The ExecStart migration only ran when ~/.authentik reported a version
below 2026.8. Installs whose marker already reads 2026.8.x but whose
units were never migrated kept pointing to the removed
/opt/authentik/authentik-server binary and failed with 203/EXEC.
Also run the migration when the server unit still has the old path.
Fixes#18306
Since Dawarich 1.15.1 the importmap pins maplibre-gl to
/maplibre/<version>/maplibre-gl.mjs in public/. Debian's nginx
mime.types has no mjs entry, so the vhost served it as
application/octet-stream and browsers refused to load the module:
blank map, map controllers fail.
Add a .mjs location (text/javascript, as Rails serves it upstream) to
the install heredoc, and insert it into existing vhosts from
update_script() before the release check, applied via nginx_enable_site.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(vm/opnsense): increase startup wait from 90 to 180 seconds
* Remove error redirection from bridge interface setup
Should fix :
⠴ Bridge interfaces are being added.update VM 101: -net0 virtio,bridge=vmbr1,macaddr=XX:XX:XX:XX:XX:XX,firewall=0,queues=4
⠙ Bridge interfaces are being added.update VM 101: -net1 virtio,bridge=vmbr0,macaddr=XX:XX:XX:XX:XX:XX,firewall=0,queues=4
✔️ Bridge interfaces have been successfully added.
The A-B refactor (#15075) moved the backup to create_backup but kept the
old hand-written restore, which reads $BACKUP_DIR. Nothing sets it any
more, so the first restore cp failed after the install dir was wiped:
the update aborted with Tomcat stopped and the config left in
/opt/apache-tomcat.backup.
Restore conf and webapps with restore_backup, which also removes the
store. lib gets a store of its own so only the jars the new release lacks
(JDBC drivers and the like) are copied back; restoring it whole would
put the old Tomcat jars over the new ones.
Co-authored-by: Matt Daleo <12395090+mazelado@users.noreply.github.com>
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
The update overlaid the release tarball, so files removed upstream survived. v0.13.1 moved the frontend config into vite.config.ts, and the leftover svelte.config.js fails pnpm build under SvelteKit 3 (config_file_unsupported) after the services are already stopped. Deploy with CLEAN_INSTALL=1, keep backend/server/media in place, and back up both .env files.
The djangorestframework<3.15 pin (#13194) worked around rest_framework.schemas.coreapi, which AdventureLog stopped using in v0.13.0. v0.13.1 requires djangorestframework>=3.18.3,<3.19, so the pin now downgrades DRF below the app's own requirement.
When a merged PR came from a DevScripts migration, the telemetry service
re-attributes that script's DevScripts records. Needs the
TELEMETRY_ADMIN_TOKEN secret; without it the step is skipped.
Stalwart v1.0.0 (26 Oct 2026) ships a new data store layout, so v0.16.x
deployments cannot be upgraded in place. Data has to be copied into a new,
empty v1 store with stalwartlabs/stalwart-migrate, which requires v0.16.27
as its source version and needs an interactive prepare step plus an offline
final cutover.
The update path pulled "latest" and would have swapped the binary for v1 on
existing containers, leaving the mail server unable to start on its old store.
Pin install and update to v0.16.27 instead and surface the reason through
check_for_gh_release. Containers that already pulled v1.0.0 are put back on
v0.16.27 by the next update run.
update_script ran apt upgrade and reported success while MeshCentral stayed on the version it was installed with, so 1.1.x installs never got 1.3.1, which fixes an actively exploited flaw. Compare the installed package with npm and install the newer one. Fixes#18205
mise 2026.10.19 defaults lockfile_mode to generate, which locks every platform during mise install. Immich's mise.toml enables the lockfile, and Java 21.0.2 has no linux-arm64-musl build, so the update failed on any host. Fixes#18236
community-scripts-pr-app[bot]