Pin Go to the version each project declares in go.mod

setup_go with no GO_VERSION resolves to whatever go.dev currently serves, so every Go app was built against a moving target. When 1.27 landed it broke wanderer outright (#16909): PocketBase pins go 1.25.0 and stack-overflows at startup when built with anything newer. Two problems, both fixed here: setup_go ran before the source was fetched in all 15 install scripts, so the pin could not be read even if someone wanted one. It now runs after the fetch and reads the version out of go.mod. 13 ct/ scripts rebuild with go during update. Eleven never called setup_go at all and rebuilt with whatever the container happened to have; the other two called it before the fetch. All 13 now use the same call as their installer, verified identical string for string. caddy is left alone: xcaddy fetches the Caddy source itself, so there is no local go.mod to read, and it already pins deliberately. wanderer is in #16976.
2026-10-01 14:39:39 +00:00 · 2026-09-02 17:41:34 +02:00
820 changed files with 7672 additions and 9318 deletions
@@ -6,17 +6,13 @@ body:
    attributes:
      value: |
        ## ⚠️ **IMPORTANT - READ FIRST**  
        - 🔍 **Search first:** Before submitting, check if the issue has already been reported or resolved in [closed issues](https://github.com/community-scripts/ProxmoxVE/issues?q=is%3Aissue+is%3Aclosed). If found, comment on that issue instead of creating a new one.  
        Alternatively, check the **[Discussions](https://github.com/community-scripts/ProxmoxVE/discussions)** under the *"Announcement"* or *"Guide"* categories for relevant information.  
        - 🔎 If you encounter `[ERROR] in line 23: exit code *: while executing command "$@" > /dev/null 2>&1`, rerun the script with verbose mode before submitting the issue.  
        - 📜 **Read the script:** Familiarize yourself with the script's content and its purpose. This will help you understand the issue better and provide more relevant information
-        **1. Reproduce the issue with verbose mode - this is mandatory.**
+        Thank you for taking the time to report an issue! Please provide as much detail as possible to help us address the problem efficiently.  
        Set `var_verbose=yes` (or *Advanced Settings → Verbose Mode*) and run the script again.
        Only a verbose log shows what actually failed - a bare `[ERROR] in line 23: exit code *` tells us nothing.
        **Reports without a verbose log will most likely be closed.**
        **2. Search before you post.**
        Check the [closed issues](https://github.com/community-scripts/ProxmoxVE/issues?q=is%3Aissue+is%3Aclosed) and the [Discussions](https://github.com/community-scripts/ProxmoxVE/discussions) (*Announcement* / *Guide*). If it is already known, comment there instead of opening a new issue.
        **3. Read the script.**
        Knowing what it does makes it much easier to describe the problem - and often to solve it yourself.
  - type: input
    id: guidelines
@@ -32,6 +28,7 @@ body:
      label: 🔎 Did you run the script with verbose mode enabled?
      description: "Required for debugging any script issue. A verbose log is mandatory."
      options:
        - ""
        - "Yes, verbose mode was enabled and the output is included below"
        - "No (this issue will likely be closed automatically)"
    validations:
@@ -53,32 +50,6 @@ body:
    validations:
      required: true
  - type: dropdown
    id: issue_phase
    attributes:
      label: 🕒 When does the issue occur?
      options:
        - "Initial creation / installation"
        - "Update of an existing container"
        - "While the application is running"
    validations:
      required: true
  - type: dropdown
    id: execution_context
    attributes:
      label: 🖱️ Where did you run the command?
      description: "The shell matters — the Proxmox web console starts without some environment variables that a normal login shell sets."
      options:
        - "Proxmox web UI → node → Shell"
        - "Proxmox web UI → LXC → Console"
        - "SSH into the Proxmox host"
        - "SSH into the container"
        - "pct enter from the host"
        - "Other / not listed"
    validations:
      required: true
  - type: checkboxes
    validations:
      required: true
@@ -93,31 +64,18 @@ body:
      value: "💡 **Tip:** If you are using Advanced Settings, please test with Default Settings before submitting an issue."
  - type: dropdown
-    id: os_distribution
+    id: linux_distribution
    attributes:
-      label: 🖥️ Which Linux distribution is the container running?
+      label: 🖥️ Which Linux distribution are you using?
      options:
-        - Debian
+        - 
        - Ubuntu
        - Alpine
-        - Devuan
+        - Debian 11
-        - AlmaLinux
+        - Debian 12
-        - Rocky Linux
+        - Debian 13
-        - CentOS Stream
+        - Ubuntu 22.04
-        - Fedora
+        - Ubuntu 24.04
-        - openSUSE
+        - Ubuntu 24.10
        - openEuler
        - Gentoo
        - Other / not listed
    validations:
      required: true
  - type: input
    id: os_version
    attributes:
      label: 🔢 Which version of that distribution?
      description: "Run `cat /etc/os-release` inside the container if unsure."
      placeholder: "e.g. 13 (Debian), 24.04 (Ubuntu), 3.22 (Alpine)"
    validations:
      required: true
@@ -127,27 +85,16 @@ body:
      label: 🧱 Is this Proxmox host running arm64?
      description: "Run `dpkg --print-architecture` on your Proxmox host if unsure."
      options:
        - ""
        - "No"
        - "Yes"
    validations:
      required: true
  - type: dropdown
    id: pve_major
    attributes:
      label: 📈 Which Proxmox VE release are you on?
      options:
        - "Proxmox VE 9"
        - "Proxmox VE 8"
        - "Proxmox VE 7 or older (end of life)"
    validations:
      required: true
  - type: input
    id: pve_version
    attributes:
-      label: 🔢 Exact Proxmox version and kernel
+      label: 📈 Which Proxmox version are you on?
      description: "Both matter — several issues turned out to be kernel-specific."
      placeholder: "run pveversion in your PVE node console"
    validations:
      required: true
@@ -8,12 +8,7 @@
        "turnkey/**",
        "vm/**"
      ],
-      "excludeGlobs": [
+      "excludeGlobs": []
        "**/headers/**",
        "ct/headers/**",
        "tools/headers/**",
        "vm/headers/**"
      ]
    }
  ],
  "update script": [
@@ -46,12 +41,7 @@
      "includeGlobs": [
        "vm/**"
      ],
-      "excludeGlobs": [
+      "excludeGlobs": []
        "**/headers/**",
        "ct/headers/**",
        "tools/headers/**",
        "vm/headers/**"
      ]
    }
  ],
  "tools": [
@@ -1,66 +1,3 @@
 ## 2026-08-31
 ### 🆕 New Scripts
  - Aurral ([#16908](https://github.com/community-scripts/ProxmoxVE/pull/16908))
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - openwebui: add UV_HTTP_TIMEOUT and retry loop to prevent uv install hangs [@MickLesk](https://github.com/MickLesk) ([#16917](https://github.com/community-scripts/ProxmoxVE/pull/16917))
    - bambuddy: force asyncio loop, uvloop breaks camera proxy handlers [@MickLesk](https://github.com/MickLesk) ([#16904](https://github.com/community-scripts/ProxmoxVE/pull/16904))
    - bookorbit: raise service start timeout, migration can exceed systemd default [@MickLesk](https://github.com/MickLesk) ([#16860](https://github.com/community-scripts/ProxmoxVE/pull/16860))
    - node-red: remove --unsafe-perm flag [@MickLesk](https://github.com/MickLesk) ([#16859](https://github.com/community-scripts/ProxmoxVE/pull/16859))
    - directus: add build-essential dependency [@MickLesk](https://github.com/MickLesk) ([#16858](https://github.com/community-scripts/ProxmoxVE/pull/16858))
  - #### ✨ New Features
    - haos-vm: add optional x86-64-v2-AES CPU option, future HA numpy builds need it [@MickLesk](https://github.com/MickLesk) ([#16868](https://github.com/community-scripts/ProxmoxVE/pull/16868))
  - #### 🔧 Refactor
    - omv: migrate to new package repo host (packages.openmediavault.org) is dead [@MickLesk](https://github.com/MickLesk) ([#16918](https://github.com/community-scripts/ProxmoxVE/pull/16918))
    - yuvomi/aurral: bump NODE_VERSION [@MickLesk](https://github.com/MickLesk) ([#16914](https://github.com/community-scripts/ProxmoxVE/pull/16914))
    - vaultwarden: relax cargo release profile via env vars to avoid build OOM [@MickLesk](https://github.com/MickLesk) ([#16915](https://github.com/community-scripts/ProxmoxVE/pull/16915))
    - kima-hub/maintainerr/planka/spliit: bump NODE_VERSION [@MickLesk](https://github.com/MickLesk) ([#16905](https://github.com/community-scripts/ProxmoxVE/pull/16905))
    - gatus: pin Go toolchain to gatus's own go.mod version [@MickLesk](https://github.com/MickLesk) ([#16893](https://github.com/community-scripts/ProxmoxVE/pull/16893))
    - immich: tolerate enable-maintenance-mode crash, same as disable-maintenance-mode [@MickLesk](https://github.com/MickLesk) ([#16866](https://github.com/community-scripts/ProxmoxVE/pull/16866))
    - move the hardware-accelerated scripts onto new core [@MickLesk](https://github.com/MickLesk) ([#16864](https://github.com/community-scripts/ProxmoxVE/pull/16864))
    - ntopng: use ntop.org's documented apt repo per Debian codename, not always apt-stable [@MickLesk](https://github.com/MickLesk) ([#16862](https://github.com/community-scripts/ProxmoxVE/pull/16862))
    - Refactor: OpenGist [@MickLesk](https://github.com/MickLesk) ([#16861](https://github.com/community-scripts/ProxmoxVE/pull/16861))
 ### 💾 Core
  - Refactor VM script settings and fix load_functions errors [@MickLesk](https://github.com/MickLesk) ([core#13](https://github.com/community-scripts/core/pull/13))
 - Ask ProxmoxVE to refresh its changelog on merge [@MickLesk](https://github.com/MickLesk) ([core#11](https://github.com/community-scripts/core/pull/11))
 - Lift the settings summary and the mode fork into vm-core [@MickLesk](https://github.com/MickLesk) ([core#12](https://github.com/community-scripts/core/pull/12))
 ### 🧰 Tools
  - #### 🐞 Bug Fixes
    - filebrowser-quantum: strip removed disableIndexing key on update, restart service [@MickLesk](https://github.com/MickLesk) ([#16892](https://github.com/community-scripts/ProxmoxVE/pull/16892))
 ### 📚 Documentation
  - Include engine pull requests in the changelog [@MickLesk](https://github.com/MickLesk) ([#16867](https://github.com/community-scripts/ProxmoxVE/pull/16867))
 ## 2026-08-30
 ### 🆕 New Scripts
  - SolidInvoice ([#16869](https://github.com/community-scripts/ProxmoxVE/pull/16869))
 - Super-Productivity ([#16870](https://github.com/community-scripts/ProxmoxVE/pull/16870))
 - Defguard ([#16871](https://github.com/community-scripts/ProxmoxVE/pull/16871))
 - OpenBao ([#16872](https://github.com/community-scripts/ProxmoxVE/pull/16872))
 ### 🚀 Updated Scripts
  - #### 🔧 Refactor
    - general: remove gitea links overall  [@MickLesk](https://github.com/MickLesk) ([#16863](https://github.com/community-scripts/ProxmoxVE/pull/16863))
 ## 2026-08-29
 ### 📚 Documentation
@@ -1,579 +0,0 @@
 ## 2026-09-26
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - Manyfold: make /opt/manyfold_data writable for the manyfold user [@sergstepanenko](https://github.com/sergstepanenko) ([#17534](https://github.com/community-scripts/ProxmoxVE/pull/17534))
    - steamcmd: update itself before installing Satisfactory [@MickLesk](https://github.com/MickLesk) ([#17526](https://github.com/community-scripts/ProxmoxVE/pull/17526))
    - AudioMuse-AI: build noavx2 environment on Python 3.11 [@MickLesk](https://github.com/MickLesk) ([#17528](https://github.com/community-scripts/ProxmoxVE/pull/17528))
    - LobeHub: pin lobehub/ui at 5.49 while LobeHub's stable release needs it [@MickLesk](https://github.com/MickLesk) ([#17531](https://github.com/community-scripts/ProxmoxVE/pull/17531))
    - Keep Trilium updates on the server releases [@MickLesk](https://github.com/MickLesk) ([#17525](https://github.com/community-scripts/ProxmoxVE/pull/17525))
    - NginxProxyManager: generate admin config and repair certbot's venv on update [@MickLesk](https://github.com/MickLesk) ([#17523](https://github.com/community-scripts/ProxmoxVE/pull/17523))
    - Komodo: add KOMODO_HOST | fix broken spinner [@MickLesk](https://github.com/MickLesk) ([#17481](https://github.com/community-scripts/ProxmoxVE/pull/17481))
    - romm: run rq cron and a scans worker for RomM 5.3 [@davidbb](https://github.com/davidbb) ([#17502](https://github.com/community-scripts/ProxmoxVE/pull/17502))
  - #### 💥 Breaking Changes
    - Semaphore: fix BoltDB migration by pinning 2.18.30 [@MickLesk](https://github.com/MickLesk) ([#17439](https://github.com/community-scripts/ProxmoxVE/pull/17439))
 ### 💾 Core
  - Keep a dash-led bridge comment out of whiptail's options [@MickLesk](https://github.com/MickLesk) ([core#74](https://github.com/community-scripts/core/pull/74))
 ## 2026-09-25
 ### 🆕 New Scripts
  - RustFS ([#17499](https://github.com/community-scripts/ProxmoxVE/pull/17499))
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - Ignis: take the Obsidian version from release tag [@MickLesk](https://github.com/MickLesk) ([#17503](https://github.com/community-scripts/ProxmoxVE/pull/17503))
  - #### 🔧 Refactor
    - Refactor: Umbrel OS VM [@MickLesk](https://github.com/MickLesk) ([#17505](https://github.com/community-scripts/ProxmoxVE/pull/17505))
    - Docker-LXC: remove Portainer installation from install [@MickLesk](https://github.com/MickLesk) ([#17493](https://github.com/community-scripts/ProxmoxVE/pull/17493))
 ### 💾 Core
  - Incus: make prompts visible for end-user [@MickLesk](https://github.com/MickLesk) ([core#73](https://github.com/community-scripts/core/pull/73))
 - incus: do not let an install script block on an invisible prompt [@MickLesk](https://github.com/MickLesk) ([core#71](https://github.com/community-scripts/core/pull/71))
 - tel: report progress from installs only, not updates [@MickLesk](https://github.com/MickLesk) ([core#72](https://github.com/community-scripts/core/pull/72))
 ## 2026-09-24
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - Declare the RomM filesystem structure required since 5.3.0 [@MickLesk](https://github.com/MickLesk) ([#17480](https://github.com/community-scripts/ProxmoxVE/pull/17480))
    - general: use apt_update_safe instead of aborting on a failed apt update [@MickLesk](https://github.com/MickLesk) ([#17462](https://github.com/community-scripts/ProxmoxVE/pull/17462))
  - #### 🔧 Refactor
    - Journiv: Serve Node Frontend and add HTTP Auth .env [@MickLesk](https://github.com/MickLesk) ([#17479](https://github.com/community-scripts/ProxmoxVE/pull/17479))
 ### 💾 Core
  - core: accept an off-subnet gateway for /31 and /32 [@MickLesk](https://github.com/MickLesk) ([core#70](https://github.com/community-scripts/core/pull/70))
 ## 2026-09-23
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - fix(signoz): install the histogramQuantile ClickHouse function [@maksimtech](https://github.com/maksimtech) ([#17386](https://github.com/community-scripts/ProxmoxVE/pull/17386))
    - omniroute: bump to 4 GB for the npm install [@MickLesk](https://github.com/MickLesk) ([#17461](https://github.com/community-scripts/ProxmoxVE/pull/17461))
    - Run Borg-UI with a single gunicorn worker [@MickLesk](https://github.com/MickLesk) ([#17445](https://github.com/community-scripts/ProxmoxVE/pull/17445))
    - immich: keep geodata linked and the build deps present on update [@MickLesk](https://github.com/MickLesk) ([#17438](https://github.com/community-scripts/ProxmoxVE/pull/17438))
  - #### 🔧 Refactor
    - Refactor: Scanopy [@MickLesk](https://github.com/MickLesk) ([#16797](https://github.com/community-scripts/ProxmoxVE/pull/16797))
 ### 💾 Core
  - stop a partial find from aborting the caller under pipefail [@MickLesk](https://github.com/MickLesk) ([core#68](https://github.com/community-scripts/core/pull/68))
 - core: give RHEL-family containers an ostype PVE accepts [@MickLesk](https://github.com/MickLesk) ([core#67](https://github.com/community-scripts/core/pull/67))
 - core: do not abort on a failed apt update [@MickLesk](https://github.com/MickLesk) ([core#66](https://github.com/community-scripts/core/pull/66))
 - VM's: report a finished VM as done, not aborted [@MickLesk](https://github.com/MickLesk) ([core#65](https://github.com/community-scripts/core/pull/65))
 - VM-Core: decide console autologin from the image, not USE_CLOUD_INIT [@MickLesk](https://github.com/MickLesk) ([core#63](https://github.com/community-scripts/core/pull/63))
 - VM-Core: report failed image steps and restore tty1 autologin without cloud-init [@MickLesk](https://github.com/MickLesk) ([core#62](https://github.com/community-scripts/core/pull/62))
 - tools: raise pnpm/yarn fetch timeout and lower network concurrency [@MickLesk](https://github.com/MickLesk) ([core#59](https://github.com/community-scripts/core/pull/59))
