flatnotes: bump Node.js from 22 to 24

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

.github/changelogs/2026/08.md

@@ -1,3 +1,66 @@
+## 2026-08-31
+
+### 🆕 New Scripts
+
+  - Aurral ([#16908](https://github.com/community-scripts/ProxmoxVE/pull/16908))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - openwebui: add UV_HTTP_TIMEOUT and retry loop to prevent uv install hangs [@MickLesk](https://github.com/MickLesk) ([#16917](https://github.com/community-scripts/ProxmoxVE/pull/16917))
+    - bambuddy: force asyncio loop, uvloop breaks camera proxy handlers [@MickLesk](https://github.com/MickLesk) ([#16904](https://github.com/community-scripts/ProxmoxVE/pull/16904))
+    - bookorbit: raise service start timeout, migration can exceed systemd default [@MickLesk](https://github.com/MickLesk) ([#16860](https://github.com/community-scripts/ProxmoxVE/pull/16860))
+    - node-red: remove --unsafe-perm flag [@MickLesk](https://github.com/MickLesk) ([#16859](https://github.com/community-scripts/ProxmoxVE/pull/16859))
+    - directus: add build-essential dependency [@MickLesk](https://github.com/MickLesk) ([#16858](https://github.com/community-scripts/ProxmoxVE/pull/16858))
+
+  - #### ✨ New Features
+
+    - haos-vm: add optional x86-64-v2-AES CPU option, future HA numpy builds need it [@MickLesk](https://github.com/MickLesk) ([#16868](https://github.com/community-scripts/ProxmoxVE/pull/16868))
+
+  - #### 🔧 Refactor
+
+    - omv: migrate to new package repo host (packages.openmediavault.org) is dead [@MickLesk](https://github.com/MickLesk) ([#16918](https://github.com/community-scripts/ProxmoxVE/pull/16918))
+    - yuvomi/aurral: bump NODE_VERSION [@MickLesk](https://github.com/MickLesk) ([#16914](https://github.com/community-scripts/ProxmoxVE/pull/16914))
+    - vaultwarden: relax cargo release profile via env vars to avoid build OOM [@MickLesk](https://github.com/MickLesk) ([#16915](https://github.com/community-scripts/ProxmoxVE/pull/16915))
+    - kima-hub/maintainerr/planka/spliit: bump NODE_VERSION [@MickLesk](https://github.com/MickLesk) ([#16905](https://github.com/community-scripts/ProxmoxVE/pull/16905))
+    - gatus: pin Go toolchain to gatus's own go.mod version [@MickLesk](https://github.com/MickLesk) ([#16893](https://github.com/community-scripts/ProxmoxVE/pull/16893))
+    - immich: tolerate enable-maintenance-mode crash, same as disable-maintenance-mode [@MickLesk](https://github.com/MickLesk) ([#16866](https://github.com/community-scripts/ProxmoxVE/pull/16866))
+    - move the hardware-accelerated scripts onto new core [@MickLesk](https://github.com/MickLesk) ([#16864](https://github.com/community-scripts/ProxmoxVE/pull/16864))
+    - ntopng: use ntop.org's documented apt repo per Debian codename, not always apt-stable [@MickLesk](https://github.com/MickLesk) ([#16862](https://github.com/community-scripts/ProxmoxVE/pull/16862))
+    - Refactor: OpenGist [@MickLesk](https://github.com/MickLesk) ([#16861](https://github.com/community-scripts/ProxmoxVE/pull/16861))
+
+### 💾 Core
+
+  - Refactor VM script settings and fix load_functions errors [@MickLesk](https://github.com/MickLesk) ([core#13](https://github.com/community-scripts/core/pull/13))
+- Ask ProxmoxVE to refresh its changelog on merge [@MickLesk](https://github.com/MickLesk) ([core#11](https://github.com/community-scripts/core/pull/11))
+- Lift the settings summary and the mode fork into vm-core [@MickLesk](https://github.com/MickLesk) ([core#12](https://github.com/community-scripts/core/pull/12))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - filebrowser-quantum: strip removed disableIndexing key on update, restart service [@MickLesk](https://github.com/MickLesk) ([#16892](https://github.com/community-scripts/ProxmoxVE/pull/16892))
+
+### 📚 Documentation
+
+  - Include engine pull requests in the changelog [@MickLesk](https://github.com/MickLesk) ([#16867](https://github.com/community-scripts/ProxmoxVE/pull/16867))
+
+## 2026-08-30
+
+### 🆕 New Scripts
+
+  - SolidInvoice ([#16869](https://github.com/community-scripts/ProxmoxVE/pull/16869))
+- Super-Productivity ([#16870](https://github.com/community-scripts/ProxmoxVE/pull/16870))
+- Defguard ([#16871](https://github.com/community-scripts/ProxmoxVE/pull/16871))
+- OpenBao ([#16872](https://github.com/community-scripts/ProxmoxVE/pull/16872))
+
+### 🚀 Updated Scripts
+
+  - #### 🔧 Refactor
+
+    - general: remove gitea links overall  [@MickLesk](https://github.com/MickLesk) ([#16863](https://github.com/community-scripts/ProxmoxVE/pull/16863))
+
 ## 2026-08-29
 
 ### 📚 Documentation

.github/changelogs/2026/09.md

@@ -0,0 +1,115 @@
+## 2026-09-05
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - authentik: scope blueprints chown to avoid recursing into the mp0 bind mount [@MickLesk](https://github.com/MickLesk) ([#17008](https://github.com/community-scripts/ProxmoxVE/pull/17008))
+    - iventoy: run iventoy.sh with bash instead of dash [@MickLesk](https://github.com/MickLesk) ([#17034](https://github.com/community-scripts/ProxmoxVE/pull/17034))
+    - frigate: restart go2rtc.service before frigate starts [@MickLesk](https://github.com/MickLesk) ([#17035](https://github.com/community-scripts/ProxmoxVE/pull/17035))
+    - snapotter: seed AI venv base packages on arm64, warn amd64 has no working CPU bundle [@MickLesk](https://github.com/MickLesk) ([#16903](https://github.com/community-scripts/ProxmoxVE/pull/16903))
+    - tolgee: bump required JDK from 21 to 25 [@MickLesk](https://github.com/MickLesk) ([#17005](https://github.com/community-scripts/ProxmoxVE/pull/17005))
+    - romm: write real version into backend/__version__.py placeholder [@MickLesk](https://github.com/MickLesk) ([#17009](https://github.com/community-scripts/ProxmoxVE/pull/17009))
+
+  - #### 🔧 Refactor
+
+    - Refactor FileFlows: Stop Spinner before read -rp / Switch from "Node" to "Agent"  [@MickLesk](https://github.com/MickLesk) ([#17007](https://github.com/community-scripts/ProxmoxVE/pull/17007))
+
+### 💾 Core
+
+  - update helper: follow renamed ct/ scripts instead of curling a 404 [@MickLesk](https://github.com/MickLesk) ([core#22](https://github.com/community-scripts/core/pull/22))
+- Use Proxmox for a template before reaching for linuxcontainers.org [@MickLesk](https://github.com/MickLesk) ([core#23](https://github.com/community-scripts/core/pull/23))
+- implement exponential backoff for curl retries in _cs_curl_retry function [@MickLesk](https://github.com/MickLesk) ([core#26](https://github.com/community-scripts/core/pull/26))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - update-apps: follow renamed ct/ scripts instead of erroring out [@MickLesk](https://github.com/MickLesk) ([#16991](https://github.com/community-scripts/ProxmoxVE/pull/16991))
+
+## 2026-09-04
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(shlink): preserve servers.json across web-client updates [@Corgei](https://github.com/Corgei) ([#17023](https://github.com/community-scripts/ProxmoxVE/pull/17023))
+    - fix-update-authentik-2026.8.1 [@thieneret](https://github.com/thieneret) ([#16999](https://github.com/community-scripts/ProxmoxVE/pull/16999))
+    - Fix npm v12 allow-git/allow-remote restrictions across affected scripts [@MickLesk](https://github.com/MickLesk) ([#17014](https://github.com/community-scripts/ProxmoxVE/pull/17014))
+    - Fix/poznote - 1st party Docker parity [@lucas-at-3x-eye](https://github.com/lucas-at-3x-eye) ([#17011](https://github.com/community-scripts/ProxmoxVE/pull/17011))
+
+### 💾 Core
+
+  - setup_go: resolve bare major.minor versions to the latest patch release [@MickLesk](https://github.com/MickLesk) ([core#24](https://github.com/community-scripts/core/pull/24))
+
+## 2026-09-03
+
+### 🚀 Updated Scripts
+
+  - Immich: bump libheif and libraw [@vhsdream](https://github.com/vhsdream) ([#16996](https://github.com/community-scripts/ProxmoxVE/pull/16996))
+
+  - #### 🐞 Bug Fixes
+
+    - romm: allow git-based npm dependency for rom-patcher under npm v12 [@MickLesk](https://github.com/MickLesk) ([#16990](https://github.com/community-scripts/ProxmoxVE/pull/16990))
+    - Pin Go to the version each project declares in go.mod [@MickLesk](https://github.com/MickLesk) ([#16976](https://github.com/community-scripts/ProxmoxVE/pull/16976))
+    - Authentik update 2026.8.1 [@thieneret](https://github.com/thieneret) ([#16980](https://github.com/community-scripts/ProxmoxVE/pull/16980))
+
+## 2026-09-02
+
+### 🆕 New Scripts
+
+  - OwnTracks-Recorder ([#16967](https://github.com/community-scripts/ProxmoxVE/pull/16967))
+- PeerTube ([#16966](https://github.com/community-scripts/ProxmoxVE/pull/16966))
+- Kaneo ([#16965](https://github.com/community-scripts/ProxmoxVE/pull/16965))
+- JDownloader ([#16964](https://github.com/community-scripts/ProxmoxVE/pull/16964))
+- ReadMeABook ([#16963](https://github.com/community-scripts/ProxmoxVE/pull/16963))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Enhance backup process in teddycloud.sh [@MickLesk](https://github.com/MickLesk) ([#16946](https://github.com/community-scripts/ProxmoxVE/pull/16946))
+    - mealie: copy Nuxt generate output and use pnpm when lockfile is present [@mjhuff](https://github.com/mjhuff) ([#16938](https://github.com/community-scripts/ProxmoxVE/pull/16938))
+    - OpenThread-BR: Clean build directory before update [@tomfrenzel](https://github.com/tomfrenzel) ([#16949](https://github.com/community-scripts/ProxmoxVE/pull/16949))
+
+  - #### 🔧 Refactor
+
+    - Scripts: use shared core bootstrap for final 114 Script Batch [@MickLesk](https://github.com/MickLesk) ([#16953](https://github.com/community-scripts/ProxmoxVE/pull/16953))
+    - Scripts: use shared core bootstrap for next 115 Script Batch [@MickLesk](https://github.com/MickLesk) ([#16952](https://github.com/community-scripts/ProxmoxVE/pull/16952))
+    - Scripts: use shared core bootstrap for next 115 Script Batch [@MickLesk](https://github.com/MickLesk) ([#16951](https://github.com/community-scripts/ProxmoxVE/pull/16951))
+    - Scripts: use shared core bootstrap for next 100 Script Batch [@MickLesk](https://github.com/MickLesk) ([#16950](https://github.com/community-scripts/ProxmoxVE/pull/16950))
+
+### 💾 Core
+
+  - setup_meilisearch: generate a 32-byte master key [@MickLesk](https://github.com/MickLesk) ([core#20](https://github.com/community-scripts/core/pull/20))
+- setup_meilisearch: generate a 32-byte master key [@MickLesk](https://github.com/MickLesk) ([core#19](https://github.com/community-scripts/core/pull/19))
+- setup_nodejs: restore the npm allowScripts bypass lost in the migration [@MickLesk](https://github.com/MickLesk) ([core#18](https://github.com/community-scripts/core/pull/18))
+
+## 2026-09-01
+
+### 🆕 New Scripts
+
+  - Mailpit ([#16942](https://github.com/community-scripts/ProxmoxVE/pull/16942))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Revert Aurral to Node22 [@Copilot](https://github.com/Copilot) ([#16930](https://github.com/community-scripts/ProxmoxVE/pull/16930))
+    - jellyfin: verify repo suite via fallback chain and use ensure_dependencies for clearer apt failures [@MickLesk](https://github.com/MickLesk) ([#16916](https://github.com/community-scripts/ProxmoxVE/pull/16916))
+
+  - #### 🔧 Refactor
+
+    - Move the next 25 scripts onto the core engine [@MickLesk](https://github.com/MickLesk) ([#16934](https://github.com/community-scripts/ProxmoxVE/pull/16934))
+
+### 💾 Core
+
+  - Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#15](https://github.com/community-scripts/core/pull/15))
+- Report the exit code the engine actually saw [@MickLesk](https://github.com/MickLesk) ([core#17](https://github.com/community-scripts/core/pull/17))
+- Silence npm's update notice so the real error stays visible [@MickLesk](https://github.com/MickLesk) ([core#16](https://github.com/community-scripts/core/pull/16))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - fix(add-iptag): merge live IPv4 addresses for running LXCs [@phillf](https://github.com/phillf) ([#16691](https://github.com/community-scripts/ProxmoxVE/pull/16691))

