From b8a1879b24d2fb8802b8521ad2e28194dd4e97b9 Mon Sep 17 00:00:00 2001
From: MickLesk <mickey.leskowitz@gmail.com>
Date: Fri, 3 Jul 2026 09:34:21 +0200
Subject: [PATCH 001/220] hotfix: retry npm install with --force for corepack
 shims

Add a fallback retry using `npm install -g --force` when the initial install fails. This handles EEXIST errors caused by corepack-provided shims for pnpm/yarn that ship with recent Node.js versions and block installation to /usr/bin/<tool>.
---
 misc/tools.func | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/misc/tools.func b/misc/tools.func
index 742244c3a..fc01a6fc0 100644
--- a/misc/tools.func
+++ b/misc/tools.func
@@ -7627,7 +7627,10 @@ setup_nodejs() {
         MODULE_INSTALLED_VERSION="$(npm list -g --depth=0 "$MODULE_NAME" 2>&1 | grep "$MODULE_NAME@" | awk -F@ '{print $2}' 2>/dev/null | tr -d '[:space:]' || echo '')"
         if [[ "$MODULE_REQ_VERSION" != "latest" && "$MODULE_REQ_VERSION" != "$MODULE_INSTALLED_VERSION" ]]; then
           msg_info "Updating $MODULE_NAME to v$MODULE_REQ_VERSION"
-          if $STD npm install -g "${MODULE_NAME}@${MODULE_REQ_VERSION}" 2>/dev/null; then
+          # Retry with --force to overwrite corepack-provided shims (pnpm/yarn), which now
+          # ship with recent corepack and cause EEXIST on /usr/bin/<tool>
+          if $STD npm install -g "${MODULE_NAME}@${MODULE_REQ_VERSION}" 2>/dev/null ||
+            $STD npm install -g --force "${MODULE_NAME}@${MODULE_REQ_VERSION}" 2>/dev/null; then
             msg_ok "Updated $MODULE_NAME"
           else
             msg_warn "Failed to update $MODULE_NAME to version $MODULE_REQ_VERSION"
@@ -7635,7 +7638,8 @@ setup_nodejs() {
           fi
         elif [[ "$MODULE_REQ_VERSION" == "latest" ]]; then
           msg_info "Updating $MODULE_NAME to latest version"
-          if $STD npm install -g "${MODULE_NAME}@latest" 2>/dev/null; then
+          if $STD npm install -g "${MODULE_NAME}@latest" 2>/dev/null ||
+            $STD npm install -g --force "${MODULE_NAME}@latest" 2>/dev/null; then
             msg_ok "Updated $MODULE_NAME"
           else
             msg_warn "Failed to update $MODULE_NAME to latest version"
@@ -7644,7 +7648,10 @@ setup_nodejs() {
         fi
       else
         msg_info "Installing $MODULE_NAME@$MODULE_REQ_VERSION"
-        if $STD npm install -g "${MODULE_NAME}@${MODULE_REQ_VERSION}" 2>/dev/null; then
+        # Retry with --force to overwrite corepack-provided shims (pnpm/yarn), which now
+        # ship with recent corepack and cause EEXIST on /usr/bin/<tool>
+        if $STD npm install -g "${MODULE_NAME}@${MODULE_REQ_VERSION}" 2>/dev/null ||
+          $STD npm install -g --force "${MODULE_NAME}@${MODULE_REQ_VERSION}" 2>/dev/null; then
           msg_ok "Installed $MODULE_NAME"
         else
           msg_warn "Failed to install $MODULE_NAME@$MODULE_REQ_VERSION"

From 225329a62ffc3fc74e551dbbfdb72d416aa46a8c Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Fri, 3 Jul 2026 07:34:47 +0000
Subject: [PATCH 002/220] Update CHANGELOG.md (#15567)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 025f25e5f..69206e15d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -489,6 +489,8 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-07-03
+
 ## 2026-07-02
 
 ### 🆕 New Scripts

From 6ad04d8b191fce4bf5b8fe637ec42c3db144caa5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=81ngel=20Oreste?=
 <39156285+alpargatagazer@users.noreply.github.com>
Date: Fri, 3 Jul 2026 18:09:41 +0200
Subject: [PATCH 003/220] Removed deprecated parameter in Filebrowser Quantum
 configuration (#15573)

---
 tools/addon/filebrowser-quantum.sh | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/tools/addon/filebrowser-quantum.sh b/tools/addon/filebrowser-quantum.sh
index 66fdb3455..ca586f04d 100644
--- a/tools/addon/filebrowser-quantum.sh
+++ b/tools/addon/filebrowser-quantum.sh
@@ -176,11 +176,10 @@ if [[ "${noauth_prompt,,}" =~ ^(y|yes)$ ]]; then
 server:
   port: $PORT
   sources:
-    - path: "$SRC_DIR"      
+    - path: "$SRC_DIR"
       name: "RootFS"
       config:
         denyByDefault: false
-        disableIndexing: false
         indexingIntervalMinutes: 240
         conditionals:
           rules:
@@ -204,7 +203,6 @@ server:
       name: "RootFS"
       config:
         denyByDefault: false
-        disableIndexing: false
         indexingIntervalMinutes: 240
         conditionals:
           rules:

From 2b3e2346e102345cf3ce5b4cb760f24d442d14a8 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Fri, 3 Jul 2026 16:10:02 +0000
Subject: [PATCH 004/220] Update CHANGELOG.md (#15576)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 69206e15d..887e28e34 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -491,6 +491,12 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ## 2026-07-03
 
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - Removed deprecated parameter in Filebrowser Quantum configuration [@alpargatagazer](https://github.com/alpargatagazer) ([#15573](https://github.com/community-scripts/ProxmoxVE/pull/15573))
+
 ## 2026-07-02
 
 ### 🆕 New Scripts

From c07570858874ce83113d0876d6ee37aec0fe453b Mon Sep 17 00:00:00 2001
From: Chris <punk.sand7393@fastmail.com>
Date: Fri, 3 Jul 2026 12:14:26 -0400
Subject: [PATCH 005/220] Opencloud: Pin to v7.2.0 (#15575)

---
 ct/opencloud.sh              | 2 +-
 install/opencloud-install.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/ct/opencloud.sh b/ct/opencloud.sh
index d2d78c805..b64dc34d0 100644
--- a/ct/opencloud.sh
+++ b/ct/opencloud.sh
@@ -30,7 +30,7 @@ function update_script() {
     exit
   fi
 
-  RELEASE="v7.0.0"
+  RELEASE="v7.2.0"
   if check_for_gh_release "OpenCloud" "opencloud-eu/opencloud" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
     msg_info "Stopping services"
     systemctl stop opencloud opencloud-wopi
diff --git a/install/opencloud-install.sh b/install/opencloud-install.sh
index 807dd2e75..608440062 100644
--- a/install/opencloud-install.sh
+++ b/install/opencloud-install.sh
@@ -64,7 +64,7 @@ $STD sudo -u cool coolconfig set-admin-password --user=admin --password="$COOLPA
 echo "$COOLPASS" >~/.coolpass
 msg_ok "Installed Collabora Online"
 
-fetch_and_deploy_gh_release "OpenCloud" "opencloud-eu/opencloud" "singlefile" "v7.0.0" "/usr/bin" "opencloud-*-linux-$(arch_resolve)"
+fetch_and_deploy_gh_release "OpenCloud" "opencloud-eu/opencloud" "singlefile" "v7.2.0" "/usr/bin" "opencloud-*-linux-$(arch_resolve)"
 mv /usr/bin/OpenCloud /usr/bin/opencloud
 
 msg_info "Configuring OpenCloud"

From 84a1f13fa7f2962a5fa4a4f6ea713568e2521a6d Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Fri, 3 Jul 2026 16:14:53 +0000
Subject: [PATCH 006/220] Update CHANGELOG.md (#15577)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 887e28e34..9ca858c73 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -491,6 +491,10 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ## 2026-07-03
 
+### 🚀 Updated Scripts
+
+  - Opencloud: Pin to v7.2.0 [@vhsdream](https://github.com/vhsdream) ([#15575](https://github.com/community-scripts/ProxmoxVE/pull/15575))
+
 ### 🧰 Tools
 
   - #### 🐞 Bug Fixes

From 044bffcea4141f6f238046e1e1be8c413fbfaa50 Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Fri, 3 Jul 2026 19:30:41 +0200
Subject: [PATCH 007/220] Immich: handle mise monorepo_root rename correctly |
 bump to 3.0.1 (#15557)

---
 ct/immich.sh              | 93 +++++++++++++++++++++++++++------------
 install/immich-install.sh | 64 +++++++++++++++------------
 2 files changed, 102 insertions(+), 55 deletions(-)

diff --git a/ct/immich.sh b/ct/immich.sh
index e97231997..321889a09 100644
--- a/ct/immich.sh
+++ b/ct/immich.sh
@@ -110,7 +110,7 @@ EOF
     msg_ok "Image-processing libraries up to date"
   fi
 
-  RELEASE="v2.7.5"
+  RELEASE="v3.0.1"
   if check_for_gh_release "Immich" "immich-app/immich" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
     if [[ $(cat ~/.immich) > "2.5.1" ]]; then
       msg_info "Enabling Maintenance Mode"
@@ -124,7 +124,7 @@ EOF
     systemctl stop immich-web
     systemctl stop immich-ml
     msg_ok "Stopped Services"
-    VCHORD_RELEASE="0.5.3"
+    VCHORD_RELEASE="1.0.0"
     [[ -f ~/.vchord_version ]] && mv ~/.vchord_version ~/.vectorchord
     if check_for_gh_release "VectorChord" "tensorchord/VectorChord" "${VCHORD_RELEASE}" "updated together with Immich after testing"; then
       fetch_and_deploy_gh_release "VectorChord" "tensorchord/VectorChord" "binary" "${VCHORD_RELEASE}" "/tmp" "postgresql-16-vchord_*_$(arch_resolve).deb"
@@ -140,7 +140,7 @@ EOF
     UPLOAD_DIR="$(sed -n '/^IMMICH_MEDIA_LOCATION/s/[^=]*=//p' /opt/immich/.env)"
     SRC_DIR="${INSTALL_DIR}/source"
     APP_DIR="${INSTALL_DIR}/app"
-    PLUGIN_DIR="${APP_DIR}/corePlugin"
+    PLUGIN_DIR="${APP_DIR}/plugins/immich-plugin-core"
     ML_DIR="${APP_DIR}/machine-learning"
     GEO_DIR="${INSTALL_DIR}/geodata"
 
@@ -168,19 +168,21 @@ EOF
     setup_uv
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Immich" "immich-app/immich" "tarball" "${RELEASE}" "$SRC_DIR"
     PNPM_VERSION="$(jq -r '.packageManager | split("@")[1] | split("+")[0]' ${SRC_DIR}/package.json)"
-    NODE_VERSION="24" NODE_MODULE="corepack,pnpm@${PNPM_VERSION}" setup_nodejs
+    export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+    export CI=1
+    NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs
+    $STD corepack prepare "pnpm@${PNPM_VERSION}" --activate
+    export PATH="/root/.local/share/pnpm/bin:$PATH"
+    $STD pnpm config set --global dangerouslyAllowAllBuilds true
 
     msg_info "Updating Immich web and microservices"
     cd "$SRC_DIR"/server
-    export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
-    export CI=1
-
     # server build
     export SHARP_IGNORE_GLOBAL_LIBVIPS=true
-    $STD pnpm --filter immich --frozen-lockfile build
+    $STD pnpm --filter @immich/sdk --filter @immich/plugin-sdk --filter immich build
     unset SHARP_IGNORE_GLOBAL_LIBVIPS
     export SHARP_FORCE_GLOBAL_LIBVIPS=true
-    $STD pnpm --filter immich --frozen-lockfile --prod --no-optional deploy "$APP_DIR"
+    $STD pnpm --filter immich --prod --no-optional deploy "$APP_DIR"
 
     # Patch helmet.json: disable upgrade-insecure-requests for HTTP access
     if [[ -f "$APP_DIR/helmet.json" ]]; then
@@ -190,32 +192,50 @@ EOF
     cp "$APP_DIR"/package.json "$APP_DIR"/bin
     sed -i "s|^start|${APP_DIR}/bin/start|" "$APP_DIR"/bin/immich-admin
 
-    # openapi & web build
+    # sdk, cli & web build
     cd "$SRC_DIR"
     echo "packageImportMethod: hardlink" >>./pnpm-workspace.yaml
-    $STD pnpm --filter @immich/sdk --filter immich-web --frozen-lockfile --force install
     unset SHARP_FORCE_GLOBAL_LIBVIPS
     export SHARP_IGNORE_GLOBAL_LIBVIPS=true
-    $STD pnpm --filter @immich/sdk --filter immich-web build
+    $STD pnpm --filter @immich/sdk --filter immich-web --filter @immich/cli build
+    $STD pnpm --filter @immich/cli --prod --no-optional deploy "$APP_DIR"/cli
     cp -a web/build "$APP_DIR"/www
     cp LICENSE "$APP_DIR"
-
-    # cli build
-    $STD pnpm --filter @immich/sdk --filter @immich/cli --frozen-lockfile install
-    $STD pnpm --filter @immich/sdk --filter @immich/cli build
-    $STD pnpm --filter @immich/cli --prod --no-optional deploy "$APP_DIR"/cli
     [[ -f "$INSTALL_DIR"/start.sh ]] && mv "$INSTALL_DIR"/start.sh "$APP_DIR"/bin
 
     # plugins
     cd "$SRC_DIR"
-    $STD mise trust --ignore ./mise.toml
-    $STD mise trust ./plugins/mise.toml
-    cd plugins
+    export MISE_TRUSTED_CONFIG_PATHS="$SRC_DIR"/mise.toml
+    export MISE_DISABLE_TOOLS=github:jellyfin/jellyfin-ffmpeg
     $STD mise install
-    $STD mise run build
+    export PATH="$(mise bin-paths 2>/dev/null | tr '\n' ':')$PATH"
+    if ! command -v extism-js >/dev/null 2>&1; then
+      # extism-js ships as a bare gzip-compressed single binary (.gz) that
+      # fetch_and_deploy_gh_release cannot deploy; fetch + gunzip it directly.
+      EXTISM_ARCH="$(arch_resolve x86_64 aarch64)"
+      curl_download /tmp/extism-js.gz "https://github.com/extism/js-pdk/releases/download/v1.6.0/extism-js-${EXTISM_ARCH}-linux-v1.6.0.gz"
+      gunzip -f /tmp/extism-js.gz
+      install -m 0755 /tmp/extism-js /usr/local/bin/extism-js
+      rm -f /tmp/extism-js
+    fi
+    if ! command -v wasm-merge >/dev/null 2>&1; then
+      # extism-js needs binaryen's `wasm-merge` to build the plugin wasm. mise
+      # 2026.7.0's github backend no longer exposes `wasm-merge` on PATH (ubi only
+      # extracts a single binary), so install the pinned binaryen release from
+      # mise.toml directly. The extracted bin/ keeps libbinaryen.so alongside it.
+      BINARYEN_VERSION="$(grep -oiP 'binaryen"\s*=\s*"\Kversion_[0-9]+' "$SRC_DIR"/mise.toml | head -n1)"
+      [[ -z "$BINARYEN_VERSION" ]] && BINARYEN_VERSION="version_124"
+      BINARYEN_ARCH="$(arch_resolve x86_64 aarch64)"
+      curl_download /tmp/binaryen.tar.gz "https://github.com/WebAssembly/binaryen/releases/download/${BINARYEN_VERSION}/binaryen-${BINARYEN_VERSION}-${BINARYEN_ARCH}-linux.tar.gz"
+      tar -xzf /tmp/binaryen.tar.gz -C /opt
+      rm -f /tmp/binaryen.tar.gz
+      export PATH="/opt/binaryen-${BINARYEN_VERSION}/bin:$PATH"
+    fi
+    $STD mise exec -- pnpm --filter @immich/sdk --filter @immich/plugin-sdk --filter @immich/plugin-core install --frozen-lockfile
+    $STD mise exec -- pnpm --filter @immich/sdk --filter @immich/plugin-sdk --filter @immich/plugin-core build
     mkdir -p "$PLUGIN_DIR"
-    cp -r ./dist "$PLUGIN_DIR"/dist
-    cp ./manifest.json "$PLUGIN_DIR"
+    cp -r ./packages/plugin-core/dist "$PLUGIN_DIR"/dist
+    cp ./packages/plugin-core/manifest.json "$PLUGIN_DIR"
     msg_ok "Updated Immich server, web, cli and plugins"
 
     cd "$SRC_DIR"/machine-learning
@@ -231,13 +251,13 @@ EOF
       ML_PYTHON="python3.13"
       msg_info "Pre-installing Python ${ML_PYTHON} for machine-learning"
       for attempt in $(seq 1 3); do
-        $STD sudo --preserve-env=VIRTUAL_ENV -nu immich uv python install "${ML_PYTHON}" && break
+        $STD sudo --preserve-env=VIRTUAL_ENV -Pnu immich uv python install "${ML_PYTHON}" && break
         [[ $attempt -lt 3 ]] && msg_warn "Python download attempt $attempt failed, retrying..." && sleep 5
       done
       msg_ok "Pre-installed Python ${ML_PYTHON}"
       msg_info "Updating Intel OpenVINO machine-learning"
       for attempt in $(seq 1 3); do
-        $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT -nu immich uv sync --extra openvino --no-dev --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
+        $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT -Pnu immich uv sync --extra openvino --no-dev --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
         [[ $attempt -lt 3 ]] && msg_warn "uv sync attempt $attempt failed, retrying..." && sleep 10
       done
       patchelf --clear-execstack "${VIRTUAL_ENV}/lib/python3.13/site-packages/onnxruntime/capi/onnxruntime_pybind11_state.cpython-313-$(arch_resolve "x86_64" "aarch64")-linux-gnu.so"
@@ -246,13 +266,13 @@ EOF
       ML_PYTHON="python3.11"
       msg_info "Pre-installing Python ${ML_PYTHON} for machine-learning"
       for attempt in $(seq 1 3); do
-        $STD sudo --preserve-env=VIRTUAL_ENV -nu immich uv python install "${ML_PYTHON}" && break
+        $STD sudo --preserve-env=VIRTUAL_ENV -Pnu immich uv python install "${ML_PYTHON}" && break
         [[ $attempt -lt 3 ]] && msg_warn "Python download attempt $attempt failed, retrying..." && sleep 5
       done
       msg_ok "Pre-installed Python ${ML_PYTHON}"
       msg_info "Updating machine-learning"
       for attempt in $(seq 1 3); do
-        $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT -nu immich uv sync --extra cpu --no-dev --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
+        $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT -Pnu immich uv sync --extra cpu --no-dev --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
         [[ $attempt -lt 3 ]] && msg_warn "uv sync attempt $attempt failed, retrying..." && sleep 10
       done
       msg_ok "Updated machine-learning"
@@ -260,6 +280,23 @@ EOF
     cd "$SRC_DIR"
     cp -a machine-learning/{ann,immich_ml} "$ML_DIR"
     [[ -f "$INSTALL_DIR"/ml_start.sh ]] && mv "$INSTALL_DIR"/ml_start.sh "$ML_DIR"
+    # Regenerate ml_start.sh if it is missing (e.g. lost by a previously interrupted update),
+    # otherwise immich-ml.service fails to start with status=203/EXEC
+    if [[ ! -f "$ML_DIR"/ml_start.sh ]]; then
+      cat <<EOF >"$ML_DIR"/ml_start.sh
+#!/usr/bin/env bash
+
+cd ${ML_DIR}
+. ${VIRTUAL_ENV}/bin/activate
+
+set -a
+. ${INSTALL_DIR}/.env
+set +a
+
+python3 -m immich_ml
+EOF
+      chmod +x "$ML_DIR"/ml_start.sh
+    fi
     [[ -f ~/.openvino ]] && sed -i "/intra_op/s/int = 0/int = os.cpu_count() or 0/" "$ML_DIR"/immich_ml/config.py
     ln -sf "$APP_DIR"/resources "$INSTALL_DIR"
     cd "$APP_DIR"
@@ -429,7 +466,7 @@ function compile_imagemagick() {
 
 function compile_libvips() {
   SOURCE=$SOURCE_DIR/libvips
-  LIBVIPS_REVISION="17ad2f62dda7e39985955da189183e594683d45e"
+  LIBVIPS_REVISION="3664cfc5dc2c5661288f5bf5a85ccc51c64c1626"
   if [[ "$LIBVIPS_REVISION" != "$(grep 'libvips' ~/.immich_library_revisions | awk '{print $2}')" ]]; then
     msg_info "Recompiling libvips"
     [[ -d "$SOURCE" ]] && rm -rf "$SOURCE"
diff --git a/install/immich-install.sh b/install/immich-install.sh
index 88bff3693..9270b29e1 100644
--- a/install/immich-install.sh
+++ b/install/immich-install.sh
@@ -162,7 +162,7 @@ PG_VERSION="16" PG_MODULES="pgvector" setup_postgresql
 ACTUAL_PG_VERSION=$(ls /etc/postgresql/ 2>/dev/null | sort -V | tail -1)
 ACTUAL_PG_VERSION=${ACTUAL_PG_VERSION:-16}
 
-VCHORD_RELEASE="0.5.3"
+VCHORD_RELEASE="1.0.0"
 fetch_and_deploy_gh_release "VectorChord" "tensorchord/VectorChord" "binary" "${VCHORD_RELEASE}" "/tmp" "postgresql-${ACTUAL_PG_VERSION}-vchord_*_$(arch_resolve).deb"
 
 sed -i "s/^#shared_preload.*/shared_preload_libraries = 'vchord.so'/" /etc/postgresql/${ACTUAL_PG_VERSION}/main/postgresql.conf
@@ -282,7 +282,7 @@ msg_ok "(4/5) Compiled imagemagick"
 
 msg_info "(5/5) Compiling libvips"
 SOURCE=$SOURCE_DIR/libvips
-LIBVIPS_REVISION="17ad2f62dda7e39985955da189183e594683d45e"
+LIBVIPS_REVISION="3664cfc5dc2c5661288f5bf5a85ccc51c64c1626"
 $STD git clone https://github.com/libvips/libvips.git "$SOURCE"
 cd "$SOURCE"
 $STD git reset --hard "$LIBVIPS_REVISION"
@@ -306,14 +306,20 @@ INSTALL_DIR="/opt/${APPLICATION}"
 UPLOAD_DIR="${INSTALL_DIR}/upload"
 SRC_DIR="${INSTALL_DIR}/source"
 APP_DIR="${INSTALL_DIR}/app"
-PLUGIN_DIR="${APP_DIR}/corePlugin"
+PLUGIN_DIR="${APP_DIR}/plugins/immich-plugin-core"
 ML_DIR="${APP_DIR}/machine-learning"
 GEO_DIR="${INSTALL_DIR}/geodata"
 mkdir -p {"${APP_DIR}","${UPLOAD_DIR}","${GEO_DIR}","${INSTALL_DIR}"/cache}
 
-fetch_and_deploy_gh_release "Immich" "immich-app/immich" "tarball" "v2.7.5" "$SRC_DIR"
+fetch_and_deploy_gh_release "Immich" "immich-app/immich" "tarball" "v3.0.1" "$SRC_DIR"
 PNPM_VERSION="$(jq -r '.packageManager | split("@")[1] | split("+")[0]' ${SRC_DIR}/package.json)"
-NODE_VERSION="24" NODE_MODULE="corepack,pnpm@${PNPM_VERSION}" setup_nodejs
+export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs
+# Provision the exact pnpm pinned in package.json's packageManager field via corepack instead
+# of `npm i -g pnpm@X`, which collides (EEXIST) with the corepack pnpm shim shipped by the
+$STD corepack prepare "pnpm@${PNPM_VERSION}" --activate
+export PATH="/root/.local/share/pnpm/bin:$PATH"
+$STD pnpm config set --global dangerouslyAllowAllBuilds true
 
 msg_info "Installing Immich (patience)"
 
@@ -323,10 +329,10 @@ export CI=1
 
 # server build
 export SHARP_IGNORE_GLOBAL_LIBVIPS=true
-$STD pnpm --filter immich --frozen-lockfile build
+$STD pnpm --filter @immich/sdk --filter @immich/plugin-sdk --filter immich build
 unset SHARP_IGNORE_GLOBAL_LIBVIPS
 export SHARP_FORCE_GLOBAL_LIBVIPS=true
-$STD pnpm --filter immich --frozen-lockfile --prod --no-optional deploy "$APP_DIR"
+$STD pnpm --filter immich --prod --no-optional deploy "$APP_DIR"
 
 # Patch helmet.json: disable upgrade-insecure-requests for HTTP access
 if [[ -f "$APP_DIR/helmet.json" ]]; then
@@ -336,31 +342,35 @@ fi
 cp "$APP_DIR"/package.json "$APP_DIR"/bin
 sed -i "s|^start|${APP_DIR}/bin/start|" "$APP_DIR"/bin/immich-admin
 
-# openapi & web build
+# sdk, cli & web build
 cd "$SRC_DIR"
 echo "packageImportMethod: hardlink" >>./pnpm-workspace.yaml
-$STD pnpm --filter @immich/sdk --filter immich-web --frozen-lockfile --force install
 unset SHARP_FORCE_GLOBAL_LIBVIPS
 export SHARP_IGNORE_GLOBAL_LIBVIPS=true
-$STD pnpm --filter @immich/sdk --filter immich-web build
+$STD pnpm --filter @immich/sdk --filter immich-web --filter @immich/cli build
+$STD pnpm --filter @immich/cli --prod --no-optional deploy "$APP_DIR"/cli
 cp -a web/build "$APP_DIR"/www
 cp LICENSE "$APP_DIR"
-
-# cli build
-$STD pnpm --filter @immich/sdk --filter @immich/cli --frozen-lockfile install
-$STD pnpm --filter @immich/sdk --filter @immich/cli build
-$STD pnpm --filter @immich/cli --prod --no-optional deploy "$APP_DIR"/cli
-
-# plugins
 cd "$SRC_DIR"
-$STD mise trust --ignore ./mise.toml
-$STD mise trust ./plugins/mise.toml
-cd plugins
+export MISE_TRUSTED_CONFIG_PATHS="$SRC_DIR"/mise.toml
+export MISE_DISABLE_TOOLS=github:jellyfin/jellyfin-ffmpeg
 $STD mise install
-$STD mise run build
+export PATH="$(mise bin-paths 2>/dev/null | tr '\n' ':')$PATH"
+if ! command -v extism-js >/dev/null 2>&1; then
+  # extism-js is published as a bare gzip-compressed single binary (.gz), which
+  # fetch_and_deploy_gh_release cannot deploy (singlefile leaves it compressed,
+  # prebuild only handles zip/tar). Fetch + gunzip it directly.
+  EXTISM_ARCH="$(arch_resolve x86_64 aarch64)"
+  curl_download /tmp/extism-js.gz "https://github.com/extism/js-pdk/releases/download/v1.6.0/extism-js-${EXTISM_ARCH}-linux-v1.6.0.gz"
+  gunzip -f /tmp/extism-js.gz
+  install -m 0755 /tmp/extism-js /usr/local/bin/extism-js
+  rm -f /tmp/extism-js
+fi
+$STD mise exec -- pnpm --filter @immich/sdk --filter @immich/plugin-sdk --filter @immich/plugin-core install --frozen-lockfile
+$STD mise exec -- pnpm --filter @immich/sdk --filter @immich/plugin-sdk --filter @immich/plugin-core build
 mkdir -p "$PLUGIN_DIR"
-cp -r ./dist "$PLUGIN_DIR"/dist
-cp ./manifest.json "$PLUGIN_DIR"
+cp -r ./packages/plugin-core/dist "$PLUGIN_DIR"/dist
+cp ./packages/plugin-core/manifest.json "$PLUGIN_DIR"
 msg_ok "Installed Immich Server, Web and Plugin Components"
 
 cd "$SRC_DIR"/machine-learning
@@ -376,13 +386,13 @@ if [[ -f ~/.openvino ]]; then
   ML_PYTHON="python3.13"
   msg_info "Pre-installing Python ${ML_PYTHON} for machine-learning"
   for attempt in $(seq 1 3); do
-    $STD sudo --preserve-env=VIRTUAL_ENV -nu immich uv python install "${ML_PYTHON}" && break
+    $STD sudo --preserve-env=VIRTUAL_ENV -Pnu immich uv python install "${ML_PYTHON}" && break
     [[ $attempt -lt 3 ]] && msg_warn "Python download attempt $attempt failed, retrying..." && sleep 5
   done
   msg_ok "Pre-installed Python ${ML_PYTHON}"
   msg_info "Installing Intel OpenVINO machine-learning"
   for attempt in $(seq 1 3); do
-    $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT -nu immich uv sync --extra openvino --no-dev --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
+    $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT -Pnu immich uv sync --extra openvino --no-dev --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
     [[ $attempt -lt 3 ]] && msg_warn "uv sync attempt $attempt failed, retrying..." && sleep 10
   done
   patchelf --clear-execstack "${VIRTUAL_ENV}/lib/python3.13/site-packages/onnxruntime/capi/onnxruntime_pybind11_state.cpython-313-$(arch_resolve "x86_64" "aarch64")-linux-gnu.so"
@@ -391,13 +401,13 @@ else
   ML_PYTHON="python3.11"
   msg_info "Pre-installing Python ${ML_PYTHON} for machine-learning"
   for attempt in $(seq 1 3); do
-    $STD sudo --preserve-env=VIRTUAL_ENV -nu immich uv python install "${ML_PYTHON}" && break
+    $STD sudo --preserve-env=VIRTUAL_ENV -Pnu immich uv python install "${ML_PYTHON}" && break
     [[ $attempt -lt 3 ]] && msg_warn "Python download attempt $attempt failed, retrying..." && sleep 5
   done
   msg_ok "Pre-installed Python ${ML_PYTHON}"
   msg_info "Installing machine-learning"
   for attempt in $(seq 1 3); do
-    $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT -nu immich uv sync --extra cpu --no-dev --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
+    $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT -Pnu immich uv sync --extra cpu --no-dev --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
     [[ $attempt -lt 3 ]] && msg_warn "uv sync attempt $attempt failed, retrying..." && sleep 10
   done
   msg_ok "Installed machine-learning"

From 3c84f2d6c17889ca0b5a20df5c06668fcd94d34a Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Fri, 3 Jul 2026 17:31:02 +0000
Subject: [PATCH 008/220] Update CHANGELOG.md (#15578)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9ca858c73..c32ffbea5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -495,6 +495,10 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - Opencloud: Pin to v7.2.0 [@vhsdream](https://github.com/vhsdream) ([#15575](https://github.com/community-scripts/ProxmoxVE/pull/15575))
 
+  - #### 🐞 Bug Fixes
+
+    - Immich: handle mise monorepo_root rename correctly | bump to 3.0.1 [@MickLesk](https://github.com/MickLesk) ([#15557](https://github.com/community-scripts/ProxmoxVE/pull/15557))
+
 ### 🧰 Tools
 
   - #### 🐞 Bug Fixes

From 704916d27d49426d1e6396df7a5e775611c75649 Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Fri, 3 Jul 2026 22:22:06 +0200
Subject: [PATCH 009/220] tools.func: fix corepack/pnpm install flow in
 setup_nodejs (#15579)

Ensure Node module setup runs non-interactively by exporting COREPACK_ENABLE_DOWNLOAD_PROMPT=0, then handle corepack first when requested (including versioned specs). pnpm/yarn are now provisioned through corepack when enabled to avoid shim EEXIST collisions, with corepack modules skipped in the generic npm loop and conflicting shims cleaned only for npm-global installs. Also replace the global pnpm dangerouslyAllowAllBuilds setting with strictDepBuilds=false to avoid project-level config conflicts while keeping installs usable.
---
 misc/tools.func | 79 +++++++++++++++++++++++++++++++++++++++++--------
 1 file changed, 67 insertions(+), 12 deletions(-)

diff --git a/misc/tools.func b/misc/tools.func
index fc01a6fc0..883c98da0 100644
--- a/misc/tools.func
+++ b/misc/tools.func
@@ -7442,6 +7442,13 @@ setup_nodejs() {
   local wants_corepack=0
   local node_setup_ok_msg=""
 
+  # Corepack must run fully non-interactive. Without this it prints
+  # "Corepack is about to download X. Do you want to continue? [Y/n]" and blocks
+  # the whole install waiting for keyboard input - both here and in the calling
+  # script's later `corepack prepare` / `corepack <pm>` calls, which run in this
+  # same shell and inherit the export.
+  export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+
   # ALWAYS clean up legacy installations first (nvm, etc.) to prevent conflicts
   cleanup_legacy_install "nodejs"
 
@@ -7596,17 +7603,48 @@ setup_nodejs() {
 
     IFS=',' read -ra MODULES <<<"$NODE_MODULE"
 
+    local corepack_spec="corepack@latest"
     for i in "${!MODULES[@]}"; do
       if [[ "${MODULES[$i]}" == "corepack" || "${MODULES[$i]}" == corepack@* ]]; then
         wants_corepack=1
+        [[ "${MODULES[$i]}" == corepack@* ]] && corepack_spec="${MODULES[$i]}"
       fi
       if [[ "${MODULES[$i]}" == "pnpm" ]]; then
         MODULES[$i]="pnpm@^10"
       fi
     done
 
+    # When corepack is requested, install and enable it FIRST. The corepack npm
+    # package owns the global yarn/pnpm/pnpx/yarnpkg bin shims, so a second
+    # `npm install -g yarn`/`pnpm` collides on /usr/bin/<tool> (EEXIST). With
+    # corepack ready we provision those package managers THROUGH corepack instead.
+    local corepack_ready=0
+    if ((wants_corepack)); then
+      msg_info "Installing corepack"
+      if $STD npm install -g "$corepack_spec" 2>/dev/null ||
+        $STD npm install -g --force "$corepack_spec" 2>/dev/null; then
+        msg_ok "Installed corepack"
+      else
+        msg_warn "Failed to install corepack"
+      fi
+      if [[ "$NODE_COREPACK_ENABLE" == "1" ]] && command -v corepack >/dev/null 2>&1; then
+        msg_info "Enabling corepack"
+        if $STD corepack enable 2>/dev/null; then
+          corepack_ready=1
+          msg_ok "Enabled corepack"
+        else
+          msg_warn "corepack enable failed"
+        fi
+      fi
+    fi
+
     local failed_modules=0
     for mod in "${MODULES[@]}"; do
+      # corepack itself is already handled above
+      if [[ "$mod" == "corepack" || "$mod" == corepack@* ]]; then
+        continue
+      fi
+
       local MODULE_NAME MODULE_REQ_VERSION MODULE_INSTALLED_VERSION
       if [[ "$mod" == @*/*@* ]]; then
         # Scoped package with version, e.g. @vue/cli-service@latest
@@ -7622,6 +7660,27 @@ setup_nodejs() {
         MODULE_REQ_VERSION="latest"
       fi
 
+      # Provision pnpm/yarn through corepack when it is active, so we never fight
+      # corepack over the /usr/bin/{yarn,pnpm} shim locations it owns.
+      if ((corepack_ready)) && [[ "$MODULE_NAME" == "pnpm" || "$MODULE_NAME" == "yarn" ]]; then
+        local corepack_pkg="$MODULE_NAME"
+        [[ "$MODULE_REQ_VERSION" != "latest" ]] && corepack_pkg="${MODULE_NAME}@${MODULE_REQ_VERSION}"
+        msg_info "Provisioning $MODULE_NAME via corepack"
+        if $STD corepack prepare "$corepack_pkg" --activate 2>/dev/null || command -v "$MODULE_NAME" >/dev/null 2>&1; then
+          msg_ok "Provisioned $MODULE_NAME via corepack"
+        else
+          msg_warn "Failed to provision $MODULE_NAME via corepack"
+          ((failed_modules++)) || true
+        fi
+        continue
+      fi
+
+      # For the npm-global path, drop any corepack-provided shim first so the
+      # bin link can be created without an EEXIST collision.
+      if [[ "$MODULE_NAME" == "pnpm" || "$MODULE_NAME" == "yarn" || "$MODULE_NAME" == "yarnpkg" ]]; then
+        rm -f /usr/bin/"$MODULE_NAME" /usr/local/bin/"$MODULE_NAME" 2>/dev/null || true
+      fi
+
       # Check if the module is already installed
       if $STD npm list -g --depth=0 "$MODULE_NAME" 2>&1 | grep -q "$MODULE_NAME@"; then
         MODULE_INSTALLED_VERSION="$(npm list -g --depth=0 "$MODULE_NAME" 2>&1 | grep "$MODULE_NAME@" | awk -F@ '{print $2}' 2>/dev/null | tr -d '[:space:]' || echo '')"
@@ -7664,19 +7723,15 @@ setup_nodejs() {
     fi
   fi
 
-  # pnpm v10+ blocks dependency build scripts by default (ERR_PNPM_IGNORED_BUILDS).
-  # In a container environment all installed packages are trusted, so we enable builds globally.
+  # pnpm v10+ blocks dependency build scripts by default. Do NOT force
+  # `dangerouslyAllowAllBuilds` globally: pnpm implements that flag as an empty
+  # `neverBuiltDependencies`, which then clashes with any project that ships its
+  # own `onlyBuiltDependencies` (every create-t3-app based app, e.g. Split Pro)
+  # and aborts with ERR_PNPM_CONFIG_CONFLICT_BUILT_DEPENDENCIES. Instead relax the
+  # strict check so an unapproved build is a warning, not a fatal error; scripts
+  # that truly need every build script executed enable that themselves.
   if command -v pnpm >/dev/null 2>&1; then
-    pnpm config set --global dangerouslyAllowAllBuilds true >/dev/null 2>&1 || true
-  fi
-
-  if [[ "$NODE_COREPACK_ENABLE" == "1" ]] && ((wants_corepack)) && command -v corepack >/dev/null 2>&1; then
-    msg_info "Enabling corepack"
-    if $STD corepack enable 2>/dev/null; then
-      msg_ok "Enabled corepack"
-    else
-      msg_warn "corepack enable failed"
-    fi
+    pnpm config set --global strictDepBuilds false >/dev/null 2>&1 || true
   fi
 }
 

From d58123a5187d5f5ad3c5689a6fc7e2650885f630 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Fri, 3 Jul 2026 20:22:29 +0000
Subject: [PATCH 010/220] Update CHANGELOG.md (#15582)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c32ffbea5..564e72d1c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -499,6 +499,12 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
     - Immich: handle mise monorepo_root rename correctly | bump to 3.0.1 [@MickLesk](https://github.com/MickLesk) ([#15557](https://github.com/community-scripts/ProxmoxVE/pull/15557))
 
+### 💾 Core
+
+  - #### 🔧 Refactor
+
+    - tools.func: fix corepack/pnpm install flow in setup_nodejs [@MickLesk](https://github.com/MickLesk) ([#15579](https://github.com/community-scripts/ProxmoxVE/pull/15579))
+
 ### 🧰 Tools
 