 - VM-Core: stop discarding cloud-init error messages [@MickLesk](https://github.com/MickLesk) ([core#60](https://github.com/community-scripts/core/pull/60))
 ## 2026-09-22
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - fix(invoiceshelf): re-link storage during update [@owenvoke](https://github.com/owenvoke) ([#17431](https://github.com/community-scripts/ProxmoxVE/pull/17431))
    - fix(alpine-it-tools): write the version file after a successful update [@Houtek](https://github.com/Houtek) ([#17421](https://github.com/community-scripts/ProxmoxVE/pull/17421))
    - Umami: Align pnpm with engines.pnpm on update [@ReneNulschDE](https://github.com/ReneNulschDE) ([#17404](https://github.com/community-scripts/ProxmoxVE/pull/17404))
  - #### 🔧 Refactor
    - several scripts: let uv see the project before syncing it | refactor some scripts that use uv [@MickLesk](https://github.com/MickLesk) ([#17436](https://github.com/community-scripts/ProxmoxVE/pull/17436))
 ### 💾 Core
  - setup_uv: honour a project's required-version pin [@MickLesk](https://github.com/MickLesk) ([core#58](https://github.com/community-scripts/core/pull/58))
 - fix(motd): repair legacy 00_lxc-details.sh header and dead color placeholders [@BadFlo](https://github.com/BadFlo) ([core#53](https://github.com/community-scripts/core/pull/53))
 - meilisearch: take the raw binary, not the .deb [@MickLesk](https://github.com/MickLesk) ([core#57](https://github.com/community-scripts/core/pull/57))
 ### 📚 Documentation
  - github: Stop generating header filenames with a newline in them [@MickLesk](https://github.com/MickLesk) ([#17435](https://github.com/community-scripts/ProxmoxVE/pull/17435))
 ### ❔ Uncategorized
  - chore(ct): sync cloudflare-ddns defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17446](https://github.com/community-scripts/ProxmoxVE/pull/17446))
 ## 2026-09-21
 ### 🆕 New Scripts
  - AudioMuse-AI ([#17415](https://github.com/community-scripts/ProxmoxVE/pull/17415))
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - fix(portabase): meet the default admin password rules [@maksimtech](https://github.com/maksimtech) ([#17384](https://github.com/community-scripts/ProxmoxVE/pull/17384))
    - truenas-vm: strip the G before the storage allocation [@MickLesk](https://github.com/MickLesk) ([#17407](https://github.com/community-scripts/ProxmoxVE/pull/17407))
    - Librenms - Fix local snmpd community string setup [@dopch](https://github.com/dopch) ([#17363](https://github.com/community-scripts/ProxmoxVE/pull/17363))
    - fix(iventoy): preserve release data and migrate legacy service launchers [@Msprg](https://github.com/Msprg) ([#17161](https://github.com/community-scripts/ProxmoxVE/pull/17161))
    - xyops: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17398](https://github.com/community-scripts/ProxmoxVE/pull/17398))
 ### 💾 Core
  - Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#56](https://github.com/community-scripts/core/pull/56))
 - github-api: take the release the maintainer marked as latest [@MickLesk](https://github.com/MickLesk) ([core#55](https://github.com/community-scripts/core/pull/55))
 - general: prune old Rust toolchains [@MickLesk](https://github.com/MickLesk) ([core#52](https://github.com/community-scripts/core/pull/52))
 - Ask when the preselected storage cannot hold the content [@MickLesk](https://github.com/MickLesk) ([core#51](https://github.com/community-scripts/core/pull/51))
 ## 2026-09-20
 ### 🆕 New Scripts
  - Your-Spotify ([#17376](https://github.com/community-scripts/ProxmoxVE/pull/17376))
 ## 2026-09-19
 ### 🆕 New Scripts
  - qBit-Manage ([#17377](https://github.com/community-scripts/ProxmoxVE/pull/17377))
 - Ubuntu-VM: AIO | new core | performance | remove old wrappers [@MickLesk](https://github.com/MickLesk) ([#17354](https://github.com/community-scripts/ProxmoxVE/pull/17354))
 ### 💾 Core
  - Fall back to the unversioned banner slug [@MickLesk](https://github.com/MickLesk) ([core#48](https://github.com/community-scripts/core/pull/48))
 ### ❔ Uncategorized
  - chore(ct): sync immichframe defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17373](https://github.com/community-scripts/ProxmoxVE/pull/17373))
 ## 2026-09-18
 ### 🆕 New Scripts
  - Almalinux-VM ([#17349](https://github.com/community-scripts/ProxmoxVE/pull/17349))
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - update authentik to 2026.8.3 [@thieneret](https://github.com/thieneret) ([#17366](https://github.com/community-scripts/ProxmoxVE/pull/17366))
    - crafty-controller: chown after restore_backup so restored data keeps ownership [@MickLesk](https://github.com/MickLesk) ([#17348](https://github.com/community-scripts/ProxmoxVE/pull/17348))
    - databasus, domain-monitor, poznote: chown after restore_backup so restored data keeps its owner [@MickLesk](https://github.com/MickLesk) ([#17350](https://github.com/community-scripts/ProxmoxVE/pull/17350))
    - alpine-vm: ask for the Cloud-Init credentials [@MickLesk](https://github.com/MickLesk) ([#17355](https://github.com/community-scripts/ProxmoxVE/pull/17355))
    - suggestarr: keep the data where the app actually reads it [@MickLesk](https://github.com/MickLesk) ([#17317](https://github.com/community-scripts/ProxmoxVE/pull/17317))
    - immichframe: set the admin password the new admin UI requires [@MickLesk](https://github.com/MickLesk) ([#17315](https://github.com/community-scripts/ProxmoxVE/pull/17315))
  - #### ✨ New Features
    - pangolin: Bump to 1.23.0 [@MickLesk](https://github.com/MickLesk) ([#17343](https://github.com/community-scripts/ProxmoxVE/pull/17343))
  - #### 🔧 Refactor
    - Refactor: Oxicloud [@MickLesk](https://github.com/MickLesk) ([#17338](https://github.com/community-scripts/ProxmoxVE/pull/17338))
 ### 💾 Core
  - Stop a modified conffile from aborting the whole update [@MickLesk](https://github.com/MickLesk) ([core#47](https://github.com/community-scripts/core/pull/47))
 - Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#46](https://github.com/community-scripts/core/pull/46))
 - github api: retry a 200 that is not a usable release payload [@MickLesk](https://github.com/MickLesk) ([core#45](https://github.com/community-scripts/core/pull/45))
 ### 📚 Documentation
  - chore: fix PR template help [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17364](https://github.com/community-scripts/ProxmoxVE/pull/17364))
 ## 2026-09-17
 ### 🆕 New Scripts
  - Alpine-VM ([#17324](https://github.com/community-scripts/ProxmoxVE/pull/17324))
 - Allstarlink ([#17321](https://github.com/community-scripts/ProxmoxVE/pull/17321))
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - changedetection: update: various fixes [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17331](https://github.com/community-scripts/ProxmoxVE/pull/17331))
    - sparkyfitness: run the Better Auth migration during the update [@MickLesk](https://github.com/MickLesk) ([#17318](https://github.com/community-scripts/ProxmoxVE/pull/17318))
    - poznote: follow init.sh into docker/ [@MickLesk](https://github.com/MickLesk) ([#17316](https://github.com/community-scripts/ProxmoxVE/pull/17316))
  - #### ✨ New Features
    - romm: make the library paths follow ROMM_BASE_PATH [@MickLesk](https://github.com/MickLesk) ([#17279](https://github.com/community-scripts/ProxmoxVE/pull/17279))
    - Debian-VM: Refactor | Support Debian 11, 12, 13 [@MickLesk](https://github.com/MickLesk) ([#17325](https://github.com/community-scripts/ProxmoxVE/pull/17325))
 ### 💾 Core
  - Ask before replacing a cached image that no longer matches [@MickLesk](https://github.com/MickLesk) ([core#44](https://github.com/community-scripts/core/pull/44))
 ## 2026-09-16
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - Immich: Pin to v3.2.2 [@vhsdream](https://github.com/vhsdream) ([#17307](https://github.com/community-scripts/ProxmoxVE/pull/17307))
    - Dispatcharr: Bump to 4G RAM [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17302](https://github.com/community-scripts/ProxmoxVE/pull/17302))
    - navidrome: repair root-owned data folders left by 0.61.x [@MickLesk](https://github.com/MickLesk) ([#17275](https://github.com/community-scripts/ProxmoxVE/pull/17275))
    - tor-snowflake: read the Go version from the module root [@MickLesk](https://github.com/MickLesk) ([#17276](https://github.com/community-scripts/ProxmoxVE/pull/17276))
    - docmost: stop corepack asking for confirmation during the build [@MickLesk](https://github.com/MickLesk) ([#17282](https://github.com/community-scripts/ProxmoxVE/pull/17282))
  - #### ✨ New Features
    - Refactor: TrueNAS VM (core / improve functions / performance) [@MickLesk](https://github.com/MickLesk) ([#17277](https://github.com/community-scripts/ProxmoxVE/pull/17277))
    - Frigate: Bump to 0.18.0 [@MickLesk](https://github.com/MickLesk) ([#17273](https://github.com/community-scripts/ProxmoxVE/pull/17273))
    - Refactor: HomeAssistant-OS (core / improve functions / performance) [@MickLesk](https://github.com/MickLesk) ([#17281](https://github.com/community-scripts/ProxmoxVE/pull/17281))
 ### 💾 Core
  - Read the IGC version compute-runtime pins, instead of taking the newest [@MickLesk](https://github.com/MickLesk) ([core#43](https://github.com/community-scripts/core/pull/43))
 - Install the Intel driver dependency before the .deb that needs it [@MickLesk](https://github.com/MickLesk) ([core#42](https://github.com/community-scripts/core/pull/42))
 ### 📚 Documentation
  - pocketbase-bot: accept the var_ names and two missing fields [@MickLesk](https://github.com/MickLesk) ([#17305](https://github.com/community-scripts/ProxmoxVE/pull/17305))
 ## 2026-09-15
 ### 🆕 New Scripts
  - valhalla ([#17231](https://github.com/community-scripts/ProxmoxVE/pull/17231))
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - borg-ui: missing dependency `sshpass` [@christian-forgacs](https://github.com/christian-forgacs) ([#17286](https://github.com/community-scripts/ProxmoxVE/pull/17286))
    - tracearr: copy packages/emails into the deploy tree [@connorgallopo](https://github.com/connorgallopo) ([#17268](https://github.com/community-scripts/ProxmoxVE/pull/17268))
    - Immich: Pin to v3.2.1 [@vhsdream](https://github.com/vhsdream) ([#17264](https://github.com/community-scripts/ProxmoxVE/pull/17264))
 ### 💾 Core
  - Add vm_extract_image, which two VM scripts already call [@MickLesk](https://github.com/MickLesk) ([core#40](https://github.com/community-scripts/core/pull/40))
 - Releases: rank releases on their numbers, not on sort -V over the raw tag [@MickLesk](https://github.com/MickLesk) ([core#39](https://github.com/community-scripts/core/pull/39))
 ### 🧰 Tools
  - #### 🔧 Refactor
    - Refactor: monitor-all (decide on flag values, not on key presence) [@MickLesk](https://github.com/MickLesk) ([#17261](https://github.com/community-scripts/ProxmoxVE/pull/17261))
 ## 2026-09-14
 ### 🆕 New Scripts
  - Borg-UI ([#17258](https://github.com/community-scripts/ProxmoxVE/pull/17258))
 ### 🚀 Updated Scripts
  - SparkyFitness: substitute NGINX_RATE_LIMIT in nginx config [@RafBorrelli](https://github.com/RafBorrelli) ([#17256](https://github.com/community-scripts/ProxmoxVE/pull/17256))
  - #### 🐞 Bug Fixes
    - spliit: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17250](https://github.com/community-scripts/ProxmoxVE/pull/17250))
 ## 2026-09-13
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - Downgrade iobroker to Node 24 [@Copilot](https://github.com/Copilot) ([#17229](https://github.com/community-scripts/ProxmoxVE/pull/17229))
 ### 💾 Core
  - Pick the highest release version, not the newest published one [@MickLesk](https://github.com/MickLesk) ([core#38](https://github.com/community-scripts/core/pull/38))
 ## 2026-09-12
 ### 🆕 New Scripts
  - Elasticsearch ([#17188](https://github.com/community-scripts/ProxmoxVE/pull/17188))
 - Hammer ([#17189](https://github.com/community-scripts/ProxmoxVE/pull/17189))
 - gotenberg ([#17205](https://github.com/community-scripts/ProxmoxVE/pull/17205))
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - fix(dispatcharr): add comskip installation and build dependencies [@eXistC](https://github.com/eXistC) ([#16224](https://github.com/community-scripts/ProxmoxVE/pull/16224))
    - poznote: serve from src/public docroot [@MickLesk](https://github.com/MickLesk) ([#17187](https://github.com/community-scripts/ProxmoxVE/pull/17187))
    - calibre-web: use calibreweb release identifier to avoid version file collision [@MickLesk](https://github.com/MickLesk) ([#17186](https://github.com/community-scripts/ProxmoxVE/pull/17186))
  - #### ✨ New Features
    - Docker VM: Feature Bump - Refactor script for improved functionality [@MickLesk](https://github.com/MickLesk) ([#17216](https://github.com/community-scripts/ProxmoxVE/pull/17216))
    - feat(jitsi-meet): optional public setup (FQDN, Let's Encrypt, NAT, secure domain) [@klanghans](https://github.com/klanghans) ([#17132](https://github.com/community-scripts/ProxmoxVE/pull/17132))
  - #### 🔧 Refactor
    - Paperless-NGX: add --no-sync to uv run services [@MickLesk](https://github.com/MickLesk) ([#17210](https://github.com/community-scripts/ProxmoxVE/pull/17210))
 ### 💾 Core
  - VM's: show the selected CPU model instead of doubling it [@MickLesk](https://github.com/MickLesk) ([core#37](https://github.com/community-scripts/core/pull/37))
 - Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#36](https://github.com/community-scripts/core/pull/36))
 ## 2026-09-11
 ### 🆕 New Scripts
  - Lemonade-Server ([#17190](https://github.com/community-scripts/ProxmoxVE/pull/17190))
 - OneTimeSecret ([#17097](https://github.com/community-scripts/ProxmoxVE/pull/17097))
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - update authentik to 2026.8.2 [@thieneret](https://github.com/thieneret) ([#17198](https://github.com/community-scripts/ProxmoxVE/pull/17198))
    - passwordpusher: restore data before running migrations [@MickLesk](https://github.com/MickLesk) ([#17141](https://github.com/community-scripts/ProxmoxVE/pull/17141))
    - paperclip: install the rust toolchain needed by the runner build [@MickLesk](https://github.com/MickLesk) ([#17142](https://github.com/community-scripts/ProxmoxVE/pull/17142))
    - homepage: run next directly instead of through pnpm [@MickLesk](https://github.com/MickLesk) ([#17155](https://github.com/community-scripts/ProxmoxVE/pull/17155))
    - changedetection: fix: pin browserless [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17163](https://github.com/community-scripts/ProxmoxVE/pull/17163))
 ### 💾 Core
  - #### 🐞 Bug Fixes
    - core.func: fall back to a usable HOME when the shell has none [@MickLesk](https://github.com/MickLesk) ([#17154](https://github.com/community-scripts/ProxmoxVE/pull/17154))
 ### 🧰 Tools
  - Dockhand ([#17191](https://github.com/community-scripts/ProxmoxVE/pull/17191))
  - #### 🐞 Bug Fixes
    - update-apps: rewrite the retired Gitea base in every container before updating it [@MickLesk](https://github.com/MickLesk) ([#17156](https://github.com/community-scripts/ProxmoxVE/pull/17156))
  - #### 🔧 Refactor
    - Rename lxc-delete.sh to guest-delete.sh [@MickLesk](https://github.com/MickLesk) ([#17152](https://github.com/community-scripts/ProxmoxVE/pull/17152))
 ### 📚 Documentation
  - issue template: add PVE release, execution context and phase; refresh distro list / pve versions [@MickLesk](https://github.com/MickLesk) ([#17160](https://github.com/community-scripts/ProxmoxVE/pull/17160))
 ## 2026-09-10
 ### 🆕 New Scripts
  - Chevereto ([#17131](https://github.com/community-scripts/ProxmoxVE/pull/17131))
 - Portabase ([#17111](https://github.com/community-scripts/ProxmoxVE/pull/17111))
 - Logseq ([#17112](https://github.com/community-scripts/ProxmoxVE/pull/17112))
 - Safebucket ([#17096](https://github.com/community-scripts/ProxmoxVE/pull/17096))
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - Immich v3.2.0 [@vhsdream](https://github.com/vhsdream) ([#17137](https://github.com/community-scripts/ProxmoxVE/pull/17137))
    - fix(solidtime): prevent composer install from hanging on root prompt [@supersoju](https://github.com/supersoju) ([#17146](https://github.com/community-scripts/ProxmoxVE/pull/17146))
    - fix(hermesagent): wait for root gateway cleanup [@steveonjava](https://github.com/steveonjava) ([#17147](https://github.com/community-scripts/ProxmoxVE/pull/17147))
 ### 💾 Core
  - Keep the script name when regenerating the entrypoint [@MickLesk](https://github.com/MickLesk) ([core#35](https://github.com/community-scripts/core/pull/35))
 - Rewrite the dead Gitea base onto GitHub instead of failing the update [@MickLesk](https://github.com/MickLesk) ([core#33](https://github.com/community-scripts/core/pull/33))
 - core.func: fall back to a usable HOME when the shell has none [@MickLesk](https://github.com/MickLesk) ([core#32](https://github.com/community-scripts/core/pull/32))
