* fix(immich): download before stopping, and clear maintenance mode after an interrupted update
setup_uv and the Immich release fetch ran after maintenance mode, the service stop and rm -rf app/*, so a failed download (e.g. a GitHub releases/download 504) left the container with no app at all. They now run first, while the old install is still serving.
The fetch writes the new version to ~/.immich, so the old version is put back until the update finishes and a failed run can still be retried.
Maintenance mode is now disabled whenever immich-admin exists at the end, not only when this run enabled it. Since #17798 a re-run after an interrupted update skips the enable, so it skipped the disable too and left the web UI on the maintenance page.
* fix(immich): trim comments to the AGENTS.md limit
* fix(immich): rely on the core pending marker, and only clear maintenance mode this run owns
fetch_and_deploy_release already keeps ~/.immich.pending until a clean exit and redoes the update while it exists, so the hand-rolled version swap is dropped; PREV_IMMICH now reads CS_PREVIOUS_VERSION so a redo sees the real old version.
Maintenance mode is disabled when this run enabled it, or when app/ was empty at the start (an interrupted run left it on), rather than whenever immich-admin exists.
* immich: drop comment per review
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* kan: bump Node.js from 20 to 24
* Set NODE_VERSION and NODE_MODULE before setup
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: CanbiZ (MickLesk) <47820557+MickLesk@users.noreply.github.com>
A closed console killed vzdump with the session (7 runs ended "Backup failed ... creating vzdump archive"); it now runs shielded from SIGHUP. A restore after a failed update raced the background shutdown and failed with "can't overwrite running container" (3 runs); it now waits for that shutdown and for the container to stop, and says so when it does not.
Alpine containers without bash failed with 127, and a failed apt update or pct start ended the whole run (12 runs in three days). The cleanup now runs with sh, keeps the apt lists so a failed update does not leave none, and lists the failed containers at the end.
A failed patchmon-agent report, apk upgrade or pct start ended the whole run under set -e (18 runs in three days). The run now updates the other containers, lists the failed ones at the end and exits 1.
The build runs with BUILD_TESTING=OFF, but the recursive submodule update also cloned the large testdata repo, and two installs died on network errors inside it. Only third_party is fetched now; libjxl at Immich's pinned revision configures and builds without it.
3.65 moved the entry point to cmd/databasus and embeds the API spec and migrations, so swag failed and every install since 2026-11-05 broke. It now builds like the upstream image: bundled client tools, the verification agent for amd64 and arm64, and APP_VERSION set to the release. Valkey, goose and the client symlinks are gone because 3.65 uses none of them. Closes#18493.
The player location's COOP/COEP add_header never fires: try_files
internally redirects /rom/<id>/ejs to /index.html, served by
"location /" — so SharedArrayBuffer cores (PSP/DS) fail with a
misleading "must be run over HTTPS" error.
Apply upstream RomM's own fix (docker nginx template): map
$request_uri — which survives the redirect — to header values for the
ejs and jsdos player paths, emit them from "location /", and drop the
dead player location. Also restore upstream's Cache-Control "no-cache"
on the SPA shell, without which a cached index.html hides the headers
and stale frontends survive RomM updates.
Widen the updater's migration gate so existing installs converge.
openwrt-vm and umbrel-os-vm kept the DevScripts base URL when they moved over, and telemetry filed their production runs under DevScripts. The check fails a pull request that adds such a URL to ct, install, vm or tools.
The version came from scraping technitium.com, which failed for some hosts ("Command substitution exited with status 1", 6 runs on 4 hosts in three days) and has no rate-limit fallback. The GitHub release carries the same version and goes through the engine's release lookup.
* fix(caddy): skip the xCaddy test build below 2 GB RAM
The container defaults to 512 MB (256 MB on Alpine), and Go's linker was
killed in xcaddy build: 14 runs on 6 hosts in a week. The build only
produced an unused binary, so below 2 GB xCaddy is installed without it
and a warning says why; install and update alike.
* Change directory to /opt before building xCaddy
The install replaced the file, which dropped JAVA_OPTS with install.data_dir, so creating a tenant failed. The DB settings are now appended, and an update restores the defaults on existing containers. The package upgrade keeps the edited file. Fixes#18483.
The server unpacks its frontend into /tmp/nexterm-sea-*. systemd-tmpfiles removes it after 10 days while the process keeps running, and every page returns 404. Fixes#18488.
Ulaş Kalaycı