openwrt-vm and umbrel-os-vm kept the DevScripts base URL when they moved over, and telemetry filed their production runs under DevScripts. The check fails a pull request that adds such a URL to ct, install, vm or tools.
The version came from scraping technitium.com, which failed for some hosts ("Command substitution exited with status 1", 6 runs on 4 hosts in three days) and has no rate-limit fallback. The GitHub release carries the same version and goes through the engine's release lookup.
* fix(caddy): skip the xCaddy test build below 2 GB RAM
The container defaults to 512 MB (256 MB on Alpine), and Go's linker was
killed in xcaddy build: 14 runs on 6 hosts in a week. The build only
produced an unused binary, so below 2 GB xCaddy is installed without it
and a warning says why; install and update alike.
* Change directory to /opt before building xCaddy
The install replaced the file, which dropped JAVA_OPTS with install.data_dir, so creating a tenant failed. The DB settings are now appended, and an update restores the defaults on existing containers. The package upgrade keeps the edited file. Fixes#18483.
The server unpacks its frontend into /tmp/nexterm-sea-*. systemd-tmpfiles removes it after 10 days while the process keeps running, and every page returns 404. Fixes#18488.
npm 12 rejects --prod, and --production still starts PLANKA through nodemon. Starting node app.js directly needs HOME: Sails 1.5.18 only looks for the project's .sailsrc when HOME is set, and systemd sets none without User=, so the app lifted with the wrong paths and returned 503. The unit now sets NODE_ENV and HOME, and an update repairs existing units even without a new release. Follow-up to #18477.
* MeTube: install Deno without its shell setup
With -y, deno's install.sh also fetches jsr:@deno/installer-shell-setup to edit the shell profile, and when jsr.io did not answer the install stopped ("JSR package manifest ... failed to load"). Deno goes to /usr/local/bin, which is on PATH, so the shell setup is not needed; CI=1 keeps the installer from asking for it on a terminal.
* Modify Deno installation command
Update Deno installation command to include CI environment variable.
* OPNsense VM: size the temp space check to the unpacked image
The script refused to run unless TEMP_DIR had 20 GB free, a figure left
over from when the download went there too. The download now goes to the
image cache and only the unpacked FreeBSD image (2.5 GB) lands in
TEMP_DIR, so hosts with 8 to 16 GB free in /tmp stopped with exit 214.
Check the size xz reports for the image instead.
* OPNsense VM: say why the EFI disk could not be allocated
pvesm's error went to stderr only, so the two exit 220 runs in telemetry
carry no reason. As msg_error it reaches the log and the trace, e.g.
"disk image '.../vm-969-disk-0.qcow2' already exists" after an earlier
run left its disk on a storage that qm destroy does not clean.
* Clean up comments in opnsense-vm.sh
Removed comments about image cache and size calculation.
Advanced mode prefills the LAN VLAN with 999. On a bridge with no
physical port that is not VLAN-aware (an internal vmbr1, the usual LAN
choice) pve-bridge cannot tag the tap, and qm start failed with "no
physical interface on bridge 'vmbr1'". The tag is dropped there with a
warning, for LAN and WAN alike.
The scripts base still pointed at DevScripts, where this script was
removed on 10-09, so every run was reported as a DevScripts run.
Portainer and the agent are written as Quadlet .container units, which
need Podman 4.4. Debian 12 ships 4.3.1, so systemctl start portainer
failed with "Unit portainer.service not found". Without Quadlet both
prompts are skipped with a warning.
* fix(truenas-vm): let a failed ISO lookup reach its own error
When download.truenas.com did not answer, the lookup handed an empty
path to an associative array (bad array subscript) and the pipeline
failed under pipefail, so the run ended with exit 1 at the SELECTED_ISO
line instead of the "Could not find a stable ISO" message. The index
fetch now fails on HTTP errors and retries, empty lines are skipped, and
the assignment no longer aborts on an empty result.