 ## 2026-09-09
 ### 🆕 New Scripts
  - Lingarr ([#17130](https://github.com/community-scripts/ProxmoxVE/pull/17130))
 ### 🚀 Updated Scripts
  - vm: drop the discussions link from the summary [@MickLesk](https://github.com/MickLesk) ([#17117](https://github.com/community-scripts/ProxmoxVE/pull/17117))
  - #### 🐞 Bug Fixes
    - fix(hermesagent): stop spurious root gateway after update [@steveonjava](https://github.com/steveonjava) ([#17126](https://github.com/community-scripts/ProxmoxVE/pull/17126))
 ## 2026-09-08
 ### 🆕 New Scripts
  - Decypharr ([#17108](https://github.com/community-scripts/ProxmoxVE/pull/17108))
 - Stash ([#17106](https://github.com/community-scripts/ProxmoxVE/pull/17106))
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - Update Jellyfin FFmpeg dependency to version 8 [@MickLesk](https://github.com/MickLesk) ([#17109](https://github.com/community-scripts/ProxmoxVE/pull/17109))
 ### 💾 Core
  - Treat a cut-short forge response as a failure, not as HTTP 200 [@MickLesk](https://github.com/MickLesk) ([core#31](https://github.com/community-scripts/core/pull/31))
 - Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#28](https://github.com/community-scripts/core/pull/28))
 - cloud-init: drop the "configure in Proxmox UI" hint [@MickLesk](https://github.com/MickLesk) ([core#30](https://github.com/community-scripts/core/pull/30))
 - Survive an empty /usr/bin/update instead of aborting the run [@MickLesk](https://github.com/MickLesk) ([core#29](https://github.com/community-scripts/core/pull/29))
 ## 2026-09-07
 ### 🆕 New Scripts
  - Chatwoot ([#17095](https://github.com/community-scripts/ProxmoxVE/pull/17095))
 - whisparr-eros ([#17094](https://github.com/community-scripts/ProxmoxVE/pull/17094))
 - Matter-Hub ([#17093](https://github.com/community-scripts/ProxmoxVE/pull/17093))
 - Journiv ([#17092](https://github.com/community-scripts/ProxmoxVE/pull/17092))
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - kaneo: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17086](https://github.com/community-scripts/ProxmoxVE/pull/17086))
    - iobroker: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17085](https://github.com/community-scripts/ProxmoxVE/pull/17085))
    - reactive-resume: repair any wrong WorkingDirectory on update [@MickLesk](https://github.com/MickLesk) ([#17068](https://github.com/community-scripts/ProxmoxVE/pull/17068))
    - mediamtx: keep mediamtx.yml across updates [@MickLesk](https://github.com/MickLesk) ([#17069](https://github.com/community-scripts/ProxmoxVE/pull/17069))
    - omnitools: allow remote action while npm ci [@MickLesk](https://github.com/MickLesk) ([#17070](https://github.com/community-scripts/ProxmoxVE/pull/17070))
  - #### ✨ New Features
    - netboot-xyz: add Secure Boot and Legacy assets [@MickLesk](https://github.com/MickLesk) ([#17066](https://github.com/community-scripts/ProxmoxVE/pull/17066))
  - #### 🔧 Refactor
    - flatnotes: follow upstream move to uv and Python 3.13 [@MickLesk](https://github.com/MickLesk) ([#17090](https://github.com/community-scripts/ProxmoxVE/pull/17090))
    - heimdall: set up PHP 8.4 on update, keep only the database, run migrations [@MickLesk](https://github.com/MickLesk) ([#17067](https://github.com/community-scripts/ProxmoxVE/pull/17067))
 ### 📂 Github
  - github: Open per-script Node bump PRs [@MickLesk](https://github.com/MickLesk) ([#17065](https://github.com/community-scripts/ProxmoxVE/pull/17065))
 ## 2026-09-06
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - Fix Sonarqube update script to add +x on sonar.sh [@jarihu](https://github.com/jarihu) ([#17056](https://github.com/community-scripts/ProxmoxVE/pull/17056))
 ## 2026-09-05
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - authentik: scope blueprints chown to avoid recursing into the mp0 bind mount [@MickLesk](https://github.com/MickLesk) ([#17008](https://github.com/community-scripts/ProxmoxVE/pull/17008))
    - iventoy: run iventoy.sh with bash instead of dash [@MickLesk](https://github.com/MickLesk) ([#17034](https://github.com/community-scripts/ProxmoxVE/pull/17034))
    - frigate: restart go2rtc.service before frigate starts [@MickLesk](https://github.com/MickLesk) ([#17035](https://github.com/community-scripts/ProxmoxVE/pull/17035))
    - snapotter: seed AI venv base packages on arm64, warn amd64 has no working CPU bundle [@MickLesk](https://github.com/MickLesk) ([#16903](https://github.com/community-scripts/ProxmoxVE/pull/16903))
    - tolgee: bump required JDK from 21 to 25 [@MickLesk](https://github.com/MickLesk) ([#17005](https://github.com/community-scripts/ProxmoxVE/pull/17005))
    - romm: write real version into backend/__version__.py placeholder [@MickLesk](https://github.com/MickLesk) ([#17009](https://github.com/community-scripts/ProxmoxVE/pull/17009))
  - #### 🔧 Refactor
    - Refactor FileFlows: Stop Spinner before read -rp / Switch from "Node" to "Agent"  [@MickLesk](https://github.com/MickLesk) ([#17007](https://github.com/community-scripts/ProxmoxVE/pull/17007))
 ### 💾 Core
  - update helper: follow renamed ct/ scripts instead of curling a 404 [@MickLesk](https://github.com/MickLesk) ([core#22](https://github.com/community-scripts/core/pull/22))
 - Use Proxmox for a template before reaching for linuxcontainers.org [@MickLesk](https://github.com/MickLesk) ([core#23](https://github.com/community-scripts/core/pull/23))
 - implement exponential backoff for curl retries in _cs_curl_retry function [@MickLesk](https://github.com/MickLesk) ([core#26](https://github.com/community-scripts/core/pull/26))
 ### 🧰 Tools
  - #### 🐞 Bug Fixes
    - update-apps: follow renamed ct/ scripts instead of erroring out [@MickLesk](https://github.com/MickLesk) ([#16991](https://github.com/community-scripts/ProxmoxVE/pull/16991))
 ## 2026-09-04
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - fix(shlink): preserve servers.json across web-client updates [@Corgei](https://github.com/Corgei) ([#17023](https://github.com/community-scripts/ProxmoxVE/pull/17023))
    - fix-update-authentik-2026.8.1 [@thieneret](https://github.com/thieneret) ([#16999](https://github.com/community-scripts/ProxmoxVE/pull/16999))
    - Fix npm v12 allow-git/allow-remote restrictions across affected scripts [@MickLesk](https://github.com/MickLesk) ([#17014](https://github.com/community-scripts/ProxmoxVE/pull/17014))
    - Fix/poznote - 1st party Docker parity [@lucas-at-3x-eye](https://github.com/lucas-at-3x-eye) ([#17011](https://github.com/community-scripts/ProxmoxVE/pull/17011))
 ### 💾 Core
  - setup_go: resolve bare major.minor versions to the latest patch release [@MickLesk](https://github.com/MickLesk) ([core#24](https://github.com/community-scripts/core/pull/24))
 ## 2026-09-03
 ### 🚀 Updated Scripts
  - Immich: bump libheif and libraw [@vhsdream](https://github.com/vhsdream) ([#16996](https://github.com/community-scripts/ProxmoxVE/pull/16996))
  - #### 🐞 Bug Fixes
    - romm: allow git-based npm dependency for rom-patcher under npm v12 [@MickLesk](https://github.com/MickLesk) ([#16990](https://github.com/community-scripts/ProxmoxVE/pull/16990))
    - Pin Go to the version each project declares in go.mod [@MickLesk](https://github.com/MickLesk) ([#16976](https://github.com/community-scripts/ProxmoxVE/pull/16976))
    - Authentik update 2026.8.1 [@thieneret](https://github.com/thieneret) ([#16980](https://github.com/community-scripts/ProxmoxVE/pull/16980))
 ## 2026-09-02
 ### 🆕 New Scripts
  - OwnTracks-Recorder ([#16967](https://github.com/community-scripts/ProxmoxVE/pull/16967))
 - PeerTube ([#16966](https://github.com/community-scripts/ProxmoxVE/pull/16966))
 - Kaneo ([#16965](https://github.com/community-scripts/ProxmoxVE/pull/16965))
 - JDownloader ([#16964](https://github.com/community-scripts/ProxmoxVE/pull/16964))
 - ReadMeABook ([#16963](https://github.com/community-scripts/ProxmoxVE/pull/16963))
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - Enhance backup process in teddycloud.sh [@MickLesk](https://github.com/MickLesk) ([#16946](https://github.com/community-scripts/ProxmoxVE/pull/16946))
    - mealie: copy Nuxt generate output and use pnpm when lockfile is present [@mjhuff](https://github.com/mjhuff) ([#16938](https://github.com/community-scripts/ProxmoxVE/pull/16938))
    - OpenThread-BR: Clean build directory before update [@tomfrenzel](https://github.com/tomfrenzel) ([#16949](https://github.com/community-scripts/ProxmoxVE/pull/16949))
  - #### 🔧 Refactor
    - Scripts: use shared core bootstrap for final 114 Script Batch [@MickLesk](https://github.com/MickLesk) ([#16953](https://github.com/community-scripts/ProxmoxVE/pull/16953))
    - Scripts: use shared core bootstrap for next 115 Script Batch [@MickLesk](https://github.com/MickLesk) ([#16952](https://github.com/community-scripts/ProxmoxVE/pull/16952))
    - Scripts: use shared core bootstrap for next 115 Script Batch [@MickLesk](https://github.com/MickLesk) ([#16951](https://github.com/community-scripts/ProxmoxVE/pull/16951))
    - Scripts: use shared core bootstrap for next 100 Script Batch [@MickLesk](https://github.com/MickLesk) ([#16950](https://github.com/community-scripts/ProxmoxVE/pull/16950))
 ### 💾 Core
  - setup_meilisearch: generate a 32-byte master key [@MickLesk](https://github.com/MickLesk) ([core#20](https://github.com/community-scripts/core/pull/20))
 - setup_meilisearch: generate a 32-byte master key [@MickLesk](https://github.com/MickLesk) ([core#19](https://github.com/community-scripts/core/pull/19))
 - setup_nodejs: restore the npm allowScripts bypass lost in the migration [@MickLesk](https://github.com/MickLesk) ([core#18](https://github.com/community-scripts/core/pull/18))
 ## 2026-09-01
 ### 🆕 New Scripts
  - Mailpit ([#16942](https://github.com/community-scripts/ProxmoxVE/pull/16942))
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - Revert Aurral to Node22 [@Copilot](https://github.com/Copilot) ([#16930](https://github.com/community-scripts/ProxmoxVE/pull/16930))
    - jellyfin: verify repo suite via fallback chain and use ensure_dependencies for clearer apt failures [@MickLesk](https://github.com/MickLesk) ([#16916](https://github.com/community-scripts/ProxmoxVE/pull/16916))
  - #### 🔧 Refactor
    - Move the next 25 scripts onto the core engine [@MickLesk](https://github.com/MickLesk) ([#16934](https://github.com/community-scripts/ProxmoxVE/pull/16934))
 ### 💾 Core
  - Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#15](https://github.com/community-scripts/core/pull/15))
 - Report the exit code the engine actually saw [@MickLesk](https://github.com/MickLesk) ([core#17](https://github.com/community-scripts/core/pull/17))
 - Silence npm's update notice so the real error stays visible [@MickLesk](https://github.com/MickLesk) ([core#16](https://github.com/community-scripts/core/pull/16))
 ### 🧰 Tools
  - #### 🐞 Bug Fixes
    - fix(add-iptag): merge live IPv4 addresses for running LXCs [@phillf](https://github.com/phillf) ([#16691](https://github.com/community-scripts/ProxmoxVE/pull/16691))
@@ -8,15 +8,12 @@ PRs without prior testing will be closed. If you are an AI agent writing this pu
 Fixes #
-## ✅ Prerequisites (**x** in brackets)
+## ✅ Prerequisites (**X** in brackets)
 - [ ] **Self-review completed** – Code follows project standards.
 - [ ] **Tested thoroughly** – Changes work as expected.
 - [ ] **No security risks** – No hardcoded secrets, unnecessary privilege escalations, or permission issues.
 **Tested on:** <!-- e.g. PVE 9.2 / Debian 13 / fresh install + update. Write "not tested" if you could not run it. -->
 ---
 ## 🤖 AI Assistance (**X** in brackets)
@@ -43,13 +40,13 @@ Fixes #
 ## 💥 Breaking Change Advisory (only if you checked "Breaking change")
-<!-- If this PR changes existing behaviour in a way that may require action before an
+If this PR changes existing behaviour in a way that may require action before an
 update, add a `breaking-change` advisory block to this PR body. The website and
 the in-container update guard read it to tell operators exactly what to expect,
 what to do first, and — with `action: block` — to stop an update until it's
 handled. Every field is optional; the advisory auto-expires 30 days after merge.
-Copy the block out of the comment below, fill it in, and paste it here: -->
+Copy the block out of the comment below, fill it in, and paste it here:
 <!--
 ```breaking-change
@@ -249,7 +249,7 @@ jobs:
                  if (new Date(pr.merged_at) <= latestDateInChangelog) continue;
                  const rawLabels = pr.labels.map(label => label.name.toLowerCase());
-                  if (rawLabels.some(l => ["invalid", "wontdo", "wontfix", "duplicate", process.env.AUTOMATED_PR_LABEL].includes(l))) continue;
+                  if (rawLabels.some(l => ["invalid", "wontdo", "wontfix", "duplicate"].includes(l))) continue;
                  if (!coreCategory) {
                    console.log(`No Core category configured; skipping core#${pr.number}`);
@@ -7,9 +7,8 @@ on:
    - cron: "0 6 * * 1"
 permissions:
-  contents: write
+  contents: read
  issues: write
  pull-requests: write
 jobs:
  check-node-versions:
@@ -391,142 +390,6 @@ jobs:
          cat /tmp/drift_report.md
      # One PR per script, not one for all of them: the bumps are judged
      # individually (an app can be deliberately held back while the next is a
      # safe follow), and a combined PR is blocked by its worst member.
      - name: Open a pull request per drifting script
        if: steps.check.outputs.drift_count != '0'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          : >/tmp/drift_prs.txt
          while IFS='|' read -r slug our upstream hint repo; do
            [[ -z "$slug" ]] && continue
            # "dynamic" and "unset" have no literal to rewrite, and a missing
            # upstream major is nothing to rewrite it to.
            if [[ ! "$our" =~ ^[0-9]+$ || ! "$upstream" =~ ^[0-9]+$ ]]; then
              printf '%s|manual||\n' "$slug" >>/tmp/drift_prs.txt
              continue
            fi
            # The branch name carries the exact bump, so the PR for it answers
            # the question on its own: open means it is waiting for a review,
            # closed means someone said no to this bump. A later upstream
            # release changes the name and gets its own PR.
            branch="node-drift/${slug}-${our}-to-${upstream}"
            existing=$(gh pr list --head "$branch" --state all \
              --json number,state,url,labels --jq '.[0] // empty' 2>/dev/null || echo "")
            if [[ -n "$existing" ]]; then
              state=$(jq -r '.state' <<<"$existing")
              url=$(jq -r '.url' <<<"$existing")
              stale=$(jq -r '[.labels[]?.name] | index("stale") // empty' <<<"$existing")
              case "$state" in
              OPEN)
                printf '%s|open|%s\n' "$slug" "$url" >>/tmp/drift_prs.txt
                continue
                ;;
              MERGED)
                printf '%s|merged|%s\n' "$slug" "$url" >>/tmp/drift_prs.txt
                continue
                ;;
              *)
                # The stale bot only closes what a human labelled "stale", so
                # that close carries no verdict on the bump — reopen the case.
                # A close without it is a decision, and it stands.
                if [[ -z "$stale" ]]; then
                  printf '%s|declined|%s\n' "$slug" "$url" >>/tmp/drift_prs.txt
                  continue
                fi
                git push origin --delete "$branch" >/dev/null 2>&1 || true
                ;;
              esac
            fi
            git checkout -q -B "$branch"
            changed=()
            for f in "install/${slug}-install.sh" "ct/${slug}.sh"; do
              [[ -f "$f" ]] || continue
              if grep -qE "NODE_VERSION=\"?${our}\"?" "$f"; then
                sed -i -E "s/(NODE_VERSION=)\"?${our}\"?/\1\"${upstream}\"/g" "$f"
                changed+=("$f")
              fi
            done
            if [[ ${#changed[@]} -eq 0 ]]; then
              printf '%s|manual||\n' "$slug" >>/tmp/drift_prs.txt
              git checkout -q main
              continue
            fi
            git add "${changed[@]}"
            git commit -q -m "${slug}: bump Node.js from ${our} to ${upstream}"
            if ! git push -q -u origin "$branch" 2>/dev/null; then
              printf '%s|failed||\n' "$slug" >>/tmp/drift_prs.txt
              git checkout -q main
              continue
            fi
            # The test command is written here rather than left to
            # pr-test-command.yml: a PR opened with GITHUB_TOKEN does not start
            # another workflow, so that comment would never arrive.
            body=$(cat <<PR_EOF
          \`${slug}\` pins Node **${our}**, upstream indicates **${upstream}** (${hint}) — [upstream repo](https://github.com/${repo}).