   - #### 🐞 Bug Fixes

From 9406a1ca9871ab99c32506c9fc22beaf2caa5d74 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Fri, 3 Jul 2026 22:24:51 +0000
Subject: [PATCH 011/220] Update CHANGELOG.md (#15583)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 564e72d1c..4feef706d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -493,12 +493,14 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ### 🚀 Updated Scripts
 
-  - Opencloud: Pin to v7.2.0 [@vhsdream](https://github.com/vhsdream) ([#15575](https://github.com/community-scripts/ProxmoxVE/pull/15575))
-
   - #### 🐞 Bug Fixes
 
     - Immich: handle mise monorepo_root rename correctly | bump to 3.0.1 [@MickLesk](https://github.com/MickLesk) ([#15557](https://github.com/community-scripts/ProxmoxVE/pull/15557))
 
+  - #### ✨ New Features
+
+    - Opencloud: bump to v7.2.0 [@vhsdream](https://github.com/vhsdream) ([#15575](https://github.com/community-scripts/ProxmoxVE/pull/15575))
+
 ### 💾 Core
 
   - #### 🔧 Refactor

From 7e15a4bf2635817b8974ae9c638fc3ba6a3f4763 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jo=C3=A3o=20Vit=C3=B3ria=20Silva?=
 <8648976+joaovitoriasilva@users.noreply.github.com>
Date: Sat, 4 Jul 2026 10:55:36 +0100
Subject: [PATCH 012/220] fix(endurain): update frontend dist path after
 upstream restructure (#15590)

---
 ct/endurain.sh              | 6 +++---
 install/endurain-install.sh | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/ct/endurain.sh b/ct/endurain.sh
index 67ead130f..934532aea 100644
--- a/ct/endurain.sh
+++ b/ct/endurain.sh
@@ -36,7 +36,7 @@ function update_script() {
 
     msg_info "Creating Backup"
     cp /opt/endurain/.env /opt/endurain.env
-    cp /opt/endurain/frontend/app/dist/env.js /opt/endurain.env.js
+    cp /opt/endurain/frontend/dist/env.js /opt/endurain.env.js
     msg_ok "Created Backup"
 
     CLEAN_INSTALL=1 fetch_and_deploy_codeberg_release "endurain" "endurain-project/endurain" "tarball" "latest" "/opt/endurain"
@@ -52,10 +52,10 @@ function update_script() {
     msg_ok "Prepared Update"
 
     msg_info "Updating Frontend"
-    cd /opt/endurain/frontend/app
+    cd /opt/endurain/frontend
     $STD npm ci
     $STD npm run build
-    cp /opt/endurain.env.js /opt/endurain/frontend/app/dist/env.js
+    cp /opt/endurain.env.js /opt/endurain/frontend/dist/env.js
     rm /opt/endurain.env.js
     msg_ok "Updated Frontend"
 
diff --git a/install/endurain-install.sh b/install/endurain-install.sh
index ca34b2c4e..b0e7953e5 100644
--- a/install/endurain-install.sh
+++ b/install/endurain-install.sh
@@ -55,7 +55,7 @@ DB_HOST=localhost
 DATABASE_URL=postgresql+psycopg://${PG_DB_USER}:${PG_DB_PASS}@localhost:5432/${PG_DB_NAME}
 
 BACKEND_DIR="/opt/endurain/backend/app"
-FRONTEND_DIR="/opt/endurain/frontend/app/dist"
+FRONTEND_DIR="/opt/endurain/frontend/dist"
 DATA_DIR="/opt/endurain_data/data"
 LOGS_DIR="/opt/endurain_data/logs"
 
@@ -69,10 +69,10 @@ EOF
 msg_ok "Setup Endurain"
 
 msg_info "Building Frontend"
-cd /opt/endurain/frontend/app
+cd /opt/endurain/frontend
 $STD npm ci --prefer-offline
 $STD npm run build
-cat <<EOF >/opt/endurain/frontend/app/dist/env.js
+cat <<EOF >/opt/endurain/frontend/dist/env.js
 window.env = {
   ENDURAIN_HOST: "${ENDURAIN_HOST}"
 }

From 819ecc1105d8ca5691d912ff2ce5d4543ce32b49 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Sat, 4 Jul 2026 09:55:57 +0000
Subject: [PATCH 013/220] Update CHANGELOG.md (#15591)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4feef706d..971a5e4ac 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -489,6 +489,14 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-07-04
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(endurain): update frontend dist path after upstream restructure [@joaovitoriasilva](https://github.com/joaovitoriasilva) ([#15590](https://github.com/community-scripts/ProxmoxVE/pull/15590))
+
 ## 2026-07-03
 
 ### 🚀 Updated Scripts

From d29eec949466008e3fd69246bf1820a95b4654a4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Slavi=C5=A1a=20Are=C5=BEina?=
 <58952836+tremor021@users.noreply.github.com>
Date: Sat, 4 Jul 2026 21:48:45 +0200
Subject: [PATCH 014/220] Refactor configuration restoration to use
 restore_backup (#15586)

Removed manual configuration restoration and replaced it with a backup restore function.
---
 ct/twenty.sh | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/ct/twenty.sh b/ct/twenty.sh
index 3bde6f746..0b212ef0f 100644
--- a/ct/twenty.sh
+++ b/ct/twenty.sh
@@ -41,11 +41,8 @@ function update_script() {
     create_backup /opt/twenty/.env \
                   /opt/twenty/packages/twenty-server/.local-storage
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "twenty" "twentyhq/twenty" "tarball"
-
-    msg_info "Restoring Configuration"
-    cp /opt/twenty.env.bak /opt/twenty/.env
-    msg_ok "Restored Configuration"
-
+    restore_backup
+    
     msg_info "Building Application"
     cd /opt/twenty
     export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
@@ -66,7 +63,6 @@ function update_script() {
     $STD npx -y typeorm migration:run -d dist/database/typeorm/core/core.datasource
     msg_ok "Ran Database Migrations"
 
-    restore_backup
 
     msg_info "Starting Services"
     systemctl start twenty-server twenty-worker

From cc5976baa63aadadd03a302693022689cef9f0e1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Slavi=C5=A1a=20Are=C5=BEina?=
 <58952836+tremor021@users.noreply.github.com>
Date: Sat, 4 Jul 2026 21:49:09 +0200
Subject: [PATCH 015/220] Fix heredoc syntax in elementsynapse-install.sh
 (#15594)

---
 install/elementsynapse-install.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/install/elementsynapse-install.sh b/install/elementsynapse-install.sh
index 8a23996bf..11b5e50f1 100644
--- a/install/elementsynapse-install.sh
+++ b/install/elementsynapse-install.sh
@@ -44,7 +44,7 @@ ADMIN_PASS="$(openssl rand -base64 18 | cut -c1-13)"
 echo "enable_registration_without_verification: true" >>/etc/matrix-synapse/homeserver.yaml
 echo "registration_shared_secret: ${SECRET}" >>/etc/matrix-synapse/homeserver.yaml
 
-cat <<EOF >/etc/matrix-synapse/homeserver.yaml
+cat <<EOF >>/etc/matrix-synapse/homeserver.yaml
 
 # MatrixRTC / Element Call configuration
 experimental_features:

From dbd591ada652635e25989479864608bf3ee1b201 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Sat, 4 Jul 2026 19:49:30 +0000
Subject: [PATCH 016/220] Update CHANGELOG.md (#15597)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 971a5e4ac..77110e343 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -495,6 +495,8 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - Element Synapse: Fix heredoc syntax in elementsynapse-install.sh [@tremor021](https://github.com/tremor021) ([#15594](https://github.com/community-scripts/ProxmoxVE/pull/15594))
+    - Twenty: Fix backup restore [@tremor021](https://github.com/tremor021) ([#15586](https://github.com/community-scripts/ProxmoxVE/pull/15586))
     - fix(endurain): update frontend dist path after upstream restructure [@joaovitoriasilva](https://github.com/joaovitoriasilva) ([#15590](https://github.com/community-scripts/ProxmoxVE/pull/15590))
 
 ## 2026-07-03

From 604f7c7ae99c120f7a95a3d04f41e709efcab304 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Sun, 5 Jul 2026 00:21:02 +0000
Subject: [PATCH 017/220] Archive old changelog entries (#15599)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 .github/changelogs/2026/06.md |  44 ++++++++++
 .github/changelogs/2026/07.md |  91 +++++++++++++++++++++
 CHANGELOG.md                  | 147 +++-------------------------------
 3 files changed, 147 insertions(+), 135 deletions(-)
 create mode 100644 .github/changelogs/2026/07.md

diff --git a/.github/changelogs/2026/06.md b/.github/changelogs/2026/06.md
index e0e87d170..b155f052e 100644
--- a/.github/changelogs/2026/06.md
+++ b/.github/changelogs/2026/06.md
@@ -1,3 +1,47 @@
+## 2026-06-30
+
+### 🚀 Updated Scripts
+
+  - #### 🔧 Refactor
+
+    - Refactor: Use heredoc when creating env files and creds/other [@tremor021](https://github.com/tremor021) ([#15469](https://github.com/community-scripts/ProxmoxVE/pull/15469))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - [tools/pve/*.sh] https://download.proxmox.com -> http://download.proxmox.com (PVE8 Only) [@galeksandrp](https://github.com/galeksandrp) ([#15498](https://github.com/community-scripts/ProxmoxVE/pull/15498))
+
+## 2026-06-29
+
+### 🆕 New Scripts
+
+  - Koffan ([#15467](https://github.com/community-scripts/ProxmoxVE/pull/15467))
+- Etherpad ([#15468](https://github.com/community-scripts/ProxmoxVE/pull/15468))
+- Flame ([#15464](https://github.com/community-scripts/ProxmoxVE/pull/15464))
+
+### 🚀 Updated Scripts
+
+  - chore(ct): sync snapotter defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#15472](https://github.com/community-scripts/ProxmoxVE/pull/15472))
+
+  - #### 🐞 Bug Fixes
+
+    - feat: update nginx proxy manager to trixie [@asylumexp](https://github.com/asylumexp) ([#15457](https://github.com/community-scripts/ProxmoxVE/pull/15457))
+
+### 💾 Core
+
+  - #### ✨ New Features
+
+    - [tools.func]: add edit_yaml_config function [@tremor021](https://github.com/tremor021) ([#15484](https://github.com/community-scripts/ProxmoxVE/pull/15484))
+
+## 2026-06-28
+
+### 🚀 Updated Scripts
+
+  - #### 💥 Breaking Changes
+
+    - remove: promtail as EOL and other fixes [@asylumexp](https://github.com/asylumexp) ([#15455](https://github.com/community-scripts/ProxmoxVE/pull/15455))
+
 ## 2026-06-27
 
 ### 🆕 New Scripts
diff --git a/.github/changelogs/2026/07.md b/.github/changelogs/2026/07.md
new file mode 100644
index 000000000..4c20ca3e6
--- /dev/null
+++ b/.github/changelogs/2026/07.md
@@ -0,0 +1,91 @@
+## 2026-07-04
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Element Synapse: Fix heredoc syntax in elementsynapse-install.sh [@tremor021](https://github.com/tremor021) ([#15594](https://github.com/community-scripts/ProxmoxVE/pull/15594))
+    - Twenty: Fix backup restore [@tremor021](https://github.com/tremor021) ([#15586](https://github.com/community-scripts/ProxmoxVE/pull/15586))
+    - fix(endurain): update frontend dist path after upstream restructure [@joaovitoriasilva](https://github.com/joaovitoriasilva) ([#15590](https://github.com/community-scripts/ProxmoxVE/pull/15590))
+
+## 2026-07-03
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Immich: handle mise monorepo_root rename correctly | bump to 3.0.1 [@MickLesk](https://github.com/MickLesk) ([#15557](https://github.com/community-scripts/ProxmoxVE/pull/15557))
+
+  - #### ✨ New Features
+
+    - Opencloud: bump to v7.2.0 [@vhsdream](https://github.com/vhsdream) ([#15575](https://github.com/community-scripts/ProxmoxVE/pull/15575))
+
+### 💾 Core
+
+  - #### 🔧 Refactor
+
+    - tools.func: fix corepack/pnpm install flow in setup_nodejs [@MickLesk](https://github.com/MickLesk) ([#15579](https://github.com/community-scripts/ProxmoxVE/pull/15579))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - Removed deprecated parameter in Filebrowser Quantum configuration [@alpargatagazer](https://github.com/alpargatagazer) ([#15573](https://github.com/community-scripts/ProxmoxVE/pull/15573))
+
+## 2026-07-02
+
+### 🆕 New Scripts
+
+  - Rackula ([#15465](https://github.com/community-scripts/ProxmoxVE/pull/15465))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - typo: fix npm update to npm install for n8n [@MickLesk](https://github.com/MickLesk) ([#15545](https://github.com/community-scripts/ProxmoxVE/pull/15545))
+
+  - #### ✨ New Features
+
+    - Frigate: bump to v0.17.2 [@MickLesk](https://github.com/MickLesk) ([#15536](https://github.com/community-scripts/ProxmoxVE/pull/15536))
+
+  - #### 💥 Breaking Changes
+
+    - Revert "Immich v3.0.0" [@MickLesk](https://github.com/MickLesk) ([#15558](https://github.com/community-scripts/ProxmoxVE/pull/15558))
+    - Immich v3.0.0 [@vhsdream](https://github.com/vhsdream) ([#15153](https://github.com/community-scripts/ProxmoxVE/pull/15153))
+
+### 💾 Core
+
+  - #### 🐞 Bug Fixes
+
+    - tools.func: configure pnpm to allow all build scripts for environments [@MickLesk](https://github.com/MickLesk) ([#15532](https://github.com/community-scripts/ProxmoxVE/pull/15532))
+
+  - #### ✨ New Features
+
+    - feat(build.func): add var_ignore_disable to bypass disabled-script guard [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15544](https://github.com/community-scripts/ProxmoxVE/pull/15544))
+
+## 2026-07-01
+
+### 🆕 New Scripts
+
+  - iVentoy ([#15503](https://github.com/community-scripts/ProxmoxVE/pull/15503))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Stirling-PDF: patch libicudata execstack flag for LXC container compatibility [@MickLesk](https://github.com/MickLesk) ([#15531](https://github.com/community-scripts/ProxmoxVE/pull/15531))
+    - FlowiseAI: align install to use pnpm instead of npm to fix missing dependencies [@MickLesk](https://github.com/MickLesk) ([#15530](https://github.com/community-scripts/ProxmoxVE/pull/15530))
+    - Vaultwarden: handle version detection failure gracefully in update [@MickLesk](https://github.com/MickLesk) ([#15526](https://github.com/community-scripts/ProxmoxVE/pull/15526))
+    - homarr: fix: update-fail [@CrazyWolf13](https://github.com/CrazyWolf13) ([#15512](https://github.com/community-scripts/ProxmoxVE/pull/15512))
+    - n8n: pin version to 2.27.5 [@tremor021](https://github.com/tremor021) ([#15516](https://github.com/community-scripts/ProxmoxVE/pull/15516))
+
+  - #### ✨ New Features
+
+    - [arm64] feat: iventory arm64 support [@asylumexp](https://github.com/asylumexp) ([#15521](https://github.com/community-scripts/ProxmoxVE/pull/15521))
+
+### 💾 Core
+
+  - #### 🐞 Bug Fixes
+
+    - core: fix SDN vnet network parameter to use bridge instead of vnet [@MickLesk](https://github.com/MickLesk) ([#15527](https://github.com/community-scripts/ProxmoxVE/pull/15527))
+    - tools.func: use safe variable expansion in check_for_gh_release RETURN trap [@MickLesk](https://github.com/MickLesk) ([#15529](https://github.com/community-scripts/ProxmoxVE/pull/15529))
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 77110e343..4fe0af921 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -71,6 +71,9 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 
 
+
+
+
 
 
 
@@ -84,7 +87,14 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 
 <details>
-<summary><h4>June (27 entries)</h4></summary>
+<summary><h4>July (4 entries)</h4></summary>
+
+[View July 2026 Changelog](.github/changelogs/2026/07.md)
+
+</details>
+
+<details>
+<summary><h4>June (30 entries)</h4></summary>
 
 [View June 2026 Changelog](.github/changelogs/2026/06.md)
 
@@ -1134,137 +1144,4 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 💥 Breaking Changes
 
-    - update authentik to 2026.5.2 [@thieneret](https://github.com/thieneret) ([#14846](https://github.com/community-scripts/ProxmoxVE/pull/14846))
-
-## 2026-06-04
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Fix status messages for several alpine scripts [@tremor021](https://github.com/tremor021) ([#14911](https://github.com/community-scripts/ProxmoxVE/pull/14911))
-    - ReactiveResume: Fix Service Path [@MickLesk](https://github.com/MickLesk) ([#14926](https://github.com/community-scripts/ProxmoxVE/pull/14926))
-    - Jellyfin: install intel-igc deps before intel-opencl-icd to fix dependency order [@MickLesk](https://github.com/MickLesk) ([#14927](https://github.com/community-scripts/ProxmoxVE/pull/14927))
-
-  - #### 🔧 Refactor
-
-    - OpenThread-BR: use official GitHub releases [@tomfrenzel](https://github.com/tomfrenzel) ([#14916](https://github.com/community-scripts/ProxmoxVE/pull/14916))
-    - Grist: remove extra text at the end of installation [@tremor021](https://github.com/tremor021) ([#14905](https://github.com/community-scripts/ProxmoxVE/pull/14905))
-
-### ❔ Uncategorized
-
-  - chore(ct): sync sparkyfitness defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#14925](https://github.com/community-scripts/ProxmoxVE/pull/14925))
-
-## 2026-06-03
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Glance: Use separate directory for configuration files [@tremor021](https://github.com/tremor021) ([#14906](https://github.com/community-scripts/ProxmoxVE/pull/14906))
-
-### 💾 Core
-
-  - #### 🐞 Bug Fixes
-
-    - [core]: Fix alignment for `msg_` functions [@tremor021](https://github.com/tremor021) ([#14908](https://github.com/community-scripts/ProxmoxVE/pull/14908))
-
-## 2026-06-02
-
-### 🆕 New Scripts
-
-  - DDNS-Updater ([#14883](https://github.com/community-scripts/ProxmoxVE/pull/14883))
-- InvoiceShelf ([#14882](https://github.com/community-scripts/ProxmoxVE/pull/14882))
-- Certimate ([#14881](https://github.com/community-scripts/ProxmoxVE/pull/14881))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - OpenThread-BR: preserve config during update [@tomfrenzel](https://github.com/tomfrenzel) ([#14893](https://github.com/community-scripts/ProxmoxVE/pull/14893))
-    - infisical: fix update abort due to creds field mismatch (#14868) [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#14870](https://github.com/community-scripts/ProxmoxVE/pull/14870))
-
-  - #### ✨ New Features
-
-    - feat(degoog): enable default valkey cache integration [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#14871](https://github.com/community-scripts/ProxmoxVE/pull/14871))
-
-  - #### 🔧 Refactor
-
-    - chore: bump Node version in selected scripts [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#14873](https://github.com/community-scripts/ProxmoxVE/pull/14873))
-
-### 💾 Core
-
-  - #### ✨ New Features
-
-    - tools.func: add support for Rust installation profile in setup_rust [@MickLesk](https://github.com/MickLesk) ([#14872](https://github.com/community-scripts/ProxmoxVE/pull/14872))
-
-### 📂 Github
-
-  - fix(workflow): only flag node drift when local is behind upstream [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#14874](https://github.com/community-scripts/ProxmoxVE/pull/14874))
-
-## 2026-06-01
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - fix(dispatcharr): forward nginx port for M3U URLs on new installs [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#14862](https://github.com/community-scripts/ProxmoxVE/pull/14862))
-    - Set environment paths in service for apprise-api-install.sh [@SystemIdleProcess](https://github.com/SystemIdleProcess) ([#14805](https://github.com/community-scripts/ProxmoxVE/pull/14805))
-    - fix(fireshare): rebuild client on update to fix nginx 500 [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#14848](https://github.com/community-scripts/ProxmoxVE/pull/14848))
-    - Fix Kan build failure (TS7016 nodemailer) [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#14856](https://github.com/community-scripts/ProxmoxVE/pull/14856))
-    - fix(firefly): set Data Importer APP_URL for subdirectory install [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#14847](https://github.com/community-scripts/ProxmoxVE/pull/14847))
-    - kan: extend fetch_and_deploy_gh_tag to use 'latest' tag [@MickLesk](https://github.com/MickLesk) ([#14853](https://github.com/community-scripts/ProxmoxVE/pull/14853))
-    - Glance: preserve glance.yml across updates [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#14845](https://github.com/community-scripts/ProxmoxVE/pull/14845))
-    - NginxProxymanager: set Certbot version in npm.service environment variable (2.15.0) [@MickLesk](https://github.com/MickLesk) ([#14843](https://github.com/community-scripts/ProxmoxVE/pull/14843))
-    - [FileFlows] Fix service handling by using systemctl --all with quoted glob [@adrianmusante](https://github.com/adrianmusante) ([#14838](https://github.com/community-scripts/ProxmoxVE/pull/14838))
-
-  - #### ✨ New Features
-
-    - Kometa: also update Quickstart in update_script [@MickLesk](https://github.com/MickLesk) ([#14529](https://github.com/community-scripts/ProxmoxVE/pull/14529))
-
-## 2026-05-31
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Manyfold: regenerate Rails credentials on update to fix encryption mimatch [@MickLesk](https://github.com/MickLesk) ([#14817](https://github.com/community-scripts/ProxmoxVE/pull/14817))
-    - OpenThread-BR: use correct ipv6 configuration [@tomfrenzel](https://github.com/tomfrenzel) ([#14829](https://github.com/community-scripts/ProxmoxVE/pull/14829))
-
-  - #### 🔧 Refactor
-
-    - Webtrees: use PHP CLI for initial setup instead of curl to setup wizard [@MickLesk](https://github.com/MickLesk) ([#14818](https://github.com/community-scripts/ProxmoxVE/pull/14818))
-    - Kima-Hub: use curl_with_retry for ML model downloads to fix possible timeout issues [@MickLesk](https://github.com/MickLesk) ([#14816](https://github.com/community-scripts/ProxmoxVE/pull/14816))
-
-### 🧰 Tools
-
-  - #### 🔧 Refactor
-
-    - PBS4-Upgrade: update current PBS3 packages before switching to Trixie repos [@MickLesk](https://github.com/MickLesk) ([#14815](https://github.com/community-scripts/ProxmoxVE/pull/14815))
-
-## 2026-05-30
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Flatnotes: fix empty package name in pyproject.toml [@MickLesk](https://github.com/MickLesk) ([#14814](https://github.com/community-scripts/ProxmoxVE/pull/14814))
-
-## 2026-05-29
-
-### 🆕 New Scripts
-
-  - Kan ([#14776](https://github.com/community-scripts/ProxmoxVE/pull/14776))
-- Dynacat ([#14777](https://github.com/community-scripts/ProxmoxVE/pull/14777))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Fix lobehub docker path [@dannyyy](https://github.com/dannyyy) ([#14793](https://github.com/community-scripts/ProxmoxVE/pull/14793))
-    - karakeep: add more hdd space [@MickLesk](https://github.com/MickLesk) ([#14797](https://github.com/community-scripts/ProxmoxVE/pull/14797))
-    - Grist: Revert installation of EE [@tremor021](https://github.com/tremor021) ([#14784](https://github.com/community-scripts/ProxmoxVE/pull/14784))
-
-  - #### 🔧 Refactor
-
-    - Sure: Remove `$STD` for `systemctl enable -q` [@tremor021](https://github.com/tremor021) ([#14801](https://github.com/community-scripts/ProxmoxVE/pull/14801))
\ No newline at end of file
+    - update authentik to 2026.5.2 [@thieneret](https://github.com/thieneret) ([#14846](https://github.com/community-scripts/ProxmoxVE/pull/14846))
\ No newline at end of file

From 954da140f14fe91b861d01ca1a1647a5f66ba1b4 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Sun, 5 Jul 2026 00:21:27 +0000
Subject: [PATCH 018/220] Update CHANGELOG.md (#15600)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4fe0af921..02e01d7e8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -499,6 +499,8 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-07-05
+
 ## 2026-07-04
 
 ### 🚀 Updated Scripts

From a8aa1ba085962c95ec7727aae5303c1ba54dc593 Mon Sep 17 00:00:00 2001
From: "push-app-to-main[bot]"
 <203845782+push-app-to-main[bot]@users.noreply.github.com>
Date: Sun, 5 Jul 2026 21:34:42 +0200
Subject: [PATCH 019/220] excalidash (#15604)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Add excalidash (ct)

* Apply suggestion from @tremor021

---------

Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com>
Co-authored-by: Slaviša Arežina <58952836+tremor021@users.noreply.github.com>
---
 ct/excalidash.sh              |  79 +++++++++++++++++++
 ct/headers/excalidash         |   6 ++
 install/excalidash-install.sh | 139 ++++++++++++++++++++++++++++++++++
 3 files changed, 224 insertions(+)
 create mode 100644 ct/excalidash.sh
 create mode 100644 ct/headers/excalidash
 create mode 100644 install/excalidash-install.sh

diff --git a/ct/excalidash.sh b/ct/excalidash.sh
new file mode 100644
index 000000000..07f2f1764
--- /dev/null
+++ b/ct/excalidash.sh
@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/ZimengXiong/ExcaliDash
+
+APP="ExcaliDash"
+var_tags="${var_tags:-documents;drawing;collaboration}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/excalidash ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "excalidash" "ZimengXiong/ExcaliDash"; then
+    msg_info "Stopping Service"
+    systemctl stop excalidash
+    msg_ok "Stopped Service"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "excalidash" "ZimengXiong/ExcaliDash" "tarball"
+    ln -sf /opt/excalidash_data/.env /opt/excalidash/backend/.env
+    set -a && source /opt/excalidash_data/.env && set +a
+
+    msg_info "Configuring Database Provider (${DATABASE_PROVIDER:-sqlite})"
+    cd /opt/excalidash/backend
+    sed -i '/datasource db {/,/}/ s/provider = env("[^"]*")/provider = "'"${DATABASE_PROVIDER:-sqlite}"'"/' prisma/schema.prisma
+    mv prisma/migrations/"${DATABASE_PROVIDER:-sqlite}"/* prisma/migrations/
+    rm -rf prisma/migrations/postgresql prisma/migrations/sqlite
+    msg_ok "Configured Database Provider"
+
+    msg_info "Rebuilding Application"
+    $STD npm ci
+    $STD npx prisma generate
+    $STD npx tsc
+    cd /opt/excalidash/frontend
+    $STD npm ci
+    $STD npm run build
+    cp -r /opt/excalidash/frontend/dist/. /var/www/excalidash/
+    msg_ok "Rebuilt Application"
+
+    msg_info "Running Migrations"
+    cd /opt/excalidash/backend
+    $STD npx prisma migrate deploy
+    msg_ok "Ran Migrations"
+
+    msg_info "Starting Service"
+    systemctl start excalidash
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:6767${CL}"
diff --git a/ct/headers/excalidash b/ct/headers/excalidash
new file mode 100644
index 000000000..5fb762583
--- /dev/null
+++ b/ct/headers/excalidash
@@ -0,0 +1,6 @@
+    ______                ___ ____             __  
+   / ____/  ___________ _/ (_) __ \____ ______/ /_ 
+  / __/ | |/_/ ___/ __ `/ / / / / / __ `/ ___/ __ \
+ / /____>  </ /__/ /_/ / / / /_/ / /_/ (__  ) / / /
+/_____/_/|_|\___/\__,_/_/_/_____/\__,_/____/_/ /_/ 
+                                                   
diff --git a/install/excalidash-install.sh b/install/excalidash-install.sh
new file mode 100644
index 000000000..8b9ed3d0a
--- /dev/null
+++ b/install/excalidash-install.sh
@@ -0,0 +1,139 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/ZimengXiong/ExcaliDash
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  build-essential \
+  nginx
+msg_ok "Installed Dependencies"
+
+NODE_VERSION="20" setup_nodejs
+PG_VERSION="18" setup_postgresql
+PG_DB_NAME="excalidash" PG_DB_USER="excalidash" setup_postgresql_db
+
+fetch_and_deploy_gh_release "excalidash" "ZimengXiong/ExcaliDash" "tarball"
+
+msg_info "Configuring Database Provider"
+cd /opt/excalidash/backend
+sed -i '/datasource db {/,/}/ s/provider = env("[^"]*")/provider = "postgresql"/' prisma/schema.prisma
+sed -i '/datasource db {/,/}/ s/provider = "[^"]*"/provider = "postgresql"/' prisma/schema.prisma
+mv prisma/migrations/postgresql/* prisma/migrations/
+rm -rf prisma/migrations/sqlite prisma/migrations/postgresql
+msg_ok "Configured Database Provider"
+
+msg_info "Building Backend"
+cd /opt/excalidash/backend
+$STD npm ci
+$STD npx prisma generate
+$STD npx tsc
+msg_ok "Built Backend"
+
+msg_info "Building Frontend"
+cd /opt/excalidash/frontend
+$STD npm ci
+$STD npm run build
+msg_ok "Built Frontend"
+
+msg_info "Configuring Application"
+mkdir -p /opt/excalidash_data
+mkdir -p /var/www/excalidash
+cp -r /opt/excalidash/frontend/dist/. /var/www/excalidash/
+cat <<EOF >/opt/excalidash_data/.env
+DATABASE_PROVIDER=postgresql
+DATABASE_URL=postgresql://${PG_DB_USER}:${PG_DB_PASS}@localhost:5432/${PG_DB_NAME}
+PORT=8000
+NODE_ENV=production
+FRONTEND_URL=http://${LOCAL_IP}:6767
+AUTH_MODE=local
+TRUST_PROXY=false
+RUN_MIGRATIONS=false
+JWT_SECRET=$(openssl rand -hex 32)
+CSRF_SECRET=$(openssl rand -base64 32)
+EOF
+ln -sf /opt/excalidash_data/.env /opt/excalidash/backend/.env
+cd /opt/excalidash/backend
+set -a && source /opt/excalidash_data/.env && set +a
+$STD npx prisma migrate deploy
+msg_ok "Configured Application"
+
+msg_info "Configuring Nginx"
+cat <<EOF >/etc/nginx/sites-available/excalidash
+server {
+    listen 6767;
+    server_name _;
+    root /var/www/excalidash;
+    index index.html;
+    client_max_body_size 50M;
+
+    location /api/ {
+        proxy_pass http://127.0.0.1:8000/;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade \$http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+        proxy_read_timeout 300s;
+        proxy_send_timeout 300s;
+    }
+
+    location /socket.io/ {
+        proxy_pass http://127.0.0.1:8000/socket.io/;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade \$http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+        proxy_read_timeout 3600s;
+        proxy_send_timeout 3600s;
+    }
+
+    location / {
+        try_files \$uri \$uri/ /index.html;
+    }
+}
+EOF
+ln -sf /etc/nginx/sites-available/excalidash /etc/nginx/sites-enabled/excalidash
+rm -f /etc/nginx/sites-enabled/default
+systemctl reload nginx
+msg_ok "Configured Nginx"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/excalidash.service
+[Unit]
+Description=ExcaliDash Service
+After=network.target postgresql.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/excalidash/backend
+EnvironmentFile=/opt/excalidash/backend/.env
+ExecStart=/usr/bin/node dist/index.js
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now excalidash
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

From 4b71ee8b3a32ae4114a5de764e37a81a581f6d9b Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Sun, 5 Jul 2026 19:35:03 +0000
Subject: [PATCH 020/220] Update CHANGELOG.md (#15606)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 02e01d7e8..91681c18f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -501,6 +501,10 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ## 2026-07-05
 
+### 🆕 New Scripts
+
+  - excalidash ([#15604](https://github.com/community-scripts/ProxmoxVE/pull/15604))
+
 ## 2026-07-04
 
 ### 🚀 Updated Scripts

From d8c636eaef3e076745942f0c88ae9035e9d293ec Mon Sep 17 00:00:00 2001
From: Kevin O'Brien <irishpadres@users.noreply.github.com>
Date: Sun, 5 Jul 2026 16:03:56 -0400
Subject: [PATCH 021/220] immich: vacuum smart_search/face_search before
 VectorChord bump (#15607)

Co-authored-by: Kevin O'Brien <kevin@immich.kobrien.net>
---
 ct/immich.sh | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/ct/immich.sh b/ct/immich.sh
index 321889a09..77500920c 100644
--- a/ct/immich.sh
+++ b/ct/immich.sh
@@ -127,6 +127,11 @@ EOF
     VCHORD_RELEASE="1.0.0"
     [[ -f ~/.vchord_version ]] && mv ~/.vchord_version ~/.vectorchord
     if check_for_gh_release "VectorChord" "tensorchord/VectorChord" "${VCHORD_RELEASE}" "updated together with Immich after testing"; then
+      # dead tuples in smart_search/face_search make the REINDEX below fail with
+      # "missing chunk ... for toast value" on VectorChord 1.0.0 (#15588); must vacuum
+      # while still on the old extension version, a post-upgrade vacuum errors instead
+      $STD sudo -u postgres psql -d immich -c "VACUUM (ANALYZE) smart_search;"
+      $STD sudo -u postgres psql -d immich -c "VACUUM (ANALYZE) face_search;"
       fetch_and_deploy_gh_release "VectorChord" "tensorchord/VectorChord" "binary" "${VCHORD_RELEASE}" "/tmp" "postgresql-16-vchord_*_$(arch_resolve).deb"
       systemctl restart postgresql
       $STD sudo -u postgres psql -d immich -c "ALTER EXTENSION vector UPDATE;"

From 4ebae9f1c45d2cb6b55ce316d6fa28756e2bb362 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Sun, 5 Jul 2026 20:04:20 +0000
Subject: [PATCH 022/220] Update CHANGELOG.md (#15608)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 91681c18f..a0d13cf9d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -505,6 +505,12 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - excalidash ([#15604](https://github.com/community-scripts/ProxmoxVE/pull/15604))
 
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - immich: vacuum smart_search/face_search before VectorChord bump [@irishpadres](https://github.com/irishpadres) ([#15607](https://github.com/community-scripts/ProxmoxVE/pull/15607))
+
 ## 2026-07-04
 
 ### 🚀 Updated Scripts

From 86991b283daa00eb1e49d0b50c9da0b955a85f05 Mon Sep 17 00:00:00 2001
From: Tobias <96661824+CrazyWolf13@users.noreply.github.com>
Date: Sun, 5 Jul 2026 22:28:00 +0200
Subject: [PATCH 023/220] fix: homarr: cli (#15603)

---
 ct/homarr.sh              | 5 +++++
 install/homarr-install.sh | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/ct/homarr.sh b/ct/homarr.sh
index 82a27cfd6..620b147a9 100644
--- a/ct/homarr.sh
+++ b/ct/homarr.sh
@@ -35,6 +35,11 @@ function update_script() {
     systemctl stop redis-server
     msg_ok "Services Stopped"
 
+    if ! grep -q "source /opt/homarr.env" /usr/bin/homarr 2>/dev/null; then
+      echo $'#!/bin/bash\nset -a\nsource /opt/homarr.env\nset +a\ncd /opt/homarr/apps/cli && timeout 10 node ./cli.cjs "$@"' >/usr/bin/homarr
+      chmod +x /usr/bin/homarr
+    fi
+
     if ! { grep -q '^REDIS_IS_EXTERNAL=' /opt/homarr/.env 2>/dev/null || grep -q '^REDIS_IS_EXTERNAL=' /opt/homarr.env 2>/dev/null; }; then
       msg_info "Fixing old structure"
       systemctl disable -q --now nginx
diff --git a/install/homarr-install.sh b/install/homarr-install.sh
index 0a976b668..db89c2542 100644
--- a/install/homarr-install.sh
+++ b/install/homarr-install.sh
@@ -52,7 +52,7 @@ grep -q '^bind 127.0.0.1 -::1$' /etc/redis/redis.conf || echo "bind 127.0.0.1 -:
 rm -f /etc/nginx/nginx.conf
 mkdir -p /etc/nginx/templates
 cp /opt/homarr/nginx.conf /etc/nginx/templates/nginx.conf
-echo $'#!/bin/bash\ncd /opt/homarr/apps/cli && node ./cli.cjs "$@"' >/usr/bin/homarr
+echo $'#!/bin/bash\nset -a\nsource /opt/homarr.env\nset +a\ncd /opt/homarr/apps/cli && node ./cli.cjs "$@"' >/usr/bin/homarr
 chmod +x /usr/bin/homarr
 msg_ok "Copied config files"
 

From 417b0641a0d6196aadcce450ac17b9ccc96c6f10 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Sun, 5 Jul 2026 20:28:22 +0000
Subject: [PATCH 024/220] Update CHANGELOG.md (#15609)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a0d13cf9d..4c48a7a4b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -509,6 +509,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - fix: homarr: cli [@CrazyWolf13](https://github.com/CrazyWolf13) ([#15603](https://github.com/community-scripts/ProxmoxVE/pull/15603))
     - immich: vacuum smart_search/face_search before VectorChord bump [@irishpadres](https://github.com/irishpadres) ([#15607](https://github.com/community-scripts/ProxmoxVE/pull/15607))
 
 ## 2026-07-04

From 20740c3ca20adf808dc043eb00fd5f6aa468d005 Mon Sep 17 00:00:00 2001
From: MickLesk <mickey.leskowitz@gmail.com>
Date: Mon, 6 Jul 2026 14:38:07 +0200
Subject: [PATCH 025/220] fix(docker): remove interactive container update
 check from setup_docker

The 'Interactive Container Update Check' block scanned ALL running
Docker containers, pulled their images, then stopped and removed them
with only a message asking the user to manually recreate them.  This
is destructive and outside the scope of the Docker LXC update script,
which is responsible for updating the Docker engine itself and the
Portainer / Portainer-Agent containers that this script originally
installed.

Removes the entire block.  Updates now cover:
  - OS packages (apt)
  - Docker engine (via setup_docker / repo)
  - Portainer CE (if installed by this script)
  - Portainer Agent (if installed by this script)

Self-hosted / user-managed containers are intentionally left alone.