.github/workflows/check-node-versions.yml

@@ -7,8 +7,9 @@ on:
     - cron: "0 6 * * 1"
 
 permissions:
-  contents: read
+  contents: write
   issues: write
+  pull-requests: write
 
 jobs:
   check-node-versions:
@@ -390,6 +391,132 @@ jobs:
 
           cat /tmp/drift_report.md
 
+      # One PR per script, not one for all of them: the bumps are judged
+      # individually (an app can be deliberately held back while the next is a
+      # safe follow), and a combined PR is blocked by its worst member.
+      - name: Open a pull request per drifting script
+        if: steps.check.outputs.drift_count != '0'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+          : >/tmp/drift_prs.txt
+
+          while IFS='|' read -r slug our upstream hint repo; do
+            [[ -z "$slug" ]] && continue
+
+            # "dynamic" and "unset" have no literal to rewrite, and a missing
+            # upstream major is nothing to rewrite it to.
+            if [[ ! "$our" =~ ^[0-9]+$ || ! "$upstream" =~ ^[0-9]+$ ]]; then
+              printf '%s|manual||\n' "$slug" >>/tmp/drift_prs.txt
+              continue
+            fi
+
+            # The branch name carries the exact bump, so the PR for it answers
+            # the question on its own: open means it is waiting for a review,
+            # closed means someone said no to this bump. A later upstream
+            # release changes the name and gets its own PR.
+            branch="node-drift/${slug}-${our}-to-${upstream}"
+
+            existing=$(gh pr list --head "$branch" --state all \
+              --json number,state,url,labels --jq '.[0] // empty' 2>/dev/null || echo "")
+
+            if [[ -n "$existing" ]]; then
+              state=$(jq -r '.state' <<<"$existing")
+              url=$(jq -r '.url' <<<"$existing")
+              stale=$(jq -r '[.labels[]?.name] | index("stale") // empty' <<<"$existing")
+
+              case "$state" in
+              OPEN)
+                printf '%s|open|%s\n' "$slug" "$url" >>/tmp/drift_prs.txt
+                continue
+                ;;
+              MERGED)
+                printf '%s|merged|%s\n' "$slug" "$url" >>/tmp/drift_prs.txt
+                continue
+                ;;
+              *)
+                # The stale bot only closes what a human labelled "stale", so
+                # that close carries no verdict on the bump — reopen the case.
+                # A close without it is a decision, and it stands.
+                if [[ -z "$stale" ]]; then
+                  printf '%s|declined|%s\n' "$slug" "$url" >>/tmp/drift_prs.txt
+                  continue
+                fi
+                git push origin --delete "$branch" >/dev/null 2>&1 || true
+                ;;
+              esac
+            fi
+
+            git checkout -q -B "$branch"
+
+            changed=()
+            for f in "install/${slug}-install.sh" "ct/${slug}.sh"; do
+              [[ -f "$f" ]] || continue
+              if grep -qE "NODE_VERSION=\"?${our}\"?" "$f"; then
+                sed -i -E "s/(NODE_VERSION=)\"?${our}\"?/\1\"${upstream}\"/g" "$f"
+                changed+=("$f")
+              fi
+            done
+
+            if [[ ${#changed[@]} -eq 0 ]]; then
+              printf '%s|manual||\n' "$slug" >>/tmp/drift_prs.txt
+              git checkout -q main
+              continue
+            fi
+
+            git add "${changed[@]}"
+            git commit -q -m "${slug}: bump Node.js from ${our} to ${upstream}"
+
+            if ! git push -q -u origin "$branch" 2>/dev/null; then
+              printf '%s|failed||\n' "$slug" >>/tmp/drift_prs.txt
+              git checkout -q main
+              continue
+            fi
+
+            # The test command is written here rather than left to
+            # pr-test-command.yml: a PR opened with GITHUB_TOKEN does not start
+            # another workflow, so that comment would never arrive.
+            body=$(cat <<PR_EOF
+          \`${slug}\` pins Node **${our}**, upstream indicates **${upstream}** (${hint}) — [upstream repo](https://github.com/${repo}).
+
+          Opened automatically by the weekly Node.js version drift check. **Nothing here has been tested.** Run it against a host before merging:
+
+          \`\`\`bash
+          export COMMUNITY_SCRIPTS_URL=https://raw.githubusercontent.com/${GITHUB_REPOSITORY}/${branch}
+          bash -c "\$(curl -fsSL "\$COMMUNITY_SCRIPTS_URL/ct/${slug}.sh")"
+          \`\`\`
+
+          Both lines are needed — each script pins \`_CS_DEFAULT_URL\` to \`main\`, and that pin is what fills \`COMMUNITY_SCRIPTS_URL\` when it is unset.
+
+          If the bump is wrong — upstream ships a newer Node than the app needs, or this script is deliberately held back — **close this PR**. It gets recorded on the drift report and this exact bump is not proposed again.
+          PR_EOF
+            )
+
+            # The label goes on at creation, not in a second call: it is what
+            # exempts the PR from the template check, and that check runs on
+            # "opened" — a label added a moment later can arrive too late.
+            if url=$(gh pr create \
+              --title "${slug}: bump Node.js from ${our} to ${upstream}" \
+              --body "$body" \
+              --base main \
+              --head "$branch" \
+              --label "automated pr" 2>/dev/null); then
+              printf '%s|open|%s\n' "$slug" "$url" >>/tmp/drift_prs.txt
+            else
+              printf '%s|failed||\n' "$slug" >>/tmp/drift_prs.txt
+            fi
+
+            git checkout -q main
+          done </tmp/drift_scripts.txt
+
+          echo "Pull request status per script:"
+          cat /tmp/drift_prs.txt
+
       - name: Create or update summary issue
         if: steps.check.outputs.drift_count != '0'
         env:
@@ -403,11 +530,31 @@ jobs:
           TOTAL="${{ steps.check.outputs.total }}"
           CHECKED="${{ steps.check.outputs.checked }}"
 
-          # Build checklist from drift data
+          # Build checklist from drift data. Each item carries the state of its
+          # own PR, so the list tracks itself instead of relying on someone
+          # ticking a box that the next run would overwrite anyway.
           CHECKLIST=""
           while IFS='|' read -r slug our_version upstream_major upstream_hint repo; do
             [[ -z "$slug" ]] && continue
-            CHECKLIST+="- [ ] **\`${slug}\`** — ours: \`${our_version}\` → upstream: \`${upstream_major}\` (${upstream_hint}) — [repo](https://github.com/${repo})"$'\n'
+
+            pr_state=""
+            pr_url=""
+            if [[ -f /tmp/drift_prs.txt ]]; then
+              pr_line=$(grep -m1 "^${slug}|" /tmp/drift_prs.txt || echo "")
+              pr_state=$(cut -d'|' -f2 <<<"$pr_line")
+              pr_url=$(cut -d'|' -f3 <<<"$pr_line")
+            fi
+
+            case "$pr_state" in
+            open)     mark="- [ ]"; note="— ${pr_url}" ;;
+            declined) mark="- [x]"; note="— declined in ${pr_url}, not proposed again" ;;
+            merged)   mark="- [x]"; note="— merged in ${pr_url}" ;;
+            manual)   mark="- [ ]"; note="— needs a manual change (no fixed \`NODE_VERSION\` to rewrite)" ;;
+            failed)   mark="- [ ]"; note="— could not open a PR automatically" ;;
+            *)        mark="- [ ]"; note="" ;;
+            esac
+
+            CHECKLIST+="${mark} **\`${slug}\`** — ours: \`${our_version}\` → upstream: \`${upstream_major}\` (${upstream_hint}) — [repo](https://github.com/${repo}) ${note}"$'\n'
           done < /tmp/drift_scripts.txt
 
           # Build full report table
@@ -424,11 +571,12 @@ jobs:
 
           ### How to resolve
 
-          1. Check upstream Dockerfile / package.json to confirm the required Node.js version
+          Each item above has its own pull request with the bump already applied and a ready-to-run test command in the description.
-          2. Test the script with the new Node version
+
-          3. Update \`NODE_VERSION\` in \`install/<slug>-install.sh\`
+          1. Check the upstream Dockerfile / package.json to confirm the required Node.js version
-          4. Update \`NODE_VERSION\` in \`ct/<slug>.sh\` (update section) if applicable
+          2. Run the test command from the PR against a host
-          5. Check off the item above once done
+          3. Merge the PR if it works — the item disappears from this list on the next run
+          4. Close the PR if the bump is wrong: the script stays as it is and this exact bump is never proposed again
 
           <details>
           <summary>Full report</summary>

.github/workflows/node-drift-pr-closed.yml

@@ -0,0 +1,55 @@
+name: Record closed Node.js drift PR
+
+# The drift check opens one PR per script and treats a closed one as a verdict:
+# that bump is not proposed again. That decision is invisible on the report
+# unless it is written there, so record it as a comment naming the script.
+
+on:
+  pull_request:
+    types: [closed]
+
+jobs:
+  record:
+    if: >
+      github.repository == 'community-scripts/ProxmoxVE' &&
+      github.event.pull_request.merged == false &&
+      startsWith(github.event.pull_request.head.ref, 'node-drift/')
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+    steps:
+      - uses: actions/github-script@v9
+        with:
+          script: |
+            const pr = context.payload.pull_request;
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+
+            // node-drift/<slug>-<from>-to-<to>
+            const m = pr.head.ref.match(/^node-drift\/(.+)-(\d+)-to-(\d+)$/);
+            if (!m) return;
+            const [, slug, from, to] = m;
+
+            // A close by the stale bot is a lapsed review, not a decision on
+            // the bump, and the drift check reopens those. Saying "declined"
+            // here would contradict it.
+            const stale = pr.labels.some((l) => l.name === 'stale');
+
+            const issues = await github.rest.issues.listForRepo({
+              owner, repo, state: 'open', labels: 'automated,dependencies', per_page: 100,
+            });
+            const issue = issues.data.find(
+              (i) => !i.pull_request && i.title === '[Automated] Node.js Version Drift Report',
+            );
+            if (!issue) return;
+
+            const body = stale
+              ? `\`${slug}\` — PR #${pr.number} (Node ${from} → ${to}) was closed as stale. `
+                + `No decision was recorded, so the next drift check opens it again.`
+              : `\`${slug}\` — PR #${pr.number} (Node ${from} → ${to}) was closed without merging. `
+                + `The script keeps Node ${from} and this bump will not be proposed again. `
+                + `If it was closed by mistake, reopen the PR.`;
+
+            await github.rest.issues.createComment({
+              owner, repo, issue_number: issue.number, body,
+            });

CHANGELOG.md

@@ -98,6 +98,9 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 
 
+
+
+
 
 
 
@@ -111,7 +114,14 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 
 <details>
-<summary><h4>August (29 entries)</h4></summary>
+<summary><h4>September (5 entries)</h4></summary>
+
+[View September 2026 Changelog](.github/changelogs/2026/09.md)
+
+</details>
+
+<details>
+<summary><h4>August (31 entries)</h4></summary>
 
 [View August 2026 Changelog](.github/changelogs/2026/08.md)
 