          Opened automatically by the weekly Node.js version drift check. **Nothing here has been tested.** Run it against a host before merging:
          \`\`\`bash
          export COMMUNITY_SCRIPTS_URL=https://raw.githubusercontent.com/${GITHUB_REPOSITORY}/${branch}
          bash -c "\$(curl -fsSL "\$COMMUNITY_SCRIPTS_URL/ct/${slug}.sh")"
          \`\`\`
          Both lines are needed — without \`COMMUNITY_SCRIPTS_URL\` the engine takes the \`install/\` script from \`main\`.
          If the bump is wrong — upstream ships a newer Node than the app needs, or this script is deliberately held back — **close this PR**. It gets recorded on the drift report and this exact bump is not proposed again.
          PR_EOF
            )
            # Labels go on at creation, not in a second call: they are what
            # exempts the PR from the template check, and that check runs on
            # "opened" — a label added a moment later can arrive too late.
            #
            # "keep-open" rather than "automated pr" for that exemption: both
            # skip the template check, but changelog-pr.yml drops every PR
            # carrying "automated pr" (it marks its own PR with it), so that
            # label would keep these bumps out of the changelog entirely.
            # "update script" and "bugfix" place them under Updated Scripts →
            # Bug Fixes; the autolabeler cannot do it, since a PR opened with
            # GITHUB_TOKEN never triggers its pull_request_target run.
            if url=$(gh pr create \
              --title "${slug}: bump Node.js from ${our} to ${upstream}" \
              --body "$body" \
              --base main \
              --head "$branch" \
              --label "keep-open" \
              --label "update script" \
              --label "bugfix" 2>/dev/null); then
              printf '%s|open|%s\n' "$slug" "$url" >>/tmp/drift_prs.txt
            else
              printf '%s|failed||\n' "$slug" >>/tmp/drift_prs.txt
            fi
            git checkout -q main
          done </tmp/drift_scripts.txt
          echo "Pull request status per script:"
          cat /tmp/drift_prs.txt
      - name: Create or update summary issue
        if: steps.check.outputs.drift_count != '0'
        env:
@@ -540,31 +403,11 @@ jobs:
          TOTAL="${{ steps.check.outputs.total }}"
          CHECKED="${{ steps.check.outputs.checked }}"
-          # Build checklist from drift data. Each item carries the state of its
+          # Build checklist from drift data
          # own PR, so the list tracks itself instead of relying on someone
          # ticking a box that the next run would overwrite anyway.
          CHECKLIST=""
          while IFS='|' read -r slug our_version upstream_major upstream_hint repo; do
            [[ -z "$slug" ]] && continue
-
+            CHECKLIST+="- [ ] **\`${slug}\`** — ours: \`${our_version}\` → upstream: \`${upstream_major}\` (${upstream_hint}) — [repo](https://github.com/${repo})"$'\n'
            pr_state=""
            pr_url=""
            if [[ -f /tmp/drift_prs.txt ]]; then
              pr_line=$(grep -m1 "^${slug}|" /tmp/drift_prs.txt || echo "")
              pr_state=$(cut -d'|' -f2 <<<"$pr_line")
              pr_url=$(cut -d'|' -f3 <<<"$pr_line")
            fi
            case "$pr_state" in
            open)     mark="- [ ]"; note="— ${pr_url}" ;;
            declined) mark="- [x]"; note="— declined in ${pr_url}, not proposed again" ;;
            merged)   mark="- [x]"; note="— merged in ${pr_url}" ;;
            manual)   mark="- [ ]"; note="— needs a manual change (no fixed \`NODE_VERSION\` to rewrite)" ;;
            failed)   mark="- [ ]"; note="— could not open a PR automatically" ;;
            *)        mark="- [ ]"; note="" ;;
            esac
            CHECKLIST+="${mark} **\`${slug}\`** — ours: \`${our_version}\` → upstream: \`${upstream_major}\` (${upstream_hint}) — [repo](https://github.com/${repo}) ${note}"$'\n'
          done < /tmp/drift_scripts.txt
          # Build full report table
@@ -581,12 +424,11 @@ jobs:
          ### How to resolve
-          Each item above has its own pull request with the bump already applied and a ready-to-run test command in the description.
+          1. Check upstream Dockerfile / package.json to confirm the required Node.js version
-
+          2. Test the script with the new Node version
-          1. Check the upstream Dockerfile / package.json to confirm the required Node.js version
+          3. Update \`NODE_VERSION\` in \`install/<slug>-install.sh\`
-          2. Run the test command from the PR against a host
+          4. Update \`NODE_VERSION\` in \`ct/<slug>.sh\` (update section) if applicable
-          3. Merge the PR if it works — the item disappears from this list on the next run
+          5. Check off the item above once done
          4. Close the PR if the bump is wrong: the script stays as it is and this exact bump is never proposed again
          <details>
          <summary>Full report</summary>
@@ -28,7 +28,6 @@ jobs:
            const allowedBots = [
              "push-app-to-main[bot]",
              "push-app-to-main",
              "community-scripts-pr-app[bot]",
              "community-scripts-pr-app"
            ];
@@ -63,9 +62,7 @@ jobs:
                per_page: 100,
              });
              hasAddedScriptFile = files.some(
-                f => f.status === "added" &&
+                f => f.status === "added" && scriptPrefixes.some(p => f.filename.startsWith(p))
                     !f.filename.includes("/headers/") &&
                     scriptPrefixes.some(p => f.filename.startsWith(p))
              );
            } catch (error) {
              core.warning(`Could not list files for PR #${prNumber}: ${error.message}`);
@@ -1,55 +0,0 @@
 name: Record closed Node.js drift PR
 # The drift check opens one PR per script and treats a closed one as a verdict:
 # that bump is not proposed again. That decision is invisible on the report
 # unless it is written there, so record it as a comment naming the script.
 on:
  pull_request:
    types: [closed]
 jobs:
  record:
    if: >
      github.repository == 'community-scripts/ProxmoxVE' &&
      github.event.pull_request.merged == false &&
      startsWith(github.event.pull_request.head.ref, 'node-drift/')
    runs-on: ubuntu-latest
    permissions:
      issues: write
    steps:
      - uses: actions/github-script@v9
        with:
          script: |
            const pr = context.payload.pull_request;
            const owner = context.repo.owner;
            const repo = context.repo.repo;
            // node-drift/<slug>-<from>-to-<to>
            const m = pr.head.ref.match(/^node-drift\/(.+)-(\d+)-to-(\d+)$/);
            if (!m) return;
            const [, slug, from, to] = m;
            // A close by the stale bot is a lapsed review, not a decision on
            // the bump, and the drift check reopens those. Saying "declined"
            // here would contradict it.
            const stale = pr.labels.some((l) => l.name === 'stale');
            const issues = await github.rest.issues.listForRepo({
              owner, repo, state: 'open', labels: 'automated,dependencies', per_page: 100,
            });
            const issue = issues.data.find(
              (i) => !i.pull_request && i.title === '[Automated] Node.js Version Drift Report',
            );
            if (!issue) return;
            const body = stale
              ? `\`${slug}\` — PR #${pr.number} (Node ${from} → ${to}) was closed as stale. `
                + `No decision was recorded, so the next drift check opens it again.`
              : `\`${slug}\` — PR #${pr.number} (Node ${from} → ${to}) was closed without merging. `
                + `The script keeps Node ${from} and this bump will not be proposed again. `
                + `If it was closed by mistake, reopen the PR.`;
            await github.rest.issues.createComment({
              owner, repo, issue_number: issue.number, body,
            });
@@ -0,0 +1,626 @@
 name: PocketBase AI Bot
 # Natural-language companion to pocketbase-bot.yml.
 # Mention the bot in plain English, e.g.:
 #   @pocketbase-bot change RAM to 4096 on zigbee2mqtt
 #   @pocketbase-bot disable script Nextcloud because upstream is broken
 # The bot parses the request with GitHub Models, replies with the exact change(s)
 # it understood, and only applies them after you reply "@pocketbase-bot confirm".
 # The slash-command bot (/pocketbase ...) is unaffected; triggers do not overlap.
 on:
  issue_comment:
    types: [created]
 permissions:
  models: read # lets the built-in GITHUB_TOKEN call GitHub Models inference
  contents: write # built-in token opens the CT-defaults sync PR (like the slash bot)
  pull-requests: write
 jobs:
  ai-bot:
    runs-on: self-hosted
    # Broad gate; the script does precise keyword + self-author checks.
    if: contains(github.event.comment.body, '@pocketbase-bot')
    steps:
      - name: Mint GitHub App token (bot identity)
        id: app-token
        uses: actions/create-github-app-token@v3
        with:
          app-id: ${{ vars.GHAPP_PBBOT_ID }}
          private-key: ${{ secrets.GHAPP_PBBOT_PRIVATE_KEY }}
      - name: Run PocketBase AI bot
        env:
          # GitHub REST as the bot identity
          GH_APP_TOKEN: ${{ steps.app-token.outputs.token }}
          PB_BOT_APP_ID: ${{ vars.GHAPP_PBBOT_ID }}
          # GitHub Models inference uses the built-in token (needs models: read)
          MODELS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Built-in token for git/PR ops (CT-defaults sync), mirroring the slash bot
          GH_DEFAULT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          AI_MODEL: openai/gpt-4o
          # PocketBase
          POCKETBASE_URL: ${{ vars.POCKETBASE_URL }}
          POCKETBASE_COLLECTION: ${{ vars.POCKETBASE_COLLECTION }}
          POCKETBASE_ADMIN_EMAIL: ${{ secrets.POCKETBASE_ADMIN_EMAIL }}
          POCKETBASE_ADMIN_PASSWORD: ${{ secrets.POCKETBASE_ADMIN_PASSWORD }}
          FRONTEND_URL: ${{ vars.FRONTEND_URL }}
          REVALIDATE_SECRET: ${{ secrets.FRONTEND_INGEST_SECRET }}
          # Event context
          COMMENT_BODY: ${{ github.event.comment.body }}
          COMMENT_ID: ${{ github.event.comment.id }}
          COMMENT_AUTHOR_TYPE: ${{ github.event.comment.user.type }}
          ISSUE_NUMBER: ${{ github.event.issue.number }}
          REPO_OWNER: ${{ github.repository_owner }}
          REPO_NAME: ${{ github.event.repository.name }}
          ACTOR: ${{ github.event.comment.user.login }}
          ACTOR_ASSOCIATION: ${{ github.event.comment.author_association }}
        run: |
          node << 'ENDSCRIPT'
          (async function () {
            const https = require('https');
            const http = require('http');
            const url = require('url');
            // ── HTTP helper with redirect following ────────────────────────────
            function request(fullUrl, opts, redirectCount) {
              redirectCount = redirectCount || 0;
              return new Promise(function (resolve, reject) {
                const u = url.parse(fullUrl);
                const isHttps = u.protocol === 'https:';
                const body = opts.body;
                const options = {
                  hostname: u.hostname,
                  port: u.port || (isHttps ? 443 : 80),
                  path: u.path,
                  method: opts.method || 'GET',
                  headers: opts.headers || {}
                };
                if (body) options.headers['Content-Length'] = Buffer.byteLength(body);
                const lib = isHttps ? https : http;
                const req = lib.request(options, function (res) {
                  if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
                    if (redirectCount >= 5) return reject(new Error('Too many redirects from ' + fullUrl));
                    const redirectUrl = url.resolve(fullUrl, res.headers.location);
                    res.resume();
                    resolve(request(redirectUrl, opts, redirectCount + 1));
                    return;
                  }
                  let data = '';
                  res.on('data', function (chunk) { data += chunk; });
                  res.on('end', function () {
                    resolve({ ok: res.statusCode >= 200 && res.statusCode < 300, statusCode: res.statusCode, body: data });
                  });
                });
                req.on('error', reject);
                if (body) req.write(body);
                req.end();
              });
            }
            // ── GitHub REST (as the bot app) ───────────────────────────────────
            const owner = process.env.REPO_OWNER;
            const repo = process.env.REPO_NAME;
            const issueNumber = parseInt(process.env.ISSUE_NUMBER, 10);
            const commentId = parseInt(process.env.COMMENT_ID, 10);
            const actor = process.env.ACTOR;
            function ghRequest(path, method, body) {
              const headers = {
                'Authorization': 'Bearer ' + process.env.GH_APP_TOKEN,
                'Accept': 'application/vnd.github+json',
                'X-GitHub-Api-Version': '2022-11-28',
                'User-Agent': 'PocketBase-AI-Bot'
              };
              const bodyStr = body ? JSON.stringify(body) : undefined;
              if (bodyStr) headers['Content-Type'] = 'application/json';
              return request('https://api.github.com' + path, { method: method || 'GET', headers, body: bodyStr });
            }
            // Same as ghRequest but authenticated with the built-in GITHUB_TOKEN.
            // Used for the CT-defaults sync branch/PR (the App token lacks contents:write).
            function ghDefault(path, method, body) {
              const headers = {
                'Authorization': 'Bearer ' + process.env.GH_DEFAULT_TOKEN,
                'Accept': 'application/vnd.github+json',
                'X-GitHub-Api-Version': '2022-11-28',
                'User-Agent': 'PocketBase-AI-Bot'
              };
              const bodyStr = body ? JSON.stringify(body) : undefined;
              if (bodyStr) headers['Content-Type'] = 'application/json';
              return request('https://api.github.com' + path, { method: method || 'GET', headers, body: bodyStr });
            }
            async function addReaction(content) {
              try {
                await ghRequest('/repos/' + owner + '/' + repo + '/issues/comments/' + commentId + '/reactions', 'POST', { content });
              } catch (e) { console.warn('Could not add reaction:', e.message); }
            }
            async function postComment(text) {
              const res = await ghRequest('/repos/' + owner + '/' + repo + '/issues/' + issueNumber + '/comments', 'POST', { body: text });
              if (!res.ok) console.warn('Could not post comment:', res.body);
              return res.ok ? JSON.parse(res.body) : null;
            }
            async function updateComment(id, text) {
              const res = await ghRequest('/repos/' + owner + '/' + repo + '/issues/comments/' + id, 'PATCH', { body: text });
              if (!res.ok) console.warn('Could not update comment:', res.body);
            }
            async function listIssueComments() {
              const all = [];
              let page = 1;
              while (page <= 10) {
                const res = await ghRequest('/repos/' + owner + '/' + repo + '/issues/' + issueNumber + '/comments?per_page=100&page=' + page);
                if (!res.ok) break;
                const batch = JSON.parse(res.body);
                all.push.apply(all, batch);
                if (batch.length < 100) break;
                page++;
              }
              return all;
            }
            // ── 1. Self-trigger guard (App-token comments DO re-fire this event) ─
            if (process.env.COMMENT_AUTHOR_TYPE === 'Bot') {
              console.log('Comment authored by a bot — skipping to avoid loops.');
              return;
            }
            // ── 2. Permission gate (mirrors the slash bot) ─────────────────────
            const association = process.env.ACTOR_ASSOCIATION;
            if (association !== 'OWNER' && association !== 'MEMBER') {
              await addReaction('-1');
              await postComment(
                '❌ **PocketBase AI Bot**: @' + actor + ' is not authorized to use this command.\n' +
                'Only org members (Contributors team) can use `@pocketbase-bot`.'
              );
              return;
            }
            // ── 3. Extract the instruction after the @pocketbase-bot handle ────
            const commentBody = process.env.COMMENT_BODY || '';
            const handleMatch = commentBody.match(/@pocketbase-bot(\[bot\])?/i);
            if (!handleMatch) {
              console.log('No @pocketbase-bot handle found — ignoring.');
              return;
            }
            const instruction = commentBody.slice(handleMatch.index + handleMatch[0].length).trim();
            if (!instruction) {
              await addReaction('-1');
              await postComment(
                'ℹ️ **PocketBase AI Bot**: Tell me what to do, e.g.\n' +
                '`@pocketbase-bot change RAM to 4096 on zigbee2mqtt` or `@pocketbase-bot disable script Nextcloud`.'
