
   msg_info "Updating LXC packages"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated LXC packages"
 

ct/notediscovery.sh

@@ -40,6 +40,7 @@ function update_script() {
     create_backup /opt/notediscovery/data /opt/notediscovery/config.yaml
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "notediscovery" "gamosoft/NoteDiscovery" "tarball"
+    UV_PROJECT_DIR="/opt/notediscovery" setup_uv
 
     msg_info "Syncing Dependencies"
     cd /opt/notediscovery

ct/notifiarr.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating Notifiarr"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated Notifiarr"
   msg_ok "Updated successfully!"

ct/ntfy.sh

@@ -54,7 +54,7 @@ update_deb_based() {
   fi
 
   msg_info "Updating ntfy"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated ntfy"
   msg_ok "Updated successfully!"

ct/ntopng.sh

@@ -33,7 +33,7 @@ function update_script() {
   fi
 
   msg_info "Updating ntopng"
-  $STD apt update
+  apt_update_safe
   $STD apt install -y ntopng
   msg_ok "Updated ntopng"
 

ct/nzbget.sh

@@ -41,7 +41,7 @@ function update_script() {
   fi
 
   msg_info "Updating NZBGet"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated NZBGet"
   msg_ok "Updated successfully!"

ct/obsidian-livesync.sh

@@ -39,7 +39,7 @@ function update_script() {
   create_backup /var/lib/couchdb /opt/couchdb/etc/local.d/obsidian-livesync.ini /opt/obsidian-livesync/.env
 
   msg_info "Updating Container OS"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated Container OS"
 

ct/omv.sh

@@ -39,7 +39,7 @@ function update_script() {
   fi
 
   msg_info "Updating ${APP} LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated successfully!"
   exit

ct/onlyoffice.sh

@@ -33,7 +33,7 @@ function update_script() {
   fi
 
   msg_info "Updating OnlyOffice Document Server"
-  $STD apt update
+  apt_update_safe
   $STD apt -y --only-upgrade install onlyoffice-documentserver
   msg_ok "Updated OnlyOffice Document Server"
 

ct/opencloud.sh

@@ -39,7 +39,7 @@ function update_script() {
     msg_ok "Stopped services"
 
     msg_info "Updating packages"
-    $STD apt-get update
+    apt_update_safe
     $STD apt-get dist-upgrade -y
     ensure_dependencies "inotify-tools"
     msg_ok "Updated packages"

ct/openhab.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating ${APP} LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated successfully!"
   exit

ct/openproject.sh

@@ -32,7 +32,7 @@ function update_script() {
   fi
 
   msg_info "Updating OpenProject"
-  $STD apt update
+  apt_update_safe
   $STD apt install --only-upgrade -y openproject
   msg_ok "Updated OpenProject"
   msg_ok "Updated successfully!"

ct/openziti-controller.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating $APP LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated $APP LXC"
   msg_ok "Updated successfully!"

ct/openziti-tunnel.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating $APP LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated $APP LXC"
   msg_ok "Updated successfully!"

ct/orb.sh

@@ -33,7 +33,7 @@ function update_script() {
   fi
 
   msg_info "Updating Orb"
-  $STD apt update
+  apt_update_safe
   $STD apt install -y --only-upgrade orb
   msg_ok "Updated successfully!"
   exit

ct/owntracks-recorder.sh

@@ -33,7 +33,7 @@ function update_script() {
   fi
 
   msg_info "Updating ${APP}"
-  $STD apt update
+  apt_update_safe
   $STD apt install -y ot-recorder
   msg_ok "Updated ${APP}"
 

ct/paperless-ngx.sh

@@ -83,13 +83,13 @@ function update_script() {
       [[ -f /opt/paperless/paperless.conf ]] && cp /opt/paperless/paperless.conf "$BACKUP_DIR/"
       msg_ok "Backup completed to $BACKUP_DIR"
 
-      PYTHON_VERSION="3.13" setup_uv  
       if ((BRIDGE_UPDATE)); then
         CLEAN_INSTALL=1 fetch_and_deploy_gh_release "paperless" "paperless-ngx/paperless-ngx" "prebuild" "v2.20.15" "/opt/paperless" "paperless*tar.xz"
       else
         CLEAN_INSTALL=1 fetch_and_deploy_gh_release "paperless" "paperless-ngx/paperless-ngx" "prebuild" "latest" "/opt/paperless" "paperless*tar.xz"
       fi
       CLEAN_INSTALL=1 fetch_and_deploy_gh_release "jbig2enc" "ie13/jbig2enc" "tarball" "latest" "/opt/jbig2enc"
+      PYTHON_VERSION="3.13" UV_PROJECT_DIR="/opt/paperless" setup_uv
 
       . /etc/os-release
       if [ "$VERSION_CODENAME" = "bookworm" ]; then