@@ -530,6 +540,92 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-09-07
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - reactive-resume: repair any wrong WorkingDirectory on update [@MickLesk](https://github.com/MickLesk) ([#17068](https://github.com/community-scripts/ProxmoxVE/pull/17068))
+    - mediamtx: keep mediamtx.yml across updates [@MickLesk](https://github.com/MickLesk) ([#17069](https://github.com/community-scripts/ProxmoxVE/pull/17069))
+    - omnitools: allow remote action while npm ci [@MickLesk](https://github.com/MickLesk) ([#17070](https://github.com/community-scripts/ProxmoxVE/pull/17070))
+
+  - #### ✨ New Features
+
+    - netboot-xyz: add Secure Boot and Legacy assets [@MickLesk](https://github.com/MickLesk) ([#17066](https://github.com/community-scripts/ProxmoxVE/pull/17066))
+
+  - #### 🔧 Refactor
+
+    - heimdall: set up PHP 8.4 on update, keep only the database, run migrations [@MickLesk](https://github.com/MickLesk) ([#17067](https://github.com/community-scripts/ProxmoxVE/pull/17067))
+
+### 📂 Github
+
+  - github: Open per-script Node bump PRs [@MickLesk](https://github.com/MickLesk) ([#17065](https://github.com/community-scripts/ProxmoxVE/pull/17065))
+
+## 2026-09-06
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Fix Sonarqube update script to add +x on sonar.sh [@jarihu](https://github.com/jarihu) ([#17056](https://github.com/community-scripts/ProxmoxVE/pull/17056))
+
+## 2026-09-05
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - authentik: scope blueprints chown to avoid recursing into the mp0 bind mount [@MickLesk](https://github.com/MickLesk) ([#17008](https://github.com/community-scripts/ProxmoxVE/pull/17008))
+    - iventoy: run iventoy.sh with bash instead of dash [@MickLesk](https://github.com/MickLesk) ([#17034](https://github.com/community-scripts/ProxmoxVE/pull/17034))
+    - frigate: restart go2rtc.service before frigate starts [@MickLesk](https://github.com/MickLesk) ([#17035](https://github.com/community-scripts/ProxmoxVE/pull/17035))
+    - snapotter: seed AI venv base packages on arm64, warn amd64 has no working CPU bundle [@MickLesk](https://github.com/MickLesk) ([#16903](https://github.com/community-scripts/ProxmoxVE/pull/16903))
+    - tolgee: bump required JDK from 21 to 25 [@MickLesk](https://github.com/MickLesk) ([#17005](https://github.com/community-scripts/ProxmoxVE/pull/17005))
+    - romm: write real version into backend/__version__.py placeholder [@MickLesk](https://github.com/MickLesk) ([#17009](https://github.com/community-scripts/ProxmoxVE/pull/17009))
+
+  - #### 🔧 Refactor
+
+    - Refactor FileFlows: Stop Spinner before read -rp / Switch from "Node" to "Agent"  [@MickLesk](https://github.com/MickLesk) ([#17007](https://github.com/community-scripts/ProxmoxVE/pull/17007))
+
+### 💾 Core
+
+  - update helper: follow renamed ct/ scripts instead of curling a 404 [@MickLesk](https://github.com/MickLesk) ([core#22](https://github.com/community-scripts/core/pull/22))
+- Use Proxmox for a template before reaching for linuxcontainers.org [@MickLesk](https://github.com/MickLesk) ([core#23](https://github.com/community-scripts/core/pull/23))
+- implement exponential backoff for curl retries in _cs_curl_retry function [@MickLesk](https://github.com/MickLesk) ([core#26](https://github.com/community-scripts/core/pull/26))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - update-apps: follow renamed ct/ scripts instead of erroring out [@MickLesk](https://github.com/MickLesk) ([#16991](https://github.com/community-scripts/ProxmoxVE/pull/16991))
+
+## 2026-09-04
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(shlink): preserve servers.json across web-client updates [@Corgei](https://github.com/Corgei) ([#17023](https://github.com/community-scripts/ProxmoxVE/pull/17023))
+    - fix-update-authentik-2026.8.1 [@thieneret](https://github.com/thieneret) ([#16999](https://github.com/community-scripts/ProxmoxVE/pull/16999))
+    - Fix npm v12 allow-git/allow-remote restrictions across affected scripts [@MickLesk](https://github.com/MickLesk) ([#17014](https://github.com/community-scripts/ProxmoxVE/pull/17014))
+    - Fix/poznote - 1st party Docker parity [@lucas-at-3x-eye](https://github.com/lucas-at-3x-eye) ([#17011](https://github.com/community-scripts/ProxmoxVE/pull/17011))
+
+### 💾 Core
+
+  - setup_go: resolve bare major.minor versions to the latest patch release [@MickLesk](https://github.com/MickLesk) ([core#24](https://github.com/community-scripts/core/pull/24))
+
+## 2026-09-03
+
+### 🚀 Updated Scripts
+
+  - Immich: bump libheif and libraw [@vhsdream](https://github.com/vhsdream) ([#16996](https://github.com/community-scripts/ProxmoxVE/pull/16996))
+
+  - #### 🐞 Bug Fixes
+
+    - romm: allow git-based npm dependency for rom-patcher under npm v12 [@MickLesk](https://github.com/MickLesk) ([#16990](https://github.com/community-scripts/ProxmoxVE/pull/16990))
+    - Pin Go to the version each project declares in go.mod [@MickLesk](https://github.com/MickLesk) ([#16976](https://github.com/community-scripts/ProxmoxVE/pull/16976))
+    - Authentik update 2026.8.1 [@thieneret](https://github.com/thieneret) ([#16980](https://github.com/community-scripts/ProxmoxVE/pull/16980))
+
 ## 2026-09-02
 
 ### 🆕 New Scripts
@@ -557,7 +653,9 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ### 💾 Core
 
-  - setup_nodejs: restore the npm allowScripts bypass lost in the migration [@MickLesk](https://github.com/MickLesk) ([core#18](https://github.com/community-scripts/core/pull/18))
+  - setup_meilisearch: generate a 32-byte master key [@MickLesk](https://github.com/MickLesk) ([core#20](https://github.com/community-scripts/core/pull/20))
+- setup_meilisearch: generate a 32-byte master key [@MickLesk](https://github.com/MickLesk) ([core#19](https://github.com/community-scripts/core/pull/19))
+- setup_nodejs: restore the npm allowScripts bypass lost in the migration [@MickLesk](https://github.com/MickLesk) ([core#18](https://github.com/community-scripts/core/pull/18))
 
 ## 2026-09-01
 
@@ -1091,133 +1189,4 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🔧 Refactor
 
-    - core: extend new vars and pocketbase values [@MickLesk](https://github.com/MickLesk) ([#16313](https://github.com/community-scripts/ProxmoxVE/pull/16313))
+    - core: extend new vars and pocketbase values [@MickLesk](https://github.com/MickLesk) ([#16313](https://github.com/community-scripts/ProxmoxVE/pull/16313))
-
-## 2026-08-06
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - paperless: change update abort message (endless spinner) [@MickLesk](https://github.com/MickLesk) ([#16299](https://github.com/community-scripts/ProxmoxVE/pull/16299))
-
-  - #### ✨ New Features
-
-    - Vikunja: remove version pin, v2.5.0 fixes the systemd syscall filter crash [@MickLesk](https://github.com/MickLesk) ([#16300](https://github.com/community-scripts/ProxmoxVE/pull/16300))
-
-### 💾 Core
-
-  - #### 🔧 Refactor
-
-    - build.func: filter templates by host architecture during search [@MickLesk](https://github.com/MickLesk) ([#16302](https://github.com/community-scripts/ProxmoxVE/pull/16302))
-
-## 2026-08-05
-
-### 🚀 Updated Scripts
-
-  - #### ✨ New Features
-
-    - NextcloudPI: Bump to Debian Trixie & Tweak broken SSH [@MickLesk](https://github.com/MickLesk) ([#15957](https://github.com/community-scripts/ProxmoxVE/pull/15957))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - fix(monitor-all): reduce polling CPU overhead [@jomplox](https://github.com/jomplox) ([#15907](https://github.com/community-scripts/ProxmoxVE/pull/15907))
-
-## 2026-08-04
-
-### 🆕 New Scripts
-
-  - Hister ([#16259](https://github.com/community-scripts/ProxmoxVE/pull/16259))
-- Obsidian-LiveSync ([#16233](https://github.com/community-scripts/ProxmoxVE/pull/16233))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Actual Budget: allow native module install scripts under npm 11 (Node24) [@MickLesk](https://github.com/MickLesk) ([#16277](https://github.com/community-scripts/ProxmoxVE/pull/16277))
-    - Heimdall-Dashboard: run full composer install on update, force production env [@MickLesk](https://github.com/MickLesk) ([#16278](https://github.com/community-scripts/ProxmoxVE/pull/16278))
-    - xyOps: rebuild xySat satellite during update [@MickLesk](https://github.com/MickLesk) ([#16279](https://github.com/community-scripts/ProxmoxVE/pull/16279))
-    - HAOS: remove non-ASCII dash from CPU model dialog text [@MickLesk](https://github.com/MickLesk) ([#16276](https://github.com/community-scripts/ProxmoxVE/pull/16276))
-    - fix: back up Termix db/data so the update stops destroying encryption keys [@LukeGus](https://github.com/LukeGus) ([#16275](https://github.com/community-scripts/ProxmoxVE/pull/16275))
-    - passwordpusher: dynamically read Ruby version from .ruby-version file [@Copilot](https://github.com/Copilot) ([#16242](https://github.com/community-scripts/ProxmoxVE/pull/16242))
-    - fix(salt): write version cache to ~/.salt, not /~.salt [@TowyTowy](https://github.com/TowyTowy) ([#16265](https://github.com/community-scripts/ProxmoxVE/pull/16265))
-    - AFFiNE: fix version and build type reported by the app itself [@MickLesk](https://github.com/MickLesk) ([#16251](https://github.com/community-scripts/ProxmoxVE/pull/16251))
-    - Passbolt: fetch GPG key from Passbolt's own host instead of the flaky keyserver [@MickLesk](https://github.com/MickLesk) ([#16248](https://github.com/community-scripts/ProxmoxVE/pull/16248))
-
-  - #### ✨ New Features
-
-    - Opencloud: Pin version to 7.4.0 [@vhsdream](https://github.com/vhsdream) ([#16257](https://github.com/community-scripts/ProxmoxVE/pull/16257))
-
-  - #### 🔧 Refactor
-
-    - Bump NodeJS Versions of several scripts [@MickLesk](https://github.com/MickLesk) ([#16230](https://github.com/community-scripts/ProxmoxVE/pull/16230))
-
-### 💾 Core
-
-  - #### 🐞 Bug Fixes
-
-    - tools.func: never delete ubuntu.sources (or other distro base sources) as orphaned [@MickLesk](https://github.com/MickLesk) ([#16250](https://github.com/community-scripts/ProxmoxVE/pull/16250))
-    - tools.func: complete a stale/partial backup manifest instead of trusting it as-is [@MickLesk](https://github.com/MickLesk) ([#16252](https://github.com/community-scripts/ProxmoxVE/pull/16252))
-
-  - #### 🔧 Refactor
-
-    - Refactor: harmonize tools/addon and move boilerplate into core.func [@MickLesk](https://github.com/MickLesk) ([#16202](https://github.com/community-scripts/ProxmoxVE/pull/16202))
-
-## 2026-08-03
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Correction to link in Paperless-NGX update script [@jsspen](https://github.com/jsspen) ([#16241](https://github.com/community-scripts/ProxmoxVE/pull/16241))
-    - fix restore env in split pro [@johanngrobe](https://github.com/johanngrobe) ([#16228](https://github.com/community-scripts/ProxmoxVE/pull/16228))
-
-### 💾 Core
-
-  - #### 🔧 Refactor
-
-    - core: read all interactive prompts from /dev/tty, drain leftover input on read failure (hotfix) [@MickLesk](https://github.com/MickLesk) ([#16235](https://github.com/community-scripts/ProxmoxVE/pull/16235))
-
-## 2026-08-02
-
-### 🆕 New Scripts
-
-  - Portainer as Addon [@MickLesk](https://github.com/MickLesk) ([#16200](https://github.com/community-scripts/ProxmoxVE/pull/16200))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - LibreNMS: Ensure ipmitool dependency is installed [@tremor021](https://github.com/tremor021) ([#16219](https://github.com/community-scripts/ProxmoxVE/pull/16219))
-    - Bitfocus Companion: add libatomic1 dependency [@tremor021](https://github.com/tremor021) ([#16212](https://github.com/community-scripts/ProxmoxVE/pull/16212))
-    - fix(dispatcharr): add recordings and dvr queues to celery worker [@eXistC](https://github.com/eXistC) ([#16204](https://github.com/community-scripts/ProxmoxVE/pull/16204))
-    - add retry for uv - same as immich [@asylumexp](https://github.com/asylumexp) ([#16203](https://github.com/community-scripts/ProxmoxVE/pull/16203))
-    - Fix for cross-seed node version regression [@TorinFrancis](https://github.com/TorinFrancis) ([#16209](https://github.com/community-scripts/ProxmoxVE/pull/16209))
-
-  - #### 🔧 Refactor
-
-    - chore: remove portainer setup from several scripts (moved to addon) [@MickLesk](https://github.com/MickLesk) ([#16201](https://github.com/community-scripts/ProxmoxVE/pull/16201))
-
-## 2026-08-01
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Update bazarr-install.sh [@asylumexp](https://github.com/asylumexp) ([#16191](https://github.com/community-scripts/ProxmoxVE/pull/16191))
-    - fix romm missing 7z [@asylumexp](https://github.com/asylumexp) ([#16194](https://github.com/community-scripts/ProxmoxVE/pull/16194))
-
-  - #### 🔧 Refactor
-
-    - add CLEANUPARR_CONFIG_PATH, CLEANUPARR_LOGS_PATH vars [@asylumexp](https://github.com/asylumexp) ([#16193](https://github.com/community-scripts/ProxmoxVE/pull/16193))
-
-## 2026-07-31
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Docmost: cleanup folder at update [@MickLesk](https://github.com/MickLesk) ([#16177](https://github.com/community-scripts/ProxmoxVE/pull/16177))
-    - Firecrawl: Add dependency [@tremor021](https://github.com/tremor021) ([#16174](https://github.com/community-scripts/ProxmoxVE/pull/16174))

ct/authentik.sh

@@ -44,13 +44,12 @@ function update_script() {
   msg_ok "Update dependencies"
 