              );
              return;
            }
            // ── PocketBase auth + low-level helpers ────────────────────────────
            const pbRaw = process.env.POCKETBASE_URL.replace(/\/$/, '');
            const apiBase = /\/api$/i.test(pbRaw) ? pbRaw : pbRaw + '/api';
            const coll = process.env.POCKETBASE_COLLECTION;
            const recordsUrl = apiBase + '/collections/' + encodeURIComponent(coll) + '/records';
            async function pbAuth() {
              const res = await request(apiBase + '/collections/users/auth-with-password', {
                method: 'POST',
                headers: { 'Content-Type': 'application/json' },
                body: JSON.stringify({ identity: process.env.POCKETBASE_ADMIN_EMAIL, password: process.env.POCKETBASE_ADMIN_PASSWORD })
              });
              if (!res.ok) throw new Error('PocketBase auth failed: ' + res.body);
              return JSON.parse(res.body).token;
            }
            async function pbFindRecord(token, slug) {
              const filter = "(slug='" + String(slug).replace(/'/g, "''") + "')";
              const res = await request(recordsUrl + '?filter=' + encodeURIComponent(filter) + '&perPage=1', { headers: { 'Authorization': token } });
              const list = JSON.parse(res.body);
              return list.items && list.items[0];
            }
            async function pbPatch(token, id, payload) {
              return request(recordsUrl + '/' + id, {
                method: 'PATCH',
                headers: { 'Authorization': token, 'Content-Type': 'application/json' },
                body: JSON.stringify(payload)
              });
            }
            function readJsonBlob(val) {
              if (Array.isArray(val)) return val;
              try { return JSON.parse(val || '[]'); } catch (e) { return []; }
            }
            async function revalidate(s) {
              const frontendUrl = process.env.FRONTEND_URL;
              const secret = process.env.REVALIDATE_SECRET;
              if (!frontendUrl || !secret) return;
              try {
                await request(frontendUrl.replace(/\/$/, '') + '/api/revalidate', {
                  method: 'POST',
                  headers: { 'Authorization': 'Bearer ' + secret, 'Content-Type': 'application/json' },
                  body: JSON.stringify({ tags: ['scripts', 'script-' + s] })
                });
              } catch (e) { console.warn('Revalidation skipped:', e.message); }
            }
            // ── CT-defaults sync PR (copied from slash bot) ────────────────────
            function encodeContentPath(filePath) { return filePath.split('/').map(encodeURIComponent).join('/'); }
            function decodeGitHubContent(content) { return Buffer.from((content || '').replace(/\n/g, ''), 'base64').toString('utf8'); }
            function sanitizeBranchPart(value) {
              return (value || '').toLowerCase().replace(/[^a-z0-9._/-]+/g, '-').replace(/\/+/g, '/').replace(/^-+|-+$/g, '');
            }
            function applyCtDefaultChanges(scriptText, varChanges) {
              let nextText = scriptText;
              const updatedVars = [], unchangedVars = [];
              for (const [varName, rawValue] of Object.entries(varChanges)) {
                const newValue = String(rawValue);
                const pattern = new RegExp('(^\\s*' + varName + '="\\$\\{' + varName + ':-)([^"}]*)(\\}"\\s*$)', 'm');
                const match = nextText.match(pattern);
                if (!match) continue;
                if (match[2] === newValue) { unchangedVars.push(varName); continue; }
                nextText = nextText.replace(pattern, '$1' + newValue + '$3');
                updatedVars.push(varName);
              }
              return { nextText, updatedVars, unchangedVars };
            }
            async function ensureBranch(defaultBranch, branchName) {
              const ghRequest = ghDefault; // git ops run as the built-in token
              const branchRefRes = await ghRequest('/repos/' + owner + '/' + repo + '/git/ref/heads/' + encodeURIComponent(branchName));
              if (branchRefRes.ok) return;
              const defaultRefRes = await ghRequest('/repos/' + owner + '/' + repo + '/git/ref/heads/' + encodeURIComponent(defaultBranch));
              if (!defaultRefRes.ok) throw new Error('Could not read default branch ref: ' + defaultRefRes.body);
              const defaultRef = JSON.parse(defaultRefRes.body);
              const createBranchRes = await ghRequest('/repos/' + owner + '/' + repo + '/git/refs', 'POST', { ref: 'refs/heads/' + branchName, sha: defaultRef.object.sha });
              if (!createBranchRes.ok) throw new Error('Could not create branch: ' + createBranchRes.body);
            }
            async function upsertCtDefaultsPr(slugValue, varChanges) {
              const ghRequest = ghDefault; // contents/PR ops run as the built-in token
              const wantedEntries = Object.entries(varChanges || {}).filter(function ([, v]) { return v !== undefined && v !== null && String(v) !== ''; });
              if (wantedEntries.length === 0) return { status: 'skipped', reason: 'No mapped CT defaults changed.' };
              const repoRes = await ghRequest('/repos/' + owner + '/' + repo);
              if (!repoRes.ok) throw new Error('Could not read repository metadata: ' + repoRes.body);
              const defaultBranch = JSON.parse(repoRes.body).default_branch;
              const ctPath = 'ct/' + slugValue + '.sh';
              const encodedCtPath = encodeContentPath(ctPath);
              const defaultFileRes = await ghRequest('/repos/' + owner + '/' + repo + '/contents/' + encodedCtPath + '?ref=' + encodeURIComponent(defaultBranch));
              if (defaultFileRes.statusCode === 404) return { status: 'skipped', reason: 'No matching CT file found at `' + ctPath + '`.' };
              if (!defaultFileRes.ok) throw new Error('Could not read CT file from default branch: ' + defaultFileRes.body);
              const branchName = 'pocketbase-sync/' + sanitizeBranchPart(slugValue || 'unknown');
              await ensureBranch(defaultBranch, branchName);
              const branchFileRes = await ghRequest('/repos/' + owner + '/' + repo + '/contents/' + encodedCtPath + '?ref=' + encodeURIComponent(branchName));
              if (!branchFileRes.ok) throw new Error('Could not read CT file from sync branch: ' + branchFileRes.body);
              const branchFile = JSON.parse(branchFileRes.body);
              const currentBranchText = decodeGitHubContent(branchFile.content);
              const updateResult = applyCtDefaultChanges(currentBranchText, Object.fromEntries(wantedEntries));
              if (updateResult.updatedVars.length === 0) return { status: 'skipped', reason: 'CT defaults already up to date.' };
              const putRes = await ghRequest('/repos/' + owner + '/' + repo + '/contents/' + encodedCtPath, 'PUT', {
                message: 'chore(ct): sync ' + slugValue + ' defaults from PocketBase',
                content: Buffer.from(updateResult.nextText, 'utf8').toString('base64'),
                sha: branchFile.sha,
                branch: branchName
              });
              if (!putRes.ok) throw new Error('Could not update CT file: ' + putRes.body);
              const openPrRes = await ghRequest('/repos/' + owner + '/' + repo + '/pulls?state=open&head=' + encodeURIComponent(owner + ':' + branchName) + '&base=' + encodeURIComponent(defaultBranch));
              if (!openPrRes.ok) throw new Error('Could not query existing PRs: ' + openPrRes.body);
              const openPrs = JSON.parse(openPrRes.body);
              if (openPrs.length > 0) return { status: 'updated', prUrl: openPrs[0].html_url, updatedVars: updateResult.updatedVars };
              const createPrRes = await ghRequest('/repos/' + owner + '/' + repo + '/pulls', 'POST', {
                title: 'chore(ct): sync ' + slugValue + ' defaults with PocketBase',
                body: '## Summary\n- Sync default CT variables for `' + slugValue + '` after an `@pocketbase-bot` update.\n- Updated vars: `' + updateResult.updatedVars.join('`, `') + '`.\n\n## Source\n- Triggered by @' + actor + ' via PocketBase AI bot.\n',
                head: branchName,
                base: defaultBranch
              });
              if (!createPrRes.ok) throw new Error('Could not create PR: ' + createPrRes.body);
              return { status: 'created', prUrl: JSON.parse(createPrRes.body).html_url, updatedVars: updateResult.updatedVars };
            }
            // ── Allow-lists (mirror the slash bot) ─────────────────────────────
            const ALLOWED_FIELDS = {
              name: 'string', description: 'string', logo: 'string', documentation: 'string',
              website: 'string', project_url: 'string', repository: 'string', config_path: 'string',
              tags: 'string', port: 'number', default_user: 'nullable_string', default_passwd: 'nullable_string',
              unprivileged: 'number', updateable: 'boolean', privileged: 'boolean',
              architectures: 'select_list', platforms: 'select_list',
              is_dev: 'boolean', is_disabled: 'boolean', disable_message: 'string',
              is_deleted: 'boolean', deleted_message: 'string'
            };
            const SELECT_VALUES = {
              architectures: ['amd64', 'arm64'],
              platforms: ['pve', 'incus'],
            };
            const FIELD_TO_CT_VAR = { tags: 'var_tags', unprivileged: 'var_unprivileged' };
            const RESOURCE_KEYS = { cpu: 'number', ram: 'number', hdd: 'number', os: 'string', version: 'string' };
            const METHOD_KEYS = { config_path: 'string', script: 'string' };
            const ALL_METHOD_KEYS = Object.assign({}, RESOURCE_KEYS, METHOD_KEYS);
            const RESOURCE_TO_CT_VAR = { cpu: 'var_cpu', ram: 'var_ram', hdd: 'var_disk', os: 'var_os', version: 'var_version' };
            function castFieldValue(key, rawVal) {
              const type = ALLOWED_FIELDS[key];
              if (!type) return { error: 'Unknown field `' + key + '`' };
              if (type === 'boolean') {
                if (rawVal === true || rawVal === 'true') return { value: true };
                if (rawVal === false || rawVal === 'false') return { value: false };
                return { error: '`' + key + '` must be true/false' };
              }
              if (type === 'number') {
                const n = parseInt(rawVal, 10);
                if (isNaN(n)) return { error: '`' + key + '` must be a number' };
                return { value: n };
              }
              if (type === 'select_list') {
                // architectures/platforms are multi-selects over a closed set,
                // so an unknown value is rejected rather than stored. The model
                // may hand back an array or a comma-separated string.
                const allowed = SELECT_VALUES[key] || [];
                const raw = Array.isArray(rawVal) ? rawVal : String(rawVal == null ? '' : rawVal).split(',');
                const values = raw.map(function (v) { return String(v).trim(); }).filter(Boolean);
                const bad = values.filter(function (v) { return allowed.indexOf(v) === -1; });
                if (bad.length > 0) return { error: '`' + key + '` accepts ' + allowed.join(', ') + ' — got: ' + bad.join(', ') };
                return { value: values };
              }
              if (type === 'nullable_string') return { value: rawVal === '' || rawVal == null ? null : String(rawVal) };
              return { value: String(rawVal) };
            }
            // ── Operation validation (used at propose AND confirm time) ────────
            // Never trust raw operations: enforce the field/op allow-lists and
            // re-cast values. Returns only well-formed, allowed operations.
            function sanitizeOperations(ops) {
              const validOps = [], problems = [];
              for (const op of (Array.isArray(ops) ? ops : [])) {
                if (op && op.kind === 'field') {
                  const cast = castFieldValue(op.field, op.value);
                  if (cast.error) { problems.push(cast.error); continue; }
                  validOps.push({ kind: 'field', field: op.field, value: cast.value });
                } else if (op && op.kind === 'note' && ['add', 'edit', 'remove'].includes(op.action)) {
                  validOps.push({ kind: 'note', action: op.action, type: String(op.type || ''), text: op.text, newText: op.newText });
                } else if (op && op.kind === 'method' && ['add', 'edit', 'remove'].includes(op.action)) {
                  const changes = {};
                  for (const [k, v] of Object.entries(op.changes || {})) { if (ALL_METHOD_KEYS[k]) changes[k] = v; }
                  validOps.push({ kind: 'method', action: op.action, type: String(op.type || 'default'), changes });
                } else {
                  problems.push('Unsupported operation: `' + JSON.stringify(op) + '`');
                }
              }
              return { validOps, problems };
            }
            // ── Executor: apply a validated {slug, operations} set ─────────────
            async function applyOperations(action) {
              const token = await pbAuth();
              const record = await pbFindRecord(token, action.slug);
              if (!record) return { ok: false, summary: '❌ No PocketBase record for slug `' + action.slug + '`.' };
              const fieldPayload = {};
              let notesArr = readJsonBlob(record.notes);
              let methodsArr = readJsonBlob(record.install_methods);
              let notesChanged = false, methodsChanged = false;
              const ctChanges = {};
              const lines = [];
              for (const op of action.operations) {
                if (op.kind === 'field') {
                  const cast = castFieldValue(op.field, op.value);
                  if (cast.error) { lines.push('- ⚠️ skipped field: ' + cast.error); continue; }
                  fieldPayload[op.field] = cast.value;
                  if (FIELD_TO_CT_VAR[op.field]) ctChanges[FIELD_TO_CT_VAR[op.field]] = cast.value;
                  lines.push('- `' + op.field + '` → `' + JSON.stringify(cast.value) + '`');
                } else if (op.kind === 'note') {
                  const type = String(op.type || '').toLowerCase();
                  if (op.action === 'add') {
                    notesArr.push({ type, text: String(op.text || '') });
                    notesChanged = true; lines.push('- note add `' + type + '`: ' + op.text);
                  } else if (op.action === 'remove') {
                    const before = notesArr.length;
                    notesArr = notesArr.filter(function (n) { return !(String(n.type).toLowerCase() === type && n.text === op.text); });
                    if (notesArr.length !== before) { notesChanged = true; lines.push('- note remove `' + type + '`: ' + op.text); }
                    else lines.push('- ⚠️ note remove: no `' + type + '` note matched');
                  } else if (op.action === 'edit') {
                    const idx = notesArr.findIndex(function (n) { return String(n.type).toLowerCase() === type && n.text === op.text; });
                    if (idx !== -1) { notesArr[idx].text = String(op.newText || ''); notesChanged = true; lines.push('- note edit `' + type + '`'); }
                    else lines.push('- ⚠️ note edit: no `' + type + '` note matched');
                  }
                } else if (op.kind === 'method') {
                  const type = String(op.type || '').toLowerCase();
                  const changes = op.changes || {};
                  if (op.action === 'remove') {
                    const before = methodsArr.length;
                    methodsArr = methodsArr.filter(function (im) { return String(im.type || '').toLowerCase() !== type; });
                    if (methodsArr.length !== before) { methodsChanged = true; lines.push('- method remove `' + type + '`'); }
                    else lines.push('- ⚠️ method remove: `' + type + '` not found');
                  } else {
                    let method = methodsArr.find(function (im) { return String(im.type || '').toLowerCase() === type; });
                    if (!method && op.action === 'add') { method = { type, resources: { cpu: 1, ram: 512, hdd: 4, os: 'debian', version: '13' } }; methodsArr.push(method); }
                    if (!method) { lines.push('- ⚠️ method edit: `' + type + '` not found'); continue; }
                    if (!method.resources) method.resources = {};
                    for (const [k, v] of Object.entries(changes)) {
                      if (RESOURCE_KEYS[k]) {
                        method.resources[k] = RESOURCE_KEYS[k] === 'number' ? parseInt(v, 10) : String(v);
                        if (RESOURCE_TO_CT_VAR[k]) ctChanges[RESOURCE_TO_CT_VAR[k]] = method.resources[k];
                      } else if (METHOD_KEYS[k]) {
                        method[k] = v === '' ? null : String(v);
                      }
                    }
                    methodsChanged = true;
                    lines.push('- method `' + (op.action === 'add' ? 'add' : 'edit') + '` `' + type + '`: ' + JSON.stringify(changes));
                  }
                }
              }
              if (Object.keys(fieldPayload).length) {
                const r = await pbPatch(token, record.id, fieldPayload);
                if (!r.ok) return { ok: false, summary: '❌ Field update failed:\n```\n' + r.body + '\n```' };
              }
              if (notesChanged) {
                const r = await pbPatch(token, record.id, { notes: notesArr });
                if (!r.ok) return { ok: false, summary: '❌ Notes update failed:\n```\n' + r.body + '\n```' };
              }
              if (methodsChanged) {
                const r = await pbPatch(token, record.id, { install_methods: methodsArr });
                if (!r.ok) return { ok: false, summary: '❌ Install-method update failed:\n```\n' + r.body + '\n```' };
              }
              await revalidate(action.slug);
              let ctNote = '';
              if (Object.keys(ctChanges).length) {
                try {
                  const sync = await upsertCtDefaultsPr(action.slug, ctChanges);
                  if (sync.status === 'created') ctNote = '\n\n**CT sync PR:** ' + sync.prUrl;
                  else if (sync.status === 'updated') ctNote = '\n\n**CT sync PR updated:** ' + sync.prUrl;
                  else if (sync.status === 'skipped') ctNote = '\n\n**CT sync skipped:** ' + sync.reason;
                } catch (e) { ctNote = '\n\n**CT sync failed:** ' + e.message; }
              }
              return { ok: true, summary: lines.join('\n') + ctNote };
            }
            // ── 4. Confirm branch ──────────────────────────────────────────────
            const PENDING_RE = /<!--\s*pocketbase-pending:\s*([A-Za-z0-9+/=]+)\s*-->/;
            const isConfirm = /^(confirm|yes|apply|do it|y)\b/i.test(instruction);
            if (isConfirm) {
              const comments = await listIssueComments();
              const appId = String(process.env.PB_BOT_APP_ID || '');
              let pending = null, pendingComment = null;
              for (let i = comments.length - 1; i >= 0; i--) {
                const c = comments[i];
                // Only trust a marker in a comment THIS bot app authored — otherwise a
                // user could hand-craft a forged pocketbase-pending marker and confirm it.