Fixes #15601
---
 misc/tools.func | 60 -------------------------------------------------
 1 file changed, 60 deletions(-)

diff --git a/misc/tools.func b/misc/tools.func
index 883c98da0..29bf34314 100644
--- a/misc/tools.func
+++ b/misc/tools.func
@@ -4641,66 +4641,6 @@ EOF
     fi
   fi
 
-  # Interactive Container Update Check
-  if [[ "${DOCKER_SKIP_UPDATES:-}" != "true" ]] && [ "$docker_installed" = true ] && ! _docker_is_noninteractive; then
-    msg_info "Checking for container updates"
-
-    # Get list of running containers with update status
-    local containers_with_updates=()
-    local container_info=()
-    local index=1
-
-    while IFS= read -r container; do
-      local name=$(echo "$container" | awk '{print $1}')
-      local image=$(echo "$container" | awk '{print $2}')
-      local current_digest=$(docker inspect "$name" --format='{{.Image}}' 2>/dev/null | cut -d':' -f2 | cut -c1-12)
-
-      # Pull latest image digest (ignore failures, e.g. local-only images or registry/permission issues)
-      docker pull "$image" >/dev/null 2>&1 || true
-      local latest_digest=$(docker inspect "$image" --format='{{.Id}}' 2>/dev/null | cut -d':' -f2 | cut -c1-12)
-
-      if [ -n "$latest_digest" ] && [ "$current_digest" != "$latest_digest" ]; then
-        containers_with_updates+=("$name")
-        container_info+=("${index}) ${name} (${image})")
-        ((index++))
-      fi
-    done < <(docker ps --format '{{.Names}} {{.Image}}')
-
-    if [ ${#containers_with_updates[@]} -gt 0 ]; then
-      echo ""
-      echo "${TAB3}Container updates available:"
-      for info in "${container_info[@]}"; do
-        echo "${TAB3}  $info"
-      done
-      echo ""
-      read -r -p "${TAB3}Select containers to update (e.g., 1,3,5 or 'all' or 'none'): " selection
-
-      if [[ ${selection,,} == "all" ]]; then
-        for container in "${containers_with_updates[@]}"; do
-          msg_info "Updating container: $container"
-          docker stop "$container"
-          docker rm "$container"
-          # Note: This requires the original docker run command - best to recreate via compose
-          msg_ok "Stopped and removed $container (please recreate with updated image)"
-        done
-      elif [[ ${selection,,} != "none" ]]; then
-        IFS=',' read -ra SELECTED <<<"$selection"
-        for num in "${SELECTED[@]}"; do
-          num=$(echo "$num" | xargs) # trim whitespace
-          if [[ "$num" =~ ^[0-9]+$ ]] && [ "$num" -ge 1 ] && [ "$num" -le "${#containers_with_updates[@]}" ]; then
-            container="${containers_with_updates[$((num - 1))]}"
-            msg_info "Updating container: $container"
-            docker stop "$container"
-            docker rm "$container"
-            msg_ok "Stopped and removed $container (please recreate with updated image)"
-          fi
-        done
-      fi
-    else
-      msg_ok "All containers are up-to-date"
-    fi
-  fi
-
   msg_ok "Docker setup completed"
 }
 

From 728726d5ccac635527c34e7ae1280510d1473abe Mon Sep 17 00:00:00 2001
From: MickLesk <mickey.leskowitz@gmail.com>
Date: Mon, 6 Jul 2026 14:43:25 +0200
Subject: [PATCH 026/220] fix(docker): safe, interactive per-container update
 check
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace the destructive multi-select container update block with a
proper per-container Y/N workflow:

- Unattended / non-interactive (DOCKER_NONINTERACTIVE=1 or no tty):
  skip silently -- no docker pulls, no prompts.
- Interactive: stop_spinner() before any prompt to keep the terminal
  clean, then for each container with a newer image:
    Compose-managed  → prompt Y/N (auto-no after 60 s)
                       → on Y: docker compose pull <service> &&
                                docker compose up -d <service>
    Standalone run   → prompt Y/N (auto-no after 60 s)
                       → on Y: docker pull only; no stop/rm;
                                user is told to recreate manually
- portainer / portainer_agent are excluded (handled earlier in
  setup_docker)

The old code always stopped and removed the container without
recreating it, leaving users with a destroyed service.  Standalone
containers without a Compose project can never be auto-recreated
safely, so only the image is pulled.

Fixes #15601
---
 misc/tools.func | 84 ++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 83 insertions(+), 1 deletion(-)

diff --git a/misc/tools.func b/misc/tools.func
index 29bf34314..e8e18f4f3 100644
--- a/misc/tools.func
+++ b/misc/tools.func
@@ -4454,7 +4454,9 @@ setup_composer() {
 #   - Uses stable distro packages by default
 #   - Migrates from get.docker.com to repository-based installation
 #   - Updates Docker Engine if newer version available
-#   - Interactive container update with multi-select
+#   - Interactive per-container update prompt (Y/N, 60 s auto-no)
+#   - Compose-managed containers: full restart via docker compose
+#   - Standalone containers: image pull only, no destructive stop/rm
 #   - Portainer installation and update support
 #   - Set DOCKER_NONINTERACTIVE=1 to skip interactive prompts (CI/unattended)
 # ------------------------------------------------------------------------------
@@ -4641,6 +4643,86 @@ EOF
     fi
   fi
 
+  # Container Update Check
+  # - Skipped entirely when running unattended / non-interactive
+  # - Compose-managed containers: offered via Y/N → docker compose pull + up -d
+  # - Standalone containers: offered via Y/N → image pull only (no stop/rm)
+  if [ "$docker_installed" = true ] && ! _docker_is_noninteractive; then
+    msg_info "Checking for container updates"
+
+    local name image compose_workdir compose_service current_digest latest_digest
+    local compose_updates=()
+    local standalone_updates=()
+
+    while IFS= read -r line; do
+      name=$(echo "$line" | awk '{print $1}')
+      image=$(echo "$line" | awk '{print $2}')
+
+      # Portainer containers are handled by the dedicated block above
+      [[ "$name" == "portainer" || "$name" == "portainer_agent" ]] && continue
+
+      current_digest=$(docker inspect "$name" --format='{{.Image}}' 2>/dev/null | cut -d':' -f2 | cut -c1-12)
+      docker pull "$image" >/dev/null 2>&1 || continue
+      latest_digest=$(docker inspect "$image" --format='{{.Id}}' 2>/dev/null | cut -d':' -f2 | cut -c1-12)
+      [[ -z "$latest_digest" || "$current_digest" == "$latest_digest" ]] && continue
+
+      compose_workdir=$(docker inspect "$name" \
+        --format='{{index .Config.Labels "com.docker.compose.project.working_dir"}}' 2>/dev/null || true)
+      compose_service=$(docker inspect "$name" \
+        --format='{{index .Config.Labels "com.docker.compose.service"}}' 2>/dev/null || true)
+
+      if [[ -n "$compose_workdir" && -n "$compose_service" && -d "$compose_workdir" ]]; then
+        compose_updates+=("${name}|${image}|${compose_workdir}|${compose_service}")
+      else
+        standalone_updates+=("${name}|${image}")
+      fi
+    done < <(docker ps --format '{{.Names}} {{.Image}}')
+
+    # Stop spinner before any interactive prompt
+    stop_spinner
+
+    if [[ ${#compose_updates[@]} -eq 0 && ${#standalone_updates[@]} -eq 0 ]]; then
+      msg_ok "All containers are up-to-date"
+    else
+      local reply
+      for entry in "${compose_updates[@]}"; do
+        IFS='|' read -r name image compose_workdir compose_service <<<"$entry"
+        reply=""
+        if read -r -t 60 -p "${TAB3}Update ${name} (${image}) via Compose? <y/N> (auto-no in 60s): " reply; then
+          echo ""
+        else
+          echo ""
+        fi
+        if [[ "${reply,,}" =~ ^(y|yes)$ ]]; then
+          msg_info "Updating $name"
+          if (cd "$compose_workdir" && $STD docker compose pull "$compose_service" && $STD docker compose up -d "$compose_service"); then
+            msg_ok "Updated $name"
+          else
+            msg_warn "Could not update $name — try manually in $compose_workdir"
+          fi
+        fi
+      done
+
+      for entry in "${standalone_updates[@]}"; do
+        IFS='|' read -r name image <<<"$entry"
+        reply=""
+        if read -r -t 60 -p "${TAB3}Pull new image for ${name} (${image})? <y/N> (auto-no in 60s): " reply; then
+          echo ""
+        else
+          echo ""
+        fi
+        if [[ "${reply,,}" =~ ^(y|yes)$ ]]; then
+          msg_info "Pulling new image for $name"
+          if $STD docker pull "$image"; then
+            msg_ok "New image available for $name — recreate the container to apply the update"
+          else
+            msg_warn "Failed to pull image for $name"
+          fi
+        fi
+      done
+    fi
+  fi
+
   msg_ok "Docker setup completed"
 }
 

From 93ce08aa72d6fde738a7328f4fb4ec78b82f87ae Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 12:44:28 +0000
Subject: [PATCH 027/220] Update CHANGELOG.md (#15616)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4c48a7a4b..af1d268f1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -499,6 +499,8 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-07-06
+
 ## 2026-07-05
 
 ### 🆕 New Scripts

From 555953117c76a17f75521247bcbd2cbd1c6ed303 Mon Sep 17 00:00:00 2001
From: Sam Heinz <sam@samheinz.com>
Date: Mon, 6 Jul 2026 23:00:41 +1000
Subject: [PATCH 028/220] fix(plane): don't clobber global app var, breaking
 /usr/bin/update (#15612)

---
 install/plane-install.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/install/plane-install.sh b/install/plane-install.sh
index 2c03938a3..d481c6551 100644
--- a/install/plane-install.sh
+++ b/install/plane-install.sh
@@ -85,8 +85,8 @@ VITE_SPACE_BASE_PATH=/spaces
 VITE_LIVE_BASE_URL=http://${LOCAL_IP}
 VITE_LIVE_BASE_PATH=/live"
 # Each Vite app needs its own .env for the build
-for app in web admin space; do
-    echo "$FRONTEND_ENV" >/opt/plane/apps/${app}/.env
+for frontend_app in web admin space; do
+    echo "$FRONTEND_ENV" >/opt/plane/apps/${frontend_app}/.env
 done
 export NODE_OPTIONS="--max-old-space-size=4096"
 export COREPACK_ENABLE_DOWNLOAD_PROMPT=0

From 81d6b2beeea2032529790e8eda19c9443243ba23 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 13:01:09 +0000
Subject: [PATCH 029/220] Update CHANGELOG.md (#15617)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index af1d268f1..d3b266ab5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -501,6 +501,12 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ## 2026-07-06
 
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(plane): don't clobber global app var, breaking /usr/bin/update [@asylumexp](https://github.com/asylumexp) ([#15612](https://github.com/community-scripts/ProxmoxVE/pull/15612))
+
 ## 2026-07-05
 
 ### 🆕 New Scripts

From 68cc4f3da7ac91f6a6ecbb63159f63051bf35033 Mon Sep 17 00:00:00 2001
From: Chris <punk.sand7393@fastmail.com>
Date: Mon, 6 Jul 2026 09:38:39 -0400
Subject: [PATCH 030/220] Immich: Update libvips to 8.18.4 (#15619)

---
 ct/immich.sh              | 2 +-
 install/immich-install.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/ct/immich.sh b/ct/immich.sh
index 77500920c..48ae7ceda 100644
--- a/ct/immich.sh
+++ b/ct/immich.sh
@@ -471,7 +471,7 @@ function compile_imagemagick() {
 
 function compile_libvips() {
   SOURCE=$SOURCE_DIR/libvips
-  LIBVIPS_REVISION="3664cfc5dc2c5661288f5bf5a85ccc51c64c1626"
+  LIBVIPS_REVISION="e01a4797cabe77d457fdfa7d776b7a7e7ca6d6a7"
   if [[ "$LIBVIPS_REVISION" != "$(grep 'libvips' ~/.immich_library_revisions | awk '{print $2}')" ]]; then
     msg_info "Recompiling libvips"
     [[ -d "$SOURCE" ]] && rm -rf "$SOURCE"
diff --git a/install/immich-install.sh b/install/immich-install.sh
index 9270b29e1..fcaad3e0b 100644
--- a/install/immich-install.sh
+++ b/install/immich-install.sh
@@ -282,7 +282,7 @@ msg_ok "(4/5) Compiled imagemagick"
 
 msg_info "(5/5) Compiling libvips"
 SOURCE=$SOURCE_DIR/libvips
-LIBVIPS_REVISION="3664cfc5dc2c5661288f5bf5a85ccc51c64c1626"
+LIBVIPS_REVISION="e01a4797cabe77d457fdfa7d776b7a7e7ca6d6a7"
 $STD git clone https://github.com/libvips/libvips.git "$SOURCE"
 cd "$SOURCE"
 $STD git reset --hard "$LIBVIPS_REVISION"

From 766f8519a3ccabdcdef30223afffbb894223903d Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 13:39:09 +0000
Subject: [PATCH 031/220] Update CHANGELOG.md (#15620)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d3b266ab5..d7b63cd8a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -503,6 +503,8 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ### 🚀 Updated Scripts
 
+  - Immich: Update libvips to 8.18.4 [@vhsdream](https://github.com/vhsdream) ([#15619](https://github.com/community-scripts/ProxmoxVE/pull/15619))
+
   - #### 🐞 Bug Fixes
 
     - fix(plane): don't clobber global app var, breaking /usr/bin/update [@asylumexp](https://github.com/asylumexp) ([#15612](https://github.com/community-scripts/ProxmoxVE/pull/15612))

From 7027d67eb3a2080cfdef33b2c4547d9640ac3ba8 Mon Sep 17 00:00:00 2001
From: Sam Heinz <sam@samheinz.com>
Date: Mon, 6 Jul 2026 23:41:55 +1000
Subject: [PATCH 032/220] attempt to port docker-vm to support arm64 (#15611)

---
 misc/vm-core.func | 15 +++++++++++----
 vm/docker-vm.sh   | 33 ++++++++++++++++++++++++++-------
 2 files changed, 37 insertions(+), 11 deletions(-)

diff --git a/misc/vm-core.func b/misc/vm-core.func
index 8ad2dfc37..da9ee5584 100644
--- a/misc/vm-core.func
+++ b/misc/vm-core.func
@@ -620,12 +620,19 @@ pve_check() {
 }
 
 arch_check() {
-  if [ "$(dpkg --print-architecture)" != "amd64" ]; then
-    echo -e "\n ${INFO}${YWB}This script will not work with PiMox! \n"
-    echo -e "\n ${YWB}Visit https://github.com/asylumexp/Proxmox for ARM64 support. \n"
+  local arch
+  arch="$(dpkg --print-architecture)"
+  if [[ "$arch" != "amd64" && "$arch" != "arm64" ]]; then
+    msg_error "This script requires amd64 or arm64."
     echo -e "Exiting..."
     sleep 2
-    exit
+    exit 106
+  fi
+  if [[ "$arch" == "arm64" && "${var_arm64:-}" != "yes" ]]; then
+    echo -e "\n ${INFO}${YWB}This script does not yet support ARM64! \n"
+    echo -e "Exiting..."
+    sleep 2
+    exit 106
   fi
 }
 
diff --git a/vm/docker-vm.sh b/vm/docker-vm.sh
index 194470a40..35d247333 100644
--- a/vm/docker-vm.sh
+++ b/vm/docker-vm.sh
@@ -11,7 +11,6 @@
 source <(curl -fsSL https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/misc/api.func) 2>/dev/null
 source <(curl -fsSL https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/misc/vm-core.func) 2>/dev/null
 source <(curl -fsSL https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/misc/cloud-init.func) 2>/dev/null || true
-load_functions
 
 # ==============================================================================
 # SCRIPT VARIABLES
@@ -21,6 +20,7 @@ APP_TYPE="vm"
 NSAPP="docker-vm"
 var_os="debian"
 var_version="13"
+ARCH=$(dpkg --print-architecture)
 
 GEN_MAC=02:$(openssl rand -hex 5 | awk '{print toupper($0)}' | sed 's/\(..\)/\1:/g; s/.$//')
 RANDOM_UUID="$(cat /proc/sys/kernel/random/uuid)"
@@ -30,6 +30,9 @@ USE_CLOUD_INIT="no"
 OS_TYPE=""
 OS_VERSION=""
 THIN="discard=on,ssd=1,"
+var_arm64="yes"
+
+load_functions
 
 # ==============================================================================
 # ERROR HANDLING & CLEANUP
@@ -136,11 +139,16 @@ function default_settings() {
 
   VMID=$(get_valid_nextid)
   FORMAT=""
-  MACHINE=" -machine q35"
+  if [ "$ARCH" = "arm64" ]; then
+    MACHINE=""
+    CPU_TYPE=""
+  else
+    MACHINE=" -machine q35"
+    CPU_TYPE=" -cpu host"
+  fi
   DISK_CACHE=""
   DISK_SIZE="10G"
   HN="docker"
-  CPU_TYPE=" -cpu host"
   CORE_COUNT="2"
   RAM_SIZE="4096"
   BRG="vmbr0"
@@ -151,11 +159,15 @@ function default_settings() {
   METHOD="default"
 
   echo -e "${CONTAINERID}${BOLD}${DGN}Virtual Machine ID: ${BGN}${VMID}${CL}"
-  echo -e "${CONTAINERTYPE}${BOLD}${DGN}Machine Type: ${BGN}Q35 (Modern)${CL}"
+  if [ "$ARCH" = "arm64" ]; then
+    echo -e "${CONTAINERTYPE}${BOLD}${DGN}Machine Type: ${BGN}virt (ARM64)${CL}"
+  else
+    echo -e "${CONTAINERTYPE}${BOLD}${DGN}Machine Type: ${BGN}Q35 (Modern)${CL}"
+  fi
   echo -e "${DISKSIZE}${BOLD}${DGN}Disk Size: ${BGN}${DISK_SIZE}${CL}"
   echo -e "${DISKSIZE}${BOLD}${DGN}Disk Cache: ${BGN}None${CL}"
   echo -e "${HOSTNAME}${BOLD}${DGN}Hostname: ${BGN}${HN}${CL}"
-  echo -e "${OS}${BOLD}${DGN}CPU Model: ${BGN}Host${CL}"
+  echo -e "${OS}${BOLD}${DGN}CPU Model: ${BGN}$([ "$ARCH" = "arm64" ] && echo "Default" || echo "Host")${CL}"
   echo -e "${CPUCORE}${BOLD}${DGN}CPU Cores: ${BGN}${CORE_COUNT}${CL}"
   echo -e "${RAMSIZE}${BOLD}${DGN}RAM Size: ${BGN}${RAM_SIZE}${CL}"
   echo -e "${BRIDGE}${BOLD}${DGN}Bridge: ${BGN}${BRG}${CL}"
@@ -197,7 +209,11 @@ function advanced_settings() {
   done
 
   # Machine Type
-  if MACH=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "MACHINE TYPE" --radiolist --cancel-button Exit-Script "Choose Type" 10 58 2 \
+  if [ "$ARCH" = "arm64" ]; then
+    FORMAT=""
+    MACHINE=""
+    echo -e "${CONTAINERTYPE}${BOLD}${DGN}Machine Type: ${BGN}virt${CL}"
+  elif MACH=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "MACHINE TYPE" --radiolist --cancel-button Exit-Script "Choose Type" 10 58 2 \
     "q35" "Q35 (Modern, PCIe)" ON \
     "i440fx" "i440fx (Legacy, PCI)" OFF \
     3>&1 1>&2 2>&3); then
@@ -262,7 +278,10 @@ function advanced_settings() {
   fi
 
   # CPU Model
-  if CPU_TYPE1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "CPU MODEL" --radiolist "Choose" --cancel-button Exit-Script 10 58 2 \
+  if [ "$ARCH" = "arm64" ]; then
+    CPU_TYPE=""
+    echo -e "${OS}${BOLD}${DGN}CPU Model: ${BGN}Default${CL}"
+  elif CPU_TYPE1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "CPU MODEL" --radiolist "Choose" --cancel-button Exit-Script 10 58 2 \
     "1" "Host (Recommended)" ON \
     "0" "KVM64" OFF \
     3>&1 1>&2 2>&3); then

From bff3c6932a0f699d1f1934485c40a772ad9a0655 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 13:42:23 +0000
Subject: [PATCH 033/220] Update CHANGELOG.md (#15621)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d7b63cd8a..8bdbe2bf7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -507,6 +507,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - attempt to port docker-vm to support arm64 [@asylumexp](https://github.com/asylumexp) ([#15611](https://github.com/community-scripts/ProxmoxVE/pull/15611))
     - fix(plane): don't clobber global app var, breaking /usr/bin/update [@asylumexp](https://github.com/asylumexp) ([#15612](https://github.com/community-scripts/ProxmoxVE/pull/15612))
 
 ## 2026-07-05

From c5f905ccf1a32d2cfe73349df4371cee755e17b9 Mon Sep 17 00:00:00 2001
From: Austin <austin@pilz.dev>
Date: Mon, 6 Jul 2026 14:18:09 -0400
Subject: [PATCH 034/220] cliproxyapi: point setup message at /management.html
 (#15628)

The completion message previously pointed to the bare host:port,
which serves the proxy API rather than the admin UI. Provider
authentication happens at /management.html.

Co-authored-by: root <root@paperclip.pilz.dev>
---
 ct/cliproxyapi.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/ct/cliproxyapi.sh b/ct/cliproxyapi.sh
index cffa0fc17..9eb49a1a6 100644
--- a/ct/cliproxyapi.sh
+++ b/ct/cliproxyapi.sh
@@ -52,5 +52,5 @@ description
 
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:8317${CL}"
+echo -e "${INFO}${YW}Authenticate your AI providers via the management panel at:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8317/management.html${CL}"

From 87ccf49dc32f47a9e843e1fb1768cce455b71bb0 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 18:18:31 +0000
Subject: [PATCH 035/220] Update CHANGELOG.md (#15629)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8bdbe2bf7..c6fdda187 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -510,6 +510,10 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
     - attempt to port docker-vm to support arm64 [@asylumexp](https://github.com/asylumexp) ([#15611](https://github.com/community-scripts/ProxmoxVE/pull/15611))
     - fix(plane): don't clobber global app var, breaking /usr/bin/update [@asylumexp](https://github.com/asylumexp) ([#15612](https://github.com/community-scripts/ProxmoxVE/pull/15612))
 
+  - #### 🔧 Refactor
+
+    - cliproxyapi: point setup message at /management.html [@austinpilz](https://github.com/austinpilz) ([#15628](https://github.com/community-scripts/ProxmoxVE/pull/15628))
+
 ## 2026-07-05
 
 ### 🆕 New Scripts

From fe7de5e26cec5587f27e1b33b23d0ca4f6d6ab33 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Slavi=C5=A1a=20Are=C5=BEina?=
 <58952836+tremor021@users.noreply.github.com>
Date: Mon, 6 Jul 2026 20:18:45 +0200
Subject: [PATCH 036/220] Update URL format in rustdeskserver.sh (#15626)

---
 ct/rustdeskserver.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ct/rustdeskserver.sh b/ct/rustdeskserver.sh
index 921ab1130..8831bda20 100644
--- a/ct/rustdeskserver.sh
+++ b/ct/rustdeskserver.sh
@@ -60,4 +60,4 @@ description
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}${IP}:21114${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:21114${CL}"

From e00df4fd6e3cd4d8f62fe290ff5d738b9e5c4279 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 18:18:57 +0000
Subject: [PATCH 037/220] Update CHANGELOG.md (#15630)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c6fdda187..c67f8c59a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -507,6 +507,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - RustDesk Server: Update URL format in rustdeskserver.sh [@tremor021](https://github.com/tremor021) ([#15626](https://github.com/community-scripts/ProxmoxVE/pull/15626))
     - attempt to port docker-vm to support arm64 [@asylumexp](https://github.com/asylumexp) ([#15611](https://github.com/community-scripts/ProxmoxVE/pull/15611))
     - fix(plane): don't clobber global app var, breaking /usr/bin/update [@asylumexp](https://github.com/asylumexp) ([#15612](https://github.com/community-scripts/ProxmoxVE/pull/15612))
 

From 0102d5bd83e79970f73241072be8b36aebe8151b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Slavi=C5=A1a=20Are=C5=BEina?=
 <58952836+tremor021@users.noreply.github.com>
Date: Mon, 6 Jul 2026 21:15:04 +0200
Subject: [PATCH 039/220] fix alignment in various ct end messages (#15632)

---
 ct/alpine-cinny.sh      |   4 +-
 ct/apache-airflow.sh    |   6 +-
 ct/authentik.sh         | 120 ++++++++++++++++++++--------------------
 ct/baserow.sh           |   4 +-
 ct/bookorbit.sh         |   4 +-
 ct/clickhouse.sh        |   4 +-
 ct/cross-seed.sh        |   2 +-
 ct/cyberchef.sh         |   8 +--
 ct/etherpad.sh          |   4 +-
 ct/excalidash.sh        |   4 +-
 ct/feishin.sh           |   4 +-
 ct/flame.sh             |   6 +-
 ct/fmd-server.sh        |   4 +-
 ct/hev-socks5-server.sh |   3 +-
 ct/iventoy.sh           |   4 +-
 ct/kiwix.sh             |   8 +--
 ct/koffan.sh            |   4 +-
 ct/kometa.sh            |   2 +-
 ct/loki.sh              |  62 ++++++++++-----------
 ct/lyrionmusicserver.sh |   4 +-
 ct/matterjs-server.sh   |   8 +--
 ct/netbird.sh           |   2 +-
 ct/paperclip.sh         |   4 +-
 ct/pinchflat.sh         |   4 +-
 ct/plane.sh             |  12 ++--
 ct/postiz.sh            |   7 +--
 ct/rackula.sh           |   4 +-
 ct/shlink.sh            |   2 +-
 ct/snapotter.sh         |   4 +-
 ct/spliit.sh            |   4 +-
 ct/tolgee.sh            |   4 +-
 ct/twenty.sh            |   9 ++-
 ct/xyops.sh             |   4 +-
 33 files changed, 163 insertions(+), 166 deletions(-)

diff --git a/ct/alpine-cinny.sh b/ct/alpine-cinny.sh
index 72c93f3e6..17a6019ae 100644
--- a/ct/alpine-cinny.sh
+++ b/ct/alpine-cinny.sh
@@ -54,5 +54,5 @@ description
 
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following IP:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:8080${CL}"
+echo -e "${INFO}${YW}Access it using the following IP:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8080${CL}"
diff --git a/ct/apache-airflow.sh b/ct/apache-airflow.sh
index d6a331177..2a97f914d 100644
--- a/ct/apache-airflow.sh
+++ b/ct/apache-airflow.sh
@@ -33,7 +33,7 @@ function update_script() {
   INSTALLED=$(cat ~/.airflow 2>/dev/null || echo "0")
   LATEST=$(curl -fsSL "https://pypi.org/pypi/apache-airflow/json" | jq -r '.info.version')
 
-  if [[ "$INSTALLED" == "$LATEST" ]]; then
+  if [[ $INSTALLED == "$LATEST" ]]; then
     msg_ok "Already on the latest version (${LATEST})"
     exit
   fi
@@ -71,5 +71,5 @@ description
 
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:8080${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8080${CL}"
diff --git a/ct/authentik.sh b/ct/authentik.sh
index b857bcff4..c8b99db82 100644
--- a/ct/authentik.sh
+++ b/ct/authentik.sh
@@ -30,7 +30,7 @@ function update_script() {
     exit
   fi
 
-  read -r MAJOR MINOR PATCH <<< "$(sed 's/^version\///; s/\./ /g' "$HOME/.authentik")"
+  read -r MAJOR MINOR PATCH <<<"$(sed 's/^version\///; s/\./ /g' "$HOME/.authentik")"
 
   msg_info "Update dependencies"
   ensure_dependencies crossbuild-essential-$(arch_resolve) gcc-$(arch_resolve "x86-64" "aarch64")-linux-gnu cmake clang libunwind-18-dev
@@ -66,26 +66,26 @@ function update_script() {
   if check_for_gh_release "authentik" "goauthentik/authentik" "${AUTHENTIK_VERSION}"; then
     msg_info "Stopping Services"
     systemctl stop authentik-server authentik-worker
-	if [[ $(systemctl is-active authentik-ldap) == active ]]; then
-		systemctl stop authentik-ldap
-	fi
-	if [[ $(systemctl is-active authentik-rac) == active ]]; then
-		systemctl stop authentik-rac
-	fi
-	if [[ $(systemctl is-active authentik-radius) == active ]]; then
-		systemctl stop authentik-radius
-	fi
+    if [[ $(systemctl is-active authentik-ldap) == active ]]; then
+      systemctl stop authentik-ldap
+    fi
+    if [[ $(systemctl is-active authentik-rac) == active ]]; then
+      systemctl stop authentik-rac
+    fi
+    if [[ $(systemctl is-active authentik-radius) == active ]]; then
+      systemctl stop authentik-radius
+    fi
     msg_ok "Stopped Services"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
 
-	msg_info "Configuring rust"
-	cd /opt/authentik
-	$STD rustup install
-	$STD rustup default "$(sed -n 's/channel = "\(.*\)"/\1/p' rust-toolchain.toml)"
-	msg_ok "Configured rust"
+    msg_info "Configuring rust"
+    cd /opt/authentik
+    $STD rustup install
+    $STD rustup default "$(sed -n 's/channel = "\(.*\)"/\1/p' rust-toolchain.toml)"
+    msg_ok "Configured rust"
 
-	msg_info "Updating web"
+    msg_info "Updating web"
     cd /opt/authentik/web
     export NODE_ENV="production"
     $STD npm install
@@ -99,18 +99,18 @@ function update_script() {
     export CC="$(arch_resolve "x86_64" "aarch64")-linux-gnu-gcc"
     $STD go mod download
     $STD go build -o /opt/authentik/authentik-server ./cmd/server
-	$STD go build -o /opt/authentik/ldap ./cmd/ldap
-	$STD go build -o /opt/authentik/rac ./cmd/rac
-	$STD go build -o /opt/authentik/radius ./cmd/radius
+    $STD go build -o /opt/authentik/ldap ./cmd/ldap
+    $STD go build -o /opt/authentik/rac ./cmd/rac
+    $STD go build -o /opt/authentik/radius ./cmd/radius
     msg_ok "Updated go proxy"
 
-	msg_info "Building worker"
-	export AWS_LC_FIPS_SYS_CC="clang"
-	cd /opt/authentik
-	$STD cargo build --package authentik --no-default-features --features core --locked --release --jobs 1
-	cp ./target/release/authentik /opt/authentik/authentik-worker
-	rm -r ./target
-	msg_ok "Built worker"
+    msg_info "Building worker"
+    export AWS_LC_FIPS_SYS_CC="clang"
+    cd /opt/authentik
+    $STD cargo build --package authentik --no-default-features --features core --locked --release --jobs 1
+    cp ./target/release/authentik /opt/authentik/authentik-worker
+    rm -r ./target
+    msg_ok "Built worker"
 
     msg_info "Updating python server"
     export UV_NO_BINARY_PACKAGE="cryptography lxml python-kadmin-rs xmlsec"
@@ -125,26 +125,26 @@ function update_script() {
     msg_ok "Updated python server"
 
     if [[ $MAJOR == 2026 && $MINOR -lt 5 ]]; then
-	  msg_info "Updating Worker and Server config"
-	  cp /etc/authentik/config.yml /etc/authentik/config.bak
-	  yq -i ".postgresql.conn_max_age = 0" /etc/authentik/config.yml
-	  yq -i ".postgresql.conn_health_checks = false" /etc/authentik/config.yml
-	  yq -i ".listen.debug_tokio = \"[::]:6669\"" /etc/authentik/config.yml
-      yq -i ".log.rust_log.console_subscriber = \"info\"" /etc/authentik/config.yml
-      yq -i ".log.rust_log.h2 = \"info\""  /etc/authentik/config.yml
-      yq -i ".log.rust_log.hyper_util = \"warn\"" /etc/authentik/config.yml
-      yq -i ".log.rust_log.mio = \"info\"" /etc/authentik/config.yml
-      yq -i ".log.rust_log.notify = \"info\"" /etc/authentik/config.yml
-	  yq -i ".log.rust_log.reqwest = \"info\"" /etc/authentik/config.yml
-      yq -i ".log.rust_log.runtime = \"info\"" /etc/authentik/config.yml
-      yq -i ".log.rust_log.rustls = \"info\"" /etc/authentik/config.yml
-      yq -i ".log.rust_log.sqlx = \"info\"" /etc/authentik/config.yml
-      yq -i ".log.rust_log.sqlx_postgres = \"info\"" /etc/authentik/config.yml
-      yq -i ".log.rust_log.tokio = \"info\"" /etc/authentik/config.yml
-      yq -i ".log.rust_log.tungstenite = \"info\"" /etc/authentik/config.yml
-	  yq -i ".web.workers = 2" /etc/authentik/config.yml
-	  mv /etc/default/authentik /etc/default/authentik.bak
-	  cat <<EOF >/etc/default/authentik-server
+      msg_info "Updating Worker and Server config"
+      cp /etc/authentik/config.yml /etc/authentik/config.bak
+      yq -i ".postgresql.conn_max_age = 0" /etc/authentik/config.yml
+      yq -i ".postgresql.conn_health_checks = false" /etc/authentik/config.yml
+      yq -i '.listen.debug_tokio = "[::]:6669"' /etc/authentik/config.yml
+      yq -i '.log.rust_log.console_subscriber = "info"' /etc/authentik/config.yml
+      yq -i '.log.rust_log.h2 = "info"' /etc/authentik/config.yml
+      yq -i '.log.rust_log.hyper_util = "warn"' /etc/authentik/config.yml
+      yq -i '.log.rust_log.mio = "info"' /etc/authentik/config.yml
+      yq -i '.log.rust_log.notify = "info"' /etc/authentik/config.yml
+      yq -i '.log.rust_log.reqwest = "info"' /etc/authentik/config.yml
+      yq -i '.log.rust_log.runtime = "info"' /etc/authentik/config.yml
+      yq -i '.log.rust_log.rustls = "info"' /etc/authentik/config.yml
+      yq -i '.log.rust_log.sqlx = "info"' /etc/authentik/config.yml
+      yq -i '.log.rust_log.sqlx_postgres = "info"' /etc/authentik/config.yml
+      yq -i '.log.rust_log.tokio = "info"' /etc/authentik/config.yml
+      yq -i '.log.rust_log.tungstenite = "info"' /etc/authentik/config.yml
+      yq -i ".web.workers = 2" /etc/authentik/config.yml
+      mv /etc/default/authentik /etc/default/authentik.bak
+      cat <<EOF >/etc/default/authentik-server
 TMPDIR=/dev/shm/
 UV_LINK_MODE=copy
 UV_PYTHON_DOWNLOADS=0
@@ -159,7 +159,7 @@ AUTHENTIK_LISTEN__HTTP="[::]:9000"
 AUTHENTIK_LISTEN__HTTPS="[::]:9443"
 AUTHENTIK_LISTEN__METRICS="[::]:9300"
 EOF
-	  cat <<EOF >/etc/default/authentik-worker
+      cat <<EOF >/etc/default/authentik-worker
 TMPDIR=/dev/shm/
 UV_LINK_MODE=copy
 UV_PYTHON_DOWNLOADS=0
@@ -174,11 +174,11 @@ AUTHENTIK_LISTEN__HTTP="[::]:8000"
 AUTHENTIK_LISTEN__HTTPS="[::]:8443"
 AUTHENTIK_LISTEN__METRICS="[::]:8300"
 EOF
-	  msg_ok "Updated Worker and Server config!"
-	  msg_warn "Please check /etc/default/authentik-worker and /etc/default/authentik-server config files for port configurations!"
+      msg_ok "Updated Worker and Server config!"
+      msg_warn "Please check /etc/default/authentik-worker and /etc/default/authentik-server config files for port configurations!"
 