   NODE_VERSION="26" NODE_MODULE=pnpm@11 setup_nodejs
-  setup_go
   $STD uv cache clean
   UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.7" setup_uv
   RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
   setup_yq
 
-  AUTHENTIK_VERSION="version/2026.8.0"
+  AUTHENTIK_VERSION="version/2026.8.1"
   # Source: https://github.com/goauthentik/fips/blob/main/Makefile#L26
   XMLSEC_VERSION="1.3.12"
 
@@ -85,7 +84,18 @@ function update_script() {
     fi
     msg_ok "Stopped Services"
 
+    if [[ ! -d /opt/authentik-data/blueprints ]]; then
+      msg_info "Moving blueprints to presistent directory"
+      cp -r /opt/authentik/blueprints /opt/authentik-data/
+      rm -r /opt/authentik/blueprints
+      $STD find /opt/authentik-data -path '*/lost+found' -prune -o -exec chown authentik:authentik {} +
+      yq -i ".blueprints_dir = \"/opt/authentik-data/blueprints\"" /etc/authentik/config.yml
+      msg_ok "blueprints moved to presistent directory"
+      msg_warn "The blueprints provided by authentik are always overwritten when updated! Only manually created custom blueprints remain unchanged between updates."
+    fi
+
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
+    GO_VERSION="$(grep -m1 '^go ' /opt/authentik/go.mod | awk '{print $2}')" setup_go
 
     msg_info "Configuring rust"
     cd /opt/authentik
@@ -143,21 +153,39 @@ function update_script() {
     chown -R authentik:authentik /opt/authentik
     msg_ok "Updated python server"
 
-	  msg_info "Updating Worker and Server config"
+    cp -r /opt/authentik/blueprints /opt/authentik-data/
-    cat <<EOF >>/etc/default/authentik-server
+    rm -r /opt/authentik/blueprints
+    $STD find /opt/authentik-data -path '*/lost+found' -prune -o -exec chown authentik:authentik {} +
+
+    if [[ $MAJOR == 2026 && $MINOR -lt 8 ]]; then
+	    msg_info "Updating Worker and Server config (from $MAJOR.$MINOR)"
+      cat <<EOF >>/etc/default/authentik-server
 RUST_BACKTRACE=full
 EOF
-    cat <<EOF >>/etc/default/authentik-worker
+      cat <<EOF >>/etc/default/authentik-worker
 RUST_BACKTRACE=full
 EOF
-    msg_ok "Updated Worker and Server config!"
+      msg_ok "Updated Worker and Server config (from $MAJOR.$MINOR)"
+
+      msg_info "Updating services (from $MAJOR.$MINOR)"
+	    sed -i "s|ExecStart=/opt/authentik/authentik-server|ExecStart=/opt/authentik/bin/authentik server|g" /etc/systemd/system/authentik-server.service
+	    sed -i "s|ExecStart=/opt/authentik/authentik-worker worker|ExecStart=/opt/authentik/bin/authentik worker|g" /etc/systemd/system/authentik-worker.service
+	    sed -i "s|ExecStart=/opt/authentik/ldap|ExecStart=/opt/authentik/bin/ldap|g" /etc/systemd/system/authentik-ldap.service
+	    sed -i "s|ExecStart=/opt/authentik/radius|ExecStart=/opt/authentik/bin/radius|g" /etc/systemd/system/authentik-radius.service
+	    sed -i "s|ExecStart=/opt/authentik/rac|ExecStart=/opt/authentik/bin/rac|g" /etc/systemd/system/authentik-rac.service
+      systemctl daemon-reload
+      msg_ok "Updated services (from $MAJOR.$MINOR)"
+    fi
+
+    msg_info "Updating Worker and Server config"
+    sed -i "s|/dev/shm\/\?$|/dev/shm/authentik-server|g" /etc/default/authentik-server
+	  sed -i "s|/dev/shm\/\?$|/dev/shm/authentik-worker|g" /etc/default/authentik-worker
+    msg_ok "Updated Worker and Server config"
 
     msg_info "Updating services"
-	  sed -i "s|ExecStart=/opt/authentik/authentik-server|ExecStart=/opt/authentik/bin/authentik server|g" /etc/systemd/system/authentik-server.service
+    sed -i 's/authentik Go Server (API Gateway)/authentik Server/g' /etc/systemd/system/authentik-server.service
-	  sed -i "s|ExecStart=/opt/authentik/authentik-worker worker|ExecStart=/opt/authentik/bin/authentik worker|g" /etc/systemd/system/authentik-worker.service
+	  sed -i '/ExecStart=/i ExecStartPre=/usr/bin/mkdir -p "${TMPDIR}"' /etc/systemd/system/authentik-server.service
-	  sed -i "s|ExecStart=/opt/authentik/ldap|ExecStart=/opt/authentik/bin/ldap|g" /etc/systemd/system/authentik-ldap.service
+    sed -i '/ExecStart=/i ExecStartPre=/usr/bin/mkdir -p "${TMPDIR}"' /etc/systemd/system/authentik-worker.service
-	  sed -i "s|ExecStart=/opt/authentik/radius|ExecStart=/opt/authentik/bin/radius|g" /etc/systemd/system/authentik-radius.service
-	  sed -i "s|ExecStart=/opt/authentik/rac|ExecStart=/opt/authentik/bin/rac|g" /etc/systemd/system/authentik-rac.service
     systemctl daemon-reload
     msg_ok "Updated services"
 
@@ -198,8 +226,9 @@ done
 $STD pct exec "$CTID" -- bash -c "mkdir -p /opt/authentik-data/{certs,media,geoip,templates}; \
   cp /opt/authentik/tests/GeoLite2-ASN-Test.mmdb /opt/authentik-data/geoip/GeoLite2-ASN.mmdb; \
   cp /opt/authentik/tests/GeoLite2-City-Test.mmdb /opt/authentik-data/geoip/GeoLite2-City.mmdb; \
-  chown authentik:authentik /opt/authentik-data; \
+  cp -r /opt/authentik/blueprints /opt/authentik-data/; \
-  chown -R authentik:authentik /opt/authentik-data/{certs,media,geoip,templates}"
+  rm -r /opt/authentik/blueprints; \
+  find /opt/authentik-data -path '*/lost+found' -prune -o -exec chown authentik:authentik {} +"
 msg_ok "Attached data storage volume"
 
 msg_info "Starting Services"

ct/baserow.sh

@@ -48,7 +48,7 @@ function update_script() {
 
     msg_info "Rebuilding Frontend"
     cd /opt/baserow/web-frontend
-    $STD npm install
+    $STD npm install --allow-remote=all
     $STD npm run build
     msg_ok "Rebuilt Frontend"
 

ct/bentopdf.sh

@@ -44,7 +44,7 @@ function update_script() {
 
     msg_info "Configuring BentoPDF"
     cd /opt/bentopdf
-    $STD npm ci --no-audit --no-fund
+    $STD npm ci --no-audit --no-fund --allow-remote=all
     export NODE_OPTIONS="--max-old-space-size=3072"
     export SIMPLE_MODE=true
     export VITE_USE_CDN=true

ct/bitmagnet.sh

@@ -71,6 +71,7 @@ update_deb_based() {
     msg_ok "Data backed up"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "bitmagnet" "bitmagnet-io/bitmagnet" "tarball"
+    GO_VERSION="$(grep -m1 '^go ' /opt/bitmagnet/go.mod | awk '{print $2}')" setup_go
     restore_backup
 
     msg_info "Configuring Bitmagnet"

ct/cloudflare-ddns.sh

@@ -37,8 +37,8 @@ function update_script() {
     systemctl stop cloudflare-ddns
     msg_ok "Stopped Service"
 
-    setup_go
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "cloudflare-ddns" "favonia/cloudflare-ddns" "tarball"
+    GO_VERSION="$(grep -m1 '^go ' /opt/cloudflare-ddns/go.mod | awk '{print $2}')" setup_go
 
     msg_info "Updating ${APP}"
     cd /opt/cloudflare-ddns

ct/cryptpad.sh

@@ -51,7 +51,7 @@ function update_script() {
 
     msg_info "Updating CryptPad"
     cd /opt/cryptpad
-    $STD npm ci
+    $STD npm ci --allow-git=all
     $STD npm run install:components
     if [ -f "/opt/cryptpad/install-onlyoffice.sh" ]; then
       $STD bash /opt/cryptpad/install-onlyoffice.sh --accept-license

ct/databasus.sh

@@ -70,6 +70,7 @@ function update_script() {
     msg_ok "Ensured Database Clients"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "databasus" "databasus/databasus" "tarball" "latest" "/opt/databasus"
+    GO_VERSION="$(grep -m1 '^go ' /opt/databasus/backend/go.mod | awk '{print $2}')" setup_go
 
     msg_info "Updating Databasus"
     export COREPACK_ENABLE_DOWNLOAD_PROMPT=0

ct/firecrawl.sh

@@ -42,6 +42,7 @@ function update_script() {
     create_backup /opt/firecrawl/.env
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "firecrawl" "firecrawl/firecrawl" "tarball" "latest" "/opt/firecrawl"
+    GO_VERSION="$(grep -m1 '^go ' /opt/firecrawl/apps/api/sharedLibs/go-html-to-md/go.mod | awk '{print $2}')" setup_go
 
     restore_backup
 

ct/gluetun.sh

@@ -39,6 +39,7 @@ function update_script() {
     msg_ok "Stopped Service"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "gluetun" "qdm12/gluetun" "tarball"
+    GO_VERSION="$(grep -m1 '^go ' /opt/gluetun/go.mod | awk '{print $2}')" setup_go
 
     msg_info "Building Gluetun"
     cd /opt/gluetun

ct/heimdall-dashboard.sh

@@ -37,12 +37,9 @@ function update_script() {
     sleep 1
     msg_ok "Stopped Service"
 
-    msg_info "Backing up Data"
+    create_backup /opt/Heimdall/database/app.sqlite
-    cp -R /opt/Heimdall/database database-backup
-    cp -R /opt/Heimdall/public public-backup
-    sleep 1
-    msg_ok "Backed up Data"
 
+    PHP_VERSION="8.4" PHP_FPM="YES" setup_php
     setup_composer
     fetch_and_deploy_gh_release "Heimdall" "linuxserver/Heimdall" "tarball"
 
@@ -52,20 +49,15 @@ function update_script() {
     rm -f bootstrap/cache/*.php
     export COMPOSER_ALLOW_SUPERUSER=1
     $STD composer install --no-dev --no-interaction --prefer-dist --optimize-autoloader
-    $STD php artisan optimize:clear
     msg_ok "Updated Heimdall-Dashboard"
 
-    msg_info "Restoring Data"
+    restore_backup
-    cd ~
-    cp -R database-backup/* /opt/Heimdall/database
-    cp -R public-backup/* /opt/Heimdall/public
-    sleep 1
-    msg_ok "Restored Data"
 