* fix(truenas-vm): use the engine's retry flags for the ISO index
* fix(proxmox-mail-gateway): take the repo suite from the container
The install hardcoded trixie, so a Debian 12 container got the PMG 9
repository and pmg-api could not resolve its trixie dependencies (held
broken packages). Suite and key now follow the container's codename;
bookworm still has PMG 8 with proxmox-mailgateway-container.
* fix(proxmox-mail-gateway): read the codename inline
* fix(immich): take the watchfiles wheel and retry GeoNames longer
The v3.3.5 lock pins watchfiles 0.21.0, which has no wheel for the
Python 3.13 machine-learning venv, so every ML install downloaded a Rust
toolchain and compiled it. Where static.rust-lang.org reset the
connection, uv sync failed three times. --upgrade-package watchfiles
takes 1.3.0, an abi3 wheel; only uvicorn's reload mode uses it.
download.geonames.org dropped connections on 11-03/04 and the first file
failed after three 10 s connects; those four calls now retry six times
with a 30 s connect timeout.
* Immich: bump release version to v3.3.6
v3.3.6 disables onnxruntime's telemetry in immich_ml, which runs from
source here, so nothing else changes. The lock still pins watchfiles
0.21.0, so the wheel upgrade stays.
The compose file from main now uses ARCANE_ENCRYPTION_KEY and
ARCANE_PROJECTS_DIRECTORY, which the latest image (2.17.3) does not read,
so it panicked on a missing ENCRYPTION_KEY. Arcane 3 in turn refuses to
start when only the old names are set. Install and update now keep both
names in compose.yaml, which also carries existing installs over to 3.
The .env was never referenced by the compose file, but compose parses it,
and the unanchored ENCRYPTION_KEY sed turned the renamed line into
ARCANE_#ENCRYPTION_KEY and broke every install. New installs no longer
download it; update repairs the broken line.
The FreeBSD image boots in under a minute when both NICs get DHCP, but
dhclient waits 60 seconds on each NIC without a DHCP server, which is the
normal case for a firewall's LAN before setup. On vx-pve an isolated LAN
took 110 seconds; the reporter of #18464 measured 210. The keys then went
into the boot output. The image prints its login prompt on the serial
console as well, so the script now reads serial0 and continues when it
appears, up to 15 minutes, or waits the old 3 minutes if the console
cannot be read.
Tududi 2.0.0 dropped SQLite and refuses to start next to a populated 1.x
database. New installs set up PostgreSQL and let start.sh create the
schema; db:init would sync the tables without SequelizeMeta and make
db-prepare treat the database as an old 1.x one. Installs without
DATABASE_URL stay on 1.15.0, the final SQLite release, which also brings
back installs that already updated to 2.0.0.
Uploads lived in backend/uploads, which CLEAN_INSTALL wiped on every
update; they move to /opt/tududi-uploads.
n8n-nodes-base 2.46.0 moved @napi-rs/canvas-linux-arm64-musl and
-linux-x64-musl from optional into hard dependencies. npm enforces
os/cpu/libc on those, and no combination satisfies both arm64 and x64,
so every install fails with EBADPLATFORM. n8n 2.46.4 reached the latest
tag on 2026-11-03 and the failures started four minutes later.
--force skips the platform check. The matching gnu binary is still
installed through @napi-rs/canvas's own optional dependencies, so canvas
keeps working.
* Wiki.js: install 3.x
Wiki.js 3 lives in requarks/wiki, needs Node.js 26 and creates its own ltree and pg_trgm extensions in the wiki schema, and starts with node --no-experimental-webstorage backend. dataPath moves out of the app folder, which every update replaces; the admin password is generated and saved to ~/wikijs.creds. Updates follow upstream's guide and put Puppeteer back when it was installed. 2.x containers keep getting 2.x updates from requarks/wiki-v2, since 3.x cannot upgrade them in place, and are told how to export and import.
* Refactor credential output to use heredoc syntax
push-app-to-main[bot]