-	  msg_info "Updating services"
-	  cat <<EOF >/etc/systemd/system/authentik-server.service
+      msg_info "Updating services"
+      cat <<EOF >/etc/systemd/system/authentik-server.service
 [Unit]
 Description=authentik Go Server (API Gateway)
 After=network.target
@@ -198,7 +198,7 @@ EnvironmentFile=/etc/default/authentik-server
 WantedBy=multi-user.target
 EOF
 
-	  cat <<EOF >/etc/systemd/system/authentik-worker.service
+      cat <<EOF >/etc/systemd/system/authentik-worker.service
 [Unit]
 Description=authentik Worker
 After=network.target postgresql.service
@@ -217,21 +217,21 @@ RestartSec=5
 [Install]
 WantedBy=multi-user.target
 EOF
-	  systemctl daemon-reload
-	  msg_ok "Updated services"
-	fi
+      systemctl daemon-reload
+      msg_ok "Updated services"
+    fi
   fi
 
   msg_info "Starting Services"
   systemctl start authentik-server authentik-worker
   if [[ $(systemctl is-enabled authentik-ldap) == enabled ]]; then
-  	systemctl start authentik-ldap
+    systemctl start authentik-ldap
   fi
   if [[ $(systemctl is-enabled authentik-rac) == enabled ]]; then
-  	systemctl start authentik-rac
+    systemctl start authentik-rac
   fi
   if [[ $(systemctl is-enabled authentik-radius) == enabled ]]; then
-  	systemctl start authentik-radius
+    systemctl start authentik-radius
   fi
   msg_ok "Started Services"
   msg_ok "Updated successfully!"
@@ -270,5 +270,5 @@ description
 
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}https://${IP}:9443${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}https://${IP}:9443${CL}"
diff --git a/ct/baserow.sh b/ct/baserow.sh
index fa0d044db..836ca4840 100644
--- a/ct/baserow.sh
+++ b/ct/baserow.sh
@@ -71,5 +71,5 @@ description
 
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:3000${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"
diff --git a/ct/bookorbit.sh b/ct/bookorbit.sh
index 16e330e24..7b0e95c13 100644
--- a/ct/bookorbit.sh
+++ b/ct/bookorbit.sh
@@ -75,5 +75,5 @@ description
 
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:3000${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"
diff --git a/ct/clickhouse.sh b/ct/clickhouse.sh
index a0e49e619..966dffa39 100644
--- a/ct/clickhouse.sh
+++ b/ct/clickhouse.sh
@@ -41,5 +41,5 @@ description
 
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:8123${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8123${CL}"
diff --git a/ct/cross-seed.sh b/ct/cross-seed.sh
index a61f1274c..7970657d8 100644
--- a/ct/cross-seed.sh
+++ b/ct/cross-seed.sh
@@ -52,5 +52,5 @@ description
 
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access cross-seed API using the following URL:${CL}"
+echo -e "${INFO}${YW}Access cross-seed API using the following URL:${CL}"
 echo -e "${GATEWAY}${BGN}http://${IP}:2468${CL}"
diff --git a/ct/cyberchef.sh b/ct/cyberchef.sh
index e50d1c7b3..d698f1c86 100644
--- a/ct/cyberchef.sh
+++ b/ct/cyberchef.sh
@@ -26,8 +26,8 @@ function update_script() {
   check_container_resources
 
   if [[ ! -d /opt/cyberchef ]]; then
-      msg_error "No ${APP} Installation Found!"
-      exit
+    msg_error "No ${APP} Installation Found!"
+    exit
   fi
 
   if check_for_gh_release "cyberchef" "gchq/CyberChef"; then
@@ -58,5 +58,5 @@ description
 
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}${CL}"
diff --git a/ct/etherpad.sh b/ct/etherpad.sh
index f5a63852d..df7cd61bf 100755
--- a/ct/etherpad.sh
+++ b/ct/etherpad.sh
@@ -61,5 +61,5 @@ description
 
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:9001${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:9001${CL}"
diff --git a/ct/excalidash.sh b/ct/excalidash.sh
index 07f2f1764..09a265fcd 100644
--- a/ct/excalidash.sh
+++ b/ct/excalidash.sh
@@ -75,5 +75,5 @@ description
 
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:6767${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:6767${CL}"
diff --git a/ct/feishin.sh b/ct/feishin.sh
index 4f3f8cd63..dec1ece1b 100644
--- a/ct/feishin.sh
+++ b/ct/feishin.sh
@@ -75,5 +75,5 @@ description
 
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:9180${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:9180${CL}"
diff --git a/ct/flame.sh b/ct/flame.sh
index 4378f4d10..c903fcc4c 100644
--- a/ct/flame.sh
+++ b/ct/flame.sh
@@ -36,7 +36,7 @@ function update_script() {
     msg_ok "Stopped Service"
 
     create_backup /opt/flame/.env \
-                  /opt/flame/data
+      /opt/flame/data
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "flame" "pawelmalak/flame" "tarball"
     restore_backup
 
@@ -65,5 +65,5 @@ description
 
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:5005${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:5005${CL}"
diff --git a/ct/fmd-server.sh b/ct/fmd-server.sh
index 76a7bd96d..0c8b75293 100644
--- a/ct/fmd-server.sh
+++ b/ct/fmd-server.sh
@@ -60,5 +60,5 @@ description
 
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}https://${IP}:8443${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}https://${IP}:8443${CL}"
diff --git a/ct/hev-socks5-server.sh b/ct/hev-socks5-server.sh
index 3b9ffe873..b2a84616a 100644
--- a/ct/hev-socks5-server.sh
+++ b/ct/hev-socks5-server.sh
@@ -30,7 +30,6 @@ function update_script() {
     exit
   fi
 
-  
   if check_for_gh_release "hev-socks5-server" "heiher/hev-socks5-server"; then
     msg_info "Stopping Service"
     systemctl stop hev-socks5-server
@@ -52,6 +51,6 @@ description
 
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it with a SOCKS5 client using the following URL:${CL}"
+echo -e "${INFO}${YW}Access it with a SOCKS5 client using the following URL:${CL}"
 echo -e "${GATEWAY}${BGN}${IP}:1080${CL}"
 echo -e "${INFO}${YW} and the credentials stored at /root/hev.creds${CL}"
diff --git a/ct/iventoy.sh b/ct/iventoy.sh
index 441312c11..89aac7813 100644
--- a/ct/iventoy.sh
+++ b/ct/iventoy.sh
@@ -52,5 +52,5 @@ description
 
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:26000${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:26000${CL}"
diff --git a/ct/kiwix.sh b/ct/kiwix.sh
index c66803e2e..ecde55d14 100644
--- a/ct/kiwix.sh
+++ b/ct/kiwix.sh
@@ -37,12 +37,12 @@ function update_script() {
   msg_ok "Updated Package Index"
 
   CANDIDATE=$(apt-cache policy kiwix-tools | awk '/Candidate:/{print $2}')
-  if [[ -z "$CANDIDATE" || "$CANDIDATE" == "(none)" ]]; then
+  if [[ -z $CANDIDATE || $CANDIDATE == "(none)" ]]; then
     msg_error "No Candidate Version Found for kiwix-tools"
     exit
   fi
 
-  if [[ "$CURRENT" == "$CANDIDATE" ]]; then
+  if [[ $CURRENT == "$CANDIDATE" ]]; then
     echo "${CURRENT}" >/root/.kiwix
     msg_ok "Already on latest version: ${CURRENT}"
     exit
@@ -71,5 +71,5 @@ description
 
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:8080${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8080${CL}"
diff --git a/ct/koffan.sh b/ct/koffan.sh
index 910070c7f..ec87a32b0 100644
--- a/ct/koffan.sh
+++ b/ct/koffan.sh
@@ -59,5 +59,5 @@ description
 
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:3000${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"
diff --git a/ct/kometa.sh b/ct/kometa.sh
index b0a9e0caa..965076f8c 100644
--- a/ct/kometa.sh
+++ b/ct/kometa.sh
@@ -83,5 +83,5 @@ description
 
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access Kometa Quickstart:${CL}"
+echo -e "${INFO}${YW}Access Kometa Quickstart:${CL}"
 echo -e "${GATEWAY}${BGN}http://${IP}:7171${CL}"
diff --git a/ct/loki.sh b/ct/loki.sh
index 2156eac5a..d1c6a2570 100644
--- a/ct/loki.sh
+++ b/ct/loki.sh
@@ -37,38 +37,38 @@ function update_script() {
 
   case $CHOICE in
   1)
-      msg_info "Stopping Loki"
-      systemctl stop loki
-      msg_ok "Stopped Loki"
+    msg_info "Stopping Loki"
+    systemctl stop loki
+    msg_ok "Stopped Loki"
 
-      msg_info "Updating Loki"
-      $STD apt update
-      $STD apt install -y --only-upgrade loki
-      msg_ok "Updated Loki"
+    msg_info "Updating Loki"
+    $STD apt update
+    $STD apt install -y --only-upgrade loki
+    msg_ok "Updated Loki"
 
-      msg_info "Starting Loki"
-      systemctl start loki
-      msg_ok "Started Loki"
-      msg_ok "Updated successfully!"
-      exit
-      ;;
-    2)
-      msg_info "Configuring Loki to listen on 0.0.0.0"
-      sed -i 's/http_listen_address:.*/http_listen_address: 0.0.0.0/' /etc/loki/config.yml
-      sed -i 's/http_listen_port:.*/http_listen_port: 3100/' /etc/loki/config.yml
-      systemctl restart loki
-      msg_ok "Configured Loki to listen on 0.0.0.0"
-      exit
-      ;;
-    3)
-      msg_info "Configuring Loki to listen on ${LOCAL_IP}"
-      sed -i "s/http_listen_address:.*/http_listen_address: $LOCAL_IP/" /etc/loki/config.yml
-      sed -i 's/http_listen_port:.*/http_listen_port: 3100/' /etc/loki/config.yml
-      systemctl restart loki
-      msg_ok "Configured Loki to listen on ${LOCAL_IP}"
-      exit
-      ;;
-    esac
+    msg_info "Starting Loki"
+    systemctl start loki
+    msg_ok "Started Loki"
+    msg_ok "Updated successfully!"
+    exit
+    ;;
+  2)
+    msg_info "Configuring Loki to listen on 0.0.0.0"
+    sed -i 's/http_listen_address:.*/http_listen_address: 0.0.0.0/' /etc/loki/config.yml
+    sed -i 's/http_listen_port:.*/http_listen_port: 3100/' /etc/loki/config.yml
+    systemctl restart loki
+    msg_ok "Configured Loki to listen on 0.0.0.0"
+    exit
+    ;;
+  3)
+    msg_info "Configuring Loki to listen on ${LOCAL_IP}"
+    sed -i "s/http_listen_address:.*/http_listen_address: $LOCAL_IP/" /etc/loki/config.yml
+    sed -i 's/http_listen_port:.*/http_listen_port: 3100/' /etc/loki/config.yml
+    systemctl restart loki
+    msg_ok "Configured Loki to listen on ${LOCAL_IP}"
+    exit
+    ;;
+  esac
   exit 0
 }
 
@@ -78,5 +78,5 @@ description
 
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access loki using the following URL:${CL}"
+echo -e "${INFO}${YW}Access loki using the following URL:${CL}"
 echo -e "${GATEWAY}${BGN}http://${IP}:3100${CL}\n"
diff --git a/ct/lyrionmusicserver.sh b/ct/lyrionmusicserver.sh
index 8ef432b93..b14d0d791 100644
--- a/ct/lyrionmusicserver.sh
+++ b/ct/lyrionmusicserver.sh
@@ -35,7 +35,7 @@ function update_script() {
   DEB_URL=$(curl_with_retry 'https://lyrion.org/getting-started/' | grep -oP "<a\s[^>]*href=\"\K[^\"]*${DEB_ARCH}\.deb(?=\"[^>]*>)" | head -n 1)
   RELEASE=$(echo "$DEB_URL" | grep -oP "lyrionmusicserver_\K[0-9.]+(?=_${DEB_ARCH}\.deb)")
   DEB_FILE="/tmp/lyrionmusicserver_${RELEASE}_${DEB_ARCH}.deb"
-  if [[ ! -f /opt/lyrion_version.txt ]] || [[ "${RELEASE}" != "$(cat /opt/lyrion_version.txt)" ]]; then
+  if [[ ! -f /opt/lyrion_version.txt ]] || [[ ${RELEASE} != "$(cat /opt/lyrion_version.txt)" ]]; then
     msg_info "Updating $APP to ${RELEASE}"
     curl_with_retry "$DEB_URL" "$DEB_FILE"
     $STD apt install "$DEB_FILE" -y
@@ -56,5 +56,5 @@ description
 
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access the web interface at:${CL}"
+echo -e "${INFO}${YW}Access the web interface at:${CL}"
 echo -e "${GATEWAY}${BGN}http://${IP}:9000${CL}"
diff --git a/ct/matterjs-server.sh b/ct/matterjs-server.sh
index 65d53f5f5..0904c4974 100644
--- a/ct/matterjs-server.sh
+++ b/ct/matterjs-server.sh
@@ -31,10 +31,10 @@ function update_script() {
   fi
 
   NODE_VERSION="24" setup_nodejs
-  
+
   CURRENT=$(cat /opt/matter-server/node_modules/matter-server/package.json | grep '"version"' | head -1 | sed 's/.*"\([^"]*\)".*/\1/')
   LATEST=$(npm view matter-server version 2>/dev/null)
-  if [[ "$CURRENT" != "$LATEST" ]]; then
+  if [[ $CURRENT != "$LATEST" ]]; then
     msg_info "Stopping Service"
     systemctl stop matterjs-server
     msg_ok "Stopped Service"
@@ -60,5 +60,5 @@ description
 
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:5580${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:5580${CL}"
diff --git a/ct/netbird.sh b/ct/netbird.sh
index 336094791..8359805be 100644
--- a/ct/netbird.sh
+++ b/ct/netbird.sh
@@ -44,5 +44,5 @@ description
 
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access NetBird by entering the container and running:${CL}"
+echo -e "${INFO}${YW}Access NetBird by entering the container and running:${CL}"
 echo -e "${GATEWAY}${BGN}netbird up${CL}"
diff --git a/ct/paperclip.sh b/ct/paperclip.sh
index e7c1f5101..10c27de23 100644
--- a/ct/paperclip.sh
+++ b/ct/paperclip.sh
@@ -79,5 +79,5 @@ description
 
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:3100${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3100${CL}"
diff --git a/ct/pinchflat.sh b/ct/pinchflat.sh
index 7b696dd41..c930b741a 100644
--- a/ct/pinchflat.sh
+++ b/ct/pinchflat.sh
@@ -66,5 +66,5 @@ description
 msg_ok "Completed Successfully!\n"
 
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:8945${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8945${CL}"
diff --git a/ct/plane.sh b/ct/plane.sh
index 13c29969c..0d8d9f6c9 100644
--- a/ct/plane.sh
+++ b/ct/plane.sh
@@ -38,10 +38,10 @@ function update_script() {
     msg_ok "Stopped Services"
 
     create_backup /opt/plane/.env \
-        /opt/plane/apps/admin/.env \
-        /opt/plane/apps/api/.env \
-        /opt/plane/apps/space/.env \
-       /opt/plane/apps/web/.env
+      /opt/plane/apps/admin/.env \
+      /opt/plane/apps/api/.env \
+      /opt/plane/apps/space/.env \
+      /opt/plane/apps/web/.env
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "plane" "makeplane/plane" "tarball"
 
@@ -86,5 +86,5 @@ description
 
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}${CL}"
diff --git a/ct/postiz.sh b/ct/postiz.sh
index cdfbc51b2..dc004abb5 100644
--- a/ct/postiz.sh
+++ b/ct/postiz.sh
@@ -37,7 +37,7 @@ function update_script() {
     msg_ok "Stopped Services"
 
     create_backup /opt/postiz/.env \
-                  /opt/postiz/uploads
+      /opt/postiz/uploads
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "postiz" "gitroomhq/postiz-app" "tarball"
 
@@ -56,7 +56,6 @@ function update_script() {
     $STD pnpm run prisma-db-push
     msg_ok "Ran Database Migrations"
 
-
     mkdir -p /opt/postiz/uploads
     restore_backup
 
@@ -74,5 +73,5 @@ description
 
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}${CL}"
diff --git a/ct/rackula.sh b/ct/rackula.sh
index 74f453c55..c0b15a9b9 100755
--- a/ct/rackula.sh
+++ b/ct/rackula.sh
@@ -77,5 +77,5 @@ description
 
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}${CL}"
diff --git a/ct/shlink.sh b/ct/shlink.sh
index 0d6a210dd..a9238fe49 100644
--- a/ct/shlink.sh
+++ b/ct/shlink.sh
@@ -80,7 +80,7 @@ description
 
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access Shlink Web Client using the following URL:${CL}"
+echo -e "${INFO}${YW}Access Shlink Web Client using the following URL:${CL}"
 echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"
 echo -e "${INFO}${YW} Shlink HTTP API:${CL}"
 echo -e "${GATEWAY}${BGN}http://${IP}:8080${CL}"
diff --git a/ct/snapotter.sh b/ct/snapotter.sh
index 86671ab42..2ebea2959 100644
--- a/ct/snapotter.sh
+++ b/ct/snapotter.sh
@@ -59,5 +59,5 @@ description
 
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:1349${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:1349${CL}"
diff --git a/ct/spliit.sh b/ct/spliit.sh
index 33076cd42..d039b75d9 100755
--- a/ct/spliit.sh
+++ b/ct/spliit.sh
@@ -72,5 +72,5 @@ description
 
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:3000${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"
diff --git a/ct/tolgee.sh b/ct/tolgee.sh
index fab3dc278..4455852ff 100644
--- a/ct/tolgee.sh
+++ b/ct/tolgee.sh
@@ -52,5 +52,5 @@ description
 
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:8080${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8080${CL}"
diff --git a/ct/twenty.sh b/ct/twenty.sh
index 0b212ef0f..e1e9e35d3 100644
--- a/ct/twenty.sh
+++ b/ct/twenty.sh
@@ -39,10 +39,10 @@ function update_script() {
     msg_ok "Stopped Services"
 
     create_backup /opt/twenty/.env \
-                  /opt/twenty/packages/twenty-server/.local-storage
+      /opt/twenty/packages/twenty-server/.local-storage
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "twenty" "twentyhq/twenty" "tarball"
     restore_backup
-    
+
     msg_info "Building Application"
     cd /opt/twenty
     export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
@@ -63,7 +63,6 @@ function update_script() {
     $STD npx -y typeorm migration:run -d dist/database/typeorm/core/core.datasource
     msg_ok "Ran Database Migrations"
 
-
     msg_info "Starting Services"
     systemctl start twenty-server twenty-worker
     msg_ok "Started Services"
@@ -78,5 +77,5 @@ description
 
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:3000${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"
diff --git a/ct/xyops.sh b/ct/xyops.sh
index 61f641119..2768a39ae 100644
--- a/ct/xyops.sh
+++ b/ct/xyops.sh
@@ -69,5 +69,5 @@ description
 
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:5522${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:5522${CL}"

From 7a9726b1dda667f79bb83235b36979754588c1e4 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 19:15:29 +0000
Subject: [PATCH 040/220] Update CHANGELOG.md (#15633)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c67f8c59a..00a310fea 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -503,7 +503,8 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ### 🚀 Updated Scripts
 
-  - Immich: Update libvips to 8.18.4 [@vhsdream](https://github.com/vhsdream) ([#15619](https://github.com/community-scripts/ProxmoxVE/pull/15619))
+  - Fix alignment in various ct end messages [@tremor021](https://github.com/tremor021) ([#15632](https://github.com/community-scripts/ProxmoxVE/pull/15632))
+- Immich: Update libvips to 8.18.4 [@vhsdream](https://github.com/vhsdream) ([#15619](https://github.com/community-scripts/ProxmoxVE/pull/15619))
 
   - #### 🐞 Bug Fixes
 

From d9d724ce57bc7721b724187cb530b71e1b2659da Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Mon, 6 Jul 2026 23:27:42 +0200
Subject: [PATCH 041/220] Remove: FlowiseAI (#15624)

---
 ct/flowiseai.sh              | 54 ------------------------------------
 install/flowiseai-install.sh | 52 ----------------------------------
 2 files changed, 106 deletions(-)
 delete mode 100644 ct/flowiseai.sh
 delete mode 100644 install/flowiseai-install.sh

diff --git a/ct/flowiseai.sh b/ct/flowiseai.sh
deleted file mode 100644
index 7d4c6468e..000000000
--- a/ct/flowiseai.sh
+++ /dev/null
@@ -1,54 +0,0 @@
-#!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
-# Copyright (c) 2021-2026 tteck
-# Author: tteck (tteckster)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://flowiseai.com/ | Github: https://github.com/FlowiseAI/Flowise
-
-APP="FlowiseAI"
-var_tags="${var_tags:-low-code}"
-var_disk="${var_disk:-10}"
-var_cpu="${var_cpu:-4}"
-var_ram="${var_ram:-4096}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-  if [[ ! -f /etc/systemd/system/flowise.service ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  NODE_VERSION="22" NODE_MODULE="pnpm" setup_nodejs
-
-  msg_info "Updating FlowiseAI (this may take some time)"
-  systemctl stop flowise
-  $STD pnpm add -g flowise
-  if grep -q 'ExecStart=npx flowise start' /etc/systemd/system/flowise.service; then
-    sed -i 's|ExecStart=npx flowise start|ExecStart=flowise start|' /etc/systemd/system/flowise.service
-    systemctl daemon-reload
-  fi
-  systemctl start flowise
-  msg_ok "Updated FlowiseAI"
-  msg_ok "Updated successfully!"
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"
diff --git a/install/flowiseai-install.sh b/install/flowiseai-install.sh
deleted file mode 100644
index 73cc8c1eb..000000000
--- a/install/flowiseai-install.sh
+++ /dev/null
@@ -1,52 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 tteck
-# Author: tteck (tteckster)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://flowiseai.com/ | Github: https://github.com/FlowiseAI/Flowise
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-msg_info "Installing Dependencies"
-$STD apt install -y \
-  build-essential \
-  pkg-config
-msg_ok "Installed Dependencies"
-
-PYTHON_VERSION="3.11" setup_uv
-NODE_VERSION="22" NODE_MODULE="pnpm" setup_nodejs
-
-msg_info "Installing FlowiseAI (Patience)"
-PYTHON_BIN="$(uv python find 3.11)"
-export npm_config_python="$PYTHON_BIN"
-$STD pnpm add -g flowise
-mkdir -p /opt/flowiseai
-curl -fsSL "https://raw.githubusercontent.com/FlowiseAI/Flowise/main/packages/server/.env.example" -o "/opt/flowiseai/.env"
-msg_ok "Installed FlowiseAI"
-
-msg_info "Creating Service"
-cat <<EOF >/etc/systemd/system/flowise.service
-[Unit]
-Description=FlowiseAI
-After=network.target
-
-[Service]
-EnvironmentFile=/opt/flowiseai/.env
-ExecStart=flowise start
-Restart=always
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now flowise
-msg_ok "Created Service"
-
-motd_ssh
-customize
-cleanup_lxc

From 3143d25caa9eb55d89f2bcd51cde6eeec8a36be9 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 21:28:09 +0000
Subject: [PATCH 042/220] Update CHANGELOG.md (#15637)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 00a310fea..237f4f130 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -516,6 +516,10 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
     - cliproxyapi: point setup message at /management.html [@austinpilz](https://github.com/austinpilz) ([#15628](https://github.com/community-scripts/ProxmoxVE/pull/15628))
 
+### 🗑️ Deleted Scripts
+
+  - Remove: FlowiseAI [@MickLesk](https://github.com/MickLesk) ([#15624](https://github.com/community-scripts/ProxmoxVE/pull/15624))
+
 ## 2026-07-05
 
 ### 🆕 New Scripts

From 2bf6c5e5da85d5208db396340bececa0e476000a Mon Sep 17 00:00:00 2001
From: Chris <punk.sand7393@fastmail.com>
Date: Mon, 6 Jul 2026 17:28:48 -0400
Subject: [PATCH 043/220] Wizarr: Build JS and CSS static assets (#15634)

---
 ct/wizarr.sh              | 34 ++++++++++++++++++++++++++--------
 install/wizarr-install.sh | 12 ++++++++----
 2 files changed, 34 insertions(+), 12 deletions(-)

diff --git a/ct/wizarr.sh b/ct/wizarr.sh
index febc1e4c3..af6a2adac 100644
--- a/ct/wizarr.sh
+++ b/ct/wizarr.sh
@@ -50,20 +50,38 @@ function update_script() {
     $STD /usr/local/bin/uv sync --frozen
     $STD /usr/local/bin/uv run --frozen pybabel compile -d app/translations
     $STD npm --prefix app/static install
-    $STD npm --prefix app/static run build:css
+    $STD npm --prefix app/static run build
     mkdir -p ./.cache
     $STD tar -xf "$BACKUP_FILE" --directory=/
-    if grep -q 'workers' /opt/wizarr/start.sh; then
-      sed -i 's/--workers 4//' /opt/wizarr/start.sh
+    if grep -q 'bind' /opt/wizarr/start.sh; then
+      WIZARR_PORT=$(awk -F: '{print $2}' /opt/wizarr/start.sh | awk -F' ' '{print $1}' | tr -d '[:space:]')
     fi
-    if ! grep -qE 'FLASK|WORKERS|VERSION' /opt/wizarr/.env; then
-      cat <<EOF >/opt/wizarr/.env
+    sed -i -E -e 's/[[:space:]]+/ /g' \
+      -e 's/--workers 4//' \
+      -e 's/--bind 0.0.0.0:[0-9]+//' /opt/wizarr/start.sh
+    KEYS=("FLASK" "WORKERS" "HOST" "PORT")
+    for key in "${KEYS[@]}"; do
+      if ! grep -q "$key" /opt/wizarr/.env; then
+        cat <<EOF >/opt/wizarr/.env
+APP_URL=http://${LOCAL_IP}
+DISABLE_BUILTIN_AUTH=false
 FLASK_ENV=production
 GUNICORN_WORKERS=4
-APP_VERSION=$(sed 's/^20/v&/' ~/.wizarr)
+HOST=0.0.0.0
+PORT=${WIZARR_PORT:-5690}
+LOG_LEVEL=info
+APP_VERSION=$(cat ~/.wizarr)
 EOF
-    else
-      sed -i "s/_VERSION=v.*$/_VERSION=v$(cat ~/.wizarr)/" /opt/wizarr/.env
+      fi
+      continue
+    done
+    sed -i "s/_VERSION=.*$/_VERSION=$(cat ~/.wizarr)/" /opt/wizarr/.env
+    if grep -q 'abnormal' /etc/systemd/system/wizarr.service; then
+      sed -i 's/on-abnormal/always \
+RestartSec=10 \
+KillMode=mixed \
+TimeoutStopSec=10/' /etc/systemd/system/wizarr.service
+      systemctl daemon-reload
     fi
     rm -rf "$BACKUP_FILE"
     export FLASK_SKIP_SCHEDULER=true
diff --git a/install/wizarr-install.sh b/install/wizarr-install.sh
index 57a152d11..ba6bca712 100644
--- a/install/wizarr-install.sh
+++ b/install/wizarr-install.sh
@@ -27,15 +27,17 @@ cd /opt/wizarr
 $STD /usr/local/bin/uv sync --frozen
 $STD /usr/local/bin/uv run --frozen pybabel compile -d app/translations
 $STD npm --prefix app/static install
-$STD npm --prefix app/static run build:css
+$STD npm --prefix app/static run build
 mkdir -p ./.cache
 cat <<EOF >/opt/wizarr/.env
 FLASK_ENV=production
 GUNICORN_WORKERS=4
 APP_URL=http://${LOCAL_IP}
+HOST=0.0.0.0
+PORT=5690
 DISABLE_BUILTIN_AUTH=false
 LOG_LEVEL=INFO
-APP_VERSION=v$(get_latest_github_release "wizarrrr/wizarr")
+APP_VERSION=$(get_latest_github_release "wizarrrr/wizarr")
 EOF
 
 cat <<EOF >/opt/wizarr/start.sh
@@ -44,7 +46,6 @@ cat <<EOF >/opt/wizarr/start.sh
 uv run --frozen gunicorn \
     --config gunicorn.conf.py \
     --preload \
-    --bind 0.0.0.0:5690 \
     --umask 007 \
     run:app
 EOF
@@ -62,7 +63,10 @@ Type=simple
 WorkingDirectory=/opt/wizarr
 EnvironmentFile=/opt/wizarr/.env
 ExecStart=/opt/wizarr/start.sh
-Restart=on-abnormal
+Restart=always
+RestartSec=10
+KillMode=mixed
+TimeoutStopSec=10
 
 [Install]
 WantedBy=multi-user.target

From a9d71b7d234f532843511e574337f9be030bfd91 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 21:29:10 +0000
Subject: [PATCH 044/220] Update CHANGELOG.md (#15638)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 237f4f130..420ba6fb2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -508,6 +508,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - Wizarr: Build JS and CSS static assets [@vhsdream](https://github.com/vhsdream) ([#15634](https://github.com/community-scripts/ProxmoxVE/pull/15634))
     - RustDesk Server: Update URL format in rustdeskserver.sh [@tremor021](https://github.com/tremor021) ([#15626](https://github.com/community-scripts/ProxmoxVE/pull/15626))
     - attempt to port docker-vm to support arm64 [@asylumexp](https://github.com/asylumexp) ([#15611](https://github.com/community-scripts/ProxmoxVE/pull/15611))
     - fix(plane): don't clobber global app var, breaking /usr/bin/update [@asylumexp](https://github.com/asylumexp) ([#15612](https://github.com/community-scripts/ProxmoxVE/pull/15612))

From 87f2189cbb5b73c9c2204a292fd06efa465b0824 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 23:47:06 +0200
Subject: [PATCH 045/220] Update .app files (#15636)

Co-authored-by: GitHub Actions <github-actions[bot]@users.noreply.github.com>
---
 ct/headers/flowiseai | 6 ------
 1 file changed, 6 deletions(-)
 delete mode 100644 ct/headers/flowiseai

diff --git a/ct/headers/flowiseai b/ct/headers/flowiseai
deleted file mode 100644
index 7011f22b4..000000000
--- a/ct/headers/flowiseai
+++ /dev/null
@@ -1,6 +0,0 @@
-    ________              _           ___    ____
-   / ____/ /___ _      __(_)_______  /   |  /  _/
-  / /_  / / __ \ | /| / / / ___/ _ \/ /| |  / /  
- / __/ / / /_/ / |/ |/ / (__  )  __/ ___ |_/ /   
-/_/   /_/\____/|__/|__/_/____/\___/_/  |_/___/   
-                                                 

From 67e0c7e9f83fda92c2b5516626a495e90fe9536b Mon Sep 17 00:00:00 2001
From: "push-app-to-main[bot]"
 <203845782+push-app-to-main[bot]@users.noreply.github.com>
Date: Tue, 7 Jul 2026 22:45:52 +0200
Subject: [PATCH 046/220] Forgejo-Runner (#15046)

---
 ct/forgejo-runner.sh              |  79 +++++++++++++++++++++
 ct/headers/forgejo-runner         |   6 ++
 install/forgejo-runner-install.sh | 114 ++++++++++++++++++++++++++++++
 3 files changed, 199 insertions(+)
 create mode 100644 ct/forgejo-runner.sh
 create mode 100644 ct/headers/forgejo-runner
 create mode 100644 install/forgejo-runner-install.sh

diff --git a/ct/forgejo-runner.sh b/ct/forgejo-runner.sh
new file mode 100644
index 000000000..7c7c1774f
--- /dev/null
+++ b/ct/forgejo-runner.sh
@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Simon Friedrich (lengschder97)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://forgejo.org/
+
+APP="Forgejo-Runner"
+var_tags="${var_tags:-ci}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+var_nesting="${var_nesting:-1}"
+var_keyctl="${var_keyctl:-1}"
+
+export var_forgejo_instance="${var_forgejo_instance:-}"
+export var_forgejo_runner_token="${var_forgejo_runner_token:-}"
+export var_runner_labels="${var_runner_labels:-}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /usr/local/bin/forgejo-runner ]]; then
+    msg_error "No ${APP} installation found!"
+    exit 1
+  fi
+
+  RELEASE=$(curl -fsSL https://data.forgejo.org/api/v1/repos/forgejo/runner/releases/latest | grep -oP '"tag_name":\s*"\K[^"]+' | sed 's/^v//')
+  if [[ "${RELEASE}" == "$(cat ~/.forgejo-runner 2>/dev/null)" ]]; then
+    msg_ok "No update required. ${APP} is already at v${RELEASE}"
+    exit
+  fi
+
+  msg_info "Stopping Services"
+  systemctl stop forgejo-runner
+  msg_ok "Stopped Services"
+
+  msg_info "Updating Forgejo Runner to v${RELEASE}"
+  curl -fsSL "https://code.forgejo.org/forgejo/runner/releases/download/v${RELEASE}/forgejo-runner-${RELEASE}-linux-$(arch_resolve)" -o /usr/local/bin/forgejo-runner
+  chmod +x /usr/local/bin/forgejo-runner
+  echo "${RELEASE}" >~/.forgejo-runner
+  msg_ok "Updated Forgejo Runner"
+
+  msg_info "Starting Services"
+  systemctl start forgejo-runner
+  msg_ok "Started Services"
+  msg_ok "Updated successfully!"
+  exit
+}
+
+if [[ -n "${mode:-}" ]]; then
+  if [[ -z "${var_forgejo_instance:-}" ]]; then
+    msg_error "var_forgejo_instance is required for unattended installs."
+    exit 1
+  fi
+  if [[ -z "${var_forgejo_runner_token:-}" ]]; then
+    msg_error "var_forgejo_runner_token is required for unattended installs."
+    exit 1
+  fi
+fi
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} After first boot, check your Forgejo Instance for the new Runner.${CL}"
diff --git a/ct/headers/forgejo-runner b/ct/headers/forgejo-runner
new file mode 100644
index 000000000..5be4a07fe
--- /dev/null
+++ b/ct/headers/forgejo-runner
@@ -0,0 +1,6 @@
+    ______                        _             ____                             
+   / ____/___  _________ ____    (_)___        / __ \__  ______  ____  ___  _____
+  / /_  / __ \/ ___/ __ `/ _ \  / / __ \______/ /_/ / / / / __ \/ __ \/ _ \/ ___/
+ / __/ / /_/ / /  / /_/ /  __/ / / /_/ /_____/ _, _/ /_/ / / / / / / /  __/ /    
+/_/    \____/_/   \__, /\___/_/ /\____/     /_/ |_|\__,_/_/ /_/_/ /_/\___/_/     
+                 /____/    /___/                                                 
diff --git a/install/forgejo-runner-install.sh b/install/forgejo-runner-install.sh
new file mode 100644
index 000000000..94ceb6877
--- /dev/null
+++ b/install/forgejo-runner-install.sh
@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Simon Friedrich (lengschder97)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://forgejo.org/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+setup_yq
+
+if [[ -z "${var_forgejo_instance:-}" ]]; then
+  read -r -p "${TAB3}Forgejo Instance URL (e.g. https://codeberg.org): " var_forgejo_instance
+  var_forgejo_instance="${var_forgejo_instance:-https://codeberg.org}"
+fi
+
+if [[ -z "${var_forgejo_runner_uuid:-}" ]]; then
+  read -r -p "${TAB3}Forgejo Runner UUID: " var_forgejo_runner_uuid
+fi
+
+if [[ -z "${var_forgejo_runner_uuid:-}" ]]; then
+  msg_error "No runner UUID provided. Cannot continue."
+  exit 1
+fi
+
+if [[ -z "${var_forgejo_runner_token:-}" ]]; then
+  read -r -p "${TAB3}Forgejo Runner Token: " var_forgejo_runner_token
+fi
+
+if [[ -z "${var_forgejo_runner_token:-}" ]]; then
+  msg_error "No runner registration token provided. Cannot continue."
+  exit 1
+fi
+
+DEFAULT_RUNNER_LABELS="linux-amd64:docker://node:22-bookworm"
+if [[ -z "${var_runner_labels:-}" ]]; then
+  read -r -p "${TAB3}Additional runner labels (comma-separated, or leave blank for default only): " var_runner_labels
+fi
+if [[ -n "${var_runner_labels:-}" ]]; then
+  RUNNER_LABELS="${DEFAULT_RUNNER_LABELS},${var_runner_labels}"
+else
+  RUNNER_LABELS="${DEFAULT_RUNNER_LABELS}"
+fi
+
+export FORGEJO_INSTANCE="$var_forgejo_instance"
+export FORGEJO_RUNNER_TOKEN="$var_forgejo_runner_token"
+export FORGEJO_RUNNER_UUID="$var_forgejo_runner_uuid"
+export RUNNER_LABELS
+
+msg_info "Installing dependencies"
+$STD apt install -y \
+  git \
+  podman podman-docker
+msg_ok "Installed dependencies"
+
+msg_info "Enabling Podman socket"
+systemctl enable --now podman.socket
+msg_ok "Enabled Podman socket"
+
+msg_info "Installing Forgejo Runner"
+RUNNER_VERSION=$(curl -fsSL https://data.forgejo.org/api/v1/repos/forgejo/runner/releases/latest | jq -r .name | sed 's/^v//')
+curl -fsSL "https://code.forgejo.org/forgejo/runner/releases/download/v${RUNNER_VERSION}/forgejo-runner-${RUNNER_VERSION}-linux-$(arch_resolve)" -o /usr/local/bin/forgejo-runner
+chmod +x /usr/local/bin/forgejo-runner
+echo "${RUNNER_VERSION}" >~/.forgejo-runner
+msg_ok "Installed Forgejo Runner"
+
+msg_info "Registering Forgejo Runner"
+export DOCKER_HOST="unix:///run/podman/podman.sock"
+
+msg_info "Generating Forgejo Runner Configuration"
+mkdir -p /etc/forgejo-runner
+CONFIG_FILE="/etc/forgejo-runner/config.yaml"
+forgejo-runner generate-config > $CONFIG_FILE
+yq -i '
+  .container.docker_host = strenv(DOCKER_HOST) |
+  .server.connections.forgejo.url = strenv(FORGEJO_INSTANCE) |
+  .server.connections.forgejo.uuid = strenv(FORGEJO_RUNNER_UUID) |
+  .server.connections.forgejo.token = strenv(FORGEJO_RUNNER_TOKEN) |
+  .server.connections.forgejo.labels = (strenv(RUNNER_LABELS) | split(",") | map(select(length > 0)))
+  ' $CONFIG_FILE
+msg_ok "Generated Forgejo Runner Configuration"
+
+
+msg_info "Creating Services"
+cat <<EOF >/etc/systemd/system/forgejo-runner.service
+[Unit]
+Description=Forgejo Runner
+Documentation=https://forgejo.org/docs/latest/admin/actions/
+After=podman.socket
+Requires=podman.socket
+
+[Service]
+User=root
+WorkingDirectory=/root
+Environment=DOCKER_HOST=unix:///run/podman/podman.sock
+ExecStart=/usr/local/bin/forgejo-runner daemon -c $CONFIG_FILE
+Restart=on-failure
+RestartSec=10
+TimeoutSec=0
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now forgejo-runner
+msg_ok "Created Services"
+
+motd_ssh
+customize
+cleanup_lxc

From e64f5a041d136545e9879d30e13cb360a0f98ba4 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Tue, 7 Jul 2026 20:46:17 +0000
Subject: [PATCH 047/220] Update CHANGELOG.md (#15644)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 420ba6fb2..2dabf3bbe 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -499,6 +499,12 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-07-07
+
+### 🆕 New Scripts
+
+  - Forgejo-Runner ([#15046](https://github.com/community-scripts/ProxmoxVE/pull/15046))
+
 ## 2026-07-06
 
 ### 🚀 Updated Scripts

From 6e55269d9fdab34fc774839e93903b383816e79b Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Wed, 8 Jul 2026 13:04:13 +0200
Subject: [PATCH 048/220] BabyBuddy: Harden update script (#15642)

Ensure cleanup runs from `/opt/babybuddy` before deleting old files, add `--` to the removal command for safer argument handling, and run `manage.py makemigrations` before `migrate` so database updates are applied reliably during upgrades.
---
 ct/babybuddy.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/ct/babybuddy.sh b/ct/babybuddy.sh
index 29fc7703a..b718a42ef 100644
--- a/ct/babybuddy.sh
+++ b/ct/babybuddy.sh
@@ -40,7 +40,8 @@ function update_script() {
     create_backup /opt/babybuddy/babybuddy/settings/production.py
 
     msg_info "Cleaning old files"
-    find . -mindepth 1 -maxdepth 1 ! -name '.venv' -exec rm -rf {} +
+    cd /opt/babybuddy || exit
+    find . -mindepth 1 -maxdepth 1 ! -name '.venv' -exec rm -rf -- {} +
     msg_ok "Cleaned old files"
 
     fetch_and_deploy_gh_release "babybuddy" "babybuddy/babybuddy" "tarball"
@@ -51,6 +52,7 @@ function update_script() {
     source .venv/bin/activate
     $STD uv pip install -r requirements.txt
     export DJANGO_SETTINGS_MODULE=babybuddy.settings.production
+    $STD python manage.py makemigrations
     $STD python manage.py migrate
     msg_ok "Updated ${APP}"
 

From a6a8651000b252c5f7a80fea5b6e3aa63475339b Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Wed, 8 Jul 2026 11:04:41 +0000
Subject: [PATCH 049/220] Update CHANGELOG.md (#15647)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2dabf3bbe..6b39405fe 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -499,6 +499,14 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-07-08
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - BabyBuddy: Harden update script [@MickLesk](https://github.com/MickLesk) ([#15642](https://github.com/community-scripts/ProxmoxVE/pull/15642))
+
 ## 2026-07-07
 
 ### 🆕 New Scripts

From 11937bf5fa8bcb2631907389c301b36c7675db4f Mon Sep 17 00:00:00 2001
From: Chris <punk.sand7393@fastmail.com>
Date: Wed, 8 Jul 2026 18:56:59 -0400
Subject: [PATCH 050/220] Opencloud: Bump version to 7.2.1 (#15655)

---
 ct/opencloud.sh              | 2 +-
 install/opencloud-install.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/ct/opencloud.sh b/ct/opencloud.sh
index b64dc34d0..b328d90ab 100644
--- a/ct/opencloud.sh
+++ b/ct/opencloud.sh
@@ -30,7 +30,7 @@ function update_script() {
     exit
   fi
 
-  RELEASE="v7.2.0"
+  RELEASE="v7.2.1"
   if check_for_gh_release "OpenCloud" "opencloud-eu/opencloud" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
     msg_info "Stopping services"
     systemctl stop opencloud opencloud-wopi
diff --git a/install/opencloud-install.sh b/install/opencloud-install.sh
index 608440062..0dc635098 100644
--- a/install/opencloud-install.sh
+++ b/install/opencloud-install.sh
@@ -64,7 +64,7 @@ $STD sudo -u cool coolconfig set-admin-password --user=admin --password="$COOLPA
 echo "$COOLPASS" >~/.coolpass
 msg_ok "Installed Collabora Online"
 
-fetch_and_deploy_gh_release "OpenCloud" "opencloud-eu/opencloud" "singlefile" "v7.2.0" "/usr/bin" "opencloud-*-linux-$(arch_resolve)"
+fetch_and_deploy_gh_release "OpenCloud" "opencloud-eu/opencloud" "singlefile" "v7.2.1" "/usr/bin" "opencloud-*-linux-$(arch_resolve)"
 mv /usr/bin/OpenCloud /usr/bin/opencloud
 
 msg_info "Configuring OpenCloud"

From f1adfc32d30d85529412e80def20e23f0f1e856a Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Wed, 8 Jul 2026 22:57:24 +0000
Subject: [PATCH 051/220] Update CHANGELOG.md (#15657)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6b39405fe..b5e9bda8c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -505,6 +505,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - Opencloud: Bump version to 7.2.1 [@vhsdream](https://github.com/vhsdream) ([#15655](https://github.com/community-scripts/ProxmoxVE/pull/15655))
     - BabyBuddy: Harden update script [@MickLesk](https://github.com/MickLesk) ([#15642](https://github.com/community-scripts/ProxmoxVE/pull/15642))
 
 ## 2026-07-07

From bfab0dd034bd182034f1ffb05e45018ec9c85373 Mon Sep 17 00:00:00 2001
From: TowyTowy <85077986+TowyTowy@users.noreply.github.com>
Date: Thu, 9 Jul 2026 03:28:40 +0200
Subject: [PATCH 052/220] fix(pihole): repair Unbound DNS-over-TLS (DoT)
 forwarding config (#15654)

When the optional Unbound install is chosen with DoT forwarding, the script
truncated (>) /etc/unbound/unbound.conf.d/pi-hole.conf and rewrote it starting
with an indented "tls-cert-bundle:" option that has no "server:" section header.
unbound-checkconf rejects this ("syntax error, is there no section start"), so
"systemctl restart unbound" exits 1 and the install aborts (line 153). The
overwrite also dropped the interface/port 5335 settings Pi-hole forwards to.