-    msg_info "Cleaning Up"
+    msg_info "Migrating Database"
-    rm -rf {public-backup,database-backup}
+    cd /opt/Heimdall
-    sleep 1
+    $STD php artisan migrate --force
-    msg_ok "Cleaned Up"
+    $STD php artisan optimize:clear
+    msg_ok "Migrated Database"
 
     msg_info "Starting Service"
     systemctl start heimdall.service

ct/immich.sh

@@ -477,7 +477,7 @@ function compile_jpegli() {
 function compile_libheif() {
   SOURCE=${SOURCE_DIR}/libheif
   ensure_dependencies libaom-dev
-  LIBHEIF_REVISION="62f1b8c76ed4d8305071fdacbe74ef9717bacac5"
+  LIBHEIF_REVISION="ac1cb05c39008f01525c991ff8b88f84ddf70fd2"
   # : "${LIBHEIF_REVISION:=$(jq -cr '.revision' "$BASE_DIR"/server/sources/libheif.json)}"
   if [[ "${update:-}" ]] || [[ "$LIBHEIF_REVISION" != "$(grep 'libheif' ~/.immich_library_revisions | awk '{print $2}')" ]]; then
     msg_info "Recompiling libheif"
@@ -509,7 +509,7 @@ function compile_libheif() {
 
 function compile_libraw() {
   SOURCE=${SOURCE_DIR}/libraw
-  LIBRAW_REVISION="b860248a89d9082b8e0a1e202e516f46af9adb29"
+  LIBRAW_REVISION="e419de08001de28ae6988ecb22df47e52b9c5eaa"
   # : "${LIBRAW_REVISION:=$(jq -cr '.revision' "$BASE_DIR"/server/sources/libraw.json)}"
   if [[ "$LIBRAW_REVISION" != "$(grep 'libraw' ~/.immich_library_revisions | awk '{print $2}')" ]]; then
     msg_info "Recompiling libraw"

ct/koffan.sh

@@ -40,6 +40,7 @@ function update_script() {
 
     create_backup /opt/koffan/data
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "koffan" "PanSalut/Koffan" "tarball"
+    GO_VERSION="$(grep -m1 '^go ' /opt/koffan/go.mod | awk '{print $2}')" setup_go
     restore_backup
 
     msg_info "Rebuilding Koffan"

ct/librechat.sh

@@ -45,7 +45,7 @@ function update_script() {
 
     msg_info "Installing Dependencies"
     cd /opt/librechat
-    $STD npm ci
+    $STD npm ci --allow-remote=all
     msg_ok "Installed Dependencies"
 
     msg_info "Building Frontend"

ct/localagi.sh

@@ -40,6 +40,7 @@ function update_script() {
 
     create_backup /opt/localagi/.env
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "localagi" "mudler/LocalAGI" "tarball" "latest" "/opt/localagi"
+    GO_VERSION="$(grep -m1 '^go ' /opt/localagi/go.mod | awk '{print $2}')" setup_go
     restore_backup
 
     msg_info "Building LocalAGI"

ct/mediamtx.sh

@@ -37,7 +37,9 @@ function update_script() {
     systemctl stop mediamtx
     msg_ok "Service stopped"
 
+    create_backup /opt/mediamtx/mediamtx.yml
     fetch_and_deploy_gh_release "mediamtx" "bluenviron/mediamtx" "prebuild" "latest" "/opt/mediamtx" "mediamtx*linux_$(arch_resolve).tar.gz"
+    restore_backup
 
     msg_info "Starting service"
     systemctl start mediamtx

ct/netboot-xyz.sh

@@ -58,6 +58,14 @@ function update_script() {
     USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-linux-bin" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-linux.bin"
     USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-dsk" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz.dsk"
     USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-pdsk" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz.pdsk"
+
+    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-efi" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.efi"
+    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-kpxe" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.kpxe"
+    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-lkrn" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.lkrn"
+    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-dsk" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.dsk"
+    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-pdsk" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.pdsk"
+    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-metal-legacy-efi" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-metal-legacy.efi"
+    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-metal-legacy-kpxe" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-metal-legacy.kpxe"
     USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-arm64" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-arm64.efi"
     USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-arm64-snp" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-arm64-snp.efi"
     USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-arm64-snponly" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-arm64-snponly.efi"
@@ -70,6 +78,12 @@ function update_script() {
     USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-arm64-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-arm64.img"
     USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-multiarch-iso" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-multiarch.iso"
     USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-multiarch-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-multiarch.img"
+    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-iso" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.iso"
+    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.img"
+    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-sb-iso" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sb.iso"
+    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-sb-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sb.img"
+    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-sb-arm64-iso" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sb-arm64.iso"
+    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-sb-arm64-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sb-arm64.img"
     USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-checksums" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sha256-checksums.txt"
 
     msg_info "Restoring Configuration"

ct/networkoptimizer.sh

@@ -39,6 +39,7 @@ function update_script() {
 
     create_backup /opt/networkoptimizer/networkoptimizer.env
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "networkoptimizer" "Ozark-Connect/NetworkOptimizer" "tarball"
+    GO_VERSION="$(grep -m1 '^go ' /opt/networkoptimizer/src/uwnspeedtest/go.mod | awk '{print $2}')" setup_go
     restore_backup
 
     msg_info "Rebuilding NetworkOptimizer"

ct/omnitools.sh

@@ -40,7 +40,7 @@ function update_script() {
     msg_info "Building OmniTools"
     cd /opt/omnitools
     export HUSKY=0
-    $STD npm ci
+    $STD npm ci --allow-remote=all
     $STD npm run build
     msg_ok "Built OmniTools"
 

ct/pangolin.sh

@@ -63,7 +63,7 @@ function update_script() {
 
     msg_info "Updating Pangolin"
     cd /opt/pangolin
-    $STD npm ci
+    $STD npm ci --allow-remote=all
     $STD npm run set:pg
     $STD npm run set:oss
     rm -rf server/private

ct/paperless-gpt.sh

@@ -41,6 +41,7 @@ function update_script() {
     fi
 
     fetch_and_deploy_gh_release "paperless-gpt" "icereed/paperless-gpt" "tarball"
+    GO_VERSION="$(grep -m1 '^go ' /opt/paperless-gpt/go.mod | awk '{print $2}')" setup_go
 
     msg_info "Updating Paperless-GPT"
     cd /opt/paperless-gpt/web-app

ct/poznote.sh

@@ -35,6 +35,7 @@ function update_script() {
   if check_for_gh_release "poznote" "timothepoznanski/poznote"; then
     msg_info "Stopping Service"
     systemctl stop nginx
+    systemctl stop poznote-reminder-worker poznote-s3-backup-worker 2>/dev/null || true
     msg_ok "Stopped Service"
 
     create_backup /var/www/html/data
@@ -48,8 +49,178 @@ function update_script() {
 
     restore_backup
 
+    msg_info "Running Poznote Initialization"
+    chmod +x /opt/poznote/init.sh
+    $STD /opt/poznote/init.sh
+    msg_ok "Initialized Poznote Data Directory"
+
+    msg_info "Updating Nginx Configuration"
+    [[ -f /etc/nginx/sites-available/poznote ]] && cp /etc/nginx/sites-available/poznote /etc/nginx/sites-available/poznote.bak
+    PHP_SOCK=$(get_php_fpm_socket)
+    cat <<EOF >/etc/nginx/sites-available/poznote
+# The Excalidraw editor must keep its window.opener relationship with
+# libraries.excalidraw.com so "Add to Excalidraw" can hand the chosen library
+# back to the already-open editor tab; COOP same-origin would sever it.
+map \$uri \$poznote_coop {
+    default                  "same-origin";
+    /excalidraw_editor.php   "unsafe-none";
+}
+
+server {
+    listen 8040;
+    root /var/www/html;
+    index index.php index.html;
+
+    gzip on;
+    gzip_comp_level 5;
+    gzip_min_length 1024;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_types text/css application/javascript text/javascript application/json
+               image/svg+xml application/manifest+json font/ttf font/otf;
+
+    location ~* \.webmanifest$ {
+        default_type application/manifest+json;
+        try_files \$uri =404;
+    }
+
+    client_max_body_size 800M;
+
+    location /api/v1 {
+        try_files \$uri \$uri/ /api/v1/index.php?\$query_string;
+    }
+
+    location = /api/health {
+        rewrite ^ /api_health.php last;
+    }
+
+    location = /api/info {
+        rewrite ^ /api_health.php last;
+    }
+
+    location / {
+        try_files \$uri \$uri/ @poznote_public;
+    }
+
+    location @poznote_public {
+        rewrite ^/folder/([^/]+)/?$ /public_folder.php?token=\$1 last;
+        rewrite ^/workspace/([^/]+)/?$ /public_note.php?token=\$1 last;
+        rewrite ^/([^/]+)/?$ /public_slug.php?slug=\$1 last;
+    }
+
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Cross-Origin-Opener-Policy \$poznote_coop always;
+    add_header Cross-Origin-Resource-Policy "same-origin" always;
+    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;
+
+    location ~* ^/data/.*\.(php[0-9]?|phtml|phar|pht)$ {
+        deny all;
+    }
+
+    location ~ \.php$ {
+        include fastcgi_params;
+        fastcgi_pass unix:${PHP_SOCK};
+        fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
+        fastcgi_param DOCUMENT_ROOT \$document_root;
+        fastcgi_param PATH_INFO \$fastcgi_path_info;
+
+        fastcgi_param HTTP_X_FORWARDED_FOR \$http_x_forwarded_for;
+        fastcgi_param HTTP_X_FORWARDED_PROTO \$http_x_forwarded_proto;
+        fastcgi_param HTTP_X_FORWARDED_HOST \$http_x_forwarded_host;
+        fastcgi_param HTTP_X_FORWARDED_PORT \$http_x_forwarded_port;
+        fastcgi_param HTTP_X_REAL_IP \$http_x_real_ip;
+        fastcgi_param HTTPS \$https if_not_empty;
+
+        # fastcgi_read_timeout 600;
+        # fastcgi_send_timeout 600;
+        # Left at nginx's 60s default, not Docker's 600s:
+        # a stalled git-sync request can hold the PHP session lock, otherwise
+    }
+
+    location ~ /\. {
+        deny all;
+    }
+
+    location ~ ^/data/users/[0-9]+/backgrounds/ {
+        try_files \$uri =404;
+    }
+
+    location ~ ^/data/css/[A-Za-z0-9._-]+\.css$ {
+        try_files \$uri =404;
+    }
+
+    location ~ ^/(data|config)/ {
+        deny all;
+    }
+
+    location ~* ^/pwa/poznote(-[0-9]+)?\.png$ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Cross-Origin-Resource-Policy "cross-origin" always;
+        try_files \$uri =404;
+    }
+
+    location ~* \.(?:js|css|png|jpg|jpeg|gif|svg|ico|woff2?|ttf|otf|eot|webp|webmanifest)$ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Cross-Origin-Resource-Policy "same-origin" always;
+        try_files \$uri =404;
+    }
+}
+EOF
+    msg_ok "Updated Nginx Configuration"
+
+    if [[ ! -f /etc/systemd/system/poznote-reminder-worker.service ]]; then
+      msg_info "Creating Reminder Worker Service"
+      cat <<EOF >/etc/systemd/system/poznote-reminder-worker.service
+[Unit]
+Description=Poznote Reminder Email Worker
+After=network.target
+
+[Service]
+Type=simple
+User=www-data
+Group=www-data
+Restart=always
+ExecStart=/usr/bin/php /var/www/html/workers/reminder-email-worker.php
+WorkingDirectory=/var/www/html
+
+[Install]
+WantedBy=multi-user.target
+EOF
+      systemctl daemon-reload
+      msg_ok "Created Reminder Worker Service"
+    fi
+
+    if [[ ! -f /etc/systemd/system/poznote-s3-backup-worker.service ]]; then
+      msg_info "Creating S3 Backup Worker Service"
+      cat <<EOF >/etc/systemd/system/poznote-s3-backup-worker.service
+[Unit]
+Description=Poznote S3 Backup Worker
+After=network.target
+
+[Service]
+Type=simple
+User=www-data
+Group=www-data
+Restart=always
+ExecStart=/usr/bin/php /var/www/html/workers/s3-backup-worker.php
+WorkingDirectory=/var/www/html
+
+[Install]
+WantedBy=multi-user.target
+EOF
+      systemctl daemon-reload
+      msg_ok "Created S3 Backup Worker Service"
+    fi
+
     msg_info "Starting Service"
     systemctl start nginx
+    systemctl enable -q --now poznote-reminder-worker poznote-s3-backup-worker
     msg_ok "Started Service"
     msg_ok "Updated successfully!"
   fi

ct/reactive-resume.sh

@@ -55,7 +55,7 @@ function update_script() {
     msg_ok "Updated Reactive Resume"
 
     msg_info "Updating Service"
-    sed -i 's|WorkingDirectory=/opt/reactive-resume/apps/web|WorkingDirectory=/opt/reactive-resume/apps/server|; s|ExecStart=/usr/bin/node .output/server/index.mjs|ExecStart=/usr/bin/node dist/index.mjs|' /etc/systemd/system/reactive-resume.service
+    sed -i -E 's|^WorkingDirectory=/opt/reactive-resume(/.*)?$|WorkingDirectory=/opt/reactive-resume/apps/server|; s|ExecStart=/usr/bin/node .output/server/index.mjs|ExecStart=/usr/bin/node dist/index.mjs|' /etc/systemd/system/reactive-resume.service
     systemctl daemon-reload
     msg_ok "Updated Service"
 