                const byBotApp = c.user && c.user.type === 'Bot' &&
                  c.performed_via_github_app && String(c.performed_via_github_app.id) === appId;
                if (!byBotApp) continue;
                const m = c.body && c.body.match(PENDING_RE);
                if (m) { pending = m[1]; pendingComment = c; break; }
              }
              if (!pending) {
                await addReaction('confused');
                await postComment('🤔 **PocketBase AI Bot**: I have no pending change to confirm in this thread.');
                return;
              }
              let action;
              try { action = JSON.parse(Buffer.from(pending, 'base64').toString('utf8')); }
              catch (e) { await postComment('❌ **PocketBase AI Bot**: Could not decode the pending change.'); return; }
              // Re-validate the decoded operations before applying (defense-in-depth).
              const recheck = sanitizeOperations(action.operations);
              if (!action.slug || recheck.validOps.length === 0) {
                await addReaction('-1');
                await postComment('❌ **PocketBase AI Bot**: The pending change is no longer valid. Please restate the request.');
                return;
              }
              action.operations = recheck.validOps;
              let result;
              try { result = await applyOperations(action); }
              catch (e) { await addReaction('-1'); await postComment('❌ **PocketBase AI Bot**: ' + e.message); return; }
              if (!result.ok) { await addReaction('-1'); await postComment(result.summary); return; }
              await updateComment(pendingComment.id, pendingComment.body.replace(PENDING_RE, '<!-- pocketbase-applied -->'));
              await addReaction('+1');
              await postComment(
                '✅ **PocketBase AI Bot**: Applied to **`' + action.slug + '`**\n\n' + result.summary +
                '\n\n*Confirmed by @' + actor + '*'
              );
              return;
            }
            // ── 5. New request: acknowledge, fetch script list, call the model ─
            await addReaction('eyes');
            const token0 = await pbAuth();
            const scripts = [];
            let page = 1;
            while (page <= 5) {
              const res = await request(recordsUrl + '?fields=slug,name&perPage=500&page=' + page, { headers: { 'Authorization': token0 } });
              if (!res.ok) break;
              const data = JSON.parse(res.body);
              (data.items || []).forEach(function (it) { if (it.slug) scripts.push({ slug: it.slug, name: it.name || it.slug }); });
              if (!data.items || data.items.length < 500) break;
              page++;
            }
            const SYSTEM_PROMPT =
              'You translate a maintainer\'s natural-language request into a STRICT JSON change-set for a ' +
              'script catalog (PocketBase). Respond with a SINGLE JSON object and nothing else.\n\n' +
              'Schema:\n' +
              '{\n' +
              '  "slug": string|null,            // MUST be one of the known slugs below, chosen from the request\n' +
              '  "operations": [ ... ],          // [] if you cannot determine concrete changes\n' +
              '  "human_summary": string,        // short plain-English description\n' +
              '  "clarification": string|null    // a question to ask if ambiguous/unsupported; else null\n' +
              '}\n\n' +
              'Operation kinds:\n' +
              '- {"kind":"field","field":<one of: ' + Object.keys(ALLOWED_FIELDS).join(', ') + '>,"value":<bool|number|string>}\n' +
              '  (booleans true/false; "is_disabled"/"is_deleted"/"is_dev" are booleans; "port"/"unprivileged" are numbers; rest strings.)\n' +
              '- {"kind":"note","action":"add"|"edit"|"remove","type":string,"text":string,"newText":string?}\n' +
              '- {"kind":"method","action":"add"|"edit"|"remove","type":string,"changes":{cpu?:number,ram?:number,hdd?:number,os?:string,version?:string,config_path?:string,script?:string}}\n' +
              '  (RAM/HDD are in MB/GB; method "type" defaults to "default" if the user does not name one.)\n\n' +
              'Rules:\n' +
              '- Only use fields/operations listed above. If the request needs something else, set clarification and operations=[].\n' +
              '- "disable"/"enable" map to is_disabled true/false. If disabling and the user gave a reason, also set disable_message.\n' +
              '- Resolve the target script to a slug from the list. If you cannot confidently match exactly one, set slug=null and ask via clarification.\n\n' +
              'Known scripts (slug — name):\n' +
              scripts.map(function (s) { return s.slug + ' — ' + s.name; }).join('\n');
            const modelRes = await request('https://models.github.ai/inference/chat/completions', {
              method: 'POST',
              headers: { 'Authorization': 'Bearer ' + process.env.MODELS_TOKEN, 'Content-Type': 'application/json', 'Accept': 'application/json' },
              body: JSON.stringify({
                model: process.env.AI_MODEL || 'openai/gpt-4o',
                temperature: 0.1,
                response_format: { type: 'json_object' },
                messages: [{ role: 'system', content: SYSTEM_PROMPT }, { role: 'user', content: instruction }]
              })
            });
            if (!modelRes.ok) {
              await addReaction('-1');
              await postComment('❌ **PocketBase AI Bot**: Model request failed (' + modelRes.statusCode + ').\n```\n' + modelRes.body.slice(0, 500) + '\n```');
              return;
            }
            let parsed;
            try {
              const content = JSON.parse(modelRes.body).choices[0].message.content;
              const cleaned = content.replace(/^```(?:json)?\s*/i, '').replace(/```\s*$/i, '').trim();
              parsed = JSON.parse(cleaned);
            } catch (e) {
              await addReaction('-1');
              await postComment('❌ **PocketBase AI Bot**: Could not parse the model response. Please rephrase.');
              return;
            }
            // ── 6. Validate ────────────────────────────────────────────────────
            const knownSlugs = new Set(scripts.map(function (s) { return s.slug; }));
            const problems = [];
            if (parsed.clarification) problems.push(parsed.clarification);
            if (!parsed.slug || !knownSlugs.has(parsed.slug)) problems.push('I could not match the request to a known script.');
            const sanitized = sanitizeOperations(parsed.operations);
            const validOps = sanitized.validOps;
            problems.push.apply(problems, sanitized.problems);
            if (validOps.length === 0) problems.push('No concrete, supported change was found.');
            if (problems.length) {
              await addReaction('confused');
              await postComment(
                '🤔 **PocketBase AI Bot**: I need a bit more to act on that.\n\n- ' + problems.join('\n- ') +
                '\n\nTry naming the script and the exact change, e.g. `@pocketbase-bot set RAM to 4096 on zigbee2mqtt`.'
              );
              return;
            }
            // ── 7. Propose (do NOT apply yet) ──────────────────────────────────
            const action = { slug: parsed.slug, operations: validOps };
            const bullets = validOps.map(function (op) {
              if (op.kind === 'field') return '- `' + op.field + '` → `' + JSON.stringify(op.value) + '`';
              if (op.kind === 'note') return '- note ' + op.action + ' `' + op.type + '`' + (op.text ? ': ' + op.text : '');
              return '- method ' + op.action + ' `' + op.type + '`: ' + JSON.stringify(op.changes);
            }).join('\n');
            const marker = '<!-- pocketbase-pending: ' + Buffer.from(JSON.stringify(action), 'utf8').toString('base64') + ' -->';
            await addReaction('+1');
            await postComment(
              '🤖 **PocketBase AI Bot** — please confirm\n\n' +
              (parsed.human_summary ? '> ' + parsed.human_summary + '\n\n' : '') +
              '**Target:** `' + action.slug + '`\n**Proposed changes:**\n' + bullets + '\n\n' +
              'Reply **`@pocketbase-bot confirm`** to apply, or restate the request to adjust.\n' + marker
            );
          })().catch(function (e) {
            console.error('Fatal error:', e && (e.message || e));
            process.exit(1);
          });
          ENDSCRIPT
@@ -26,7 +26,6 @@ jobs:
          COMMENT_BODY: ${{ github.event.comment.body }}
          COMMENT_ID: ${{ github.event.comment.id }}
          ISSUE_NUMBER: ${{ github.event.issue.number }}
          IS_PR_COMMENT: ${{ github.event.issue.pull_request && 'true' || 'false' }}
          REPO_OWNER: ${{ github.repository_owner }}
          REPO_NAME: ${{ github.event.repository.name }}
          ACTOR: ${{ github.event.comment.user.login }}
@@ -85,7 +84,6 @@ jobs:
            const owner = process.env.REPO_OWNER;
            const repo = process.env.REPO_NAME;
            const issueNumber = parseInt(process.env.ISSUE_NUMBER, 10);
            const isPrComment = process.env.IS_PR_COMMENT === 'true';
            const commentId = parseInt(process.env.COMMENT_ID, 10);
            const actor = process.env.ACTOR;
@@ -218,22 +216,11 @@ jobs:
              const prTitle = 'chore(ct): sync ' + slugValue + ' defaults with PocketBase';
              const prBody =
-                '## ✍️ Description\n\n' +
+                '## Summary\n' +
-                'Sync of the default CT variables for `' + slugValue + '` after a `/pocketbase` update by @' + actor + '.\n\n' +
+                '- Sync default CT variables for `' + slugValue + '` after `/pocketbase` update.\n' +
-                'Updated: `' + updateResult.updatedVars.join('`, `') + '`\n\n' +
+                '- Updated vars: `' + updateResult.updatedVars.join('`, `') + '`.\n\n' +
-                '## 🔗 Related Issue\n\n' +
+                '## Source\n' +
-                (isPrComment ? 'Triggered from #' : 'Fixes #') + issueNumber + '\n\n' +
+                '- Triggered by @' + actor + ' via PocketBase bot.\n';
                '## ✅ Prerequisites (**X** in brackets)\n\n' +
                '- [x] **Self-review completed** – Code follows project standards.\n' +
                '- [ ] **Tested thoroughly** – Changes work as expected.\n' +
                '- [x] **No security risks** – No hardcoded secrets, unnecessary privilege escalations, or permission issues.\n\n' +
                '**Tested on:** not tested — generated from the PocketBase record, only `var_` defaults changed.\n\n' +
                '---\n\n' +
                '## 🤖 AI Assistance (**X** in brackets)\n\n' +
                '- [x] **No AI used** – Scripts were written without AI assistance.\n\n' +
                '---\n\n' +
                '## 🛠️ Type of Change (**X** in brackets)\n\n' +
                '- [x] 🐞 **Bug fix** – Resolves an issue without breaking functionality.\n';
              const createPrRes = await ghRequest('/repos/' + owner + '/' + repo + '/pulls', 'POST', {
                title: prTitle,
                body: prBody,
@@ -348,10 +335,7 @@ jobs:
              '`architectures` (amd64,arm64) `platforms` (pve,incus) ' +
              '`execute_in` (pve,lxc,pbs,vm,pmg,pdm) `categories` (names or ids) ' +
              '`type` (ct, vm, addon, …) ' +
-              '`is_disabled` `disable_message` `is_deleted` `deleted_message` ' +
+              '`is_disabled` `disable_message` `is_deleted` `deleted_message`\n\n' +
              '`pin_reason` `last_update_commit`\n\n' +
              'The `var_` names from the ct scripts work too: `var_cpu` `var_ram` `var_disk`\n' +
              '`var_os` `var_version` `var_port` `var_tags` `var_unprivileged`\n\n' +
              '**Screenshots:**\n' +
              '```\n' +
              '/pocketbase <slug> screenshot https://example.com/one.png https://example.com/two.png\n' +
@@ -415,14 +399,6 @@ jobs:
            // ── Shared helpers ─────────────────────────────────────────────────
            // The ct scripts name these var_cpu/var_ram/var_disk, and that is what
            // people type. Accept them for the PocketBase keys.
            const KEY_ALIASES = {
              var_cpu: 'cpu', var_ram: 'ram', var_disk: 'hdd', var_hdd: 'hdd',
              var_os: 'os', var_version: 'version', var_unprivileged: 'unprivileged',
              var_port: 'port', var_tags: 'tags', disk: 'hdd', memory: 'ram',
            };
            // Key=value parser: handles unquoted and "quoted" values
            function parseKVPairs(str) {
              const fields = {};
@@ -450,7 +426,7 @@ jobs:
                  while (pos < str.length && !/\s/.test(str[pos])) pos++;
                  value = str.substring(valStart, pos);
                }
-                fields[KEY_ALIASES[key.toLowerCase()] || key] = value;
+                fields[key] = value;
              }
              return fields;
            }
@@ -1006,8 +982,6 @@ jobs:
                disable_message:  'string',
                is_deleted:       'boolean',
                deleted_message:  'string',
                pin_reason:       'string',
                last_update_commit: 'string',
              };
              const parsedFields = parseKVPairs(rest);
@@ -2,8 +2,7 @@ name: PR test command
 # Posts a ready-to-run test command for reviewers.
 # It uses this PR’s script branch with the production engine, since both resolve
-# independently. ct/ scripts need community-scripts/core; vm/, tools/ and
+# independently. Only scripts using community-scripts/core are supported.
 # turnkey/ scripts run straight from the branch.
 #
 # pull_request_target allows comments on fork PRs. No PR code is checked out or
 # executed; API inputs are validated and the comment is assembled in JavaScript.
@@ -15,9 +14,6 @@ on:
    paths:
      - "ct/**"
      - "install/**"
      - "vm/**"
      - "tools/**"
      - "turnkey/**"
 jobs:
  comment:
@@ -54,43 +50,14 @@ jobs:
            // ct/foo.sh and install/foo-install.sh are the same app. A removed
            // file has nothing left to run.
            const apps = new Map();               // slug -> {ct, install}
            const others = [];
            for (const f of files) {
              if (f.status === 'removed') continue;
              let m = f.filename.match(/^ct\/([a-z0-9][a-z0-9._-]*)\.sh$/);
              if (m) { apps.set(m[1], { ...apps.get(m[1]), ct: true }); continue; }
              m = f.filename.match(/^install\/([a-z0-9][a-z0-9._-]*)-install\.sh$/);
-              if (m) { apps.set(m[1], { ...apps.get(m[1]), install: true }); continue; }
+              if (m) apps.set(m[1], { ...apps.get(m[1]), install: true });
              if (/^(vm|tools|turnkey)\/[A-Za-z0-9._\/-]+\.sh$/.test(f.filename)) others.push(f.filename);
            }
-            if (apps.size === 0 && others.length === 0) return;
+            if (apps.size === 0) return;
            others.sort();
            // Where a tool runs is read from the script itself; it is never run.
            const HOST = /(^|[\s;&|(`$])(pct|qm|pveam|pvesm|pvesh|pveversion)\s/m;
            async function runsOn(path) {
              if (path.startsWith('vm/')) return 'pve';
              const appliance = (path.split('/').pop().match(/(?:^|-)(pbs|pmg|pdm)(?=[0-9-]|\.sh$)/) || [])[1];
              if (path.startsWith('tools/pve/')) return appliance || 'pve';
              let text = '';
              try {
                const res = await github.rest.repos.getContent({
                  owner: head.owner.login, repo: head.name, path, ref: pr.head.sha,
                });
                text = Buffer.from(res.data.content || '', 'base64').toString('utf8');
              } catch (e) {}
              if (HOST.test(text.replace(/^\s*#.*$/gm, '').replace(/command -v \S+/g, ''))) return 'pve';
              if (appliance) return appliance;
              return path.startsWith('tools/addon/') ? 'guest' : 'unknown';
            }
            const WHERE = {
              pve: 'in the Proxmox VE shell',
              guest: 'inside the LXC or VM that should get it',
              pbs: 'in the Proxmox Backup Server shell',
              pmg: 'in the Proxmox Mail Gateway shell',
              pdm: 'in the Proxmox Datacenter Manager shell',
              unknown: 'wherever the script is meant to run',
            };
            // Read the ct script at the PR head to see which engine it loads.
            // Read only -- it is never sourced or run.