Append (>>) the DoT additions to the existing recursive server block instead,
under a proper "server:" section (unbound merges multiple server: clauses), so
the tls-cert-bundle and forward-zone are valid and the resolver keeps listening
on 127.0.0.1:5335. Recursive (non-DoT) mode is unchanged.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 install/pihole-install.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/install/pihole-install.sh b/install/pihole-install.sh
index c88a7c997..547d79f23 100644
--- a/install/pihole-install.sh
+++ b/install/pihole-install.sh
@@ -119,7 +119,8 @@ edns-packet-max=1232
 EOF
 
   if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
-    cat <<EOF >/etc/unbound/unbound.conf.d/pi-hole.conf
+    cat <<EOF >>/etc/unbound/unbound.conf.d/pi-hole.conf
+server:
   tls-cert-bundle: "/etc/ssl/certs/ca-certificates.crt"
 forward-zone:
   name: "."

From 25045ef344386fe5855ed2ea19c89f0d03e452b3 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Thu, 9 Jul 2026 01:29:01 +0000
Subject: [PATCH 053/220] Update CHANGELOG.md (#15659)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b5e9bda8c..25dc2426a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -499,6 +499,12 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-07-09
+
+### 🚀 Updated Scripts
+
+  - fix(pihole): repair Unbound DNS-over-TLS (DoT) forwarding config [@TowyTowy](https://github.com/TowyTowy) ([#15654](https://github.com/community-scripts/ProxmoxVE/pull/15654))
+
 ## 2026-07-08
 
 ### 🚀 Updated Scripts

From 89b671880a752c0e7c8cba029bd12d9e4f200f8e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Slavi=C5=A1a=20Are=C5=BEina?=
 <58952836+tremor021@users.noreply.github.com>
Date: Fri, 10 Jul 2026 10:53:04 +0200
Subject: [PATCH 054/220] Endurain: Fix update procedure (#15674)

* Update CHANGELOG.md (#15631)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

* Update CHANGELOG.md (#15631)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

* Update CHANGELOG.md (#15631)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

* Fixed update procedure

* ups

---------

Co-authored-by: community-scripts-pr-app[bot] <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 ct/endurain.sh | 17 ++++-------------
 1 file changed, 4 insertions(+), 13 deletions(-)

diff --git a/ct/endurain.sh b/ct/endurain.sh
index 934532aea..cdfd6eb0a 100644
--- a/ct/endurain.sh
+++ b/ct/endurain.sh
@@ -34,31 +34,22 @@ function update_script() {
     systemctl stop endurain
     msg_ok "Stopped Service"
 
-    msg_info "Creating Backup"
-    cp /opt/endurain/.env /opt/endurain.env
-    cp /opt/endurain/frontend/dist/env.js /opt/endurain.env.js
-    msg_ok "Created Backup"
-
+    create_backup /opt/endurain/.env /opt/endurain/frontend/dist/env.js
     CLEAN_INSTALL=1 fetch_and_deploy_codeberg_release "endurain" "endurain-project/endurain" "tarball" "latest" "/opt/endurain"
 
     msg_info "Preparing Update"
     cd /opt/endurain
-    rm -rf \
-      /opt/endurain/{docs,example.env,screenshot_01.png} \
-      /opt/endurain/docker* \
-      /opt/endurain/*.yml
-    cp /opt/endurain.env /opt/endurain/.env
-    rm /opt/endurain.env
+    rm -rf /opt/endurain/{docs,example.env,screenshot_01.png} /opt/endurain/docker* /opt/endurain/*.yml
     msg_ok "Prepared Update"
 
     msg_info "Updating Frontend"
     cd /opt/endurain/frontend
     $STD npm ci
     $STD npm run build
-    cp /opt/endurain.env.js /opt/endurain/frontend/dist/env.js
-    rm /opt/endurain.env.js
     msg_ok "Updated Frontend"
 
+    restore_backup
+
     msg_info "Updating Backend"
     cd /opt/endurain/backend
     UV_VERSION=$(grep -Po 'required-version\s*=\s*"\K[^"]+' pyproject.toml 2>/dev/null || echo "0.11.18")

From f1e952005ebcef591859b4d04686b72fe984e92d Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Fri, 10 Jul 2026 08:53:34 +0000
Subject: [PATCH 055/220] Update CHANGELOG.md (#15678)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 25dc2426a..62e82d39c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -499,6 +499,14 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-07-10
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Endurain: Fix update procedure [@tremor021](https://github.com/tremor021) ([#15674](https://github.com/community-scripts/ProxmoxVE/pull/15674))
+
 ## 2026-07-09
 
 ### 🚀 Updated Scripts

From 6716d8de842c5a0507f08c111f6d3c9a7bc11729 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Slavi=C5=A1a=20Are=C5=BEina?=
 <58952836+tremor021@users.noreply.github.com>
Date: Fri, 10 Jul 2026 10:53:51 +0200
Subject: [PATCH 056/220] Fireshare: Fix for install and upgrade to v1.7.3
 (#15673)

* Update CHANGELOG.md (#15631)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

* Update CHANGELOG.md (#15631)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

* Update CHANGELOG.md (#15631)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

* Fix install and upgrade to v1.7.3

---------

Co-authored-by: community-scripts-pr-app[bot] <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 ct/fireshare.sh              | 21 ++++++++++++++-------
 install/fireshare-install.sh |  3 +++
 2 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/ct/fireshare.sh b/ct/fireshare.sh
index 296cb6c01..f10be013b 100644
--- a/ct/fireshare.sh
+++ b/ct/fireshare.sh
@@ -35,12 +35,22 @@ function update_script() {
     systemctl stop fireshare
     msg_ok "Stopped Service"
 
-    mv /opt/fireshare/fireshare.env /opt
+    create_backup /opt/fireshare/fireshare.env
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "fireshare" "ShaneIsrael/fireshare" "tarball"
-    mv /opt/fireshare.env /opt/fireshare
+    restore_backup
     rm -f /usr/local/bin/fireshare
 
-    msg_info "Updating Fireshare"
+    if ! grep -q "__FIRESHARE_PORT__" /etc/nginx/nginx.conf; then
+      cp /opt/fireshare/app/nginx/prod.conf /etc/nginx/nginx.conf
+      sed -i 's|root /processed/|root /opt/fireshare-processed/|g' /etc/nginx/nginx.conf
+      sed -i 's/^user[[:space:]]\+nginx;/user  root;/' /etc/nginx/nginx.conf
+      sed -i 's|root[[:space:]]\+/app/build;|root /opt/fireshare/app/client/build;|' /etc/nginx/nginx.conf
+      sed -i 's/__FIRESHARE_PORT__/80/g' /etc/nginx/nginx.conf
+      cp /opt/fireshare/app/nginx/error.html /etc/nginx/
+      cp /opt/fireshare/app/nginx/api_unavailable.html /etc/nginx/
+    fi
+    msg_info "Configuring Fireshare"
+
     cd /opt/fireshare
     $STD uv venv --clear
     $STD .venv/bin/python -m ensurepip --upgrade
@@ -53,13 +63,10 @@ function update_script() {
     export VIDEO_DIRECTORY=/opt/fireshare-videos
     export PROCESSED_DIRECTORY=/opt/fireshare-processed
     $STD uv run flask db upgrade
-
-    msg_info "Building Fireshare Client"
     cd /opt/fireshare/app/client
     $STD npm install
     $STD npm run build
-    msg_ok "Built Fireshare Client"
-    msg_ok "Updated Fireshare"
+    msg_ok "Configured Fireshare"
 
     msg_info "Starting Service"
     systemctl start fireshare
diff --git a/install/fireshare-install.sh b/install/fireshare-install.sh
index 982679c6e..311ba230b 100644
--- a/install/fireshare-install.sh
+++ b/install/fireshare-install.sh
@@ -141,6 +141,9 @@ cp /opt/fireshare/app/nginx/prod.conf /etc/nginx/nginx.conf
 sed -i 's|root /processed/|root /opt/fireshare-processed/|g' /etc/nginx/nginx.conf
 sed -i 's/^user[[:space:]]\+nginx;/user  root;/' /etc/nginx/nginx.conf
 sed -i 's|root[[:space:]]\+/app/build;|root /opt/fireshare/app/client/build;|' /etc/nginx/nginx.conf
+sed -i 's/__FIRESHARE_PORT__/80/g' /etc/nginx/nginx.conf
+cp /opt/fireshare/app/nginx/error.html /etc/nginx/
+cp /opt/fireshare/app/nginx/api_unavailable.html /etc/nginx/
 systemctl start nginx
 
 cat <<EOF >~/fireshare.creds

From 11139aede74cf8c4aa648a8c8a0ac1bf47270d90 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Fri, 10 Jul 2026 08:54:13 +0000
Subject: [PATCH 057/220] Update CHANGELOG.md (#15679)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 62e82d39c..d6e442727 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -505,6 +505,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - Fireshare: Fix for install and upgrade to v1.7.3 [@tremor021](https://github.com/tremor021) ([#15673](https://github.com/community-scripts/ProxmoxVE/pull/15673))
     - Endurain: Fix update procedure [@tremor021](https://github.com/tremor021) ([#15674](https://github.com/community-scripts/ProxmoxVE/pull/15674))
 
 ## 2026-07-09

From 2e4558e2628c3038b8d32cd44d84d50feaa4d41b Mon Sep 17 00:00:00 2001
From: "push-app-to-main[bot]"
 <203845782+push-app-to-main[bot]@users.noreply.github.com>
Date: Fri, 10 Jul 2026 10:57:27 +0200
Subject: [PATCH 058/220] Squid (#15605)

* Add squid (ct)

* Update ct/squid.sh

* Simplify squid.sh by removing proxy user instructions

Removed instructions for adding a proxy user inside the container.

---------

Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com>
Co-authored-by: Sam Heinz <sam@samheinz.com>
Co-authored-by: CanbiZ (MickLesk) <47820557+MickLesk@users.noreply.github.com>
---
 ct/headers/squid         |  6 +++
 ct/squid.sh              | 53 ++++++++++++++++++++++++
 install/squid-install.sh | 88 ++++++++++++++++++++++++++++++++++++++++
 3 files changed, 147 insertions(+)
 create mode 100644 ct/headers/squid
 create mode 100644 ct/squid.sh
 create mode 100644 install/squid-install.sh

diff --git a/ct/headers/squid b/ct/headers/squid
new file mode 100644
index 000000000..3d826ef75
--- /dev/null
+++ b/ct/headers/squid
@@ -0,0 +1,6 @@
+   _____             _     __
+  / ___/____ ___  __(_)___/ /
+  \__ \/ __ `/ / / / / __  / 
+ ___/ / /_/ / /_/ / / /_/ /  
+/____/\__, /\__,_/_/\__,_/   
+        /_/                  
diff --git a/ct/squid.sh b/ct/squid.sh
new file mode 100644
index 000000000..1698fc395
--- /dev/null
+++ b/ct/squid.sh
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: 007hacky007
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.squid-cache.org/
+
+APP="Squid"
+var_tags="${var_tags:-proxy}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-512}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+  if [[ ! -f /etc/squid/squid.conf ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+  msg_info "Updating Squid"
+  $STD apt update
+  $STD apt upgrade -y
+  msg_ok "Updated Squid"
+
+  msg_info "Validating Squid Configuration"
+  $STD squid -k parse
+  msg_ok "Validated Squid Configuration"
+
+  msg_info "Restarting Squid"
+  systemctl restart squid
+  msg_ok "Restarted Squid"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Proxy endpoint:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}${IP}:3128${CL}"
diff --git a/install/squid-install.sh b/install/squid-install.sh
new file mode 100644
index 000000000..aa0110820
--- /dev/null
+++ b/install/squid-install.sh
@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: 007hacky007
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.squid-cache.org/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Configuring Squid"
+mkdir -p /etc/squid
+cat <<EOF >/etc/squid/squid.conf
+acl localnet src 0.0.0.1-0.255.255.255
+acl localnet src 10.0.0.0/8
+acl localnet src 100.64.0.0/10
+acl localnet src 169.254.0.0/16
+acl localnet src 172.16.0.0/12
+acl localnet src 192.168.0.0/16
+acl localnet src fc00::/7
+acl localnet src fe80::/10
+
+acl SSL_ports port 443
+acl Safe_ports port 80
+acl Safe_ports port 21
+acl Safe_ports port 443
+acl Safe_ports port 70
+acl Safe_ports port 210
+acl Safe_ports port 1025-65535
+acl Safe_ports port 280
+acl Safe_ports port 488
+acl Safe_ports port 591
+acl Safe_ports port 777
+acl CONNECT method CONNECT
+
+http_access deny !Safe_ports
+http_access deny CONNECT !SSL_ports
+http_access allow localhost manager
+http_access deny manager
+
+auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwords
+auth_param basic realm proxy
+acl authenticated proxy_auth REQUIRED
+http_access allow authenticated
+http_access deny all
+
+http_port 3128
+
+coredump_dir /var/spool/squid
+
+refresh_pattern ^ftp:        1440    20%    10080
+refresh_pattern ^gopher:     1440    0%     1440
+refresh_pattern -i (/cgi-bin/|\\?) 0  0%     0
+refresh_pattern .            0       20%    4320
+
+# Privacy / hardening
+httpd_suppress_version_string on
+visible_hostname $(hostname)
+forwarded_for delete
+request_header_access X-Forwarded-For deny all
+EOF
+msg_ok "Configured Squid"
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  squid \
+  apache2-utils
+msg_ok "Installed Dependencies"
+
+msg_info "Configuring Squid Authentication"
+touch /etc/squid/passwords
+chown proxy:proxy /etc/squid/passwords
+chmod 640 /etc/squid/passwords
+$STD squid -k parse
+msg_ok "Configured Squid Authentication"
+
+msg_info "Starting Service"
+systemctl enable -q --now squid
+msg_ok "Started Service"
+
+motd_ssh
+customize
+cleanup_lxc

From f4e0111ac0236580d5fb78e51922e7a5dcf5bc08 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Fri, 10 Jul 2026 08:57:54 +0000
Subject: [PATCH 059/220] Update CHANGELOG.md (#15680)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d6e442727..e4c01f33b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -501,6 +501,10 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ## 2026-07-10
 
+### 🆕 New Scripts
+
+  - Squid ([#15605](https://github.com/community-scripts/ProxmoxVE/pull/15605))
+
 ### 🚀 Updated Scripts
 
   - #### 🐞 Bug Fixes

From 92c4fb45a9e36899b4cbddffe4b3680f63ff775e Mon Sep 17 00:00:00 2001
From: wollew <wollew@users.noreply.github.com>
Date: Fri, 10 Jul 2026 20:47:58 +0200
Subject: [PATCH 060/220] Adapt to new artifact filename format for pocket id
 (#15689)

* Adapt to new artifact filename format for pocket id

* adapt pocket id install to new artifact filename format as well
---
 ct/pocketid.sh              | 2 +-
 install/pocketid-install.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/ct/pocketid.sh b/ct/pocketid.sh
index 6153b40c0..9ffc54426 100755
--- a/ct/pocketid.sh
+++ b/ct/pocketid.sh
@@ -71,7 +71,7 @@ function update_script() {
       cp /opt/pocket-id/.env /opt/env
     fi
 
-    fetch_and_deploy_gh_release "pocket-id" "pocket-id/pocket-id" "singlefile" "latest" "/opt/pocket-id/" "pocket-id-linux-$(arch_resolve)"
+    fetch_and_deploy_gh_release "pocket-id" "pocket-id/pocket-id" "singlefile" "latest" "/opt/pocket-id/" "pocket-id_linux_$(arch_resolve)"
     mv /opt/env /opt/pocket-id/.env
 
     msg_info "Starting Service"
diff --git a/install/pocketid-install.sh b/install/pocketid-install.sh
index 47f945d3b..11b8fa591 100644
--- a/install/pocketid-install.sh
+++ b/install/pocketid-install.sh
@@ -14,7 +14,7 @@ network_check
 update_os
 
 read -r -p "${TAB3}What public URL do you want to use (e.g. pocketid.mydomain.com)? " public_url
-fetch_and_deploy_gh_release "pocket-id" "pocket-id/pocket-id" "singlefile" "latest" "/opt/pocket-id/" "pocket-id-linux-$(arch_resolve)"
+fetch_and_deploy_gh_release "pocket-id" "pocket-id/pocket-id" "singlefile" "latest" "/opt/pocket-id/" "pocket-id_linux_$(arch_resolve)"
 
 msg_info "Configuring Pocket ID"
 ENCRYPTION_KEY=$(openssl rand -base64 32)

From b958252441893470e356cfc0e5073957c5552030 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Fri, 10 Jul 2026 18:48:25 +0000
Subject: [PATCH 061/220] Update CHANGELOG.md (#15692)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e4c01f33b..67c3be7b4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -509,6 +509,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - Adapt to new artifact filename format for pocket id [@wollew](https://github.com/wollew) ([#15689](https://github.com/community-scripts/ProxmoxVE/pull/15689))
     - Fireshare: Fix for install and upgrade to v1.7.3 [@tremor021](https://github.com/tremor021) ([#15673](https://github.com/community-scripts/ProxmoxVE/pull/15673))
     - Endurain: Fix update procedure [@tremor021](https://github.com/tremor021) ([#15674](https://github.com/community-scripts/ProxmoxVE/pull/15674))
 

From 98bedb6ccd7a0cb3f9424989b364e835ca0f0249 Mon Sep 17 00:00:00 2001
From: pumrum <pumrum@gmail.com>
Date: Sat, 11 Jul 2026 04:48:55 -0400
Subject: [PATCH 062/220] Fix spacing on VLAN Input Box in haos-vm.sh (#15696)

---
 vm/haos-vm.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/vm/haos-vm.sh b/vm/haos-vm.sh
index 85d582170..df5189614 100644
--- a/vm/haos-vm.sh
+++ b/vm/haos-vm.sh
@@ -475,7 +475,7 @@ function advanced_settings() {
   done
 
   while true; do
-    if VLAN1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a Vlan(leave blank for default)" 8 58 --title "VLAN" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
+    if VLAN1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a Vlan (leave blank for default)" 8 58 --title "VLAN" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
       if [ -z "$VLAN1" ]; then
         VLAN1="Default"
         VLAN=""

From f137f8c8942e552693a0f2f9f2bdfcb56735e85a Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Sat, 11 Jul 2026 08:49:21 +0000
Subject: [PATCH 063/220] Update CHANGELOG.md (#15699)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 67c3be7b4..ab1e165fa 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -499,6 +499,14 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-07-11
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Fix spacing on VLAN Input Box in haos-vm.sh [@pumrum](https://github.com/pumrum) ([#15696](https://github.com/community-scripts/ProxmoxVE/pull/15696))
+
 ## 2026-07-10
 
 ### 🆕 New Scripts

From 618d578c353149798079c19720f1b0478fc085ca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Slavi=C5=A1a=20Are=C5=BEina?=
 <58952836+tremor021@users.noreply.github.com>
Date: Sat, 11 Jul 2026 20:00:29 +0200
Subject: [PATCH 064/220] [tools.func]: Add function to handle deployment via
 GitLab release tags (#15641)

* Update CHANGELOG.md (#15631)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

* Update CHANGELOG.md (#15631)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

* Update CHANGELOG.md (#15631)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

* add gl tag handling funcs

---------

Co-authored-by: community-scripts-pr-app[bot] <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 misc/tools.func | 193 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 193 insertions(+)

diff --git a/misc/tools.func b/misc/tools.func
index e8e18f4f3..9360535a3 100644
--- a/misc/tools.func
+++ b/misc/tools.func
@@ -2559,6 +2559,199 @@ fetch_and_deploy_gh_tag() {
   return 0
 }
 
+# ------------------------------------------------------------------------------
+# Get the latest GitLab repository tag matching a glob pattern.
+#
+# Description:
+#   - Queries the GitLab repository tags API (up to 100 tags per page)
+#   - Filters tag names against a shell glob pattern (e.g. "web-v*" or "mobile-v*")
+#   - Always excludes pre-release tags (those containing alpha, beta, or rc)
+#   - Sorts matching tags with `sort -V` and returns the highest one
+#   - Supports GITLAB_TOKEN for private/rate-limited projects
+#
+# Usage:
+#     get_latest_gl_tag "owner/repo" "web-v*"
+#     get_latest_gl_tag "owner/repo" "mobile-v*"
+#     get_latest_gl_tag "owner/repo"          # returns newest tag (no filter)
+#
+# Arguments:
+#   $1 - GitLab repo path (namespace/project, e.g. "mygroup/myapp")
+#   $2 - Optional glob pattern to filter tag names (e.g. "web-v*")
+#
+# Returns:
+#   Latest matching tag name on stdout, or non-zero on failure
+# ------------------------------------------------------------------------------
+get_latest_gl_tag() {
+  local repo="$1"
+  local pattern="${2:-}"
+
+  local repo_encoded
+  repo_encoded=$(printf '%s' "$repo" | sed 's|/|%2F|g')
+
+  local api_base="https://gitlab.com/api/v4/projects/${repo_encoded}/repository/tags"
+  local api_timeout="--connect-timeout 10 --max-time 60"
+
+  local header=()
+  [[ -n "${GITLAB_TOKEN:-}" ]] && header=(-H "PRIVATE-TOKEN: $GITLAB_TOKEN")
+
+  # If a pattern is given, pass it as a regex search to reduce server-side results.
+  # GitLab ?search= supports anchored regex; convert leading glob prefix to regex anchor.
+  local search_param=""
+  if [[ -n "$pattern" ]]; then
+    # Strip trailing wildcard for the search hint (server-side prefix filter).
+    local prefix="${pattern%%\**}"
+    [[ -n "$prefix" ]] && search_param="?search=^${prefix}&per_page=100" || search_param="?per_page=100"
+  else
+    search_param="?per_page=100"
+  fi
+
+  local temp_file
+  temp_file=$(mktemp) || return 1
+
+  local http_code
+  http_code=$(curl $api_timeout -sSL -w "%{http_code}" -o "$temp_file" \
+    "${header[@]}" "${api_base}${search_param}" 2>/dev/null) || true
+
+  if [[ "$http_code" != "200" ]]; then
+    rm -f "$temp_file"
+    msg_error "GitLab tags API returned HTTP $http_code for $repo"
+    return 22
+  fi
+
+  local tag=""
+  if [[ -n "$pattern" ]]; then
+    # Client-side glob filter + pre-release exclusion, then version-sort to pick the highest match.
+    tag=$(jq -r '.[].name' "$temp_file" 2>/dev/null | while IFS= read -r t; do
+      case "$t" in
+      *alpha* | *beta* | *rc*) continue ;;
+      $pattern) echo "$t" ;;
+      esac
+    done | sort -V | tail -n1)
+  else
+    # No pattern: skip pre-release tags, take the first remaining (newest) one.
+    tag=$(jq -r '.[].name' "$temp_file" 2>/dev/null |
+      grep -Eiv '(alpha|beta|rc)' |
+      head -n1)
+  fi
+
+  rm -f "$temp_file"
+
+  if [[ -z "$tag" ]]; then
+    msg_error "No tags matching '${pattern:-*}' found for ${repo}"
+    return 250
+  fi
+
+  echo "$tag"
+}
+
+# ------------------------------------------------------------------------------
+# Fetches and deploys a GitLab tag-based source tarball.
+#
+# Description:
+#   - Resolves the latest tag matching the given glob pattern via get_latest_gl_tag
+#     (or uses the exact tag if one is provided instead of "latest")
+#   - Downloads the GitLab source tarball for that tag
+#   - Extracts it to the target directory
+#   - Writes the resolved tag to ~/.<app> for update-checking
+#
+# Usage:
+#     fetch_and_deploy_gl_tag "myapp" "mygroup/myrepo" "web-v*"
+#     fetch_and_deploy_gl_tag "myapp" "mygroup/myrepo" "mobile-v*" "/opt/myapp"
+#     fetch_and_deploy_gl_tag "myapp" "mygroup/myrepo" "v*"          # any v-tag
+#     fetch_and_deploy_gl_tag "myapp" "mygroup/myrepo" "web-v3.0*"   # narrow version range
+#
+# Arguments:
+#   $1 - App name (used for version file ~/.<app> and lowercase tarball name)
+#   $2 - GitLab repo path (namespace/project, e.g. "mygroup/myapp")
+#   $3 - Tag pattern: glob (e.g. "web-v*") or exact tag (e.g. "web-v3.0.0").
+#        Use "latest" to fetch the single newest tag with no pattern filter.
+#   $4 - Target directory (default: /opt/$app)
+#
+# Notes:
+#   - Supports CLEAN_INSTALL=1 to wipe target before extracting
+#   - Supports GITLAB_TOKEN for private/rate-limited projects
+#   - For repos that only publish tags, not formal GitLab Releases
+#     (use fetch_and_deploy_gl_release for proper Releases with assets)
+# ------------------------------------------------------------------------------
+fetch_and_deploy_gl_tag() {
+  local app="$1"
+  local repo="$2"
+  local tag_pattern="${3:-latest}"
+  local target="${4:-/opt/$app}"
+
+  local app_lc=""
+  app_lc="$(echo "${app,,}" | tr -d ' ')"
+  local version_file="$HOME/.${app_lc}"
+
+  local api_timeout="--connect-timeout 10 --max-time 60"
+  local download_timeout="--connect-timeout 15 --max-time 900"
+
+  local header=()
+  [[ -n "${GITLAB_TOKEN:-}" ]] && header=(-H "PRIVATE-TOKEN: $GITLAB_TOKEN")
+
+  # Resolve the tag: if caller passed a glob/latest, query the API.
+  # If caller passed an exact tag (no wildcards), use it directly.
+  local resolved_tag="$tag_pattern"
+  if [[ "$tag_pattern" == "latest" || "$tag_pattern" == *"*"* || "$tag_pattern" == *"?"* ]]; then
+    local glob_arg=""
+    [[ "$tag_pattern" != "latest" ]] && glob_arg="$tag_pattern"
+    resolved_tag=$(get_latest_gl_tag "$repo" "$glob_arg") || {
+      msg_error "Failed to determine latest tag matching '${tag_pattern}' for ${repo}"
+      return 250
+    }
+  fi
+
+  local current_version=""
+  [[ -f "$version_file" ]] && current_version=$(<"$version_file")
+
+  if [[ "$current_version" == "$resolved_tag" ]]; then
+    msg_ok "$app is already up-to-date ($resolved_tag)"
+    return 0
+  fi
+
+  local repo_encoded
+  repo_encoded=$(printf '%s' "$repo" | sed 's|/|%2F|g')
+
+  # GitLab source tarball URL (no release needed, works for any tag).
+  local version_safe="${resolved_tag//\//-}"
+  local tarball_url="https://gitlab.com/${repo}/-/archive/${resolved_tag}/${app_lc}-${version_safe}.tar.gz"
+
+  local tmpdir
+  tmpdir=$(mktemp -d) || return 1
+  local filename="${app_lc}-${version_safe}.tar.gz"
+
+  msg_info "Fetching GitLab tag: ${app} (${resolved_tag})"
+
+  curl $download_timeout -fsSL "${header[@]}" -o "$tmpdir/$filename" "$tarball_url" || {
+    msg_error "Download failed: $tarball_url"
+    rm -rf "$tmpdir"
+    return 7
+  }
+
+  mkdir -p "$target"
+  if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
+    rm -rf "${target:?}/"*
+  fi
+
+  tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
+    msg_error "Failed to extract tarball"
+    rm -rf "$tmpdir"
+    return 251
+  }
+
+  local unpack_dir
+  unpack_dir=$(find "$tmpdir" -mindepth 1 -maxdepth 1 -type d | head -n1)
+
+  shopt -s dotglob nullglob
+  cp -r "$unpack_dir"/* "$target/"
+  shopt -u dotglob nullglob
+
+  rm -rf "$tmpdir"
+  echo "$resolved_tag" >"$version_file"
+  msg_ok "Deployed ${app} ${resolved_tag} to ${target}"
+  return 0
+}
+
 # ------------------------------------------------------------------------------
 # Checks for new GitHub tag (for repos without releases).
 #

From 0906341e95a151b19095ddf130251f0ef632e053 Mon Sep 17 00:00:00 2001
From: "push-app-to-main[bot]"
 <203845782+push-app-to-main[bot]@users.noreply.github.com>
Date: Sat, 11 Jul 2026 20:00:36 +0200
Subject: [PATCH 065/220] LocalAGI (#15687)

* Add localagi (ct)

* Refactor localagi.sh for better readability

Removed unnecessary blank lines and improved script readability.

---------

Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com>
Co-authored-by: CanbiZ (MickLesk) <47820557+MickLesk@users.noreply.github.com>
---
 ct/headers/localagi         |  6 +++
 ct/localagi.sh              | 67 +++++++++++++++++++++++++++++++++
 install/localagi-install.sh | 75 +++++++++++++++++++++++++++++++++++++
 3 files changed, 148 insertions(+)
 create mode 100644 ct/headers/localagi
 create mode 100644 ct/localagi.sh
 create mode 100644 install/localagi-install.sh

diff --git a/ct/headers/localagi b/ct/headers/localagi
new file mode 100644
index 000000000..c47da9aac
--- /dev/null
+++ b/ct/headers/localagi
@@ -0,0 +1,6 @@
+    __                     _____   __________
+   / /   ____  _________ _/ /   | / ____/  _/
+  / /   / __ \/ ___/ __ `/ / /| |/ / __ / /  
+ / /___/ /_/ / /__/ /_/ / / ___ / /_/ // /   
+/_____/\____/\___/\__,_/_/_/  |_\____/___/   
+                                             
diff --git a/ct/localagi.sh b/ct/localagi.sh
new file mode 100644
index 000000000..b2f9fbe91
--- /dev/null
+++ b/ct/localagi.sh
@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: BillyOutlast
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/mudler/LocalAGI
+
+APP="LocalAGI"
+var_tags="${var_tags:-ai}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-20}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+var_gpu="${var_gpu:-no}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/localagi ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "localagi" "mudler/LocalAGI"; then
+    msg_info "Stopping Service"
+    systemctl stop localagi
+    msg_ok "Stopped Service"
+
+    create_backup /opt/localagi/.env
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "localagi" "mudler/LocalAGI" "tarball" "latest" "/opt/localagi"
+    restore_backup
+
+    msg_info "Building LocalAGI"
+    cd /opt/localagi/webui/react-ui
+    $STD bun install
+    $STD bun run build
+    cd /opt/localagi
+    $STD go build -o /usr/local/bin/localagi
+    msg_ok "Updated LocalAGI successfully"
+
+    msg_info "Starting Service"
+    systemctl start localagi
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+    exit
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"
diff --git a/install/localagi-install.sh b/install/localagi-install.sh
new file mode 100644
index 000000000..3589d1b8b
--- /dev/null
+++ b/install/localagi-install.sh
@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: BillyOutlast
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/mudler/LocalAGI
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+APP="LocalAGI"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y build-essential
+msg_ok "Installed Dependencies"
+
+NODE_VERSION="24" setup_nodejs
+setup_go
+
+msg_info "Installing Bun"
+export BUN_INSTALL="/root/.bun"
+curl -fsSL https://bun.sh/install | $STD bash
+ln -sf /root/.bun/bin/bun /usr/local/bin/bun
+ln -sf /root/.bun/bin/bunx /usr/local/bin/bunx
+msg_ok "Installed Bun"
+
+fetch_and_deploy_gh_release "localagi" "mudler/LocalAGI" "tarball" "latest" "/opt/localagi"
+
+msg_info "Configuring LocalAGI"
+mkdir -p /opt/localagi/pool
+cat <<'EOF' >/opt/localagi/.env
+LOCALAGI_MODEL=gemma-3-4b-it-qat
+LOCALAGI_MULTIMODAL_MODEL=moondream2-20250414
+LOCALAGI_IMAGE_MODEL=sd-1.5-ggml
+LOCALAGI_LLM_API_URL=http://127.0.0.1:11434/v1
+LOCALAGI_STATE_DIR=/opt/localagi/pool
+EOF
+msg_ok "Configured LocalAGI"
+
+msg_info "Setting up LocalAGI"
+cd /opt/localagi/webui/react-ui
+$STD bun install
+$STD bun run build
+cd /opt/localagi
+$STD go build -o /usr/local/bin/localagi
+msg_ok "Set up LocalAGI"
+
+msg_info "Creating LocalAGI systemd service"
+cat <<EOF >/etc/systemd/system/localagi.service
+[Unit]
+Description=LocalAGI
+After=network.target
+
+[Service]
+User=root
+Type=simple
+EnvironmentFile=/opt/localagi/.env
+
+WorkingDirectory=/opt/localagi
+ExecStart=/usr/local/bin/localagi
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now localagi
+msg_ok "Created LocalAGI systemd service"
+
+motd_ssh
+customize
+cleanup_lxc

From ed9c80f8053f66520b9469225d312a060d2753cf Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Sat, 11 Jul 2026 18:00:51 +0000
Subject: [PATCH 066/220] Update CHANGELOG.md (#15707)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ab1e165fa..a2bb24f91 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -501,12 +501,22 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ## 2026-07-11
 
+### 🆕 New Scripts
+
+  - LocalAGI ([#15687](https://github.com/community-scripts/ProxmoxVE/pull/15687))
+
 ### 🚀 Updated Scripts
 
   - #### 🐞 Bug Fixes
 
     - Fix spacing on VLAN Input Box in haos-vm.sh [@pumrum](https://github.com/pumrum) ([#15696](https://github.com/community-scripts/ProxmoxVE/pull/15696))
 
+### 💾 Core
+
+  - #### ✨ New Features
+
+    - [tools.func]: Add function to handle deployment via GitLab release tags [@tremor021](https://github.com/tremor021) ([#15641](https://github.com/community-scripts/ProxmoxVE/pull/15641))
+
 ## 2026-07-10
 
 ### 🆕 New Scripts

From f1b2bd048600228d0108d5f3fc1b32fce672a656 Mon Sep 17 00:00:00 2001
From: TowyTowy <85077986+TowyTowy@users.noreply.github.com>
Date: Sat, 11 Jul 2026 20:07:05 +0200
Subject: [PATCH 068/220] fix(adventurelog): allow pnpm build scripts so
 install/update doesn't abort (#15681)

AdventureLog's frontend install runs a bare `pnpm i`. On pnpm v10+, build
scripts of dependencies (esbuild, es5-ext, svelte-preprocess) are ignored by
default and pnpm aborts with ERR_PNPM_IGNORED_BUILDS (exit 1), so the install
never reaches `pnpm build`. The shipped frontend/pnpm-workspace.yaml already
pins esbuild, so those builds are expected to run.

Enable the builds for this app only by appending `dangerouslyAllowAllBuilds:
true` to the frontend's pnpm-workspace.yaml before `pnpm i`, in both the install
and update paths. The change is guarded so it is not duplicated on re-run, and
it is scoped to AdventureLog (which ships no onlyBuiltDependencies) to avoid the
global config conflict that a repo-wide setting would cause.

Fixes #15670

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 ct/adventurelog.sh              | 1 +
 install/adventurelog-install.sh | 1 +
 2 files changed, 2 insertions(+)

diff --git a/ct/adventurelog.sh b/ct/adventurelog.sh
index 0da4c09c0..98327747e 100644
--- a/ct/adventurelog.sh
+++ b/ct/adventurelog.sh
@@ -60,6 +60,7 @@ function update_script() {
     $STD .venv/bin/python -m manage migrate
 
     cd /opt/adventurelog/frontend
+    grep -q "^dangerouslyAllowAllBuilds:" ./pnpm-workspace.yaml 2>/dev/null || echo "dangerouslyAllowAllBuilds: true" >>./pnpm-workspace.yaml
     $STD pnpm i
     $STD pnpm build
     msg_ok "Updated AdventureLog"
diff --git a/install/adventurelog-install.sh b/install/adventurelog-install.sh
index 10e664bc6..b480da0d9 100644
--- a/install/adventurelog-install.sh
+++ b/install/adventurelog-install.sh
@@ -72,6 +72,7 @@ BODY_SIZE_LIMIT=Infinity
 ORIGIN='http://$LOCAL_IP:3000'
 EOF
 cd /opt/adventurelog/frontend
+grep -q "^dangerouslyAllowAllBuilds:" ./pnpm-workspace.yaml 2>/dev/null || echo "dangerouslyAllowAllBuilds: true" >>./pnpm-workspace.yaml
 $STD pnpm i
 $STD pnpm build
 msg_ok "Installed AdventureLog"

From dcd1eefdd4d5051ce5e6d41fa00cbc9ab6ad52b3 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Sat, 11 Jul 2026 18:07:32 +0000
Subject: [PATCH 069/220] Update CHANGELOG.md (#15709)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a2bb24f91..707ec2a40 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -507,6 +507,8 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ### 🚀 Updated Scripts
 
+  - fix(adventurelog): allow pnpm build scripts so install/update doesn't abort [@TowyTowy](https://github.com/TowyTowy) ([#15681](https://github.com/community-scripts/ProxmoxVE/pull/15681))
+
   - #### 🐞 Bug Fixes
 
     - Fix spacing on VLAN Input Box in haos-vm.sh [@pumrum](https://github.com/pumrum) ([#15696](https://github.com/community-scripts/ProxmoxVE/pull/15696))

From c481c3e24ee6cb91e7d98cb6ef9b517f8060c039 Mon Sep 17 00:00:00 2001
From: TowyTowy <85077986+TowyTowy@users.noreply.github.com>
Date: Sat, 11 Jul 2026 22:15:12 +0200
Subject: [PATCH 070/220] fix(fileflows): install .NET 10 ASP.NET Core Runtime
 to match current release (#15702)

* fix(fileflows): install .NET 10 ASP.NET Core Runtime to match current release

FileFlows now ships its server/node binaries targeting .NET 10
(Microsoft.NETCore.App 10.0.0), but the install script still installs the
ASP.NET Core Runtime 8.0. On a fresh install the app therefore cannot start:

  You must install or update .NET to run this application.
  Framework: 'Microsoft.NETCore.App', version '10.0.0' (x64)
  The following frameworks were found:
    8.0.28 at [/usr/share/dotnet/shared/Microsoft.NETCore.App]

so "dotnet FileFlows.Server.dll --systemd install" fails with exit code 150
(service failed to start) and the container aborts (issue #15686).