ct/romm.sh

@@ -51,6 +51,7 @@ function update_script() {
       /opt/romm/frontend/dist/assets/ruffle
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "romm" "rommapp/romm" "tarball" "latest" "/opt/romm"
+    echo "__version__ = \"$(cat ~/.romm)\"" >/opt/romm/backend/__version__.py
 
     find /opt/romm/backend/alembic/versions -maxdepth 1 -type f -name '1.*.py' -delete 2>/dev/null || true
     find /opt/romm/backend/alembic/versions -maxdepth 1 -type f -name '2.0.0_.py' -delete 2>/dev/null || true
@@ -65,7 +66,7 @@ function update_script() {
     $STD uv run alembic upgrade head
     if [[ -f /opt/romm/backend/utils/rom_patcher/package.json ]]; then
       cd /opt/romm/backend/utils/rom_patcher
-      $STD npm install --ignore-scripts --no-audit --no-fund
+      $STD npm install --ignore-scripts --no-audit --no-fund --allow-git=all
       if [[ -d node_modules/rom-patcher/rom-patcher-js ]]; then
         rm -rf rom-patcher-js
         cp -r node_modules/rom-patcher/rom-patcher-js ./rom-patcher-js

ct/shlink.sh

@@ -61,7 +61,12 @@ function update_script() {
 
   if [[ -d /opt/shlink-web-client ]]; then
     if check_for_gh_release "shlink-web-client" "shlinkio/shlink-web-client"; then
+      create_backup /opt/shlink-web-client/servers.json
+
       CLEAN_INSTALL=1 fetch_and_deploy_gh_release "shlink-web-client" "shlinkio/shlink-web-client" "prebuild" "latest" "/opt/shlink-web-client" "shlink-web-client_*_dist.zip"
+
+      restore_backup
+
       msg_ok "Updated Web Client"
     fi
   fi

ct/snapotter.sh

@@ -88,6 +88,13 @@ EOF
     msg_info "Updating SnapOtter"
     $STD uv python install 3.11
     $STD uv venv --seed --python 3.11 /opt/snapotter_data/ai/venv
+    if [[ "$(arch_resolve)" == "arm64" ]]; then
+      $STD uv pip install --python /opt/snapotter_data/ai/venv/bin/python \
+        numpy==1.26.4 Pillow==12.3.0 opencv-python-headless==4.10.0.84 fonttools \
+        'huggingface-hub[hf_xet,hf_transfer]==0.36.2'
+    else
+      msg_warn "SnapOtter AI Features have no working CPU-only bundle for amd64 upstream (published bundle is Python 3.12/GPU-CUDA only). Use the official Docker image instead: https://docs.snapotter.com"
+    fi
     ln -sfn /opt/snapotter /app
     msg_ok "Updated SnapOtter"
 

ct/sonarqube.sh

@@ -54,6 +54,7 @@ function update_script() {
     cp -rp ${BACKUP_DIR}/extensions/ /opt/sonarqube/extensions/
     cp -p ${BACKUP_DIR}/conf/sonar.properties /opt/sonarqube/conf/sonar.properties
     rm -rf ${BACKUP_DIR}
+    chmod +x /opt/sonarqube/bin/linux-x86-64/sonar.sh
     chown -R sonarqube:sonarqube /opt/sonarqube
     msg_ok "Restored Backup"
 

ct/tolgee.sh

@@ -37,6 +37,8 @@ function update_script() {
     systemctl stop tolgee
     msg_ok "Stopped Service"
 
+    JAVA_VERSION="25" setup_java
+
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "tolgee" "tolgee/tolgee-platform" "singlefile" "latest" "/opt/tolgee" "tolgee-*.jar"
     find /opt/tolgee -maxdepth 1 -type f -name 'tolgee-*.jar' -exec mv {} /opt/tolgee/tolgee.jar \;
 

ct/tor-snowflake.sh

@@ -44,6 +44,7 @@ function update_script() {
     msg_ok "Stopped Service"
 
     CLEAN_INSTALL=1 GITLAB_URL="https://gitlab.torproject.org" fetch_and_deploy_gl_release "tor-snowflake" "tpo/anti-censorship/pluggable-transports/snowflake" "tarball"
+    GO_VERSION="$(grep -m1 '^go ' /opt/tor-snowflake/proxy/go.mod | awk '{print $2}')" setup_go
 
     msg_info "Building Snowflake"
     cd /opt/tor-snowflake/proxy

ct/wanderer.sh

@@ -158,6 +158,8 @@ EOF
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "wanderer" "open-wanderer/wanderer" "tarball" "latest"
     restore_backup
 
+    GO_VERSION="$(grep -m1 '^go ' /opt/wanderer/db/go.mod | awk '{print $2}')" setup_go
+
     msg_info "Updating wanderer"
     cd /opt/wanderer/db
     $STD go mod tidy

ct/watcharr.sh

@@ -40,6 +40,7 @@ function update_script() {
 
     create_backup /opt/watcharr/server/data
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "watcharr" "sbondCo/Watcharr" "tarball"
+    GO_VERSION="$(grep -m1 '^go ' /opt/watcharr/server/go.mod | awk '{print $2}')" setup_go
     restore_backup
 
     msg_info "Updating Watcharr"

ct/yopass.sh

@@ -38,6 +38,7 @@ function update_script() {
     msg_ok "Stopped Service"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "yopass" "jhaals/yopass" "tarball"
+    GO_VERSION="$(grep -m1 '^go ' /opt/yopass/go.mod | awk '{print $2}')" setup_go
 
     msg_info "Building Yopass"
     cd /opt/yopass

install/authentik-install.sh

@@ -52,16 +52,16 @@ msg_ok "Installed Dependencies"
 
 NODE_VERSION="26" NODE_MODULE=pnpm@11 setup_nodejs
 setup_yq
-setup_go
 RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
 UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.7" setup_uv
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db
 
 XMLSEC_VERSION="1.3.12"
-AUTHENTIK_VERSION="version/2026.8.0"
+AUTHENTIK_VERSION="version/2026.8.1"
 fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec"
 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
+GO_VERSION="$(grep -m1 '^go ' /opt/authentik/go.mod | awk '{print $2}')" setup_go
 fetch_and_deploy_gh_release "geoipupdate" "maxmind/geoipupdate" "binary"
 
 msg_info "Setting up xmlsec"
@@ -146,7 +146,7 @@ yq -i ".secret_key = \"$(openssl rand -base64 128 | tr -dc 'a-zA-Z0-9' | head -c
 yq -i ".postgresql.password = \"${PG_DB_PASS}\"" /etc/authentik/config.yml
 yq -i ".events.context_processors.geoip = \"/opt/authentik-data/geoip/GeoLite2-City.mmdb\"" /etc/authentik/config.yml
 yq -i ".events.context_processors.asn = \"/opt/authentik-data/geoip/GeoLite2-ASN.mmdb\"" /etc/authentik/config.yml
-yq -i ".blueprints_dir = \"/opt/authentik/blueprints\"" /etc/authentik/config.yml
+yq -i ".blueprints_dir = \"/opt/authentik-data/blueprints\"" /etc/authentik/config.yml
 yq -i ".cert_discovery_dir = \"/opt/authentik-data/certs\"" /etc/authentik/config.yml
 yq -i ".email.template_dir = \"/opt/authentik-data/templates\"" /etc/authentik/config.yml
 yq -i ".storage.file.path = \"/opt/authentik-data\"" /etc/authentik/config.yml
@@ -154,7 +154,7 @@ yq -i ".disable_startup_analytics = \"true\"" /etc/authentik/config.yml
 $STD useradd -U -s /usr/sbin/nologin -r -M -d /opt/authentik authentik
 chown -R authentik:authentik /opt/authentik
 cat <<EOF >/etc/default/authentik-server
-TMPDIR=/dev/shm/
+TMPDIR=/dev/shm/authentik-server
 UV_LINK_MODE=copy
 UV_PYTHON_DOWNLOADS=0
 UV_NATIVE_TLS=1
@@ -170,7 +170,7 @@ AUTHENTIK_LISTEN__HTTPS="[::]:9443"
 AUTHENTIK_LISTEN__METRICS="[::]:9300"
 EOF
 cat <<EOF >/etc/default/authentik-worker
-TMPDIR=/dev/shm/
+TMPDIR=/dev/shm/authentik-worker
 UV_LINK_MODE=copy
 UV_PYTHON_DOWNLOADS=0
 UV_NATIVE_TLS=1
@@ -214,6 +214,7 @@ User=authentik
 Group=authentik
 EnvironmentFile=/etc/default/authentik-server
 ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
+ExecStartPre=/usr/bin/mkdir -p "\${TMPDIR}"
 ExecStart=/opt/authentik/bin/authentik server
 WorkingDirectory=/opt/authentik/
 Restart=always
@@ -234,6 +235,7 @@ Group=authentik
 Type=simple
 EnvironmentFile=/etc/default/authentik-worker
 ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
+ExecStartPre=/usr/bin/mkdir -p "\${TMPDIR}"
 ExecStart=/opt/authentik/bin/authentik worker
 WorkingDirectory=/opt/authentik
 Restart=always

install/baserow-install.sh

@@ -45,7 +45,7 @@ msg_ok "Installed Backend Dependencies"
 
 msg_info "Building Frontend"
 cd /opt/baserow/web-frontend
-NODE_OPTIONS="--max-old-space-size=4096" $STD npm install --legacy-peer-deps
+NODE_OPTIONS="--max-old-space-size=4096" $STD npm install --legacy-peer-deps --allow-remote=all
 NODE_OPTIONS="--max-old-space-size=4096" $STD npm run build
 msg_ok "Built Frontend"
 

install/bentopdf-install.sh

@@ -24,7 +24,7 @@ fetch_and_deploy_gh_release "bentopdf" "alam00000/bentopdf" "tarball" "latest" "
 
 msg_info "Setup BentoPDF"
 cd /opt/bentopdf
-$STD npm ci --no-audit --no-fund
+$STD npm ci --no-audit --no-fund --allow-remote=all
 cp ./.env.example ./.env.production
 export NODE_OPTIONS="--max-old-space-size=3072"
 export SIMPLE_MODE=true

install/bitmagnet-install.sh

@@ -23,9 +23,9 @@ setup_deb_based() {
 
   PG_VERSION="16" setup_postgresql
   PG_DB_NAME="bitmagnet" PG_DB_USER="bitmagnet" setup_postgresql_db
-  setup_go
 
   fetch_and_deploy_gh_release "bitmagnet" "bitmagnet-io/bitmagnet" "tarball"
+  GO_VERSION="$(grep -m1 '^go ' /opt/bitmagnet/go.mod | awk '{print $2}')" setup_go
   RELEASE=$(cat ~/.bitmagnet)
 
   msg_info "Configuring bitmagnet"

install/cloudflare-ddns-install.sh

@@ -51,8 +51,8 @@ while true; do
 done
 msg_ok "Configured Application"
 
-setup_go
 fetch_and_deploy_gh_release "cloudflare-ddns" "favonia/cloudflare-ddns" "tarball"
+GO_VERSION="$(grep -m1 '^go ' /opt/cloudflare-ddns/go.mod | awk '{print $2}')" setup_go
 
 msg_info "Building ${APPLICATION}"
 cd /opt/cloudflare-ddns

install/cryptpad-install.sh

@@ -24,7 +24,7 @@ fetch_and_deploy_gh_release "cryptpad" "cryptpad/cryptpad" "tarball"
 
 msg_info "Setup CryptPad"
 cd /opt/cryptpad
-$STD npm ci
+$STD npm ci --allow-git=all
 $STD npm run install:components
 if [[ "$onlyoffice" =~ ^[Yy]$ ]]; then
   $STD bash -c "./install-onlyoffice.sh --accept-license"

install/databasus-install.sh

@@ -22,7 +22,6 @@ $STD apt install -y \
 msg_ok "Installed Dependencies"
 
 PG_VERSION="17" setup_postgresql
-setup_go
 NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs
 
 msg_info "Installing Database Clients"
@@ -52,6 +51,7 @@ done
 msg_ok "Installed Database Clients"
 
 fetch_and_deploy_gh_release "databasus" "databasus/databasus" "tarball" "latest" "/opt/databasus"
+GO_VERSION="$(grep -m1 '^go ' /opt/databasus/backend/go.mod | awk '{print $2}')" setup_go
 
 msg_info "Building Databasus (Patience)"
 export COREPACK_ENABLE_DOWNLOAD_PROMPT=0

install/fileflows-install.sh

@@ -45,7 +45,7 @@ $STD ln -svf /usr/bin/ffmpeg /usr/local/bin/ffmpeg
 $STD ln -svf /usr/bin/ffprobe /usr/local/bin/ffprobe
 $STD rm -rf /opt/fileflows/Server/runtimes/win-*
 