@@ -144,9 +111,10 @@ jobs:
                );
              }
              lines.push(
-                'Both lines are needed. Without `COMMUNITY_SCRIPTS_URL` the engine falls back to',
+                'Both lines are needed. Each script pins `_CS_DEFAULT_URL` to `main`, and that',
-                '`main`, so curling the branch URL on its own gives you the `ct/` script from',
+                'pin is what fills `COMMUNITY_SCRIPTS_URL` when the variable is unset — so',
-                'this PR and the `install/` script from `main`. Frequently the one you meant to test.',
+                'curling the branch URL on its own gives you the `ct/` script from this PR and',
                'the `install/` script from `main`. Frequently the one you meant to test.',
                '',
                'The same command works on an Incus host: the engine detects the platform and',
                'loads the matching backend, while the scripts still come from this branch.',
@@ -165,30 +133,6 @@ jobs:
              );
            }
            if (others.length > 0) {
              const shown = others.slice(0, MAX_APPS);
              lines.push(...(ready.length > 0 ? ['', '---', ''] : ['### Try this branch', '']));
              for (const path of shown) {
                lines.push(
                  `\`${path}\`, run ${WHERE[await runsOn(path)]}:`,
                  '```bash',
                  `bash -c "$(curl -fsSL "${base}/${path}")"`,
                  '```',
                  '',
                );
              }
              if (others.length > shown.length) {
                lines.push(
                  `${others.length - shown.length} more script(s) changed; same command, different path.`,
                  '',
                );
              }
              lines.push(
                'Only the script itself comes from this branch. Whatever it loads, the engine',
                'or the `misc/` helpers, still comes from `main`.',
              );
            }
            if (legacy.length > 0) {
              lines.push(
                '',
@@ -22,9 +22,7 @@ generate_headers() {
  for script in "${file_list[@]}"; do
    [[ -f "$script" ]] || continue
-    # -m1: a script that sets APP twice (the second carrying ${var_version})
+    app_name=$(grep -oP '^APP="\K[^"]+' "$script" 2>/dev/null)
    # otherwise yields both lines, and the filename gets a newline in it.
    app_name=$(grep -m1 -oP '^APP="\K[^"]+' "$script" 2>/dev/null)
    if [[ -n "$app_name" ]]; then
      # core.func/vm-core.func look the header up as "${APP,,}" without spaces,
      # so the generated file has to be named after APP - not after the script.
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -32,7 +33,7 @@ function update_script() {
  fi
  setup_mariadb
  if check_for_gh_release "2fauth" "Bubka/2FAuth"; then
-    apt_update_safe
+    $STD apt update
    $STD apt -y upgrade
    msg_info "Creating Backup"
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 tteck
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 tteck
@@ -54,8 +55,9 @@ function update_script() {
      $STD uv venv --clear .venv
      $STD .venv/bin/python -m ensurepip --upgrade
    fi
-    $STD uv pip install --python .venv/bin/python -r requirements.txt
+    $STD .venv/bin/python -m pip install --upgrade pip
-    $STD uv pip install --python .venv/bin/python 'djangorestframework<3.15'
+    $STD .venv/bin/python -m pip install -r requirements.txt
    $STD .venv/bin/python -m pip install 'djangorestframework<3.15'
    $STD .venv/bin/python -m manage collectstatic --noinput
    $STD .venv/bin/python -m manage migrate
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 tteck
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -39,7 +40,6 @@ function update_script() {
    cp -r /tmp/dist/* /usr/share/nginx/html
    rm -rf /tmp/dist
    rm -f it-tools.zip
    echo "${RELEASE}" >/opt/${APP}_version.txt
    msg_ok "Updated successfully!"
  else
    msg_ok "No update required. ${APP} is already at ${RELEASE}"
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 tteck
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 tteck
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,65 +0,0 @@
 #!/usr/bin/env bash
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://docs.ankiweb.net/sync-server.html
 APP="Anki-Sync-Server"
 var_tags="${var_tags:-anki;flashcards;sync}"
 var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-512}"
 var_disk="${var_disk:-4}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 header_info "$APP"
 variables
 color
 catch_errors
 function update_script() {
  header_info
  check_container_storage
  check_container_resources
  if [[ ! -f /opt/anki-sync-server/.env ]]; then
    msg_error "No ${APP} Installation Found!"
    exit
  fi
  if check_for_gh_release "anki-sync-server" "ankitects/anki"; then
    msg_info "Stopping Service"
    systemctl stop anki-sync-server
    msg_ok "Stopped Service"
    create_backup /opt/anki-sync-server/.env /opt/anki-sync-server/data
    msg_info "Updating Anki Sync Server"
    $STD uv pip install --python /opt/anki-sync-server/venv/bin/python "anki==$(get_latest_github_release "ankitects/anki")"
    cat <<EOF >~/.anki-sync-server
 $(get_latest_github_release "ankitects/anki")
 EOF
    msg_ok "Updated Anki Sync Server"
    restore_backup
    msg_info "Starting Service"
    systemctl start anki-sync-server
    msg_ok "Started Service"
    msg_ok "Updated successfully!"
  fi
  exit
 }
 start
 build_container
 description
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
 echo -e "${GATEWAY}${BGN}http://${IP}:8080${CL}"
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 tteck
@@ -30,7 +31,7 @@ function update_script() {
    exit
  fi
  msg_info "Updating Apache Cassandra"
-  apt_update_safe
+  $STD apt update
  $STD apt install -y --only-upgrade cassandra cassandra-tools
  msg_ok "Updated Apache Cassandra"
  msg_ok "Updated successfully!"
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 tteck
@@ -30,7 +31,7 @@ function update_script() {
    exit
  fi
  msg_info "Updating Apache CouchDB"
-  apt_update_safe
+  $STD apt-get update
  $STD apt-get install -y --only-upgrade couchdb
  msg_ok "Updated Apache CouchDB"
  msg_ok "Updated successfully!"
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 tteck
@@ -30,7 +31,7 @@ function update_script() {
    exit
  fi
  msg_info "Updating Apt-Cacher-NG"
-  apt_update_safe
+  $STD apt update
  $STD apt -y upgrade
  msg_ok "Updated Apt-Cacher-NG"
  msg_ok "Updated successfully!"
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 tteck
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 tteck
@@ -30,7 +31,7 @@ function update_script() {
    exit
  fi
  msg_info "Updating Aria2"
-  apt_update_safe
+  $STD apt update
  $STD apt -y upgrade
  msg_ok "Updated Aria2"
  msg_ok "Updated successfully!"
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 tteck
@@ -31,7 +32,7 @@ function update_script() {
  fi
  msg_info "Updating AudiobookShelf"
-  apt_update_safe
+  $STD apt update
  $STD apt upgrade -y
  msg_ok "Updated AudiobookShelf"
  msg_ok "Updated successfully!"
@@ -1,82 +0,0 @@
 #!/usr/bin/env bash
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://github.com/NeptuneHub/AudioMuse-AI
 APP="AudioMuse-AI"
 var_tags="${var_tags:-music;ai}"
 var_cpu="${var_cpu:-4}"
 var_ram="${var_ram:-8192}"
 var_disk="${var_disk:-20}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
 #var_arm64="${var_arm64:-no}"
 var_unprivileged="${var_unprivileged:-1}"
 header_info "$APP"
 variables
 color
 catch_errors
 function update_script() {
  header_info
  check_container_storage
  check_container_resources
  if [[ ! -d /opt/audiomuse-ai ]]; then
    msg_error "No ${APP} Installation Found!"
    exit
  fi
  if check_for_gh_release "audiomuse-ai" "NeptuneHub/AudioMuse-AI"; then
    msg_info "Stopping Services"
    systemctl stop audiomuse-ai audiomuse-ai-worker audiomuse-ai-worker-high audiomuse-ai-janitor audiomuse-ai-control
    msg_ok "Stopped Services"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "audiomuse-ai" "NeptuneHub/AudioMuse-AI" "tarball"
    AUDIOMUSE_BACKEND="$(cat /opt/audiomuse-ai_data/.backend 2>/dev/null || echo cpu)"
    REQ_COMMON="common.txt"
    PY_VERSION="3.12"
    case "$AUDIOMUSE_BACKEND" in
    gpu)
      REQ_ACCEL="gpu.txt"
      [[ "$(uname -m)" == "aarch64" ]] && REQ_ACCEL="gpu-arm64.txt"
      ;;
    cpu-noavx2)
      REQ_COMMON="common-noavx2.txt"
      REQ_ACCEL="cpu-noavx2.txt"
      PY_VERSION="3.11"
      ;;
    *)
      REQ_ACCEL="cpu.txt"
      ;;
    esac
    msg_info "Updating Python Environment (${AUDIOMUSE_BACKEND})"
    cd /opt/audiomuse-ai
    $STD uv venv --seed --python "$PY_VERSION" /opt/audiomuse-ai/.venv
    $STD uv pip install --python /opt/audiomuse-ai/.venv \
      -r "/opt/audiomuse-ai/requirements/${REQ_COMMON}" \
      -r "/opt/audiomuse-ai/requirements/${REQ_ACCEL}"
    msg_ok "Updated Python Environment (${AUDIOMUSE_BACKEND})"
    msg_info "Starting Services"
    systemctl start audiomuse-ai audiomuse-ai-worker audiomuse-ai-worker-high audiomuse-ai-janitor audiomuse-ai-control
    msg_ok "Started Services"
    msg_ok "Updated successfully!"
  fi
  exit
 }
 start
 build_container
 description
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
 echo -e "${GATEWAY}${BGN}http://${IP}:8000${CL}"
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -37,16 +38,13 @@ function update_script() {
    msg_ok "Stopped Service"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "aurral" "lklynet/aurral" "tarball"
-    NODE_VERSION="26" setup_nodejs
+    NODE_VERSION="22" setup_nodejs
    msg_info "Updating Aurral"
    cd /opt/aurral
    export VITE_APP_VERSION="$(cat ~/.aurral)"
    export VITE_GITHUB_REPO="lklynet/aurral"
    export VITE_RELEASE_CHANNEL="stable"
    # aurral's .npmrc sets engine-strict=true and pins an exact node patch (e.g. 26.8.x),
    # which NodeSource can't match since it only ships the latest patch per major.
    export npm_config_engine_strict=false
    $STD npm ci --workspace frontend --include-workspace-root=false
    $STD npm run build --workspace frontend
    $STD npm ci --workspace backend --omit=dev --include=optional --include-workspace-root=false
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -33,7 +34,7 @@ function update_script() {
  fi
  if check_for_gh_release "authelia" "authelia/authelia"; then
-    apt_update_safe
+    $STD apt update
    $STD apt -y upgrade
    fetch_and_deploy_gh_release "authelia" "authelia/authelia" "binary"
    msg_ok "Updated successfully!"
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -42,12 +43,13 @@ function update_script() {
  ensure_dependencies crossbuild-essential-$(arch_resolve) gcc-$(arch_resolve "x86-64" "aarch64")-linux-gnu cmake clang libunwind-18-dev
  msg_ok "Update dependencies"
-  NODE_VERSION="26" NODE_MODULE=pnpm@12 setup_nodejs
+  NODE_VERSION="26" NODE_MODULE=pnpm@11 setup_nodejs
  $STD uv cache clean
  UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.7" setup_uv
  RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
  setup_yq
-  AUTHENTIK_VERSION="version/2026.8.3"
+  AUTHENTIK_VERSION="version/2026.8.0"
  # Source: https://github.com/goauthentik/fips/blob/main/Makefile#L26
  XMLSEC_VERSION="1.3.12"
@@ -82,18 +84,7 @@ function update_script() {
    fi
    msg_ok "Stopped Services"
    if [[ ! -d /opt/authentik-data/blueprints ]]; then
      msg_info "Moving blueprints to presistent directory"
      cp -r /opt/authentik/blueprints /opt/authentik-data/
      rm -r /opt/authentik/blueprints
      $STD find /opt/authentik-data -path '*/lost+found' -prune -o -exec chown authentik:authentik {} +
      yq -i ".blueprints_dir = \"/opt/authentik-data/blueprints\"" /etc/authentik/config.yml
      msg_ok "blueprints moved to presistent directory"
      msg_warn "The blueprints provided by authentik are always overwritten when updated! Only manually created custom blueprints remain unchanged between updates."
    fi
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
    UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.7" UV_PROJECT_DIR="/opt/authentik" setup_uv
    GO_VERSION="$(grep -m1 '^go ' /opt/authentik/go.mod | awk '{print $2}')" setup_go
    msg_info "Configuring rust"
@@ -105,7 +96,7 @@ function update_script() {
    msg_info "Updating web"
    export NODE_ENV="production"
 	  cd /opt/authentik
-	  $STD node ./scripts/node/lint-runtime.ts ./web
+	  $STD node ./scripts/node/lint-runtime.mjs ./web
 	  cd /opt/authentik/web
 	  $STD pnpm install --frozen-lockfile
 	  $STD pnpm run build
@@ -152,44 +143,22 @@ function update_script() {
    chown -R authentik:authentik /opt/authentik
    msg_ok "Updated python server"
-    cp -r /opt/authentik/blueprints /opt/authentik-data/
+	  msg_info "Updating Worker and Server config"
    rm -r /opt/authentik/blueprints
    $STD find /opt/authentik-data -path '*/lost+found' -prune -o -exec chown authentik:authentik {} +
    if [[ $MAJOR == 2026 && $MINOR -lt 8 ]]; then
 	    msg_info "Updating Worker and Server config (from $MAJOR.$MINOR)"
    cat <<EOF >>/etc/default/authentik-server
 RUST_BACKTRACE=full
 EOF
    cat <<EOF >>/etc/default/authentik-worker
 RUST_BACKTRACE=full
 EOF
-      msg_ok "Updated Worker and Server config (from $MAJOR.$MINOR)"
+    msg_ok "Updated Worker and Server config!"
-      msg_info "Updating services (from $MAJOR.$MINOR)"
+    msg_info "Updating services"
 	  sed -i "s|ExecStart=/opt/authentik/authentik-server|ExecStart=/opt/authentik/bin/authentik server|g" /etc/systemd/system/authentik-server.service
 	  sed -i "s|ExecStart=/opt/authentik/authentik-worker worker|ExecStart=/opt/authentik/bin/authentik worker|g" /etc/systemd/system/authentik-worker.service
 	  sed -i "s|ExecStart=/opt/authentik/ldap|ExecStart=/opt/authentik/bin/ldap|g" /etc/systemd/system/authentik-ldap.service
 	  sed -i "s|ExecStart=/opt/authentik/radius|ExecStart=/opt/authentik/bin/radius|g" /etc/systemd/system/authentik-radius.service
 	  sed -i "s|ExecStart=/opt/authentik/rac|ExecStart=/opt/authentik/bin/rac|g" /etc/systemd/system/authentik-rac.service
    systemctl daemon-reload
      msg_ok "Updated services (from $MAJOR.$MINOR)"
    fi
    msg_info "Updating Worker and Server config"
    sed -i "s|/dev/shm\/\?$|/dev/shm/authentik-server|g" /etc/default/authentik-server
 	  sed -i "s|/dev/shm\/\?$|/dev/shm/authentik-worker|g" /etc/default/authentik-worker
    msg_ok "Updated Worker and Server config"
    msg_info "Updating services"
    sed -i 's/authentik Go Server (API Gateway)/authentik Server/g' /etc/systemd/system/authentik-server.service
    if ! grep -qF -- 'ExecStartPre=/usr/bin/mkdir -p "${TMPDIR}"' /etc/systemd/system/authentik-server.service; then
 	    sed -i '/ExecStart=/i ExecStartPre=/usr/bin/mkdir -p "${TMPDIR}"' /etc/systemd/system/authentik-server.service
    fi
    if ! grep -qF -- 'ExecStartPre=/usr/bin/mkdir -p "${TMPDIR}"' /etc/systemd/system/authentik-worker.service; then
      sed -i '/ExecStart=/i ExecStartPre=/usr/bin/mkdir -p "${TMPDIR}"' /etc/systemd/system/authentik-worker.service
    fi
    systemctl daemon-reload
    msg_ok "Updated services"
  	msg_info "Starting Services"
@@ -227,11 +196,10 @@ for i in {1..10}; do
  sleep 1
 done
 $STD pct exec "$CTID" -- bash -c "mkdir -p /opt/authentik-data/{certs,media,geoip,templates}; \
-  cp /opt/authentik/tests/geoip/GeoLite2-ASN-Test.mmdb /opt/authentik-data/geoip/GeoLite2-ASN.mmdb; \
+  cp /opt/authentik/tests/GeoLite2-ASN-Test.mmdb /opt/authentik-data/geoip/GeoLite2-ASN.mmdb; \
-  cp /opt/authentik/tests/geoip/GeoLite2-City-Test.mmdb /opt/authentik-data/geoip/GeoLite2-City.mmdb; \
+  cp /opt/authentik/tests/GeoLite2-City-Test.mmdb /opt/authentik-data/geoip/GeoLite2-City.mmdb; \
-  cp -r /opt/authentik/blueprints /opt/authentik-data/; \
+  chown authentik:authentik /opt/authentik-data; \
-  rm -r /opt/authentik/blueprints; \
+  chown -R authentik:authentik /opt/authentik-data/{certs,media,geoip,templates}"
  find /opt/authentik-data -path '*/lost+found' -prune -o -exec chown authentik:authentik {} +"
 msg_ok "Attached data storage volume"
 msg_info "Starting Services"
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 tteck
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -30,6 +31,8 @@ function update_script() {
    exit
  fi
  setup_uv
  RELEASE=$(get_latest_codeberg_release "gelbphoenix/autocaliweb")
  if check_for_codeberg_release "autocaliweb" "gelbphoenix/autocaliweb"; then
    msg_info "Stopping Services"
@@ -40,7 +43,6 @@ function update_script() {
    export VIRTUAL_ENV="${INSTALL_DIR}/venv"
    $STD tar -cf ~/autocaliweb_bkp.tar "$INSTALL_DIR"/{metadata_change_logs,dirs.json,.env,scripts/ingest_watcher.sh,scripts/auto_zipper_wrapper.sh,scripts/metadata_change_detector_wrapper.sh}
    fetch_and_deploy_codeberg_release "autocaliweb" "gelbphoenix/autocaliweb" "tarball" "latest" "/opt/autocaliweb"
    setup_uv $INSTALL_DIR
    msg_info "Updating Autocaliweb"
    cd "$INSTALL_DIR" 
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -38,7 +39,6 @@ function update_script() {
    create_backup /opt/baserow/.env
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "baserow" "baserow/baserow" "tarball"
    UV_PROJECT_DIR="/opt/baserow/backend" setup_uv
    restore_backup
    msg_info "Configuring Baserow"
@@ -48,7 +48,7 @@ function update_script() {
    msg_info "Rebuilding Frontend"
    cd /opt/baserow/web-frontend
-    $STD npm install --allow-remote=all
+    $STD npm install
    $STD npm run build
    msg_ok "Rebuilt Frontend"
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 tteck
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -39,7 +40,6 @@ function update_script() {
    create_backup /opt/beaverhabits/.user
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "beaverhabits" "daya0576/beaverhabits" "tarball"
    PYTHON_VERSION="3.14" UV_PROJECT_DIR="/opt/beaverhabits" setup_uv
    msg_info "Syncing Dependencies"
    cd /opt/beaverhabits
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -43,7 +44,7 @@ function update_script() {
    msg_info "Configuring BentoPDF"
    cd /opt/bentopdf
-    $STD npm ci --no-audit --no-fund --allow-remote=all
+    $STD npm ci --no-audit --no-fund
    export NODE_OPTIONS="--max-old-space-size=3072"
    export SIMPLE_MODE=true
    export VITE_USE_CDN=true
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 tteck
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,150 +0,0 @@
 #!/usr/bin/env bash
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://github.com/karanhudia/borg-ui
 APP="Borg-UI"
 var_tags="${var_tags:-backup}"
 var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-4096}"
 var_disk="${var_disk:-10}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
 #var_arm64="${var_arm64:-no}"
 var_unprivileged="${var_unprivileged:-1}"
 header_info "$APP"
 variables
 color
 catch_errors
 function update_script() {
  header_info
  check_container_storage
  check_container_resources
  if [[ ! -d /opt/borg-ui ]]; then
    msg_error "No ${APP} Installation Found!"