Bump the runtime to 10.0 on both branches: aspnetcore-runtime-10.0 from
packages.microsoft.com on amd64 (the same repo and package already used by
igotify, rdtclient and technitiumdns) and dotnet-install --channel 10.0 on
arm64.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(fileflows): ensure current .NET runtime on update too

An existing install set up under an older .NET (e.g. aspnetcore-runtime-8.0)
would download a newer FileFlows on update but keep the old runtime, failing to
start with the same framework-not-found error. Mirror the runtime handling used
by technitiumdns/rdtclient in update_script.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 ct/fileflows.sh              | 22 ++++++++++++++++++++++
 install/fileflows-install.sh |  6 +++---
 2 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/ct/fileflows.sh b/ct/fileflows.sh
index 1f33d2dd0..473efd435 100644
--- a/ct/fileflows.sh
+++ b/ct/fileflows.sh
@@ -43,6 +43,28 @@ function update_script() {
     tar -czf "$backup_filename" -C /opt/fileflows Data
     msg_ok "Backup Created"
 
+    # FileFlows tracks the latest release, whose .NET target can move (e.g. 8 -> 10);
+    # ensure the current ASP.NET Core Runtime so an existing install doesn't fail to
+    # start after updating to a newer .NET major version.
+    msg_info "Ensuring ASP.NET Core Runtime"
+    if [[ "$(arch_resolve)" == "arm64" ]]; then
+      if [[ ! -x /usr/lib/dotnet10/dotnet ]]; then
+        curl -fsSL https://dot.net/v1/dotnet-install.sh -o /tmp/dotnet-install.sh
+        $STD bash /tmp/dotnet-install.sh --channel 10.0 --runtime aspnetcore --install-dir /usr/lib/dotnet10
+        ln -sf /usr/lib/dotnet10/dotnet /usr/bin/dotnet
+        rm -f /tmp/dotnet-install.sh
+      fi
+    elif ! is_package_installed "aspnetcore-runtime-10.0"; then
+      $STD apt remove -y aspnetcore-runtime-8.0 aspnetcore-runtime-9.0 2>/dev/null || true
+      setup_deb822_repo \
+        "microsoft" \
+        "https://packages.microsoft.com/keys/microsoft-2025.asc" \
+        "https://packages.microsoft.com/debian/13/prod/" \
+        "trixie"
+      $STD apt install -y aspnetcore-runtime-10.0
+    fi
+    msg_ok "Ensured ASP.NET Core Runtime"
+
     fetch_and_deploy_from_url "https://fileflows.com/downloads/zip" "/opt/fileflows"
 
     msg_info "Starting Service"
diff --git a/install/fileflows-install.sh b/install/fileflows-install.sh
index af93424b6..50242be8a 100644
--- a/install/fileflows-install.sh
+++ b/install/fileflows-install.sh
@@ -26,8 +26,8 @@ msg_info "Installing ASP.NET Core Runtime"
 if [[ "$(arch_resolve)" == "arm64" ]]; then
   # packages.microsoft.com only ships amd64 debs for Debian; use dotnet-install on arm64
   curl -fsSL https://dot.net/v1/dotnet-install.sh -o /tmp/dotnet-install.sh
-  $STD bash /tmp/dotnet-install.sh --channel 8.0 --runtime aspnetcore --install-dir /usr/lib/dotnet8
-  ln -sf /usr/lib/dotnet8/dotnet /usr/bin/dotnet
+  $STD bash /tmp/dotnet-install.sh --channel 10.0 --runtime aspnetcore --install-dir /usr/lib/dotnet10
+  ln -sf /usr/lib/dotnet10/dotnet /usr/bin/dotnet
   rm -f /tmp/dotnet-install.sh
 else
   setup_deb822_repo \
@@ -35,7 +35,7 @@ else
     "https://packages.microsoft.com/keys/microsoft-2025.asc" \
     "https://packages.microsoft.com/debian/13/prod/" \
     "trixie"
-  $STD apt install -y aspnetcore-runtime-8.0
+  $STD apt install -y aspnetcore-runtime-10.0
 fi
 msg_ok "Installed ASP.NET Core Runtime"
 

From 8fbb4b1988e3fde4cdfdd684401dddc9096b8691 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Sat, 11 Jul 2026 20:15:36 +0000
Subject: [PATCH 071/220] Update CHANGELOG.md (#15712)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 707ec2a40..c880c3861 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -511,6 +511,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - fix(fileflows): install .NET 10 ASP.NET Core Runtime to match current release [@TowyTowy](https://github.com/TowyTowy) ([#15702](https://github.com/community-scripts/ProxmoxVE/pull/15702))
     - Fix spacing on VLAN Input Box in haos-vm.sh [@pumrum](https://github.com/pumrum) ([#15696](https://github.com/community-scripts/ProxmoxVE/pull/15696))
 
 ### 💾 Core

From 76335cefe8790b036249636b12920fb04c6ab254 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Sun, 12 Jul 2026 00:17:46 +0000
Subject: [PATCH 072/220] Archive old changelog entries (#15714)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 .github/changelogs/2026/07.md |  91 ++++++++++++++++++++++
 CHANGELOG.md                  | 138 ++--------------------------------
 2 files changed, 96 insertions(+), 133 deletions(-)

diff --git a/.github/changelogs/2026/07.md b/.github/changelogs/2026/07.md
index 4c20ca3e6..2ecd58f89 100644
--- a/.github/changelogs/2026/07.md
+++ b/.github/changelogs/2026/07.md
@@ -1,3 +1,94 @@
+## 2026-07-11
+
+### 🆕 New Scripts
+
+  - LocalAGI ([#15687](https://github.com/community-scripts/ProxmoxVE/pull/15687))
+
+### 🚀 Updated Scripts
+
+  - fix(adventurelog): allow pnpm build scripts so install/update doesn't abort [@TowyTowy](https://github.com/TowyTowy) ([#15681](https://github.com/community-scripts/ProxmoxVE/pull/15681))
+
+  - #### 🐞 Bug Fixes
+
+    - fix(fileflows): install .NET 10 ASP.NET Core Runtime to match current release [@TowyTowy](https://github.com/TowyTowy) ([#15702](https://github.com/community-scripts/ProxmoxVE/pull/15702))
+    - Fix spacing on VLAN Input Box in haos-vm.sh [@pumrum](https://github.com/pumrum) ([#15696](https://github.com/community-scripts/ProxmoxVE/pull/15696))
+
+### 💾 Core
+
+  - #### ✨ New Features
+
+    - [tools.func]: Add function to handle deployment via GitLab release tags [@tremor021](https://github.com/tremor021) ([#15641](https://github.com/community-scripts/ProxmoxVE/pull/15641))
+
+## 2026-07-10
+
+### 🆕 New Scripts
+
+  - Squid ([#15605](https://github.com/community-scripts/ProxmoxVE/pull/15605))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Adapt to new artifact filename format for pocket id [@wollew](https://github.com/wollew) ([#15689](https://github.com/community-scripts/ProxmoxVE/pull/15689))
+    - Fireshare: Fix for install and upgrade to v1.7.3 [@tremor021](https://github.com/tremor021) ([#15673](https://github.com/community-scripts/ProxmoxVE/pull/15673))
+    - Endurain: Fix update procedure [@tremor021](https://github.com/tremor021) ([#15674](https://github.com/community-scripts/ProxmoxVE/pull/15674))
+
+## 2026-07-09
+
+### 🚀 Updated Scripts
+
+  - fix(pihole): repair Unbound DNS-over-TLS (DoT) forwarding config [@TowyTowy](https://github.com/TowyTowy) ([#15654](https://github.com/community-scripts/ProxmoxVE/pull/15654))
+
+## 2026-07-08
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Opencloud: Bump version to 7.2.1 [@vhsdream](https://github.com/vhsdream) ([#15655](https://github.com/community-scripts/ProxmoxVE/pull/15655))
+    - BabyBuddy: Harden update script [@MickLesk](https://github.com/MickLesk) ([#15642](https://github.com/community-scripts/ProxmoxVE/pull/15642))
+
+## 2026-07-07
+
+### 🆕 New Scripts
+
+  - Forgejo-Runner ([#15046](https://github.com/community-scripts/ProxmoxVE/pull/15046))
+
+## 2026-07-06
+
+### 🚀 Updated Scripts
+
+  - Fix alignment in various ct end messages [@tremor021](https://github.com/tremor021) ([#15632](https://github.com/community-scripts/ProxmoxVE/pull/15632))
+- Immich: Update libvips to 8.18.4 [@vhsdream](https://github.com/vhsdream) ([#15619](https://github.com/community-scripts/ProxmoxVE/pull/15619))
+
+  - #### 🐞 Bug Fixes
+
+    - Wizarr: Build JS and CSS static assets [@vhsdream](https://github.com/vhsdream) ([#15634](https://github.com/community-scripts/ProxmoxVE/pull/15634))
+    - RustDesk Server: Update URL format in rustdeskserver.sh [@tremor021](https://github.com/tremor021) ([#15626](https://github.com/community-scripts/ProxmoxVE/pull/15626))
+    - attempt to port docker-vm to support arm64 [@asylumexp](https://github.com/asylumexp) ([#15611](https://github.com/community-scripts/ProxmoxVE/pull/15611))
+    - fix(plane): don't clobber global app var, breaking /usr/bin/update [@asylumexp](https://github.com/asylumexp) ([#15612](https://github.com/community-scripts/ProxmoxVE/pull/15612))
+
+  - #### 🔧 Refactor
+
+    - cliproxyapi: point setup message at /management.html [@austinpilz](https://github.com/austinpilz) ([#15628](https://github.com/community-scripts/ProxmoxVE/pull/15628))
+
+### 🗑️ Deleted Scripts
+
+  - Remove: FlowiseAI [@MickLesk](https://github.com/MickLesk) ([#15624](https://github.com/community-scripts/ProxmoxVE/pull/15624))
+
+## 2026-07-05
+
+### 🆕 New Scripts
+
+  - excalidash ([#15604](https://github.com/community-scripts/ProxmoxVE/pull/15604))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix: homarr: cli [@CrazyWolf13](https://github.com/CrazyWolf13) ([#15603](https://github.com/community-scripts/ProxmoxVE/pull/15603))
+    - immich: vacuum smart_search/face_search before VectorChord bump [@irishpadres](https://github.com/irishpadres) ([#15607](https://github.com/community-scripts/ProxmoxVE/pull/15607))
+
 ## 2026-07-04
 
 ### 🚀 Updated Scripts
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c880c3861..8e1c5dcbb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -74,6 +74,9 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 
 
+
+
+
 
 
 
@@ -87,7 +90,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 
 <details>
-<summary><h4>July (4 entries)</h4></summary>
+<summary><h4>July (11 entries)</h4></summary>
 
 [View July 2026 Changelog](.github/changelogs/2026/07.md)
 
@@ -1104,135 +1107,4 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### ✨ New Features
 
-    - [core] Implement backup and restore functions [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15067](https://github.com/community-scripts/ProxmoxVE/pull/15067))
-
-## 2026-06-11
-
-### 🆕 New Scripts
-
-  - Clickhouse ([#15045](https://github.com/community-scripts/ProxmoxVE/pull/15045))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Manyfold: add new dependency [@MickLesk](https://github.com/MickLesk) ([#15040](https://github.com/community-scripts/ProxmoxVE/pull/15040))
-    - OpenArchiver: switch Rebuild Function [@MickLesk](https://github.com/MickLesk) ([#15042](https://github.com/community-scripts/ProxmoxVE/pull/15042))
-    - CLIProxyAPI: Save management password to creds file [@tremor021](https://github.com/tremor021) ([#15051](https://github.com/community-scripts/ProxmoxVE/pull/15051))
-    - Jotty: Fix wrong path test in config restore [@vhsdream](https://github.com/vhsdream) ([#15038](https://github.com/community-scripts/ProxmoxVE/pull/15038))
-    - Fix for cross-seed after node upgrade [@TorinFrancis](https://github.com/TorinFrancis) ([#15025](https://github.com/community-scripts/ProxmoxVE/pull/15025))
-
-  - #### 🔧 Refactor
-
-    - Alpine-Nextcloud: Upgrade PHP and dependencies in installation script [@MickLesk](https://github.com/MickLesk) ([#15039](https://github.com/community-scripts/ProxmoxVE/pull/15039))
-    - [arm64] porting stage 1: set script arm64 statuses to yes [@asylumexp](https://github.com/asylumexp) ([#15052](https://github.com/community-scripts/ProxmoxVE/pull/15052))
-
-### 💾 Core
-
-  - #### ✨ New Features
-
-    - misc scripts: add support for arm64 [@asylumexp](https://github.com/asylumexp) ([#12639](https://github.com/community-scripts/ProxmoxVE/pull/12639))
-
-  - #### 🔧 Refactor
-
-    - [arm64] remove logic for custom debian arm64 template [@asylumexp](https://github.com/asylumexp) ([#15050](https://github.com/community-scripts/ProxmoxVE/pull/15050))
-
-### 📚 Documentation
-
-  - (github): Revise script request template [@MickLesk](https://github.com/MickLesk) ([#15058](https://github.com/community-scripts/ProxmoxVE/pull/15058))
-
-## 2026-06-10
-
-### 🆕 New Scripts
-
-  - Baserow ([#14968](https://github.com/community-scripts/ProxmoxVE/pull/14968))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Koillection: Fix update procedure [@tremor021](https://github.com/tremor021) ([#15033](https://github.com/community-scripts/ProxmoxVE/pull/15033))
-
-## 2026-06-09
-
-### 🆕 New Scripts
-
-  - paperclip ([#14990](https://github.com/community-scripts/ProxmoxVE/pull/14990))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - endurain: Install pytz package during backend setup [@MickLesk](https://github.com/MickLesk) ([#15014](https://github.com/community-scripts/ProxmoxVE/pull/15014))
-
-  - #### 🔧 Refactor
-
-    - Refactor: Proxmox Backup Server - use deb822 [@MickLesk](https://github.com/MickLesk) ([#15013](https://github.com/community-scripts/ProxmoxVE/pull/15013))
-
-## 2026-06-08
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - security: Fix HTTP to HTTPS for all package and repository downloads [@MickLesk](https://github.com/MickLesk) ([#15009](https://github.com/community-scripts/ProxmoxVE/pull/15009))
-    - homelable: preserve MCP server config across updates [@ferr079](https://github.com/ferr079) ([#14996](https://github.com/community-scripts/ProxmoxVE/pull/14996))
-    - changedetection: migrate Python install to uv venv [@ferr079](https://github.com/ferr079) ([#14995](https://github.com/community-scripts/ProxmoxVE/pull/14995))
-
-  - #### 🔧 Refactor
-
-    - Update Flowwiseai to node 24 [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#14999](https://github.com/community-scripts/ProxmoxVE/pull/14999))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - security: Fix MITM RCE vulnerability in microcode scripts (CVE) [@MickLesk](https://github.com/MickLesk) ([#15007](https://github.com/community-scripts/ProxmoxVE/pull/15007))
-
-## 2026-06-07
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Immich: use actual installed PostgreSQL version for vchord package [@MickLesk](https://github.com/MickLesk) ([#14989](https://github.com/community-scripts/ProxmoxVE/pull/14989))
-
-  - #### 🔧 Refactor
-
-    - Navidrome: remove genereic filebrowser addon setup [@MickLesk](https://github.com/MickLesk) ([#14991](https://github.com/community-scripts/ProxmoxVE/pull/14991))
-
-## 2026-06-06
-
-### 🆕 New Scripts
-
-  - Spliit ([#14966](https://github.com/community-scripts/ProxmoxVE/pull/14966))
-- Tolgee ([#14965](https://github.com/community-scripts/ProxmoxVE/pull/14965))
-- XYOps ([#14967](https://github.com/community-scripts/ProxmoxVE/pull/14967))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Photoprism: Allow env variables with spaces [@Badintral](https://github.com/Badintral) ([#14969](https://github.com/community-scripts/ProxmoxVE/pull/14969))
-
-## 2026-06-05
-
-### 🆕 New Scripts
-
-  - MatterJS-Server ([#14951](https://github.com/community-scripts/ProxmoxVE/pull/14951))
-- CyberChef ([#14952](https://github.com/community-scripts/ProxmoxVE/pull/14952))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Jackett: Create missing .env file [@tremor021](https://github.com/tremor021) ([#14959](https://github.com/community-scripts/ProxmoxVE/pull/14959))
-    - OpenThread-BR: use systemd instead of init.d [@tomfrenzel](https://github.com/tomfrenzel) ([#14942](https://github.com/community-scripts/ProxmoxVE/pull/14942))
-
-  - #### ✨ New Features
-
-    - AMD IGPU support [@Learath](https://github.com/Learath) ([#14944](https://github.com/community-scripts/ProxmoxVE/pull/14944))
-
-  - #### 💥 Breaking Changes
-
-    - update authentik to 2026.5.2 [@thieneret](https://github.com/thieneret) ([#14846](https://github.com/community-scripts/ProxmoxVE/pull/14846))
\ No newline at end of file
+    - [core] Implement backup and restore functions [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15067](https://github.com/community-scripts/ProxmoxVE/pull/15067))
\ No newline at end of file

From 96100474cc54c6a0f64efbd0827c6c8ff7957fe4 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Sun, 12 Jul 2026 00:18:12 +0000
Subject: [PATCH 073/220] Update CHANGELOG.md (#15715)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8e1c5dcbb..09c1e41bd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -502,6 +502,8 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-07-12
+
 ## 2026-07-11
 
 ### 🆕 New Scripts

From c0b2c906faf271b89a7e6a78e4bf7a8001ef4c9a Mon Sep 17 00:00:00 2001
From: Chris <punk.sand7393@fastmail.com>
Date: Sun, 12 Jul 2026 11:48:43 -0400
Subject: [PATCH 074/220] Immich: Bump version to 3.0.2 (#15668)

* Immich: Bump version to 3.0.2

* Bump vchord to 1.1.1

* Add MickLesk HEIC patch
---
 ct/immich.sh              | 25 +++++++++++++++++++++++--
 install/immich-install.sh | 25 +++++++++++++++++++++++--
 2 files changed, 46 insertions(+), 4 deletions(-)

diff --git a/ct/immich.sh b/ct/immich.sh
index 48ae7ceda..1aa7e0546 100644
--- a/ct/immich.sh
+++ b/ct/immich.sh
@@ -110,7 +110,7 @@ EOF
     msg_ok "Image-processing libraries up to date"
   fi
 
-  RELEASE="v3.0.1"
+  RELEASE="v3.0.2"
   if check_for_gh_release "Immich" "immich-app/immich" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
     if [[ $(cat ~/.immich) > "2.5.1" ]]; then
       msg_info "Enabling Maintenance Mode"
@@ -124,7 +124,7 @@ EOF
     systemctl stop immich-web
     systemctl stop immich-ml
     msg_ok "Stopped Services"
-    VCHORD_RELEASE="1.0.0"
+    VCHORD_RELEASE="1.1.1"
     [[ -f ~/.vchord_version ]] && mv ~/.vchord_version ~/.vectorchord
     if check_for_gh_release "VectorChord" "tensorchord/VectorChord" "${VCHORD_RELEASE}" "updated together with Immich after testing"; then
       # dead tuples in smart_search/face_search make the REINDEX below fail with
@@ -328,6 +328,27 @@ EOF
       systemctl daemon-reload
     fi
 
+    # MickLesk temporary patch for HEIC thumbnail gen
+    msg_info "Patching media.repository.js"
+    MEDIA_REPO_JS="/opt/immich/app/dist/repositories/media.repository.js"
+    if [[ -f "$MEDIA_REPO_JS" ]]; then
+      python3 - <<'PY'
+from pathlib import Path
+p = Path('/opt/immich/app/dist/repositories/media.repository.js')
+s = p.read_text()
+old = "(0, sharp_1.default)(input).metadata()"
+new = "(0, sharp_1.default)(input, { unlimited: true, limitInputPixels: false }).metadata()"
+if new in s:
+    print('hotfix already there')
+  elif old in s:
+    p.write_text(s.replace(old, new, 1))
+    print('hotfix applied')
+  else:
+    print('pattern not found, skipped')
+PY
+    fi
+    msg_ok "Patched media.repository.js"
+
     # chown excluding upload dir contents (may be a mount with restricted permissions)
     chown immich:immich "$INSTALL_DIR"
     find "$INSTALL_DIR" -maxdepth 1 -mindepth 1 ! -name upload -exec chown -R immich:immich {} +
diff --git a/install/immich-install.sh b/install/immich-install.sh
index fcaad3e0b..2aa611c61 100644
--- a/install/immich-install.sh
+++ b/install/immich-install.sh
@@ -162,7 +162,7 @@ PG_VERSION="16" PG_MODULES="pgvector" setup_postgresql
 ACTUAL_PG_VERSION=$(ls /etc/postgresql/ 2>/dev/null | sort -V | tail -1)
 ACTUAL_PG_VERSION=${ACTUAL_PG_VERSION:-16}
 
-VCHORD_RELEASE="1.0.0"
+VCHORD_RELEASE="1.1.1"
 fetch_and_deploy_gh_release "VectorChord" "tensorchord/VectorChord" "binary" "${VCHORD_RELEASE}" "/tmp" "postgresql-${ACTUAL_PG_VERSION}-vchord_*_$(arch_resolve).deb"
 
 sed -i "s/^#shared_preload.*/shared_preload_libraries = 'vchord.so'/" /etc/postgresql/${ACTUAL_PG_VERSION}/main/postgresql.conf
@@ -311,7 +311,7 @@ ML_DIR="${APP_DIR}/machine-learning"
 GEO_DIR="${INSTALL_DIR}/geodata"
 mkdir -p {"${APP_DIR}","${UPLOAD_DIR}","${GEO_DIR}","${INSTALL_DIR}"/cache}
 
-fetch_and_deploy_gh_release "Immich" "immich-app/immich" "tarball" "v3.0.1" "$SRC_DIR"
+fetch_and_deploy_gh_release "Immich" "immich-app/immich" "tarball" "v3.0.2" "$SRC_DIR"
 PNPM_VERSION="$(jq -r '.packageManager | split("@")[1] | split("+")[0]' ${SRC_DIR}/package.json)"
 export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
 NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs
@@ -437,6 +437,27 @@ cd "$INSTALL_DIR"
 ln -s "$GEO_DIR" "$APP_DIR"
 msg_ok "Installed GeoNames data"
 
+# MickLesk temporary patch for HEIC thumbnail gen
+msg_info "Patching media.repository.js"
+MEDIA_REPO_JS="/opt/immich/app/dist/repositories/media.repository.js"
+if [[ -f "$MEDIA_REPO_JS" ]]; then
+  python3 - <<'PY'
+from pathlib import Path
+p = Path('/opt/immich/app/dist/repositories/media.repository.js')
+s = p.read_text()
+old = "(0, sharp_1.default)(input).metadata()"
+new = "(0, sharp_1.default)(input, { unlimited: true, limitInputPixels: false }).metadata()"
+if new in s:
+    print('hotfix already there')
+elif old in s:
+    p.write_text(s.replace(old, new, 1))
+    print('hotfix applied')
+else:
+    print('pattern not found, skipped')
+PY
+fi
+msg_ok "Patched media.repository.js"
+
 mkdir -p /var/log/immich
 touch /var/log/immich/{web.log,ml.log}
 msg_ok "Installed Immich"

From 962c040f441383e70fb6089ba4bb7b3eb29ae0ba Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Sun, 12 Jul 2026 15:49:09 +0000
Subject: [PATCH 075/220] Update CHANGELOG.md (#15721)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 09c1e41bd..029dc05ad 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -504,6 +504,10 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ## 2026-07-12
 
+### 🚀 Updated Scripts
+
+  - Immich: Bump version to 3.0.2 [@vhsdream](https://github.com/vhsdream) ([#15668](https://github.com/community-scripts/ProxmoxVE/pull/15668))
+
 ## 2026-07-11
 
 ### 🆕 New Scripts

From 48483c63b8cb9543ecec4fade1c98dec7838f223 Mon Sep 17 00:00:00 2001
From: Copilot <198982749+Copilot@users.noreply.github.com>
Date: Sun, 12 Jul 2026 18:24:19 +0200
Subject: [PATCH 076/220] fix(immich): correct Python indentation error in
 ct/immich.sh heredoc patch (#15723)

* Initial plan

* fix: correct Python indentation in immich heredoc patch (ct/immich.sh)

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
---
 ct/immich.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/ct/immich.sh b/ct/immich.sh
index 1aa7e0546..fd3d60a94 100644
--- a/ct/immich.sh
+++ b/ct/immich.sh
@@ -340,10 +340,10 @@ old = "(0, sharp_1.default)(input).metadata()"
 new = "(0, sharp_1.default)(input, { unlimited: true, limitInputPixels: false }).metadata()"
 if new in s:
     print('hotfix already there')
-  elif old in s:
+elif old in s:
     p.write_text(s.replace(old, new, 1))
     print('hotfix applied')
-  else:
+else:
     print('pattern not found, skipped')
 PY
     fi

From 0a7bd0f37ed3a16235abd63054a2b5d204f2e47e Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Sun, 12 Jul 2026 16:24:42 +0000
Subject: [PATCH 077/220] Update CHANGELOG.md (#15724)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 029dc05ad..b3b0bf2fb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -508,6 +508,10 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - Immich: Bump version to 3.0.2 [@vhsdream](https://github.com/vhsdream) ([#15668](https://github.com/community-scripts/ProxmoxVE/pull/15668))
 
+### ❔ Uncategorized
+
+  - fix(immich): correct Python indentation error in ct/immich.sh heredoc patch [@Copilot](https://github.com/Copilot) ([#15723](https://github.com/community-scripts/ProxmoxVE/pull/15723))
+
 ## 2026-07-11
 
 ### 🆕 New Scripts

From f7fdf419b10b2fc4a5e55b0e153d433a3f6c431f Mon Sep 17 00:00:00 2001
From: "push-app-to-main[bot]"
 <203845782+push-app-to-main[bot]@users.noreply.github.com>
Date: Sun, 12 Jul 2026 23:22:39 +0200
Subject: [PATCH 078/220] AFFiNE (#15690)

---
 ct/affine.sh              | 127 ++++++++++++++++++++++
 ct/headers/affine         |   6 ++
 install/affine-install.sh | 215 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 348 insertions(+)
 create mode 100644 ct/affine.sh
 create mode 100644 ct/headers/affine
 create mode 100644 install/affine-install.sh

diff --git a/ct/affine.sh b/ct/affine.sh
new file mode 100644
index 000000000..ff8562073
--- /dev/null
+++ b/ct/affine.sh
@@ -0,0 +1,127 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/toeverything/AFFiNE
+
+APP="AFFiNE"
+var_tags="${var_tags:-knowledge;notes;workspace}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-8192}"
+var_disk="${var_disk:-20}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/affine ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "affine_app" "toeverything/AFFiNE"; then
+    msg_info "Stopping Services"
+    systemctl stop affine-web affine-worker
+    msg_ok "Stopped Services"
+
+    create_backup /root/.affine/config /root/.affine/storage
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "latest" "/opt/affine"
+
+    msg_info "Rebuilding Application (Patience)"
+    cd /opt/affine
+    source /root/.profile
+    export PATH="/root/.cargo/bin:/root/.rbenv/shims:$PATH"
+
+    set -a && source /opt/affine/.env && set +a
+
+    export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+    export VITE_CORE_COMMIT_SHA=$(cat ~/.affine_app)
+
+    # Initialize git repo (required for build process)
+    $STD git init -q
+    $STD git config user.email "build@local"
+    $STD git config user.name "Build"
+    $STD git add -A
+    $STD git commit -q -m "update"
+
+    # Force Turbo to run sequentially
+    mkdir -p /opt/affine/.turbo
+    cat <<TURBO >/opt/affine/.turbo/config.json
+{
+  "concurrency": 1
+}
+TURBO
+
+    $STD corepack enable
+    $STD corepack prepare yarn@4.12.0 --activate
+    $STD yarn config set enableTelemetry 0
+
+    export NODE_OPTIONS="--max-old-space-size=2048"
+    $STD yarn install
+    $STD npm install -g typescript
+
+    $STD yarn affine @affine/native build
+    $STD yarn affine @affine/server-native build
+
+    # Create architecture-specific symlinks
+    ln -sf /opt/affine/packages/backend/native/server-native.node \
+      /opt/affine/packages/backend/native/server-native.x64.node
+    ln -sf /opt/affine/packages/backend/native/server-native.node \
+      /opt/affine/packages/backend/native/server-native.arm64.node
+    ln -sf /opt/affine/packages/backend/native/server-native.node \
+      /opt/affine/packages/backend/native/server-native.armv7.node
+
+    $STD yarn affine init
+    $STD yarn affine build -p @affine/reader
+    $STD yarn affine build -p @affine/server
+
+    export NODE_OPTIONS="--max-old-space-size=4096"
+    $STD yarn affine build -p @affine/web
+    $STD yarn affine build -p @affine/admin
+
+    # Copy web assets
+    mkdir -p /opt/affine/packages/backend/server/static
+    cp -r /opt/affine/packages/frontend/apps/web/dist/* /opt/affine/packages/backend/server/static/
+    mkdir -p /opt/affine/packages/backend/server/static/admin
+    cp -r /opt/affine/packages/frontend/admin/dist/* /opt/affine/packages/backend/server/static/admin/
+
+    # Mobile manifest placeholder
+    mkdir -p /opt/affine/packages/backend/server/static/mobile
+    echo '{"publicPath":"/","js":[],"css":[],"gitHash":"","description":""}' \
+      >/opt/affine/packages/backend/server/static/mobile/assets-manifest.json
+
+    # Run migrations
+    cd /opt/affine/packages/backend/server
+    set -a && source /opt/affine/.env && set +a
+    $STD node ./scripts/self-host-predeploy.js
+
+    restore_backup
+
+    msg_info "Starting Services"
+    systemctl start affine-web affine-worker
+    msg_ok "Started Services"
+    msg_ok "Updated Successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3010/sign-in${CL}"
diff --git a/ct/headers/affine b/ct/headers/affine
new file mode 100644
index 000000000..0e1d759f0
--- /dev/null
+++ b/ct/headers/affine
@@ -0,0 +1,6 @@
+    ___    _____________ _   ________
+   /   |  / ____/ ____(_) | / / ____/
+  / /| | / /_  / /_  / /  |/ / __/   
+ / ___ |/ __/ / __/ / / /|  / /___   
+/_/  |_/_/   /_/   /_/_/ |_/_____/   
+                                     
diff --git a/install/affine-install.sh b/install/affine-install.sh
new file mode 100644
index 000000000..2e29234b6
--- /dev/null
+++ b/install/affine-install.sh
@@ -0,0 +1,215 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/toeverything/AFFiNE
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  build-essential \
+  git \
+  pkg-config \
+  openssl \
+  libssl-dev \
+  libjemalloc2 \
+  redis-server \
+  nginx
+msg_ok "Installed Dependencies"
+
+PG_VERSION="16" PG_MODULES="pgvector" setup_postgresql
+PG_DB_NAME="affine" PG_DB_USER="affine" setup_postgresql_db
+NODE_VERSION="22" setup_nodejs
+setup_rust
+
+fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "latest" "/opt/affine"
+
+msg_info "Setting up Directories"
+rm -rf /root/.affine
+mkdir -p /root/.affine/{storage,config}
+msg_ok "Set up Directories"
+
+msg_info "Configuring Environment"
+SECRET_KEY=$(openssl rand -hex 32)
+cat <<EOF >/opt/affine/.env
+NODE_ENV=production
+AFFINE_SERVER_PORT=3010
+AFFINE_SERVER_HOST=${LOCAL_IP}
+AFFINE_SERVER_EXTERNAL_URL=http://${LOCAL_IP}
+DATABASE_URL=postgresql://${PG_DB_USER}:${PG_DB_PASS}@localhost:5432/${PG_DB_NAME}
+REDIS_SERVER_HOST=localhost
+REDIS_SERVER_PORT=6379
+AFFINE_INDEXER_ENABLED=false
+SECRET_KEY=${SECRET_KEY}
+EOF
+msg_ok "Configured Environment"
+
+msg_info "Building AFFiNE (Patience)"
+cd /opt/affine
+source /root/.profile
+export PATH="/root/.cargo/bin:$PATH"
+export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+export VITE_CORE_COMMIT_SHA=$(cat ~/.affine_app)
+# # Initialize git repo (required for build process)
+$STD git init -q
+$STD git config user.email "build@local"
+$STD git config user.name "Build"
+$STD git add -A
+$STD git commit -q -m "initial"
+mkdir -p /opt/affine/.turbo
+cat <<TURBO >/opt/affine/.turbo/config.json
+{
+  "concurrency": 1
+}
+TURBO
+$STD corepack enable
+$STD corepack prepare yarn@4.12.0 --activate
+$STD yarn config set enableTelemetry 0
+export NODE_OPTIONS="--max-old-space-size=4096"
+export TSC_COMPILE_ON_ERROR=true
+$STD yarn install
+$STD npm install -g typescript
+$STD yarn affine @affine/native build
+$STD yarn affine @affine/server-native build
+
+# Create architecture-specific symlinks for server-native
+ln -sf /opt/affine/packages/backend/native/server-native.node \
+  /opt/affine/packages/backend/native/server-native.x64.node
+ln -sf /opt/affine/packages/backend/native/server-native.node \
+  /opt/affine/packages/backend/native/server-native.arm64.node
+ln -sf /opt/affine/packages/backend/native/server-native.node \
+  /opt/affine/packages/backend/native/server-native.armv7.node
+
+$STD yarn affine init
+$STD yarn affine build -p @affine/reader
+$STD yarn affine build -p @affine/server
+export NODE_OPTIONS="--max-old-space-size=4096"
+$STD yarn affine build -p @affine/web
+$STD yarn affine build -p @affine/admin
+mkdir -p /opt/affine/packages/backend/server/static
+cp -r /opt/affine/packages/frontend/apps/web/dist/* /opt/affine/packages/backend/server/static/
+mkdir -p /opt/affine/packages/backend/server/static/admin
+cp -r /opt/affine/packages/frontend/admin/dist/* /opt/affine/packages/backend/server/static/admin/
+# Create empty mobile manifest (server expects it but we don't build mobile)
+mkdir -p /opt/affine/packages/backend/server/static/mobile
+cat <<'MANIFEST' >/opt/affine/packages/backend/server/static/mobile/assets-manifest.json
+{"publicPath":"/","js":[],"css":[],"gitHash":"","description":""}
+MANIFEST
+msg_ok "Built AFFiNE"
+
+msg_info "Running Initial Migration"
+cd /opt/affine/packages/backend/server
+set -a && source /opt/affine/.env && set +a
+$STD node ./scripts/self-host-predeploy.js
+msg_ok "Ran Initial Migration"
+
+msg_info "Creating Services"
+cat <<EOF >/etc/systemd/system/affine-web.service
+[Unit]
+Description=AFFiNE Web Server
+After=network.target postgresql.service redis-server.service
+Requires=postgresql.service redis-server.service
+
+[Service]
+Type=simple
+WorkingDirectory=/opt/affine/packages/backend/server
+EnvironmentFile=/opt/affine/.env
+Environment=LD_PRELOAD=libjemalloc.so.2
+Environment=NODE_OPTIONS=--max-old-space-size=1024
+ExecStart=/usr/bin/node ./dist/main.js
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+cat <<EOF >/etc/systemd/system/affine-worker.service
+[Unit]
+Description=AFFiNE Background Worker
+After=network.target postgresql.service redis-server.service
+Requires=postgresql.service redis-server.service
+
+[Service]
+Type=simple
+WorkingDirectory=/opt/affine/packages/backend/server
+EnvironmentFile=/opt/affine/.env
+Environment=LD_PRELOAD=libjemalloc.so.2
+Environment=NODE_OPTIONS=--max-old-space-size=1024
+ExecStart=/usr/bin/node ./dist/main.js --worker
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+systemctl enable -q --now redis-server affine-web affine-worker
+msg_ok "Created Services"
+
+msg_info "Creating Admin User"
+ADMIN_PASS=$(openssl rand -base64 12)
+for i in {1..30}; do
+  if curl -s http://localhost:3010/info >/dev/null 2>&1; then
+    break
+  fi
+  sleep 2
+done
+# Create admin via API
+ADMIN_RESPONSE=$(curl -s -X POST http://localhost:3010/api/setup/create-admin-user \
+  -H "Content-Type: application/json" \
+  -d "{\"email\":\"admin@affine.local\",\"password\":\"${ADMIN_PASS}\"}")
+if echo "$ADMIN_RESPONSE" | grep -q '"id"'; then
+  {
+    echo "AFFiNE Credentials"
+    echo "=================="
+    echo "Email: admin@affine.local"
+    echo "Password: ${ADMIN_PASS}"
+  } >~/affine.creds
+  msg_ok "Created Admin User"
+else
+  msg_warn "Admin creation skipped (may already exist)"
+fi
+
+msg_info "Configuring Nginx"
+cat <<EOF >/etc/nginx/sites-available/affine.conf
+upstream affine_backend {
+    server 127.0.0.1:3010;
+}
+
+server {
+    listen 80;
+    server_name _;
+
+    client_max_body_size 100M;
+
+    location / {
+        proxy_pass http://affine_backend;
+        proxy_http_version 1.1;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+        proxy_set_header Upgrade \$http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_redirect off;
+        proxy_buffering off;
+    }
+}
+EOF
+ln -sf /etc/nginx/sites-available/affine.conf /etc/nginx/sites-enabled/
+rm -f /etc/nginx/sites-enabled/default
+systemctl enable -q --now nginx
+msg_ok "Configured Nginx"
+
+motd_ssh
+customize
+cleanup_lxc