-read -r -p "${TAB3}Do you want to install FileFlows Server or Node? (S/N): " install_server
+read -r -p "${TAB3}Do you want to install FileFlows Server or Agent? (S/A): " install_server
 
 if [[ "$install_server" =~ ^[Ss]$ ]]; then
   msg_info "Installing FileFlows Server"
@@ -54,15 +54,23 @@ if [[ "$install_server" =~ ^[Ss]$ ]]; then
   systemctl enable -q --now fileflows
   msg_ok "Installed FileFlows Server"
 else
-  msg_info "Installing FileFlows Node"
+  msg_info "Installing FileFlows Agent"
+  stop_spinner
   read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url
   while [[ -z "${server_url// /}" ]]; do
     read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url
   done
-  cd /opt/fileflows/Node
+  cd /opt/fileflows/Agent
-  $STD dotnet FileFlows.Node.dll --server "$server_url" --systemd install --root true
+  before_units="$(systemctl list-unit-files 'fileflows*' --no-legend 2>/dev/null | awk '{print $1}' | sort || true)"
-  systemctl enable -q --now fileflows-node
+  $STD dotnet FileFlows.Agent.dll --server "$server_url" --systemd install --root true
-  msg_ok "Installed FileFlows Node"
+  after_units="$(systemctl list-unit-files 'fileflows*' --no-legend 2>/dev/null | awk '{print $1}' | sort || true)"
+  agent_unit="$(comm -13 <(echo "$before_units") <(echo "$after_units") | head -n1)"
+  if [[ -n "$agent_unit" ]]; then
+    systemctl enable -q --now "$agent_unit"
+  else
+    msg_warn "Could not detect the FileFlows Agent systemd unit; start it manually (systemctl list-unit-files 'fileflows*')."
+  fi
+  msg_ok "Installed FileFlows Agent"
 fi
 
 motd_ssh

install/firecrawl-install.sh

@@ -28,11 +28,11 @@ $STD apt install -y \
 msg_ok "Installed Dependencies"
 
 NODE_VERSION="22" NODE_MODULE="pnpm@11.4.0" setup_nodejs
-setup_go
 RUST_PROFILE="minimal" setup_rust
 PG_VERSION="17" PG_MODULES="cron" setup_postgresql
 
 fetch_and_deploy_gh_release "firecrawl" "firecrawl/firecrawl" "tarball" "latest" "/opt/firecrawl"
+GO_VERSION="$(grep -m1 '^go ' /opt/firecrawl/apps/api/sharedLibs/go-html-to-md/go.mod | awk '{print $2}')" setup_go
 
 msg_info "Configuring FDB"
 FDB_VERSION="$(awk -F= '/^ARG FDB_VERSION=/{print $2; exit}' /opt/firecrawl/apps/api/Dockerfile)"

install/flatnotes-install.sh

@@ -15,7 +15,7 @@ update_os
 
 fetch_and_deploy_gh_release "flatnotes" "dullage/flatnotes" "tarball"
 USE_UVX="YES" setup_uv
-NODE_VERSION="22" setup_nodejs
+NODE_VERSION="24" setup_nodejs
 
 msg_info "Setting up Flatnotes"
 cd /opt/flatnotes

install/frigate-install.sh

@@ -362,6 +362,7 @@ Restart=always
 RestartSec=1
 User=root
 EnvironmentFile=/etc/frigate.env
+ExecStartPre=+/usr/bin/systemctl restart go2rtc.service
 ExecStartPre=+rm -f /dev/shm/logs/frigate/current
 ExecStart=/bin/bash -c "bash /opt/frigate/docker/main/rootfs/etc/s6-overlay/s6-rc.d/frigate/run 2> >(/usr/bin/ts '%%Y-%%m-%%d %%H:%%M:%%.S ' >&2) | /usr/bin/ts '%%Y-%%m-%%d %%H:%%M:%%.S '"
 StandardOutput=file:/dev/shm/logs/frigate/current

install/gluetun-install.sh

@@ -26,9 +26,9 @@ $STD update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
 ln -sf /usr/sbin/openvpn /usr/sbin/openvpn2.6
 msg_ok "Configured iptables"
 
-setup_go
 
 fetch_and_deploy_gh_release "gluetun" "qdm12/gluetun" "tarball"
+GO_VERSION="$(grep -m1 '^go ' /opt/gluetun/go.mod | awk '{print $2}')" setup_go
 
 msg_info "Building Gluetun"
 cd /opt/gluetun

install/immich-install.sh

@@ -266,7 +266,7 @@ msg_ok "(2/6) Compiled jpegli"
 
 msg_info "(3/6) Compiling libheif"
 SOURCE=${SOURCE_DIR}/libheif
-LIBHEIF_REVISION="62f1b8c76ed4d8305071fdacbe74ef9717bacac5"
+LIBHEIF_REVISION="ac1cb05c39008f01525c991ff8b88f84ddf70fd2"
 # : "${LIBHEIF_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libheif.json)}"
 $STD git clone https://github.com/strukturag/libheif.git "$SOURCE"
 cd "$SOURCE"
@@ -292,7 +292,7 @@ msg_ok "(3/6) Compiled libheif"
 
 msg_info "(4/6) Compiling libraw"
 SOURCE=${SOURCE_DIR}/libraw
-LIBRAW_REVISION="b860248a89d9082b8e0a1e202e516f46af9adb29"
+LIBRAW_REVISION="e419de08001de28ae6988ecb22df47e52b9c5eaa"
 # : "${LIBRAW_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libraw.json)}"
 $STD git clone https://github.com/LibRaw/LibRaw.git "$SOURCE"
 cd "$SOURCE"

install/iventoy-install.sh

@@ -31,8 +31,8 @@ Environment=IVENTOY_API_ALL=1
 Environment=IVENTOY_AUTO_RUN=1
 Environment=LIBRARY_PATH=/opt/iventoy/lib/lin64
 Environment=LD_LIBRARY_PATH=/opt/iventoy/lib/lin64
-ExecStart=/bin/sh /opt/iventoy/iventoy.sh -R start
+ExecStart=/bin/bash /opt/iventoy/iventoy.sh -R start
-ExecStop=/bin/sh /opt/iventoy/iventoy.sh stop
+ExecStop=/bin/bash /opt/iventoy/iventoy.sh stop
 Restart=on-failure
 RestartSec=5
 

install/koffan-install.sh

@@ -17,8 +17,8 @@ msg_info "Installing Dependencies"
 $STD apt install -y build-essential
 msg_ok "Installed Dependencies"
 
-setup_go
 fetch_and_deploy_gh_release "koffan" "PanSalut/Koffan" "tarball"
+GO_VERSION="$(grep -m1 '^go ' /opt/koffan/go.mod | awk '{print $2}')" setup_go
 
 msg_info "Building Koffan"
 cd /opt/koffan

install/librechat-install.sh

@@ -25,7 +25,7 @@ fetch_and_deploy_gh_release "rag-api" "danny-avila/rag_api" "tarball"
 
 msg_info "Installing LibreChat Dependencies"
 cd /opt/librechat
-$STD npm ci
+$STD npm ci --allow-remote=all
 msg_ok "Installed LibreChat Dependencies"
 
 msg_info "Building Frontend"

install/localagi-install.sh

@@ -19,7 +19,6 @@ $STD apt install -y build-essential
 msg_ok "Installed Dependencies"
 
 NODE_VERSION="24" setup_nodejs
-setup_go
 
 msg_info "Installing Bun"
 export BUN_INSTALL="/root/.bun"
@@ -29,6 +28,7 @@ ln -sf /root/.bun/bin/bunx /usr/local/bin/bunx
 msg_ok "Installed Bun"
 
 fetch_and_deploy_gh_release "localagi" "mudler/LocalAGI" "tarball" "latest" "/opt/localagi"
+GO_VERSION="$(grep -m1 '^go ' /opt/localagi/go.mod | awk '{print $2}')" setup_go
 
 msg_info "Configuring LocalAGI"
 mkdir -p /opt/localagi/pool

install/neko-install.sh

@@ -48,9 +48,9 @@ $STD apt install -y \
 msg_ok "Installed Build Dependencies"
 
 NODE_VERSION="22" setup_nodejs
-setup_go
 
 fetch_and_deploy_gh_release "neko" "m1k1o/neko" "tarball"
+GO_VERSION="$(grep -m1 '^go ' /opt/neko/server/go.mod | awk '{print $2}')" setup_go
 
 msg_info "Building Client"
 cd /opt/neko/client

install/netboot-xyz-install.sh

@@ -41,6 +41,14 @@ USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-lkrn" "netbo
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-linux-bin" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-linux.bin"
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-dsk" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz.dsk"
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-pdsk" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz.pdsk"
+
+USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-efi" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.efi"
+USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-kpxe" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.kpxe"
+USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-lkrn" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.lkrn"
+USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-dsk" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.dsk"
+USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-pdsk" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.pdsk"
+USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-metal-legacy-efi" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-metal-legacy.efi"
+USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-metal-legacy-kpxe" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-metal-legacy.kpxe"
 # ARM64 bootloaders
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-arm64" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-arm64.efi"
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-arm64-snp" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-arm64-snp.efi"
@@ -55,6 +63,12 @@ USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-arm64-iso" "
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-arm64-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-arm64.img"
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-multiarch-iso" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-multiarch.iso"
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-multiarch-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-multiarch.img"
+USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-iso" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.iso"
+USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.img"
+USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-sb-iso" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sb.iso"
+USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-sb-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sb.img"
+USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-sb-arm64-iso" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sb-arm64.iso"
+USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-sb-arm64-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sb-arm64.img"
 # SHA256 checksums
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-checksums" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sha256-checksums.txt"
 

install/networkoptimizer-install.sh

@@ -27,9 +27,9 @@ setup_deb822_repo \
 $STD apt install -y dotnet-sdk-10.0
 msg_ok "Installed Dependencies"
 
-setup_go
 
 fetch_and_deploy_gh_release "networkoptimizer" "Ozark-Connect/NetworkOptimizer" "tarball"
+GO_VERSION="$(grep -m1 '^go ' /opt/networkoptimizer/src/uwnspeedtest/go.mod | awk '{print $2}')" setup_go
 
 msg_info "Building NetworkOptimizer"
 RID="linux-x64"

install/omnitools-install.sh

@@ -23,7 +23,7 @@ fetch_and_deploy_gh_release "omnitools" "iib0011/omni-tools" "tarball"
 msg_info "Building OmniTools"
 cd /opt/omnitools
 export HUSKY=0
-$STD npm ci
+$STD npm ci --allow-remote=all
 $STD npm run build
 msg_ok "Built OmniTools"
 

install/pangolin-install.sh

@@ -45,7 +45,7 @@ SECRET_KEY=$(openssl rand -base64 48 | tr -dc 'A-Za-z0-9' | head -c 32)
 BADGER_VERSION=$(get_latest_github_release "fosrl/badger" "false")
 cd /opt/pangolin
 mkdir -p /opt/pangolin/config/{traefik,db,letsencrypt,logs}
-$STD npm ci
+$STD npm ci --allow-remote=all
 $STD npm run set:pg
 $STD npm run set:oss
 rm -rf server/private

install/paperless-gpt-install.sh

@@ -23,8 +23,8 @@ $STD apt install -y \
 msg_ok "Installed Dependencies"
 
 NODE_VERSION="24" setup_nodejs
-setup_go
 fetch_and_deploy_gh_release "paperless-gpt" "icereed/paperless-gpt" "tarball"
+GO_VERSION="$(grep -m1 '^go ' /opt/paperless-gpt/go.mod | awk '{print $2}')" setup_go
 
 msg_info "Setup Paperless-GPT"
 cd /opt/paperless-gpt/web-app

install/poznote-install.sh

@@ -28,16 +28,73 @@ touch /var/www/html/data/database/poznote.db
 chown -R www-data:www-data /var/www/html
 msg_ok "Deployed Poznote"
 
+msg_info "Running Poznote Initialization"
+chmod +x /opt/poznote/init.sh
+$STD /opt/poznote/init.sh
+msg_ok "Initialized Poznote Data Directory"
+
 msg_info "Configuring Nginx"
 PHP_SOCK=$(get_php_fpm_socket)
 cat <<EOF >/etc/nginx/sites-available/poznote
+# The Excalidraw editor must keep its window.opener relationship with
+# libraries.excalidraw.com so "Add to Excalidraw" can hand the chosen library
+# back to the already-open editor tab; COOP same-origin would sever it.
+map \$uri \$poznote_coop {
+    default                  "same-origin";
+    /excalidraw_editor.php   "unsafe-none";
+}
+
 server {
     listen 8040;
     root /var/www/html;
     index index.php index.html;
 