    exit
  fi
  local changed=0
  if check_for_gh_release "borg-ui" "karanhudia/borg-ui"; then
    changed=1
    msg_info "Stopping Service"
    systemctl stop borg-ui
    msg_ok "Stopped Service"
    create_backup /opt/borg-ui/.env
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "borg-ui" "karanhudia/borg-ui" "tarball"
    restore_backup
    BORG_UI_VERSION=$(cat "$HOME/.borg-ui" 2>/dev/null)
    if [[ -n "$BORG_UI_VERSION" ]]; then
      if grep -q '^APP_VERSION=' /opt/borg-ui/.env; then
        sed -i "s|^APP_VERSION=.*|APP_VERSION=${BORG_UI_VERSION}|" /opt/borg-ui/.env
      else
        echo "APP_VERSION=${BORG_UI_VERSION}" >>/opt/borg-ui/.env
      fi
    fi
    # Only the three Borg pins appear in every release of this file; PYTHON_VERSION
    # and RCLONE_VERSION were added upstream after v2.2.6, so both fall back.
    RUNTIME_ENV="/opt/borg-ui/docker/runtime-base.env"
    BORG1_VERSION=$(sed -n 's/^BORG1_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
    BORG2_VERSION=$(sed -n 's/^BORG2_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
    BORGSTORE_VERSION=$(sed -n 's/^BORGSTORE_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
    RCLONE_VERSION=$(sed -n 's/^RCLONE_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
    BORG_PYTHON=$(sed -n 's/^PYTHON_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
    BORG_PYTHON="${BORG_PYTHON:-3.12}"
    if [[ -z "$BORG1_VERSION" || -z "$BORG2_VERSION" || -z "$BORGSTORE_VERSION" ]]; then
      msg_error "Could not read the pinned Borg versions from ${RUNTIME_ENV}"
      exit 1
    fi
    if [[ "$(cat /opt/borg1-venv/.pinned_version 2>/dev/null)" != "$BORG1_VERSION" ]]; then
      msg_info "Installing Borg ${BORG1_VERSION} (Patience)"
      $STD uv venv --python "$BORG_PYTHON" /opt/borg1-venv
      $STD uv pip install --python /opt/borg1-venv pyfuse3 "borgbackup==${BORG1_VERSION}"
      echo "$BORG1_VERSION" >/opt/borg1-venv/.pinned_version
      ln -sf /opt/borg1-venv/bin/borg /usr/local/bin/borg
      msg_ok "Installed Borg ${BORG1_VERSION}"
    fi
    if [[ "$(cat /opt/borg2-venv/.pinned_version 2>/dev/null)" != "${BORG2_VERSION}-${BORGSTORE_VERSION}" ]]; then
      msg_info "Installing Borg ${BORG2_VERSION} (Patience)"
      $STD uv venv --python "$BORG_PYTHON" /opt/borg2-venv
      $STD uv pip install --python /opt/borg2-venv pyfuse3 "borgbackup==${BORG2_VERSION}" "borgstore[rclone,sftp,rest,s3,blake3]==${BORGSTORE_VERSION}"
      echo "${BORG2_VERSION}-${BORGSTORE_VERSION}" >/opt/borg2-venv/.pinned_version
      ln -sf /opt/borg2-venv/bin/borg /usr/local/bin/borg2
      msg_ok "Installed Borg ${BORG2_VERSION}"
    fi
    RCLONE_TAG="${RCLONE_VERSION:+v${RCLONE_VERSION}}"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "rclone" "rclone/rclone" "prebuild" "${RCLONE_TAG:-latest}" "/opt/rclone" "rclone-${RCLONE_TAG:-*}-linux-$(arch_resolve amd64 arm64).zip"
    ln -sf /opt/rclone/rclone /usr/local/bin/rclone
    msg_info "Building Frontend"
    cd /opt/borg-ui/frontend
    $STD npm ci
    $STD npm run build
    rm -rf /opt/borg-ui/app/static
    mkdir -p /opt/borg-ui/app/static
    cp -r /opt/borg-ui/frontend/build/* /opt/borg-ui/app/static/
    msg_ok "Built Frontend"
    msg_info "Updating Python Environment"
    cd /opt/borg-ui
    $STD uv venv --python "$BORG_PYTHON" /opt/borg-ui/.venv
    $STD uv pip install --python /opt/borg-ui/.venv -r requirements.txt
    msg_ok "Updated Python Environment"
  fi
  if [[ -f /opt/borg-ui/packaging/native/start.sh ]] && ! grep -q 'packaging/native/start.sh' /etc/systemd/system/borg-ui.service; then
    msg_info "Switching Service to the upstream start script"
    cat <<EOF >/etc/systemd/system/borg-ui.service
 [Unit]
 Description=Borg-UI
 Wants=network-online.target
 After=network-online.target
 [Service]
 Type=simple
 User=root
 WorkingDirectory=/opt/borg-ui
 EnvironmentFile=/opt/borg-ui/.env
 Environment=BORG_UI_VENV=/opt/borg-ui/.venv
 ExecStart=/bin/bash /opt/borg-ui/packaging/native/start.sh
 Restart=on-failure
 RestartSec=5
 [Install]
 WantedBy=multi-user.target
 EOF
    systemctl daemon-reload
    msg_ok "Switched Service to the upstream start script"
    changed=1
  fi
  if [[ "$changed" == 1 ]]; then
    msg_info "Starting Service"
    systemctl restart borg-ui
    msg_ok "Started Service"
    msg_ok "Updated successfully!"
  fi
  exit
 }
 start
 build_container
 description
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
 echo -e "${GATEWAY}${BGN}http://${IP}:8081${CL}"
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 tteck
@@ -38,7 +39,7 @@ Package: bunkerweb
 Pin: version ${RELEASE}
 Pin-Priority: 1001
 EOF
-    apt_update_safe
+    $STD apt update
    $STD apt-mark unhold bunkerweb nginx
    $STD apt install -y --allow-downgrades bunkerweb="${RELEASE}"
    msg_ok "Updated BunkerWeb"
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -36,7 +37,6 @@ function update_script() {
    msg_ok "Stopped Service"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Byparr" "ThePhaseless/Byparr" "tarball" "latest"
    UV_PROJECT_DIR="/opt/Byparr" setup_uv
    if ! dpkg -l | grep -q ffmpeg; then
      msg_info "Installing dependencies"
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 tteck
@@ -39,7 +40,7 @@ update_deb_based() {
  fi
  msg_info "Updating Caddy LXC"
-  apt_update_safe
+  $STD apt update
  $STD apt upgrade -y
  msg_ok "Updated Caddy LXC"
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -31,18 +32,14 @@ function update_script() {
    exit
  fi
-  if [[ -f /root/.calibre-web && ! -e /root/.calibreweb ]]; then
+  if check_for_gh_release "Calibre-Web" "janeczku/calibre-web"; then
    mv /root/.calibre-web /root/.calibreweb
  fi
  if check_for_gh_release "calibreweb" "janeczku/calibre-web"; then
    msg_info "Stopping Service"
    systemctl stop calibre-web
    msg_ok "Stopped Service"
    create_backup /opt/calibre-web/data
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "calibreweb" "janeczku/calibre-web" "prebuild" "latest" "/opt/calibre-web" "calibreweb*.tar.gz"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Calibre-Web" "janeczku/calibre-web" "prebuild" "latest" "/opt/calibre-web" "calibreweb*.tar.gz"
    setup_uv
    msg_info "Installing Dependencies"
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 tteck
@@ -30,7 +31,7 @@ function update_script() {
    exit
  fi
  msg_info "Updating ${APP} LXC"
-  apt_update_safe
+  $STD apt-get update
  $STD apt-get -y upgrade
  msg_ok "Updated ${APP} LXC"
  msg_ok "Updated successfully!"
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 tteck
@@ -31,18 +32,7 @@ function update_script() {
    exit
  fi
-  ensure_dependencies libjpeg-dev poppler-utils file locales
+  ensure_dependencies libjpeg-dev
  msg_info "Generating Locales"
  for l in cs_CZ de_DE en_GB en_US es_ES fr_FR id_ID it_IT ja_JP ko_KR \
    pl_PL pt_BR ru_RU tr_TR uk_UA zh_CN zh_TW; do
    sed -i "s/^# *${l}.UTF-8 UTF-8/${l}.UTF-8 UTF-8/" /etc/locale.gen
  done
  $STD locale-gen
  if ! grep -q "^LC_ALL=" /opt/changedetection/.env 2>/dev/null; then
    echo "LC_ALL=en_US.UTF-8" >>/opt/changedetection/.env
  fi
  msg_ok "Generated Locales"
  NODE_VERSION="24" setup_nodejs
@@ -56,11 +46,12 @@ function update_script() {
    rm -rf "$VENV_PATH"
    $STD uv venv --clear "$VENV_PATH"
    $STD "$VENV_PATH/bin/python" -m ensurepip --upgrade
-    $STD uv pip install --python "$VENV_PATH/bin/python" changedetection.io playwright
+    $STD "$VENV_PATH/bin/python" -m pip install --upgrade pip
    $STD "$VENV_PATH/bin/python" -m pip install changedetection.io playwright
    msg_ok "Migrated to uv/venv"
  else
    msg_info "Updating ${APP}"
-    $STD uv pip install --python "$VENV_PATH/bin/python" --upgrade changedetection.io playwright
+    $STD "$VENV_PATH/bin/python" -m pip install --upgrade changedetection.io playwright
    msg_ok "Updated ${APP}"
  fi
@@ -78,7 +69,6 @@ function update_script() {
    $STD git -C /opt/browserless/ reset --hard origin/main
    $STD npm update --prefix /opt/browserless
    $STD npm ci --include=optional --include=dev --prefix /opt/browserless
    $STD npm install --save-exact playwright-core@1.62.1 --prefix /opt/browserless
    $STD /opt/browserless/node_modules/playwright-core/cli.js install --with-deps
    # Update Chrome separately, as it has to be done with the force option. Otherwise the installation of other browsers will not be done if Chrome is already installed.
    $STD /opt/browserless/node_modules/playwright-core/cli.js install --force chrome
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 tteck
@@ -1,75 +0,0 @@
 #!/usr/bin/env bash
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://www.chatwoot.com/
 APP="Chatwoot"
 var_tags="${var_tags:-support;chat;helpdesk;crm}"
 var_cpu="${var_cpu:-4}"
 var_ram="${var_ram:-6144}"
 var_disk="${var_disk:-16}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
 var_arm64="${var_arm64:-no}"
 var_unprivileged="${var_unprivileged:-1}"
 header_info "$APP"
 variables
 color
 catch_errors
 function update_script() {
  header_info
  check_container_storage
  check_container_resources
  if [[ ! -f /opt/chatwoot/.env ]]; then
    msg_error "No ${APP} Installation Found!"
    exit
  fi
  if check_for_gh_release "chatwoot" "chatwoot/chatwoot"; then
    msg_info "Stopping Services"
    systemctl stop chatwoot-web chatwoot-worker
    msg_ok "Stopped Services"
    create_backup /opt/chatwoot/.env /opt/chatwoot/storage
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "chatwoot" "chatwoot/chatwoot" "tarball"
    RUBY_VERSION=$(tr -d ' \n' </opt/chatwoot/.ruby-version)
    RUBY_VERSION="${RUBY_VERSION}" RUBY_INSTALL_RAILS="false" setup_ruby
    NODE_VERSION=$(tr -d ' \n' </opt/chatwoot/.nvmrc)
    NODE_VERSION="${NODE_VERSION}" NODE_MODULE="pnpm" setup_nodejs
    export PATH="$HOME/.rbenv/shims:$HOME/.rbenv/bin:$PATH"
    restore_backup
    msg_info "Updating Application"
    cd /opt/chatwoot
    $STD bundle config set --local without 'development test'
    $STD bundle config set --local deployment 'true'
    $STD bundle install
    $STD pnpm install --frozen-lockfile
    RAILS_ENV=production $STD bundle exec rails db:chatwoot_prepare
    RAILS_ENV=production $STD bundle exec rails assets:precompile
    msg_ok "Updated Application"
    msg_info "Starting Services"
    systemctl start chatwoot-web chatwoot-worker
    msg_ok "Started Services"
    msg_ok "Updated successfully!"
  fi
  exit
 }
 start
 build_container
 description
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
 echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,72 +0,0 @@
 #!/usr/bin/env bash
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://chevereto.com/
 APP="Chevereto"
 var_tags="${var_tags:-image-hosting;gallery;media}"
 var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-10}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 header_info "$APP"
 variables
 color
 catch_errors
 function update_script() {
  header_info
  check_container_storage
  check_container_resources
  if [[ ! -d /opt/chevereto ]]; then
    msg_error "No ${APP} Installation Found!"
    exit
  fi
  if check_for_gh_release "chevereto" "chevereto/chevereto"; then
    PHP_FPM_SERVICE="$(basename "$(get_php_fpm_socket)" .sock)"
    msg_info "Stopping Services"
    systemctl stop nginx "$PHP_FPM_SERVICE"
    msg_ok "Stopped Services"
    create_backup /opt/chevereto/app/env.php \
      /opt/chevereto/images \
      /opt/chevereto/content
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "chevereto" "chevereto/chevereto" "tarball"
    restore_backup
    msg_info "Updating Chevereto"
    cd /opt/chevereto/app
    export COMPOSER_ALLOW_SUPERUSER=1
    $STD composer install --no-dev --prefer-dist --no-interaction --optimize-autoloader
    chown -R www-data:www-data /opt/chevereto
    chmod -R 775 /opt/chevereto/images /opt/chevereto/content
    msg_ok "Updated Chevereto"
    msg_info "Starting Services"
    systemctl start "$PHP_FPM_SERVICE" nginx
    msg_ok "Started Services"
    msg_ok "Updated successfully!"
  fi
  exit
 }
 start
 build_container
 description
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
 echo -e "${GATEWAY}${BGN}http://${IP}${CL}"
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -8,8 +9,8 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 APP="Cloudflare-DDNS"
 var_tags="${var_tags:-network}"
-var_cpu="${var_cpu:-1}"
+var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-512}"
+var_ram="${var_ram:-1024}"
 var_disk="${var_disk:-3}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 tteck
@@ -30,7 +31,7 @@ function update_script() {
    exit
  fi
  msg_info "Updating $APP LXC"
-  apt_update_safe
+  $STD apt update
  $STD apt -y upgrade
  msg_ok "Updated $APP LXC"
  msg_ok "Updated successfully!"
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 tteck
@@ -31,7 +32,7 @@ function update_script() {
  fi
  msg_info "Updating ${APP} LXC"
-  apt_update_safe
+  $STD apt update
  $STD apt -y upgrade
  msg_ok "Updated ${APP} LXC"
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 tteck
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 _CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
--- a/Show More
+++ b/Show More