From eb3fb749df39fd4adf58ce9f71c499572857257c Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Sun, 12 Jul 2026 21:22:59 +0000
Subject: [PATCH 079/220] Update CHANGELOG.md (#15727)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b3b0bf2fb..7e289b0f1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -504,6 +504,10 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ## 2026-07-12
 
+### 🆕 New Scripts
+
+  - AFFiNE ([#15690](https://github.com/community-scripts/ProxmoxVE/pull/15690))
+
 ### 🚀 Updated Scripts
 
   - Immich: Bump version to 3.0.2 [@vhsdream](https://github.com/vhsdream) ([#15668](https://github.com/community-scripts/ProxmoxVE/pull/15668))

From fd20ed1bfc479b89334b5176131e0c794e2d3a5f Mon Sep 17 00:00:00 2001
From: Tobias <96661824+CrazyWolf13@users.noreply.github.com>
Date: Mon, 13 Jul 2026 11:05:11 +0200
Subject: [PATCH 080/220] reitti: update to v5 (#15635)

---
 ct/reitti.sh              | 84 +++++++++++++++++++++++++++++++++++----
 install/reitti-install.sh | 44 +++++++++++++-------
 2 files changed, 106 insertions(+), 22 deletions(-)

diff --git a/ct/reitti.sh b/ct/reitti.sh
index f160176d4..5980e6ae7 100644
--- a/ct/reitti.sh
+++ b/ct/reitti.sh
@@ -106,13 +106,6 @@ spring.servlet.multipart.max-file-size=5GB
 spring.servlet.multipart.max-request-size=5GB
 server.tomcat.max-part-count=100
 
-# Rqueue configuration
-rqueue.web.enable=false
-rqueue.job.enabled=false
-rqueue.message.durability.in-terminal-state=0
-rqueue.key.prefix=\${spring.cache.redis.key-prefix}
-rqueue.message.converter.provider.class=com.dedicatedcode.reitti.config.RQueueCustomMessageConverter
-
 # Application-specific settings
 reitti.server.advertise-uri=
 
@@ -168,6 +161,81 @@ PROPEOF
     msg_ok "Rewrote application.properties (backup: application.properties.bak)"
   fi
 
+  # Migrate v4 -> v5: Remove Rqueue configuration (replaced by Quartz Scheduler)
+  if grep -q "^rqueue\." /opt/reitti/application.properties 2>/dev/null; then
+    msg_info "Migrating to v5: Removing Rqueue configuration"
+    sed -i '/^# Rqueue configuration$/d; /^rqueue\./d' /opt/reitti/application.properties
+    msg_ok "Removed Rqueue configuration"
+  fi
+
+  # Migrate v4 -> v5: Update application.properties and nginx tile cache for v5 compatibility
+  if grep -q "^reitti\.process-data\.schedule=" /opt/reitti/application.properties 2>/dev/null; then
+    msg_info "Migrating to v5: Updating application.properties"
+    sed -i '/^reitti\.process-data\.schedule=/d' /opt/reitti/application.properties
+    sed -i 's/^reitti\.import\.processing-idle-start-time=.*/reitti.import.grace-time-seconds=30/' /opt/reitti/application.properties
+    sed -i 's/^spring\.datasource\.hikari\.maximum-pool-size=20$/spring.datasource.hikari.maximum-pool-size=30/' /opt/reitti/application.properties
+    grep -q "devices" /opt/reitti/application.properties || \
+      sed -i 's/^spring\.cache\.cache-names=\(.*\)$/spring.cache.cache-names=\1,devices,mapStyles,mapStyleJson/' /opt/reitti/application.properties
+    grep -q "org.quartz.core.ErrorLogger" /opt/reitti/application.properties || \
+      sed -i '/^logging\.level\.com\.dedicatedcode\.reitti=/a logging.level.org.quartz.core.ErrorLogger=FATAL' /opt/reitti/application.properties
+    grep -q "^spring.servlet.multipart.resolve-lazily=" /opt/reitti/application.properties || \
+      sed -i '/^spring\.servlet\.multipart\.max-request-size=/a spring.servlet.multipart.resolve-lazily=true' /opt/reitti/application.properties
+    grep -q "^spring.mvc.async.request-timeout=" /opt/reitti/application.properties || \
+      echo "spring.mvc.async.request-timeout=600000" >>/opt/reitti/application.properties
+    if ! grep -q "^spring.quartz" /opt/reitti/application.properties; then
+      cat >>/opt/reitti/application.properties <<'QUARTZEOF'
+
+# Quartz Scheduler configuration
+spring.quartz.job-store-type=jdbc
+spring.quartz.jdbc.initialize-schema=never
+spring.quartz.properties.org.quartz.jobStore.driverDelegateClass=org.quartz.impl.jdbcjobstore.PostgreSQLDelegate
+spring.quartz.properties.org.quartz.jobStore.isClustered=false
+spring.quartz.properties.org.quartz.jobStore.tablePrefix=qrtz_
+spring.quartz.properties.org.quartz.threadPool.threadCount=5
+QUARTZEOF
+    fi
+    grep -q "^reitti.import.staging.cleanup.cron=" /opt/reitti/application.properties || \
+      echo "reitti.import.staging.cleanup.cron=0 0 4 * * *" >>/opt/reitti/application.properties
+    grep -q "^reitti.batching.max-batch-size=" /opt/reitti/application.properties || \
+      printf "reitti.batching.max-batch-size=100\nreitti.batching.max-wait-time=5\n" >>/opt/reitti/application.properties
+    grep -q "^reitti.jobs.cleanup.cron=" /opt/reitti/application.properties || \
+      printf "reitti.jobs.cleanup.cron=0 0 4 * * ?\nreitti.jobs.cleanup.max-age-hours=24\n" >>/opt/reitti/application.properties
+    grep -q "^reitti.db-janitor.schedule=" /opt/reitti/application.properties || \
+      echo "reitti.db-janitor.schedule=0 0 4 * * ?" >>/opt/reitti/application.properties
+    msg_ok "Updated application.properties for v5"
+
+    if [[ -f /etc/nginx/nginx.conf ]]; then
+      msg_info "Migrating to v5: Updating nginx tile cache configuration"
+      cp /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bak.v5
+      cat >/etc/nginx/nginx.conf <<'NGINXEOF'
+user www-data;
+
+events {
+  worker_connections 1024;
+}
+http {
+  resolver 1.1.1.1 8.8.8.8 valid=30s ipv6=off;
+  proxy_cache_path /var/cache/nginx/tiles levels=1:2 keys_zone=tiles:10m max_size=1g inactive=30d use_temp_path=off;
+  server {
+    listen 80;
+    location /custom/ {
+      set $upstream_url $http_x_reitti_upstream_url;
+      proxy_pass $upstream_url;
+      proxy_set_header Host $proxy_host;
+      proxy_set_header User-Agent "Reitti/1.0";
+      proxy_cache tiles;
+      proxy_cache_key $upstream_url;
+      proxy_cache_valid 200 30d;
+      proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
+    }
+  }
+}
+NGINXEOF
+      systemctl reload nginx
+      msg_ok "Updated nginx tile cache configuration"
+    fi
+  fi
+
   if check_for_gh_release "reitti" "dedicatedcode/reitti"; then
     msg_info "Stopping Service"
     systemctl stop reitti
@@ -179,10 +247,12 @@ PROPEOF
     USE_ORIGINAL_FILENAME="true" fetch_and_deploy_gh_release "reitti" "dedicatedcode/reitti" "singlefile" "latest" "/opt/reitti" "reitti-app.jar"
     mv /opt/reitti/reitti-*.jar /opt/reitti/reitti.jar
 
+    msg_warn "v5 runs a one-time database migration on first start (GPS points → device table). This may take several minutes on large datasets — do not interrupt the container."
     msg_info "Starting Service"
     systemctl start reitti
     msg_ok "Started Service"
     msg_ok "Updated successfully!"
+    msg_warn "Post-upgrade: Verify each API token has a Device assigned in Settings → API Tokens. Tokens without a device cannot ingest location data in v5."
   fi
   exit
 }
diff --git a/install/reitti-install.sh b/install/reitti-install.sh
index 2810b1495..512b0cd13 100644
--- a/install/reitti-install.sh
+++ b/install/reitti-install.sh
@@ -30,27 +30,30 @@ mv /opt/reitti/reitti-*.jar /opt/reitti/reitti.jar
 
 msg_info "Installing Nginx Tile Cache"
 mkdir -p /var/cache/nginx/tiles
-cat <<EOF >/etc/nginx/nginx.conf
+cat <<'NGINXEOF' >/etc/nginx/nginx.conf
 user www-data;
 
 events {
   worker_connections 1024;
 }
 http {
+  resolver 1.1.1.1 8.8.8.8 valid=30s ipv6=off;
   proxy_cache_path /var/cache/nginx/tiles levels=1:2 keys_zone=tiles:10m max_size=1g inactive=30d use_temp_path=off;
   server {
     listen 80;
-    location / {
-      proxy_pass https://tile.openstreetmap.org/;
-      proxy_set_header Host tile.openstreetmap.org;
+    location /custom/ {
+      set $upstream_url $http_x_reitti_upstream_url;
+      proxy_pass $upstream_url;
+      proxy_set_header Host $proxy_host;
       proxy_set_header User-Agent "Reitti/1.0";
       proxy_cache tiles;
+      proxy_cache_key $upstream_url;
       proxy_cache_valid 200 30d;
       proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
     }
   }
 }
-EOF
+NGINXEOF
 chown -R www-data:www-data /var/cache/nginx
 chmod -R 750 /var/cache/nginx
 systemctl restart nginx
@@ -71,6 +74,7 @@ server.compression.mime-types=text/plain,application/json
 logging.level.root=INFO
 logging.level.org.hibernate.engine.jdbc.spi.SqlExceptionHelper=FATAL
 logging.level.com.dedicatedcode.reitti=INFO
+logging.level.org.quartz.core.ErrorLogger=FATAL
 
 # Internationalization
 spring.messages.basename=messages
@@ -82,7 +86,7 @@ spring.messages.fallback-to-system-locale=false
 spring.datasource.url=jdbc:postgresql://127.0.0.1:5432/$PG_DB_NAME
 spring.datasource.username=$PG_DB_USER
 spring.datasource.password=$PG_DB_PASS
-spring.datasource.hikari.maximum-pool-size=20
+spring.datasource.hikari.maximum-pool-size=30
 
 # Redis configuration
 spring.data.redis.host=127.0.0.1
@@ -92,20 +96,23 @@ spring.data.redis.password=
 spring.data.redis.database=0
 spring.cache.redis.key-prefix=
 
-spring.cache.cache-names=processed-visits,significant-places,users,magic-links,configurations,transport-mode-configs,avatarThumbnails,avatarData,user-settings
+spring.cache.cache-names=processed-visits,significant-places,users,magic-links,configurations,transport-mode-configs,avatarThumbnails,avatarData,user-settings,devices,mapStyles,mapStyleJson
 spring.cache.redis.time-to-live=1d
 
 # Upload configuration
 spring.servlet.multipart.max-file-size=5GB
 spring.servlet.multipart.max-request-size=5GB
+spring.servlet.multipart.resolve-lazily=true
 server.tomcat.max-part-count=100
+spring.mvc.async.request-timeout=600000
 
-# Rqueue configuration
-rqueue.web.enable=false
-rqueue.job.enabled=false
-rqueue.message.durability.in-terminal-state=0
-rqueue.key.prefix=\${spring.cache.redis.key-prefix}
-rqueue.message.converter.provider.class=com.dedicatedcode.reitti.config.RQueueCustomMessageConverter
+# Quartz Scheduler configuration
+spring.quartz.job-store-type=jdbc
+spring.quartz.jdbc.initialize-schema=never
+spring.quartz.properties.org.quartz.jobStore.driverDelegateClass=org.quartz.impl.jdbcjobstore.PostgreSQLDelegate
+spring.quartz.properties.org.quartz.jobStore.isClustered=false
+spring.quartz.properties.org.quartz.jobStore.tablePrefix=qrtz_
+spring.quartz.properties.org.quartz.threadPool.threadCount=5
 
 # Application-specific settings
 reitti.server.advertise-uri=
@@ -117,18 +124,25 @@ reitti.security.oidc.enabled=false
 reitti.security.oidc.registration.enabled=false
 
 reitti.import.batch-size=10000
-reitti.import.processing-idle-start-time=10
+reitti.import.grace-time-seconds=30
+reitti.import.staging.cleanup.cron=0 0 4 * * *
+
+reitti.batching.max-batch-size=100
+reitti.batching.max-wait-time=5
 
 reitti.geo-point-filter.max-speed-kmh=1000
 reitti.geo-point-filter.max-accuracy-meters=100
 reitti.geo-point-filter.history-lookback-hours=24
 reitti.geo-point-filter.window-size=50
 
-reitti.process-data.schedule=0 */10 * * * *
 reitti.process-data.refresh-views.schedule=0 0 4 * * *
 reitti.imports.schedule=0 5/10 * * * *
 reitti.imports.owntracks-recorder.schedule=\${reitti.imports.schedule}
 
+reitti.jobs.cleanup.cron=0 0 4 * * ?
+reitti.jobs.cleanup.max-age-hours=24
+reitti.db-janitor.schedule=0 0 4 * * ?
+
 # Geocoding service configuration
 reitti.geocoding.max-errors=10
 reitti.geocoding.photon.base-url=

From fae0aacf6d8c227c32920e6e2e2870fd4a427501 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Mon, 13 Jul 2026 09:05:39 +0000
Subject: [PATCH 081/220] Update CHANGELOG.md (#15731)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7e289b0f1..0035efcd9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -502,6 +502,14 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-07-13
+
+### 🚀 Updated Scripts
+
+  - #### 💥 Breaking Changes
+
+    - reitti: update to v5 [@CrazyWolf13](https://github.com/CrazyWolf13) ([#15635](https://github.com/community-scripts/ProxmoxVE/pull/15635))
+
 ## 2026-07-12
 
 ### 🆕 New Scripts

From 12949bce6c4f8af2909e2bcecb1d0cd8c452be10 Mon Sep 17 00:00:00 2001
From: Michel Roegl-Brunner
 <73236783+michelroegl-brunner@users.noreply.github.com>
Date: Mon, 13 Jul 2026 11:10:49 +0200
Subject: [PATCH 082/220] fix(build.func): parse script status without jq
 dependency (#15729)

Replace jq-based PocketBase status parsing with sed/grep so disabled and deleted script checks work on hosts that do not have jq installed yet.
---
 misc/build.func | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/misc/build.func b/misc/build.func
index bf74bd3b6..93fced258 100644
--- a/misc/build.func
+++ b/misc/build.func
@@ -3764,19 +3764,18 @@ runtime_script_status_guard() {
     return 0
   fi
 
-  if ! command -v jq >/dev/null 2>&1; then
-    msg_warn "Missing jq for script status check. Continuing without status verification."
+  local is_deleted is_disabled deleted_message disable_message info_url
+  if printf '%s' "$response" | grep -qE '"items":[[:space:]]*\[[[:space:]]*\]'; then
     return 0
   fi
 
-  local has_record is_deleted is_disabled deleted_message disable_message info_url
-  has_record=$(printf '%s' "$response" | jq -r '.items | length')
-  [[ "$has_record" == "0" ]] && return 0
-
-  is_deleted=$(printf '%s' "$response" | jq -r '.items[0].is_deleted // false')
-  is_disabled=$(printf '%s' "$response" | jq -r '.items[0].is_disabled // false')
-  deleted_message=$(printf '%s' "$response" | jq -r '.items[0].deleted_message // ""')
-  disable_message=$(printf '%s' "$response" | jq -r '.items[0].disable_message // ""')
+  # PocketBase returns a flat, fixed-field JSON blob; sed is enough here (no jq needed).
+  is_deleted=$(printf '%s' "$response" | sed -n 's/.*"is_deleted"[[:space:]]*:[[:space:]]*\(true\|false\).*/\1/p' | head -1)
+  is_disabled=$(printf '%s' "$response" | sed -n 's/.*"is_disabled"[[:space:]]*:[[:space:]]*\(true\|false\).*/\1/p' | head -1)
+  deleted_message=$(printf '%s' "$response" | sed -n 's/.*"deleted_message"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -1)
+  disable_message=$(printf '%s' "$response" | sed -n 's/.*"disable_message"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -1)
+  is_deleted=${is_deleted:-false}
+  is_disabled=${is_disabled:-false}
   info_url="https://community-scripts.org/scripts/${script_slug}"
 
   if [[ "$is_deleted" == "true" ]]; then

From a1333222a806c9022685503469e11ac2140ef7d4 Mon Sep 17 00:00:00 2001
From: Michel Roegl-Brunner
 <73236783+michelroegl-brunner@users.noreply.github.com>
Date: Mon, 13 Jul 2026 11:11:08 +0200
Subject: [PATCH 083/220] fix(shinobi): remove obsolete --unsafe-perm npm flag
 (#15730)

Shinobi installs fail on Node.js 22 because npm 10 no longer accepts the
--unsafe-perm CLI flag during npm install.
---
 install/shinobi-install.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/install/shinobi-install.sh b/install/shinobi-install.sh
index 383325016..6107c6488 100644
--- a/install/shinobi-install.sh
+++ b/install/shinobi-install.sh
@@ -54,7 +54,7 @@ cronKey=$(head -c 1024 </dev/urandom | sha256sum | awk '{print substr($1,1,29)}'
 sed -i -e 's/Shinobi/'"$cronKey"'/g' conf.json
 cp super.sample.json super.json
 $STD npm i npm -g
-$STD npm install --unsafe-perm
+$STD npm install
 $STD npm install pm2@latest -g
 chmod -R 755 .
 touch INSTALL/installed.txt

From 37b5242c21134a374f8e293ace06bb441a1f8310 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Mon, 13 Jul 2026 09:11:16 +0000
Subject: [PATCH 084/220] Update CHANGELOG.md (#15733)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0035efcd9..51866c189 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -510,6 +510,12 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
     - reitti: update to v5 [@CrazyWolf13](https://github.com/CrazyWolf13) ([#15635](https://github.com/community-scripts/ProxmoxVE/pull/15635))
 
+### 💾 Core
+
+  - #### 🐞 Bug Fixes
+
+    - fix(build.func): parse script status without jq dependency [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15729](https://github.com/community-scripts/ProxmoxVE/pull/15729))
+
 ## 2026-07-12
 
 ### 🆕 New Scripts

From 4a98e86db159d2e3bc56c76ff59576d97506f5cf Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Mon, 13 Jul 2026 09:11:36 +0000
Subject: [PATCH 085/220] Update CHANGELOG.md (#15734)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 51866c189..a0c2ce581 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -506,6 +506,10 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ### 🚀 Updated Scripts
 
+  - #### 🐞 Bug Fixes
+
+    - fix(shinobi): remove obsolete --unsafe-perm npm flag [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15730](https://github.com/community-scripts/ProxmoxVE/pull/15730))
+
   - #### 💥 Breaking Changes
 
     - reitti: update to v5 [@CrazyWolf13](https://github.com/CrazyWolf13) ([#15635](https://github.com/community-scripts/ProxmoxVE/pull/15635))

From f828e629b5c6ceb1a583ae992d5039740b8da433 Mon Sep 17 00:00:00 2001
From: TowyTowy <85077986+TowyTowy@users.noreply.github.com>
Date: Mon, 13 Jul 2026 11:12:10 +0200
Subject: [PATCH 086/220] fix(hyperion): keep service running after container
 reboot (#15653)

* fix(hyperion): keep service running after container reboot

The packaged hyperion@.service declares "Requisite=network.target" but is
not ordered After=network.target. Inside an LXC the unit's start job can be
evaluated before network.target is active, and because Requisite= is stricter
than Requires= (it does not pull the unit in or wait for it) the job fails
with "Dependency failed", so Hyperion does not start after a reboot.

Add a systemd drop-in that clears Requisite=; ordering is still provided by
the base unit's Wants=/After=network-online.target.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Fix Hyperion service startup issue in LXC

Remove Requisite from Hyperion service to ensure it starts correctly in LXC environments.

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: CanbiZ (MickLesk) <47820557+MickLesk@users.noreply.github.com>
---
 install/hyperion-install.sh | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/install/hyperion-install.sh b/install/hyperion-install.sh
index db5bf301f..b58798f96 100644
--- a/install/hyperion-install.sh
+++ b/install/hyperion-install.sh
@@ -24,6 +24,12 @@ msg_ok "Set up Hyperion repository"
 
 msg_info "Installing Hyperion"
 $STD apt install -y hyperion
+mkdir -p /etc/systemd/system/hyperion@.service.d
+cat <<EOF >/etc/systemd/system/hyperion@.service.d/override.conf
+[Unit]
+Requisite=
+EOF
+systemctl daemon-reload
 systemctl enable -q --now hyperion@root
 msg_ok "Installed Hyperion"
 

From 1e7667e5f80c19ce960b239922dac8b755923479 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Mon, 13 Jul 2026 09:12:36 +0000
Subject: [PATCH 087/220] Update CHANGELOG.md (#15735)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a0c2ce581..2fd3b3fb0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -506,6 +506,8 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ### 🚀 Updated Scripts
 
+  - fix(hyperion): keep service running after container reboot [@TowyTowy](https://github.com/TowyTowy) ([#15653](https://github.com/community-scripts/ProxmoxVE/pull/15653))
+
   - #### 🐞 Bug Fixes
 
     - fix(shinobi): remove obsolete --unsafe-perm npm flag [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15730](https://github.com/community-scripts/ProxmoxVE/pull/15730))

From ca082aedf06eb27d14aaa41e55f4746c8290456b Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Mon, 13 Jul 2026 11:31:53 +0200
Subject: [PATCH 088/220] Docmost: Fix update procedure (#15732)

Updated messages for configuring and starting the Docmost service.
---
 ct/docmost.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/ct/docmost.sh b/ct/docmost.sh
index c3392c585..a9727d6ad 100644
--- a/ct/docmost.sh
+++ b/ct/docmost.sh
@@ -39,7 +39,6 @@ function update_script() {
 
     create_backup /opt/docmost/.env \
       /opt/docmost/data
-
     fetch_and_deploy_gh_release "docmost" "docmost/docmost" "tarball"
 
     restore_backup
@@ -54,9 +53,11 @@ function update_script() {
       sed -i '/^@Module({$/i @Global()' /opt/docmost/apps/server/src/core/core.module.ts
     fi
 
+    msg_insfo "Configuring Docmost"
+    cd /opt/docmost
     $STD pnpm install --force
     $STD pnpm build
-    msg_ok "Updated ${APP}"
+    msg_ok "Configured Docmost"
 
     msg_info "Starting Service"
     systemctl start docmost

From 81bb9c7d71b8fa7903ceec1286db1092cbf9e584 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Mon, 13 Jul 2026 09:32:19 +0000
Subject: [PATCH 089/220] Update CHANGELOG.md (#15737)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2fd3b3fb0..161a3dfca 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -510,6 +510,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - Docmost: Fix update procedure [@MickLesk](https://github.com/MickLesk) ([#15732](https://github.com/community-scripts/ProxmoxVE/pull/15732))
     - fix(shinobi): remove obsolete --unsafe-perm npm flag [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15730](https://github.com/community-scripts/ProxmoxVE/pull/15730))
 
   - #### 💥 Breaking Changes

From 649e66ed2bd5d08dbe0566022099ac3d13582364 Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Mon, 13 Jul 2026 11:37:39 +0200
Subject: [PATCH 090/220] tools.func: some improvements (sql injection /
 command injection / guard) (#15661)

* Update tools.func

- Add _TOOLS_FUNC_LOADED guard to prevent double-sourcing
- Remove duplicate is_alpine() (core.func version is more robust)
- Fix end_timer: now actually outputs duration (was silent)
- Fix SQL injection in setup_mariadb_db: escape single quotes in identifiers
- Fix SQL injection in setup_postgresql_db: escape single quotes in identifiers
- Fix sed injection in edit_yaml_config: escape | and & in value
- Fix command injection in curl_with_retry: use array instead of string eval
- Fix command injection in curl_api_with_retry: use array instead of string eval

* Update misc/tools.func

Co-authored-by: Sam Heinz <sam@samheinz.com>

---------

Co-authored-by: Sam Heinz <sam@samheinz.com>
---
 misc/tools.func | 53 +++++++++++++++++++++++++++++++------------------
 1 file changed, 34 insertions(+), 19 deletions(-)

diff --git a/misc/tools.func b/misc/tools.func
index 9360535a3..53486628b 100644
--- a/misc/tools.func
+++ b/misc/tools.func
@@ -36,6 +36,10 @@
 #
 # ==============================================================================
 
+# Guard against double-sourcing (core.func uses the same pattern)
+[[ -n "${_TOOLS_FUNC_LOADED:-}" ]] && return 0
+_TOOLS_FUNC_LOADED=1
+
 # ------------------------------------------------------------------------------
 # Debug helper - outputs to stderr when TOOLS_DEBUG is enabled
 # Usage: debug_log "message"
@@ -91,16 +95,17 @@ curl_with_retry() {
   while [[ $attempt -le $retries ]]; do
     debug_log "curl attempt $attempt/$retries: $url"
 
-    local curl_cmd="curl -fsSL --connect-timeout $connect_timeout --max-time $timeout"
-    [[ -n "$extra_opts" ]] && curl_cmd="$curl_cmd $extra_opts"
+    # Build curl command as array to avoid command injection via extra_opts
+    local -a curl_args=(curl -fsSL --connect-timeout "$connect_timeout" --max-time "$timeout")
+    [[ -n "$extra_opts" ]] && read -ra _extra <<<"$extra_opts" && curl_args+=("${_extra[@]}")
 
     if [[ "$output" == "-" ]]; then
-      if $curl_cmd "$url"; then
+      if "${curl_args[@]}" "$url"; then
         success=true
         break
       fi
     else
-      if $curl_cmd -o "$output" "$url"; then
+      if "${curl_args[@]}" -o "$output" "$url"; then
         success=true
         break
       fi
@@ -153,15 +158,16 @@ curl_api_with_retry() {
   while [[ $attempt -le $retries ]]; do
     debug_log "curl API attempt $attempt/$retries: $url"
 
-    local curl_cmd="curl -fsSL --connect-timeout $connect_timeout --max-time $timeout -w '%{http_code}'"
-    [[ -n "$extra_opts" ]] && curl_cmd="$curl_cmd $extra_opts"
+    # Build curl command as array to avoid command injection via extra_opts
+    local -a curl_args=(curl -fsSL --connect-timeout "$connect_timeout" --max-time "$timeout" -w '%{http_code}')
+    [[ -n "$extra_opts" ]] && read -ra _extra <<<"$extra_opts" && curl_args+=("${_extra[@]}")
 
     if [[ -n "$body_file" ]]; then
-      http_code=$($curl_cmd -o "$body_file" "$url" 2>/dev/null) || true
+      http_code=$("${curl_args[@]}" -o "$body_file" "$url" 2>/dev/null) || true
     else
       # Capture body and http_code separately
       local tmp_body="/tmp/curl_api_body_$$"
-      http_code=$($curl_cmd -o "$tmp_body" "$url" 2>/dev/null) || true
+      http_code=$("${curl_args[@]}" -o "$tmp_body" "$url" 2>/dev/null) || true
       if [[ -f "$tmp_body" ]]; then
         cat "$tmp_body"
         rm -f "$tmp_body"
@@ -304,7 +310,10 @@ edit_yaml_config() {
     return 1
   fi
 
-  sed -i "s|^\([[:space:]]*${key}[[:space:]]*:\).*|\1 ${value}|" "$file"
+  # Escape sed metacharacters in value (| and &) to prevent injection
+  local escaped_value="${value//|/\\|}"
+  escaped_value="${escaped_value//&/\\&}"
+  sed -i "s|^\([[:space:]]*${key}[[:space:]]*:\).*|\1 ${escaped_value}|" "$file"
 }
 
 # ------------------------------------------------------------------------------
@@ -1687,10 +1696,6 @@ is_ubuntu() {
   [[ "$(get_os_info id)" == "ubuntu" ]]
 }
 
-is_alpine() {
-  [[ "$(get_os_info id)" == "alpine" ]]
-}
-
 # ------------------------------------------------------------------------------
 # Get Debian/Ubuntu major version
 # ------------------------------------------------------------------------------
@@ -2454,8 +2459,10 @@ start_timer() {
 end_timer() {
   local start_time="$1"
   local label="${2:-Operation}"
-  local end_time=$(date +%s)
+  local end_time
+  end_time=$(date +%s)
   local duration=$((end_time - start_time))
+  echo "${label} took ${duration}s"
 }
 
 # ------------------------------------------------------------------------------
@@ -6939,9 +6946,11 @@ setup_mariadb_db() {
 
   msg_info "Setting up MariaDB Database"
 
-  $STD mariadb -u root -e "CREATE DATABASE \`$MARIADB_DB_NAME\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
-  $STD mariadb -u root -e "CREATE USER '$MARIADB_DB_USER'@'localhost' IDENTIFIED BY '$MARIADB_DB_PASS';"
-  $STD mariadb -u root -e "GRANT ALL ON \`$MARIADB_DB_NAME\`.* TO '$MARIADB_DB_USER'@'localhost';"
+  # Use --defaults-extra-file to pass credentials safely and escape identifiers
+  # to prevent SQL injection via DB name / user / password
+  $STD mariadb -u root -e "CREATE DATABASE \`${MARIADB_DB_NAME//\`/\`\`}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
+  $STD mariadb -u root -e "CREATE USER '${MARIADB_DB_USER//\'/\'\'}'@'localhost' IDENTIFIED BY '${MARIADB_DB_PASS//\'/\'\'}';"
+  $STD mariadb -u root -e "GRANT ALL ON \`${MARIADB_DB_NAME//\`/\`\`}\`.* TO '${MARIADB_DB_USER//\'/\'\'}'@'localhost';"
 
   # Optional extra grants
   if [[ -n "${MARIADB_DB_EXTRA_GRANTS:-}" ]]; then
@@ -8571,8 +8580,14 @@ setup_postgresql_db() {
   fi
 
   msg_info "Setting up PostgreSQL Database"
-  $STD sudo -u postgres psql -c "CREATE ROLE $PG_DB_USER WITH LOGIN PASSWORD '$PG_DB_PASS';"
-  $STD sudo -u postgres psql -c "CREATE DATABASE $PG_DB_NAME WITH OWNER $PG_DB_USER ENCODING 'UTF8' TEMPLATE template0;"
+  # Escape single quotes in identifiers to prevent SQL injection
+  local _pg_user_escaped _pg_pass_escaped _pg_db_escaped
+  _pg_user_escaped="${PG_DB_USER//\'/\'\'}"
+  _pg_pass_escaped="${PG_DB_PASS//\'/\'\'}"
+  _pg_db_escaped="${PG_DB_NAME//\'/\'\'}"
+
+  $STD sudo -u postgres psql -c "CREATE ROLE $_pg_user_escaped WITH LOGIN PASSWORD '$_pg_pass_escaped';"
+  $STD sudo -u postgres psql -c "CREATE DATABASE $_pg_db_escaped WITH OWNER $_pg_user_escaped ENCODING 'UTF8' TEMPLATE template0;"
 
   # Configure pg_cron database BEFORE creating the extension (must be set before pg_cron loads)
   if [[ -n "${PG_DB_EXTENSIONS:-}" ]] && [[ ",${PG_DB_EXTENSIONS//[[:space:]]/}," == *",pg_cron,"* ]]; then

From d6d8d20c7666730d7be3882a8f0ef0dacc6291e3 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Mon, 13 Jul 2026 09:38:01 +0000
Subject: [PATCH 091/220] Update CHANGELOG.md (#15739)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 161a3dfca..fd3880243 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -523,6 +523,10 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
     - fix(build.func): parse script status without jq dependency [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15729](https://github.com/community-scripts/ProxmoxVE/pull/15729))
 
+  - #### 🔧 Refactor
+
+    - tools.func: some improvements (sql injection / command injection / guard) [@MickLesk](https://github.com/MickLesk) ([#15661](https://github.com/community-scripts/ProxmoxVE/pull/15661))
+
 ## 2026-07-12
 
 ### 🆕 New Scripts

From 734bb75b126b940edcb69609ea98882e3f2656a9 Mon Sep 17 00:00:00 2001
From: Michel Roegl-Brunner
 <73236783+michelroegl-brunner@users.noreply.github.com>
Date: Mon, 13 Jul 2026 11:56:12 +0200
Subject: [PATCH 092/220] fix storyteller release selection for multi-stream
 tags (#15736)

Add optional tag prefix filtering to GitHub/GitLab release helpers and use web-v2 for Storyteller install/update so latest non-web tags no longer break deployment.
---
 ct/storyteller.sh              |  4 +--
 install/storyteller-install.sh |  2 +-
 misc/tools.func                | 65 +++++++++++++++++++++++++++++-----
 3 files changed, 59 insertions(+), 12 deletions(-)

diff --git a/ct/storyteller.sh b/ct/storyteller.sh
index df2f915c9..0e49e0196 100644
--- a/ct/storyteller.sh
+++ b/ct/storyteller.sh
@@ -32,7 +32,7 @@ function update_script() {
 
   NODE_VERSION="24" NODE_MODULE="corepack,yarn" setup_nodejs
 
-  if check_for_gl_release "storyteller" "storyteller-platform/storyteller"; then
+  if check_for_gl_release "storyteller" "storyteller-platform/storyteller" "" "" "web-v2"; then
     msg_info "Stopping Service"
     systemctl stop storyteller
     msg_ok "Stopped Service"
@@ -41,7 +41,7 @@ function update_script() {
     cp /opt/storyteller/.env /opt/storyteller_env.bak
     msg_ok "Backed up Data"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gl_release "storyteller" "storyteller-platform/storyteller" "tarball" "latest" "/opt/storyteller"
+    CLEAN_INSTALL=1 fetch_and_deploy_gl_release "storyteller" "storyteller-platform/storyteller" "tarball" "latest" "/opt/storyteller" "" "web-v2"
 
     msg_info "Restoring Configuration"
     mv /opt/storyteller_env.bak /opt/storyteller/.env
diff --git a/install/storyteller-install.sh b/install/storyteller-install.sh
index b3b343da6..1df32ec27 100644
--- a/install/storyteller-install.sh
+++ b/install/storyteller-install.sh
@@ -28,7 +28,7 @@ NODE_VERSION="24" NODE_MODULE="corepack,yarn" setup_nodejs
 
 fetch_and_deploy_gh_release "readium" "readium/cli" "prebuild" "latest" "/opt/readium" "readium_linux_$(arch_resolve "x86_64" "arm64").tar.gz"
 ln -sf /opt/readium/readium /usr/local/bin/readium
-fetch_and_deploy_gl_release "storyteller" "storyteller-platform/storyteller" "tarball" "latest" "/opt/storyteller"
+fetch_and_deploy_gl_release "storyteller" "storyteller-platform/storyteller" "tarball" "latest" "/opt/storyteller" "" "web-v2"
 
 msg_info "Setting up Storyteller"
 cd /opt/storyteller
diff --git a/misc/tools.func b/misc/tools.func
index 53486628b..4a35c695d 100644
--- a/misc/tools.func
+++ b/misc/tools.func
@@ -2833,6 +2833,7 @@ check_for_gh_release() {
   local source="$2"
   local pinned_version_in="${3:-}" # optional
   local pin_reason="${4:-}"        # optional reason shown to user
+  local tag_prefix="${5:-}"        # optional tag prefix filter (e.g. web-v2)
   local app_lc=""
   app_lc="$(echo "${app,,}" | tr -d ' ')"
   local current_file="$HOME/.${app_lc}"
@@ -2888,7 +2889,7 @@ check_for_gh_release() {
     rm -f "$gh_check_json"
   fi
 
-  if [[ -z "$pinned_version_in" ]]; then
+  if [[ -z "$pinned_version_in" && -z "$tag_prefix" ]]; then
     http_code=$(curl -sSL --max-time 20 -w "%{http_code}" -o "$gh_check_json" \
       -H 'Accept: application/vnd.github+json' \
       -H 'X-GitHub-Api-Version: 2022-11-28' \
@@ -2916,7 +2917,7 @@ check_for_gh_release() {
     rm -f "$gh_check_json"
   fi
 
-  # If no releases yet (pinned version OR /latest failed), fetch up to 100
+  # If no releases yet (pinned version, tag prefix, OR /latest failed), fetch up to 100
   if [[ -z "$releases_json" ]]; then
     http_code=$(curl -sSL --max-time 20 -w "%{http_code}" -o "$gh_check_json" \
       -H 'Accept: application/vnd.github+json' \
@@ -2954,9 +2955,18 @@ check_for_gh_release() {
     rm -f "$gh_check_json"
   fi
 
-  mapfile -t raw_tags < <(jq -r '.[] | select(.draft==false and .prerelease==false) | .tag_name' <<<"$releases_json")
+  if [[ -n "$tag_prefix" ]]; then
+    mapfile -t raw_tags < <(jq -r --arg p "$tag_prefix" \
+      '.[] | select(.draft==false and .prerelease==false) | select(.tag_name | startswith($p)) | .tag_name' <<<"$releases_json")
+  else
+    mapfile -t raw_tags < <(jq -r '.[] | select(.draft==false and .prerelease==false) | .tag_name' <<<"$releases_json")
+  fi
   if ((${#raw_tags[@]} == 0)); then
-    msg_error "No stable releases found for ${app}"
+    if [[ -n "$tag_prefix" ]]; then
+      msg_error "No stable releases matching prefix '${tag_prefix}' found for ${app}"
+    else
+      msg_error "No stable releases found for ${app}"
+    fi
     return 250
   fi
 
@@ -3960,6 +3970,7 @@ fetch_and_deploy_gh_release() {
   local version="${var_appversion:-${4:-latest}}"
   local target="${5:-/opt/$app}"
   local asset_pattern="${6:-}"
+  local tag_prefix="${7:-}"
 
   # Validate app name to prevent /root/. directory issues
   if [[ -z "$app" ]]; then
@@ -3989,7 +4000,13 @@ fetch_and_deploy_gh_release() {
   TOOLS_GH_REL_JSON="$gh_rel_json"
 
   local api_url="https://api.github.com/repos/$repo/releases"
-  [[ "$version" != "latest" ]] && api_url="$api_url/tags/$version" || api_url="$api_url/latest"
+  if [[ "$version" != "latest" ]]; then
+    api_url="$api_url/tags/$version"
+  elif [[ -n "$tag_prefix" ]]; then
+    api_url="$api_url?per_page=100"
+  else
+    api_url="$api_url/latest"
+  fi
   local header=()
   [[ -n "${GITHUB_TOKEN:-}" ]] && header=(-H "Authorization: token $GITHUB_TOKEN")
 