+    gzip on;
+    gzip_comp_level 5;
+    gzip_min_length 1024;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_types text/css application/javascript text/javascript application/json
+               image/svg+xml application/manifest+json font/ttf font/otf;
+
+    location ~* \.webmanifest$ {
+        default_type application/manifest+json;
+        try_files \$uri =404;
+    }
+
+    client_max_body_size 800M;
+
+    location /api/v1 {
+        try_files \$uri \$uri/ /api/v1/index.php?\$query_string;
+    }
+
+    location = /api/health {
+        rewrite ^ /api_health.php last;
+    }
+
+    location = /api/info {
+        rewrite ^ /api_health.php last;
+    }
+
     location / {
-        try_files \$uri \$uri/ /index.php?\$query_string;
+        try_files \$uri \$uri/ @poznote_public;
+    }
+
+    location @poznote_public {
+        rewrite ^/folder/([^/]+)/?$ /public_folder.php?token=\$1 last;
+        rewrite ^/workspace/([^/]+)/?$ /public_note.php?token=\$1 last;
+        rewrite ^/([^/]+)/?$ /public_slug.php?slug=\$1 last;
+    }
+
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Cross-Origin-Opener-Policy \$poznote_coop always;
+    add_header Cross-Origin-Resource-Policy "same-origin" always;
+    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;
+
+    location ~* ^/data/.*\.(php[0-9]?|phtml|phar|pht)$ {
+        deny all;
     }
 
     location ~ \.php$ {
@@ -45,16 +102,93 @@ server {
         fastcgi_pass unix:${PHP_SOCK};
         fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
         fastcgi_param DOCUMENT_ROOT \$document_root;
+        fastcgi_param PATH_INFO \$fastcgi_path_info;
+
+        fastcgi_param HTTP_X_FORWARDED_FOR \$http_x_forwarded_for;
+        fastcgi_param HTTP_X_FORWARDED_PROTO \$http_x_forwarded_proto;
+        fastcgi_param HTTP_X_FORWARDED_HOST \$http_x_forwarded_host;
+        fastcgi_param HTTP_X_FORWARDED_PORT \$http_x_forwarded_port;
+        fastcgi_param HTTP_X_REAL_IP \$http_x_real_ip;
+        fastcgi_param HTTPS \$https if_not_empty;
+
+        # fastcgi_read_timeout 600;
+        # fastcgi_send_timeout 600;
+        # Left at nginx's 60s default, not Docker's 600s:
+        # a stalled git-sync request can hold the PHP session lock, otherwise
     }
 
-    location ~ /\.ht {
+    location ~ /\. {
         deny all;
     }
+
+    location ~ ^/data/users/[0-9]+/backgrounds/ {
+        try_files \$uri =404;
+    }
+
+    location ~ ^/data/css/[A-Za-z0-9._-]+\.css$ {
+        try_files \$uri =404;
+    }
+
+    location ~ ^/(data|config)/ {
+        deny all;
+    }
+
+    location ~* ^/pwa/poznote(-[0-9]+)?\.png$ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Cross-Origin-Resource-Policy "cross-origin" always;
+        try_files \$uri =404;
+    }
+
+    location ~* \.(?:js|css|png|jpg|jpeg|gif|svg|ico|woff2?|ttf|otf|eot|webp|webmanifest)$ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Cross-Origin-Resource-Policy "same-origin" always;
+        try_files \$uri =404;
+    }
 }
 EOF
 nginx_enable_site poznote
 msg_ok "Configured Nginx"
 
+msg_info "Creating Background Worker Services"
+cat <<EOF >/etc/systemd/system/poznote-reminder-worker.service
+[Unit]
+Description=Poznote Reminder Email Worker
+After=network.target
+
+[Service]
+Type=simple
+User=www-data
+Group=www-data
+Restart=always
+ExecStart=/usr/bin/php /var/www/html/workers/reminder-email-worker.php
+WorkingDirectory=/var/www/html
+
+[Install]
+WantedBy=multi-user.target
+EOF
+cat <<EOF >/etc/systemd/system/poznote-s3-backup-worker.service
+[Unit]
+Description=Poznote S3 Backup Worker
+After=network.target
+
+[Service]
+Type=simple
+User=www-data
+Group=www-data
+Restart=always
+ExecStart=/usr/bin/php /var/www/html/workers/s3-backup-worker.php
+WorkingDirectory=/var/www/html
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now poznote-reminder-worker poznote-s3-backup-worker
+msg_ok "Created Background Worker Services"
+
 motd_ssh
 customize
 cleanup_lxc

install/romm-install.sh

@@ -161,6 +161,7 @@ else
 fi
 
 fetch_and_deploy_gh_release "romm" "rommapp/romm" "tarball"
+echo "__version__ = \"$(cat ~/.romm)\"" >/opt/romm/backend/__version__.py
 
 msg_info "Creating environment file"
 sed -i 's/^supervised no/supervised systemd/' /etc/redis/redis.conf
@@ -214,7 +215,7 @@ msg_ok "Set up RomM Backend"
 if [[ -f /opt/romm/backend/utils/rom_patcher/package.json ]]; then
   msg_info "Building ROM Patcher helper"
   cd /opt/romm/backend/utils/rom_patcher
-  $STD npm install --ignore-scripts --no-audit --no-fund
+  $STD npm install --ignore-scripts --no-audit --no-fund --allow-git=all
   if [[ -d node_modules/rom-patcher/rom-patcher-js ]]; then
     rm -rf rom-patcher-js
     cp -r node_modules/rom-patcher/rom-patcher-js ./rom-patcher-js

install/seelf-install.sh

@@ -19,9 +19,9 @@ $STD apt install -y \
   gcc
 msg_ok "Installed Dependencies"
 
-setup_go
 NODE_VERSION="22" setup_nodejs
 fetch_and_deploy_gh_release "seelf" "YuukanOO/seelf" "tarball"
+GO_VERSION="$(grep -m1 '^go ' /opt/seelf/go.mod | awk '{print $2}')" setup_go
 
 msg_info "Setting up seelf. Patience"
 cd /opt/seelf

install/snapotter-install.sh

@@ -34,7 +34,12 @@ $STD apt install -y \
   python3 \
   python3-dev \
   gcc \
-  g++
+  g++ \
+  libavif-bin \
+  libavif-dev \
+  libopencv-dev \
+  python3-opencv \
+  libgles2
 msg_ok "Installed Dependencies"
 
 PYTHON_VERSION="3.11" setup_uv
@@ -59,11 +64,13 @@ msg_info "Setting up Python Environment"
 mkdir -p /opt/snapotter_data/ai/models/rembg
 $STD uv python install 3.11
 $STD uv venv --seed --python 3.11 /opt/snapotter_data/ai/venv
-#if [[ -f /opt/snapotter/packages/ai/python/requirements.txt ]]; then
+if [[ "$(arch_resolve)" == "arm64" ]]; then
-#  $STD uv pip install \
+  $STD uv pip install --python /opt/snapotter_data/ai/venv/bin/python \
-#    --python /opt/snapotter_data/ai/venv/bin/python \
+    numpy==1.26.4 Pillow==12.3.0 opencv-python-headless==4.10.0.84 fonttools \
-#    -r /opt/snapotter/packages/ai/python/requirements.txt
+    'huggingface-hub[hf_xet,hf_transfer]==0.36.2'
-#fi
+else
+  msg_warn "SnapOtter AI Features have no working CPU-only bundle for amd64 upstream (published bundle is Python 3.12/GPU-CUDA only). Use the official Docker image instead: https://docs.snapotter.com"
+fi
 ln -sfn /opt/snapotter /app
 msg_ok "Set up Python Environment"
 

install/tolgee-install.sh

@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os
 
-JAVA_VERSION="21" setup_java
+JAVA_VERSION="25" setup_java
 PG_VERSION="16" setup_postgresql
 PG_DB_NAME="tolgee" PG_DB_USER="tolgee" setup_postgresql_db
 

install/tor-snowflake-install.sh

@@ -13,10 +13,10 @@ setting_up_container
 network_check
 update_os
 
-setup_go
 
 msg_info "Building Snowflake"
 GITLAB_URL="https://gitlab.torproject.org" fetch_and_deploy_gl_release "tor-snowflake" "tpo/anti-censorship/pluggable-transports/snowflake" "tarball"
+GO_VERSION="$(grep -m1 '^go ' /opt/tor-snowflake/proxy/go.mod | awk '{print $2}')" setup_go
 cd /opt/tor-snowflake/proxy
 $STD go build -o snowflake-proxy .
 msg_ok "Built Snowflake Proxy"

install/wanderer-install.sh

@@ -13,7 +13,6 @@ setting_up_container
 network_check
 update_os
 
-setup_go
 NODE_VERSION="22" setup_nodejs
 mkdir -p /opt/{wanderer,wanderer_data/pb_data,wanderer_data/meili_data,wanderer_data/plugins}
 MEILISEARCH_DB_PATH="/opt/wanderer_data/meili_data" setup_meilisearch
@@ -21,6 +20,8 @@ fetch_and_deploy_gh_release "wanderer" "open-wanderer/wanderer" "tarball" "lates
 mkdir -p /opt/wanderer/db/data
 [[ -e /opt/wanderer/db/data/plugins ]] || ln -sfn /opt/wanderer_data/plugins /opt/wanderer/db/data/plugins
 
+GO_VERSION="$(grep -m1 '^go ' /opt/wanderer/db/go.mod | awk '{print $2}')" setup_go
+
 msg_info "Installing wanderer (patience)"
 cd /opt/wanderer/db
 $STD go mod tidy

install/watcharr-install.sh

@@ -17,9 +17,9 @@ msg_info "Installing Dependencies"
 $STD apt install -y gcc
 msg_ok "Installed Dependencies"
 
-setup_go
 NODE_VERSION="24" setup_nodejs
 fetch_and_deploy_gh_release "watcharr" "sbondCo/Watcharr" "tarball"
+GO_VERSION="$(grep -m1 '^go ' /opt/watcharr/server/go.mod | awk '{print $2}')" setup_go
 
 msg_info "Setup Watcharr"
 cd /opt/watcharr

install/yopass-install.sh

@@ -18,10 +18,10 @@ $STD apt install -y redis-server
 systemctl enable -q --now redis-server
 msg_ok "Installed Dependencies"
 
-setup_go
 NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
 
 fetch_and_deploy_gh_release "yopass" "jhaals/yopass" "tarball"
+GO_VERSION="$(grep -m1 '^go ' /opt/yopass/go.mod | awk '{print $2}')" setup_go
 
 msg_info "Building Yopass"
 cd /opt/yopass

tools/pve/update-apps.sh

@@ -155,13 +155,29 @@ function sanitize_service_name() {
   return 0
 }
 
-function validate_service_script() {
+function script_exists() {
   local name="$1"
   sanitize_service_name "$name" || return 1
   curl -fsSL --max-time 10 -o /dev/null \
     "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/${name}.sh" 2>/dev/null
 }
 
+# A container keeps the slug it was built with, so a renamed ct/ script leaves it
+# pointing at a name that no longer exists. Try the successors, but only accept one
+# that is really there -- guessing wrong would run a foreign app's updater.
+function resolve_service_script() {
+  local n="$1" c
+  script_exists "$n" && { printf '%s' "$n"; return 0; }
+  for c in "${n#alpine-}" "$(printf '%s' "$n" | sed -E 's/-v[0-9]+$//')"; do
+    [[ -n "$c" && "$c" != "$n" ]] || continue
+    script_exists "$c" && { printf '%s' "$c"; return 0; }
+  done
+  case "$n" in
+  pbs) script_exists proxmox-backup-server && { printf '%s' proxmox-backup-server; return 0; } ;;
+  esac
+  return 1
+}
+
 function detect_service() {
   local container="$1"
   local tmpdir update_file
@@ -484,12 +500,18 @@ for container in $CHOICE; do
     continue
   fi
 
-  if ! validate_service_script "${service}"; then
+  resolved_service="$(resolve_service_script "${service}")"
+  if [ -z "${resolved_service}" ]; then
     echo -e "${RD}[ERROR]${CL} Service '${service}' does not resolve to ct/${service}.sh"
     log_result "$container" "${service}" "ERROR" "No matching ct/${service}.sh script found"
     log_write "Container $container: ERROR — ct/${service}.sh not found"
     continue
   fi
+  if [ "${resolved_service}" != "${service}" ]; then
+    echo -e "${BL}[INFO]${CL} Script was renamed: ${service} -> ${GN}${resolved_service}${CL}"
+    log_write "Container $container: slug ${service} resolved to ${resolved_service}"
+    service="${resolved_service}"
+  fi
 
   echo -e "${BL}[INFO]${CL} Detected service: ${GN}${service}${CL}"
   log_write "Container $container: detected service '${service}'"