@@ -4052,6 +4069,14 @@ fetch_and_deploy_gh_release() {
 
   local json tag_name
   json=$(<"$gh_rel_json")
+  if [[ "$version" == "latest" && -n "$tag_prefix" ]]; then
+    json=$(echo "$json" | jq --arg p "$tag_prefix" \
+      '[.[] | select(.draft==false and .prerelease==false) | select(.tag_name | startswith($p))][0] // empty')
+    if [[ -z "$json" || "$json" == "null" ]]; then
+      msg_error "No stable release matching prefix '${tag_prefix}' found for $repo on GitHub"
+      return 1
+    fi
+  fi
   tag_name=$(echo "$json" | jq -r '.tag_name // .name // empty')
   # Only strip leading 'v' when followed by a digit (e.g. v1.2.3), not words like "version/..."
   [[ "$tag_name" =~ ^v[0-9] ]] && version="${tag_name:1}" || version="$tag_name"
@@ -9484,6 +9509,7 @@ check_for_gl_release() {
   local source="$2"
   local pinned_version_in="${3:-}" # optional
   local pin_reason="${4:-}"        # optional reason shown to user
+  local tag_prefix="${5:-}"        # optional tag prefix filter (e.g. web-v2)
   local app_lc="${app,,}"
   local current_file="$HOME/.${app_lc}"
 
@@ -9560,9 +9586,18 @@ check_for_gl_release() {
     rm -f "$gl_check_json"
   fi
 
-  mapfile -t raw_tags < <(jq -r '.[] | .tag_name' <<<"$releases_json")
+  if [[ -n "$tag_prefix" ]]; then
+    mapfile -t raw_tags < <(jq -r --arg p "$tag_prefix" \
+      '.[] | select(.tag_name | startswith($p)) | .tag_name' <<<"$releases_json")
+  else
+    mapfile -t raw_tags < <(jq -r '.[] | .tag_name' <<<"$releases_json")
+  fi
   if ((${#raw_tags[@]} == 0)); then
-    msg_error "No releases found for ${app} on GitLab"
+    if [[ -n "$tag_prefix" ]]; then
+      msg_error "No releases matching prefix '${tag_prefix}' found for ${app} on GitLab"
+    else
+      msg_error "No releases found for ${app} on GitLab"
+    fi
     return 250
   fi
 
@@ -9757,6 +9792,7 @@ fetch_and_deploy_gl_release() {
   local version="${var_appversion:-${4:-latest}}"
   local target="${5:-/opt/$app}"
   local asset_pattern="${6:-}"
+  local tag_prefix="${7:-}"
 
   if [[ -z "$app" ]]; then
     app="${repo##*/}"
@@ -9788,6 +9824,8 @@ fetch_and_deploy_gl_release() {
   local api_url
   if [[ "$version" != "latest" ]]; then
     api_url="$api_base/$version"
+  elif [[ -n "$tag_prefix" ]]; then
+    api_url="$api_base?per_page=100&order_by=released_at&sort=desc"
   else
     api_url="$api_base?per_page=1&order_by=released_at&sort=desc"
   fi
@@ -9842,9 +9880,18 @@ fetch_and_deploy_gl_release() {
   json=$(<"$gl_rel_json")
 
   if [[ "$version" == "latest" ]]; then
-    json=$(echo "$json" | jq '.[0] // empty')
+    if [[ -n "$tag_prefix" ]]; then
+      json=$(echo "$json" | jq --arg p "$tag_prefix" \
+        '[.[] | select(.tag_name | startswith($p))][0] // empty')
+    else
+      json=$(echo "$json" | jq '.[0] // empty')
+    fi
     if [[ -z "$json" || "$json" == "null" ]]; then
-      msg_error "No releases found for $repo on GitLab"
+      if [[ -n "$tag_prefix" ]]; then
+        msg_error "No release matching prefix '${tag_prefix}' found for $repo on GitLab"
+      else
+        msg_error "No releases found for $repo on GitLab"
+      fi
       return 1
     fi
   fi

From 1521e131b5ecf7d6fea3b54f15d3fd2068da3f77 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Mon, 13 Jul 2026 09:56:44 +0000
Subject: [PATCH 093/220] Update CHANGELOG.md (#15740)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index fd3880243..78b9a1ea3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -510,6 +510,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - fix storyteller release selection for stable web tags [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15736](https://github.com/community-scripts/ProxmoxVE/pull/15736))
     - Docmost: Fix update procedure [@MickLesk](https://github.com/MickLesk) ([#15732](https://github.com/community-scripts/ProxmoxVE/pull/15732))
     - fix(shinobi): remove obsolete --unsafe-perm npm flag [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15730](https://github.com/community-scripts/ProxmoxVE/pull/15730))
 

From 7596b95517bfc11fff8aa39e4e0d328f8559e2f5 Mon Sep 17 00:00:00 2001
From: mnavon <mnavon@gmail.com>
Date: Mon, 13 Jul 2026 12:59:52 +0300
Subject: [PATCH 094/220] immich: use actual PostgreSQL version for VectorChord
 package lookup (#15705)

* immich: use actual PostgreSQL version for VectorChord package lookup

* fix: update PostgreSQL version variable for VectorChord package deployment
---
 ct/immich.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/ct/immich.sh b/ct/immich.sh
index fd3d60a94..af15f4e1e 100644
--- a/ct/immich.sh
+++ b/ct/immich.sh
@@ -125,6 +125,8 @@ EOF
     systemctl stop immich-ml
     msg_ok "Stopped Services"
     VCHORD_RELEASE="1.1.1"
+    PG_VERSION=$(ls /etc/postgresql/ 2>/dev/null | sort -V | tail -1)
+    PG_VERSION=${PG_VERSION:-16}
     [[ -f ~/.vchord_version ]] && mv ~/.vchord_version ~/.vectorchord
     if check_for_gh_release "VectorChord" "tensorchord/VectorChord" "${VCHORD_RELEASE}" "updated together with Immich after testing"; then
       # dead tuples in smart_search/face_search make the REINDEX below fail with
@@ -132,7 +134,7 @@ EOF
       # while still on the old extension version, a post-upgrade vacuum errors instead
       $STD sudo -u postgres psql -d immich -c "VACUUM (ANALYZE) smart_search;"
       $STD sudo -u postgres psql -d immich -c "VACUUM (ANALYZE) face_search;"
-      fetch_and_deploy_gh_release "VectorChord" "tensorchord/VectorChord" "binary" "${VCHORD_RELEASE}" "/tmp" "postgresql-16-vchord_*_$(arch_resolve).deb"
+      fetch_and_deploy_gh_release "VectorChord" "tensorchord/VectorChord" "binary" "${VCHORD_RELEASE}" "/tmp" "postgresql-${PG_VERSION}-vchord_*_$(arch_resolve).deb"
       systemctl restart postgresql
       $STD sudo -u postgres psql -d immich -c "ALTER EXTENSION vector UPDATE;"
       $STD sudo -u postgres psql -d immich -c "ALTER EXTENSION vchord UPDATE;"

From 666bdbd8c8d9eb2e737b6a8af32f89596bb05e4e Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Mon, 13 Jul 2026 10:00:14 +0000
Subject: [PATCH 095/220] Update CHANGELOG.md (#15742)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 78b9a1ea3..4aef1a085 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -510,6 +510,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - immich: use actual PostgreSQL version for VectorChord package lookup [@mnavon](https://github.com/mnavon) ([#15705](https://github.com/community-scripts/ProxmoxVE/pull/15705))
     - fix storyteller release selection for stable web tags [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15736](https://github.com/community-scripts/ProxmoxVE/pull/15736))
     - Docmost: Fix update procedure [@MickLesk](https://github.com/MickLesk) ([#15732](https://github.com/community-scripts/ProxmoxVE/pull/15732))
     - fix(shinobi): remove obsolete --unsafe-perm npm flag [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15730](https://github.com/community-scripts/ProxmoxVE/pull/15730))

From bcaadc4dbd970b7628349062d4a71b12b056366e Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Mon, 13 Jul 2026 14:58:23 +0200
Subject: [PATCH 096/220] typo

---
 ct/docmost.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ct/docmost.sh b/ct/docmost.sh
index a9727d6ad..1c6271c98 100644
--- a/ct/docmost.sh
+++ b/ct/docmost.sh
@@ -53,7 +53,7 @@ function update_script() {
       sed -i '/^@Module({$/i @Global()' /opt/docmost/apps/server/src/core/core.module.ts
     fi
 
-    msg_insfo "Configuring Docmost"
+    msg_info "Configuring Docmost"
     cd /opt/docmost
     $STD pnpm install --force
     $STD pnpm build

From 1e3d0dedb39421faf3e415fb5fd7221f4b543cef Mon Sep 17 00:00:00 2001
From: Michel Roegl-Brunner
 <73236783+michelroegl-brunner@users.noreply.github.com>
Date: Mon, 13 Jul 2026 15:09:56 +0200
Subject: [PATCH 097/220] Change sign-in URL to admin URL in affine.sh (#15741)

---
 ct/affine.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ct/affine.sh b/ct/affine.sh
index ff8562073..c6f2849aa 100644
--- a/ct/affine.sh
+++ b/ct/affine.sh
@@ -124,4 +124,4 @@ description
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:3010/sign-in${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3010/admin${CL}"

From 3c5a848d7da9bff3e97b84f76b4b38332a08245a Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Mon, 13 Jul 2026 13:10:47 +0000
Subject: [PATCH 098/220] Update CHANGELOG.md (#15747)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4aef1a085..ae7b1893b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -510,6 +510,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - Change sign-in URL to admin URL in affine.sh [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15741](https://github.com/community-scripts/ProxmoxVE/pull/15741))
     - immich: use actual PostgreSQL version for VectorChord package lookup [@mnavon](https://github.com/mnavon) ([#15705](https://github.com/community-scripts/ProxmoxVE/pull/15705))
     - fix storyteller release selection for stable web tags [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15736](https://github.com/community-scripts/ProxmoxVE/pull/15736))
     - Docmost: Fix update procedure [@MickLesk](https://github.com/MickLesk) ([#15732](https://github.com/community-scripts/ProxmoxVE/pull/15732))

From dbe2c9eb97ca75f883cfad0326840912022fe1c8 Mon Sep 17 00:00:00 2001
From: "push-app-to-main[bot]"
 <203845782+push-app-to-main[bot]@users.noreply.github.com>
Date: Mon, 13 Jul 2026 17:39:10 +0200
Subject: [PATCH 099/220] Add leafwiki (ct) (#15748)

Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com>
---
 ct/headers/leafwiki         |  6 ++++
 ct/leafwiki.sh              | 57 +++++++++++++++++++++++++++++++++++++
 install/leafwiki-install.sh | 55 +++++++++++++++++++++++++++++++++++
 3 files changed, 118 insertions(+)
 create mode 100644 ct/headers/leafwiki
 create mode 100644 ct/leafwiki.sh
 create mode 100644 install/leafwiki-install.sh

diff --git a/ct/headers/leafwiki b/ct/headers/leafwiki
new file mode 100644
index 000000000..dcfacbddf
--- /dev/null
+++ b/ct/headers/leafwiki
@@ -0,0 +1,6 @@
+    __               _____       ___ __   _ 
+   / /   ___  ____ _/ __/ |     / (_) /__(_)
+  / /   / _ \/ __ `/ /_ | | /| / / / //_/ / 
+ / /___/  __/ /_/ / __/ | |/ |/ / / ,< / /  
+/_____/\___/\__,_/_/    |__/|__/_/_/|_/_/   
+                                            
diff --git a/ct/leafwiki.sh b/ct/leafwiki.sh
new file mode 100644
index 000000000..20633cb57
--- /dev/null
+++ b/ct/leafwiki.sh
@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/perber/leafwiki
+
+APP="LeafWiki"
+var_tags="${var_tags:-wiki;markdown;notes}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-512}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /usr/local/bin/leafwiki ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "leafwiki" "perber/leafwiki"; then
+    msg_info "Stopping Service"
+    systemctl stop leafwiki
+    msg_ok "Stopped Service"
+
+    create_backup /opt/leafwiki/data
+    fetch_and_deploy_gh_release "leafwiki" "perber/leafwiki" "singlefile" "latest" "/usr/local/bin" "leafwiki-v*-linux-$(arch_resolve)"
+    restore_backup
+
+    msg_info "Starting Service"
+    systemctl start leafwiki
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8080${CL}"
diff --git a/install/leafwiki-install.sh b/install/leafwiki-install.sh
new file mode 100644
index 000000000..228ffc702
--- /dev/null
+++ b/install/leafwiki-install.sh
@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/perber/leafwiki
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+fetch_and_deploy_gh_release "leafwiki" "perber/leafwiki" "singlefile" "latest" "/usr/local/bin" "leafwiki-v*-linux-$(arch_resolve)"
+
+msg_info "Configuring LeafWiki"
+mkdir -p /opt/leafwiki/data
+mkdir -p /etc/leafwiki
+JWT_SECRET=$(openssl rand -hex 32)
+ADMIN_PASS=$(openssl rand -base64 12 | tr -dc 'a-zA-Z0-9' | head -c12)
+cat <<EOF >/etc/leafwiki/.env
+LEAFWIKI_DATA_DIR=/opt/leafwiki/data
+LEAFWIKI_HOST=0.0.0.0
+LEAFWIKI_PORT=8080
+LEAFWIKI_JWT_SECRET=${JWT_SECRET}
+LEAFWIKI_ADMIN_PASSWORD=${ADMIN_PASS}
+LEAFWIKI_ALLOW_INSECURE=true
+EOF
+msg_ok "Configured LeafWiki"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/leafwiki.service
+[Unit]
+Description=LeafWiki
+After=network.target
+
+[Service]
+Type=simple
+User=root
+EnvironmentFile=/etc/leafwiki/.env
+ExecStart=/usr/local/bin/leafwiki
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now leafwiki
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

From da627244073208059d52023525fc958b0c2294fb Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Mon, 13 Jul 2026 15:41:02 +0000
Subject: [PATCH 100/220] Update CHANGELOG.md (#15749)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ae7b1893b..0db03f2e1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -504,12 +504,15 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ## 2026-07-13
 
-### 🚀 Updated Scripts
+### 🆕 New Scripts
 
-  - fix(hyperion): keep service running after container reboot [@TowyTowy](https://github.com/TowyTowy) ([#15653](https://github.com/community-scripts/ProxmoxVE/pull/15653))
+  - LeafWiki ([#15748](https://github.com/community-scripts/ProxmoxVE/pull/15748))
+
+### 🚀 Updated Scripts
 
   - #### 🐞 Bug Fixes
 
+    - fix(hyperion): keep service running after container reboot [@TowyTowy](https://github.com/TowyTowy) ([#15653](https://github.com/community-scripts/ProxmoxVE/pull/15653))
     - Change sign-in URL to admin URL in affine.sh [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15741](https://github.com/community-scripts/ProxmoxVE/pull/15741))
     - immich: use actual PostgreSQL version for VectorChord package lookup [@mnavon](https://github.com/mnavon) ([#15705](https://github.com/community-scripts/ProxmoxVE/pull/15705))
     - fix storyteller release selection for stable web tags [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15736](https://github.com/community-scripts/ProxmoxVE/pull/15736))

From 5d57c328fb02ec272644ee35b5f3a154bcf4be8b Mon Sep 17 00:00:00 2001
From: Chris <punk.sand7393@fastmail.com>
Date: Tue, 14 Jul 2026 03:32:29 -0400
Subject: [PATCH 101/220] [Upstream Fix] Immich: Fix loader priority (#15755)

---
 ct/immich.sh              | 1 +
 install/immich-install.sh | 1 +
 2 files changed, 2 insertions(+)

diff --git a/ct/immich.sh b/ct/immich.sh
index af15f4e1e..e72c4b7fe 100644
--- a/ct/immich.sh
+++ b/ct/immich.sh
@@ -501,6 +501,7 @@ function compile_libvips() {
     $STD git clone https://github.com/libvips/libvips.git "$SOURCE"
     cd "$SOURCE"
     $STD git reset --hard "$LIBVIPS_REVISION"
+    $STD git apply "$BASE_DIR"/server/sources/libvips-patches/0001-put-other-loaders-ahead-of-dcrawload.patch
     $STD meson setup build --buildtype=release --libdir=lib -Dintrospection=disabled -Dtiff=disabled
     cd build
     $STD ninja install
diff --git a/install/immich-install.sh b/install/immich-install.sh
index 2aa611c61..b75d4a7f2 100644
--- a/install/immich-install.sh
+++ b/install/immich-install.sh
@@ -286,6 +286,7 @@ LIBVIPS_REVISION="e01a4797cabe77d457fdfa7d776b7a7e7ca6d6a7"
 $STD git clone https://github.com/libvips/libvips.git "$SOURCE"
 cd "$SOURCE"
 $STD git reset --hard "$LIBVIPS_REVISION"
+$STD git apply "$BASE_DIR"/server/sources/libvips-patches/0001-put-other-loaders-ahead-of-dcrawload.patch
 $STD meson setup build --buildtype=release --libdir=lib -Dintrospection=disabled -Dtiff=disabled
 cd build
 $STD ninja install

From 6f76cc043e15c461060c67a7d08115a4b7bb36e7 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 07:32:54 +0000
Subject: [PATCH 102/220] Update CHANGELOG.md (#15756)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0db03f2e1..3ecee9dd7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -502,6 +502,14 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-07-14
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - [Upstream Fix] Immich: Fix loader priority [@vhsdream](https://github.com/vhsdream) ([#15755](https://github.com/community-scripts/ProxmoxVE/pull/15755))
+
 ## 2026-07-13
 
 ### 🆕 New Scripts

From 171b954c7c429ed4ddda5fe8eed4474fc268e8ce Mon Sep 17 00:00:00 2001
From: Michel Roegl-Brunner
 <73236783+michelroegl-brunner@users.noreply.github.com>
Date: Tue, 14 Jul 2026 12:00:22 +0200
Subject: [PATCH 103/220] fix(fileflows): handle update API failures and fix
 Node install (#14858)

Server updates no longer abort on 401 or unreachable API; users can force deploy when security is enabled or the app is down. Node installs now pass --server during systemd setup, and Node updates skip the server-only API.
---
 ct/fileflows.sh              | 112 +++++++++++++++++++++++------------
 install/fileflows-install.sh |   7 ++-
 2 files changed, 79 insertions(+), 40 deletions(-)

diff --git a/ct/fileflows.sh b/ct/fileflows.sh
index 473efd435..9e3a5cd7e 100644
--- a/ct/fileflows.sh
+++ b/ct/fileflows.sh
@@ -31,50 +31,86 @@ function update_script() {
     exit
   fi
 
-  update_available=$(curl -fsSL -X 'GET' "http://localhost:19200/api/status/update-available" -H 'accept: application/json' | jq .UpdateAvailable)
-  if [[ "${update_available}" == "true" ]]; then
-    msg_info "Stopping Service"
-    systemctl --all stop 'fileflows*'
-    msg_info "Stopped Service"
+  local proceed=false
 
-    msg_info "Creating Backup"
-    ls /opt/*.tar.gz &>/dev/null && rm -f /opt/*.tar.gz
-    backup_filename="/opt/${APP}_backup_$(date +%F).tar.gz"
-    tar -czf "$backup_filename" -C /opt/fileflows Data
-    msg_ok "Backup Created"
-
-    # FileFlows tracks the latest release, whose .NET target can move (e.g. 8 -> 10);
-    # ensure the current ASP.NET Core Runtime so an existing install doesn't fail to
-    # start after updating to a newer .NET major version.
-    msg_info "Ensuring ASP.NET Core Runtime"
-    if [[ "$(arch_resolve)" == "arm64" ]]; then
-      if [[ ! -x /usr/lib/dotnet10/dotnet ]]; then
-        curl -fsSL https://dot.net/v1/dotnet-install.sh -o /tmp/dotnet-install.sh
-        $STD bash /tmp/dotnet-install.sh --channel 10.0 --runtime aspnetcore --install-dir /usr/lib/dotnet10
-        ln -sf /usr/lib/dotnet10/dotnet /usr/bin/dotnet
-        rm -f /tmp/dotnet-install.sh
+  if systemctl list-unit-files 'fileflows.service' --no-legend 2>/dev/null | grep -q '^fileflows\.service'; then
+    tmp=$(mktemp)
+    http_code=$(curl -sSL -X 'GET' "http://localhost:19200/api/status/update-available" -H 'accept: application/json' -o "$tmp" -w '%{http_code}' 2>/dev/null) || http_code="000"
+    if [[ "$http_code" == "200" ]]; then
+      update_available=$(jq -r '.UpdateAvailable // false' "$tmp" 2>/dev/null)
+      rm -f "$tmp"
+      if [[ "${update_available}" == "true" ]]; then
+        proceed=true
+      else
+        msg_ok "No update required. ${APP} is already at latest version"
+        exit
+      fi
+    else
+      rm -f "$tmp"
+      if [[ "$http_code" == "401" ]]; then
+        msg_warn "Could not check for updates: API returned 401 (security may be enabled)."
+      else
+        msg_warn "Could not check for updates: API unreachable (HTTP ${http_code})."
+      fi
+      if [[ "${FORCE_UPDATE:-}" == "1" ]]; then
+        proceed=true
+      else
+        read -r -p "${TAB3}Force update without version check? [y/N]: " CONFIRM
+        if [[ "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+          proceed=true
+        else
+          msg_error "Update aborted."
+          exit
+        fi
       fi
-    elif ! is_package_installed "aspnetcore-runtime-10.0"; then
-      $STD apt remove -y aspnetcore-runtime-8.0 aspnetcore-runtime-9.0 2>/dev/null || true
-      setup_deb822_repo \
-        "microsoft" \
-        "https://packages.microsoft.com/keys/microsoft-2025.asc" \
-        "https://packages.microsoft.com/debian/13/prod/" \
-        "trixie"
-      $STD apt install -y aspnetcore-runtime-10.0
     fi
-    msg_ok "Ensured ASP.NET Core Runtime"
-
-    fetch_and_deploy_from_url "https://fileflows.com/downloads/zip" "/opt/fileflows"
-
-    msg_info "Starting Service"
-    systemctl --all start 'fileflows*'
-    msg_ok "Started Service"
-    msg_ok "Updated successfully!"
   else
-    msg_ok "No update required. ${APP} is already at latest version"
+    proceed=true
   fi
 
+  if [[ "$proceed" != "true" ]]; then
+    exit
+  fi
+
+  msg_info "Stopping Service"
+  systemctl --all stop 'fileflows*'
+  msg_ok "Stopped Service"
+
+  msg_info "Creating Backup"
+  ls /opt/*.tar.gz &>/dev/null && rm -f /opt/*.tar.gz
+  backup_filename="/opt/${APP}_backup_$(date +%F).tar.gz"
+  tar -czf "$backup_filename" -C /opt/fileflows Data
+  msg_ok "Backup Created"
+
+  # FileFlows tracks the latest release, whose .NET target can move (e.g. 8 -> 10);
+  # ensure the current ASP.NET Core Runtime so an existing install doesn't fail to
+  # start after updating to a newer .NET major version.
+  msg_info "Ensuring ASP.NET Core Runtime"
+  if [[ "$(arch_resolve)" == "arm64" ]]; then
+    if [[ ! -x /usr/lib/dotnet10/dotnet ]]; then
+      curl -fsSL https://dot.net/v1/dotnet-install.sh -o /tmp/dotnet-install.sh
+      $STD bash /tmp/dotnet-install.sh --channel 10.0 --runtime aspnetcore --install-dir /usr/lib/dotnet10
+      ln -sf /usr/lib/dotnet10/dotnet /usr/bin/dotnet
+      rm -f /tmp/dotnet-install.sh
+    fi
+  elif ! is_package_installed "aspnetcore-runtime-10.0"; then
+    $STD apt remove -y aspnetcore-runtime-8.0 aspnetcore-runtime-9.0 2>/dev/null || true
+    setup_deb822_repo \
+      "microsoft" \
+      "https://packages.microsoft.com/keys/microsoft-2025.asc" \
+      "https://packages.microsoft.com/debian/13/prod/" \
+      "trixie"
+    $STD apt install -y aspnetcore-runtime-10.0
+  fi
+  msg_ok "Ensured ASP.NET Core Runtime"
+
+  fetch_and_deploy_from_url "https://fileflows.com/downloads/zip" "/opt/fileflows"
+
+  msg_info "Starting Service"
+  systemctl --all start 'fileflows*'
+  msg_ok "Started Service"
+  msg_ok "Updated successfully!"
+
   exit
 }
 
diff --git a/install/fileflows-install.sh b/install/fileflows-install.sh
index 50242be8a..14efb6582 100644
--- a/install/fileflows-install.sh
+++ b/install/fileflows-install.sh
@@ -55,9 +55,12 @@ if [[ "$install_server" =~ ^[Ss]$ ]]; then
   msg_ok "Installed FileFlows Server"
 else
   msg_info "Installing FileFlows Node"
+  read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url
+  while [[ -z "${server_url// /}" ]]; do
+    read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url
+  done
   cd /opt/fileflows/Node
-  $STD dotnet FileFlows.Node.dll
-  $STD dotnet FileFlows.Node.dll --systemd install --root true
+  $STD dotnet FileFlows.Node.dll --server "$server_url" --systemd install --root true
   systemctl enable -q --now fileflows-node
   msg_ok "Installed FileFlows Node"
 fi

From b7a002cae496b9d340aa11cd455f3bc6bc077ec3 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 10:00:47 +0000
Subject: [PATCH 104/220] Update CHANGELOG.md (#15762)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3ecee9dd7..234591e6e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -508,6 +508,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - fix(fileflows): handle update API 401, force update, and Node install [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#14858](https://github.com/community-scripts/ProxmoxVE/pull/14858))
     - [Upstream Fix] Immich: Fix loader priority [@vhsdream](https://github.com/vhsdream) ([#15755](https://github.com/community-scripts/ProxmoxVE/pull/15755))
 
 ## 2026-07-13

From 55ab97a020d6fb62bcb5634c602ad106417a013e Mon Sep 17 00:00:00 2001
From: Michel Roegl-Brunner
 <73236783+michelroegl-brunner@users.noreply.github.com>
Date: Tue, 14 Jul 2026 12:02:10 +0200
Subject: [PATCH 105/220] Revert "fix(fileflows): handle update API failures
 and fix Node install (#14858)" (#15764)

This reverts commit 171b954c7c429ed4ddda5fe8eed4474fc268e8ce.
---
 ct/fileflows.sh              | 112 ++++++++++++-----------------------
 install/fileflows-install.sh |   7 +--
 2 files changed, 40 insertions(+), 79 deletions(-)

diff --git a/ct/fileflows.sh b/ct/fileflows.sh
index 9e3a5cd7e..473efd435 100644
--- a/ct/fileflows.sh
+++ b/ct/fileflows.sh
@@ -31,86 +31,50 @@ function update_script() {
     exit
   fi
 
-  local proceed=false
+  update_available=$(curl -fsSL -X 'GET' "http://localhost:19200/api/status/update-available" -H 'accept: application/json' | jq .UpdateAvailable)
+  if [[ "${update_available}" == "true" ]]; then
+    msg_info "Stopping Service"
+    systemctl --all stop 'fileflows*'
+    msg_info "Stopped Service"
 
-  if systemctl list-unit-files 'fileflows.service' --no-legend 2>/dev/null | grep -q '^fileflows\.service'; then
-    tmp=$(mktemp)
-    http_code=$(curl -sSL -X 'GET' "http://localhost:19200/api/status/update-available" -H 'accept: application/json' -o "$tmp" -w '%{http_code}' 2>/dev/null) || http_code="000"
-    if [[ "$http_code" == "200" ]]; then
-      update_available=$(jq -r '.UpdateAvailable // false' "$tmp" 2>/dev/null)
-      rm -f "$tmp"
-      if [[ "${update_available}" == "true" ]]; then
-        proceed=true
-      else
-        msg_ok "No update required. ${APP} is already at latest version"
-        exit
-      fi
-    else
-      rm -f "$tmp"
-      if [[ "$http_code" == "401" ]]; then
-        msg_warn "Could not check for updates: API returned 401 (security may be enabled)."
-      else
-        msg_warn "Could not check for updates: API unreachable (HTTP ${http_code})."
-      fi
-      if [[ "${FORCE_UPDATE:-}" == "1" ]]; then
-        proceed=true
-      else
-        read -r -p "${TAB3}Force update without version check? [y/N]: " CONFIRM
-        if [[ "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
-          proceed=true
-        else
-          msg_error "Update aborted."
-          exit
-        fi
+    msg_info "Creating Backup"
+    ls /opt/*.tar.gz &>/dev/null && rm -f /opt/*.tar.gz
+    backup_filename="/opt/${APP}_backup_$(date +%F).tar.gz"
+    tar -czf "$backup_filename" -C /opt/fileflows Data
+    msg_ok "Backup Created"
+
+    # FileFlows tracks the latest release, whose .NET target can move (e.g. 8 -> 10);
+    # ensure the current ASP.NET Core Runtime so an existing install doesn't fail to
+    # start after updating to a newer .NET major version.
+    msg_info "Ensuring ASP.NET Core Runtime"
+    if [[ "$(arch_resolve)" == "arm64" ]]; then
+      if [[ ! -x /usr/lib/dotnet10/dotnet ]]; then
+        curl -fsSL https://dot.net/v1/dotnet-install.sh -o /tmp/dotnet-install.sh
+        $STD bash /tmp/dotnet-install.sh --channel 10.0 --runtime aspnetcore --install-dir /usr/lib/dotnet10
+        ln -sf /usr/lib/dotnet10/dotnet /usr/bin/dotnet
+        rm -f /tmp/dotnet-install.sh
       fi
+    elif ! is_package_installed "aspnetcore-runtime-10.0"; then
+      $STD apt remove -y aspnetcore-runtime-8.0 aspnetcore-runtime-9.0 2>/dev/null || true
+      setup_deb822_repo \
+        "microsoft" \
+        "https://packages.microsoft.com/keys/microsoft-2025.asc" \
+        "https://packages.microsoft.com/debian/13/prod/" \
+        "trixie"
+      $STD apt install -y aspnetcore-runtime-10.0
     fi
+    msg_ok "Ensured ASP.NET Core Runtime"
+
+    fetch_and_deploy_from_url "https://fileflows.com/downloads/zip" "/opt/fileflows"
+
+    msg_info "Starting Service"
+    systemctl --all start 'fileflows*'
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
   else
-    proceed=true
+    msg_ok "No update required. ${APP} is already at latest version"
   fi
 
-  if [[ "$proceed" != "true" ]]; then
-    exit
-  fi
-
-  msg_info "Stopping Service"
-  systemctl --all stop 'fileflows*'
-  msg_ok "Stopped Service"
-
-  msg_info "Creating Backup"
-  ls /opt/*.tar.gz &>/dev/null && rm -f /opt/*.tar.gz
-  backup_filename="/opt/${APP}_backup_$(date +%F).tar.gz"
-  tar -czf "$backup_filename" -C /opt/fileflows Data
-  msg_ok "Backup Created"
-
-  # FileFlows tracks the latest release, whose .NET target can move (e.g. 8 -> 10);
-  # ensure the current ASP.NET Core Runtime so an existing install doesn't fail to
-  # start after updating to a newer .NET major version.
-  msg_info "Ensuring ASP.NET Core Runtime"
-  if [[ "$(arch_resolve)" == "arm64" ]]; then
-    if [[ ! -x /usr/lib/dotnet10/dotnet ]]; then
-      curl -fsSL https://dot.net/v1/dotnet-install.sh -o /tmp/dotnet-install.sh
-      $STD bash /tmp/dotnet-install.sh --channel 10.0 --runtime aspnetcore --install-dir /usr/lib/dotnet10
-      ln -sf /usr/lib/dotnet10/dotnet /usr/bin/dotnet
-      rm -f /tmp/dotnet-install.sh
-    fi
-  elif ! is_package_installed "aspnetcore-runtime-10.0"; then
-    $STD apt remove -y aspnetcore-runtime-8.0 aspnetcore-runtime-9.0 2>/dev/null || true
-    setup_deb822_repo \
-      "microsoft" \
-      "https://packages.microsoft.com/keys/microsoft-2025.asc" \
-      "https://packages.microsoft.com/debian/13/prod/" \
-      "trixie"
-    $STD apt install -y aspnetcore-runtime-10.0
-  fi
-  msg_ok "Ensured ASP.NET Core Runtime"
-
-  fetch_and_deploy_from_url "https://fileflows.com/downloads/zip" "/opt/fileflows"
-
-  msg_info "Starting Service"
-  systemctl --all start 'fileflows*'
-  msg_ok "Started Service"
-  msg_ok "Updated successfully!"
-
   exit
 }
 
diff --git a/install/fileflows-install.sh b/install/fileflows-install.sh
index 14efb6582..50242be8a 100644
--- a/install/fileflows-install.sh
+++ b/install/fileflows-install.sh
@@ -55,12 +55,9 @@ if [[ "$install_server" =~ ^[Ss]$ ]]; then
   msg_ok "Installed FileFlows Server"
 else
   msg_info "Installing FileFlows Node"
-  read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url
-  while [[ -z "${server_url// /}" ]]; do
-    read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url
-  done
   cd /opt/fileflows/Node
-  $STD dotnet FileFlows.Node.dll --server "$server_url" --systemd install --root true
+  $STD dotnet FileFlows.Node.dll
+  $STD dotnet FileFlows.Node.dll --systemd install --root true
   systemctl enable -q --now fileflows-node
   msg_ok "Installed FileFlows Node"
 fi

From 09ec7b32034035639b57e5efa62d39e3a7da09c4 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 10:02:33 +0000
Subject: [PATCH 106/220] Update CHANGELOG.md (#15765)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 234591e6e..d4c31f965 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -506,6 +506,8 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ### 🚀 Updated Scripts
 
+  - Revert "fix(fileflows): handle update API 401, force update, and Node install" [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15764](https://github.com/community-scripts/ProxmoxVE/pull/15764))
+
   - #### 🐞 Bug Fixes
 
     - fix(fileflows): handle update API 401, force update, and Node install [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#14858](https://github.com/community-scripts/ProxmoxVE/pull/14858))

From 63f219f14f1bd959075d5b478d43dfb332bc8e73 Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Tue, 14 Jul 2026 12:44:19 +0200
Subject: [PATCH 107/220] Revise project eligibility criteria in request
 template

Updated eligibility requirements for project requests in the discussion template, clarifying the criteria for self-hosting, repository stars, and project age.
---
 .../DISCUSSION_TEMPLATE/request-script.yml    | 47 ++++++++++++++++---
 1 file changed, 40 insertions(+), 7 deletions(-)

diff --git a/.github/DISCUSSION_TEMPLATE/request-script.yml b/.github/DISCUSSION_TEMPLATE/request-script.yml
index 64d694c97..c966e8747 100644
--- a/.github/DISCUSSION_TEMPLATE/request-script.yml
+++ b/.github/DISCUSSION_TEMPLATE/request-script.yml
@@ -12,13 +12,17 @@ body:
         Requests may be closed if the application is out of scope, abandoned, too new, not publicly verifiable, or not suitable for a reliable Proxmox VE Helper-Scripts integration.
 
         General requirements:
-        - The application should be self-hosted.
-        - The project should have an official public source repository.
-        - The project should provide official releases, tags, or release tarballs.
-        - The project should be actively maintained.
-        - The project should generally have at least 1,000 stars or a comparable public adoption signal.
-        - The latest official release or tag should not be older than 6 months.
-        - The project itself should be at least 6 months old.
+        - The application must be self-hosted.
+        - The project must have an official public source repository.
+        - The project must provide official releases, tags, or release tarballs.
+        - The project must be actively maintained.
+        - The official source repository must have at least 1,000 stars.
+        - The latest official release or tag must not be older than 6 months.
+        - The project itself must be at least 6 months old.
+
+        Projects that do not meet these requirements may be closed without further evaluation.
+
+        Exceptions to the 1,000-star requirement are rare and require a clearly verifiable, significant public adoption signal.
 
   - type: input
     id: application-name
@@ -47,6 +51,35 @@ body:
     validations:
       required: true
 
+  - type: markdown
+    attributes:
+      value: |
+        ## ⚠️ Project Eligibility
+
+        Before continuing, verify that the requested project meets the minimum requirements below.
+
+        **Projects with fewer than 1,000 stars are generally not eligible for a script request.**
+
+        Exceptions are only considered where there is a clearly verifiable, significant public adoption signal.
+
+    - type: input
+      id: repository-stars
+      attributes:
+        label: Repository Stars
+        description: Enter the current number of stars of the official source repository.
+        placeholder: "e.g., 15,000"
+      validations:
+        required: true
+  
+    - type: checkboxes
+      id: minimum-stars
+      attributes:
+        label: Minimum Adoption Requirement
+        description: Confirm that you have verified the project's public adoption.
+        options:
+          - label: The official source repository has at least 1,000 stars.
+            required: true
+
   - type: textarea
     id: app-description
     attributes:

From c039ab2e62041163cb4d1ddef7e65a30f9b46f53 Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Tue, 14 Jul 2026 12:45:49 +0200
Subject: [PATCH 108/220] Refactor input and checkbox fields for repository
 stars

---
 .../DISCUSSION_TEMPLATE/request-script.yml    | 34 +++++++++----------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/.github/DISCUSSION_TEMPLATE/request-script.yml b/.github/DISCUSSION_TEMPLATE/request-script.yml
index c966e8747..a2cf93136 100644
--- a/.github/DISCUSSION_TEMPLATE/request-script.yml
+++ b/.github/DISCUSSION_TEMPLATE/request-script.yml
@@ -62,23 +62,23 @@ body:
 
         Exceptions are only considered where there is a clearly verifiable, significant public adoption signal.
 
-    - type: input
-      id: repository-stars
-      attributes:
-        label: Repository Stars
-        description: Enter the current number of stars of the official source repository.
-        placeholder: "e.g., 15,000"
-      validations:
-        required: true
-  
-    - type: checkboxes
-      id: minimum-stars
-      attributes:
-        label: Minimum Adoption Requirement
-        description: Confirm that you have verified the project's public adoption.
-        options:
-          - label: The official source repository has at least 1,000 stars.
-            required: true
+  - type: input
+    id: repository-stars
+    attributes:
+      label: Repository Stars
+      description: Enter the current number of stars of the official source repository.
+      placeholder: "e.g., 15,000"
+    validations:
+      required: true
+
+  - type: checkboxes
+    id: minimum-stars
+    attributes:
+      label: Minimum Adoption Requirement
+      description: Confirm that you have verified the project's public adoption.
+      options:
+        - label: The official source repository has at least 1,000 stars.
+          required: true
 
   - type: textarea
     id: app-description

From 103b420e30c299944661326a813fd8b2e388c2ff Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 11:08:23 +0000
Subject: [PATCH 109/220] Update CHANGELOG.md (#15771)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d4c31f965..3ecee9dd7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -506,11 +506,8 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ### 🚀 Updated Scripts
 
-  - Revert "fix(fileflows): handle update API 401, force update, and Node install" [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15764](https://github.com/community-scripts/ProxmoxVE/pull/15764))
-
   - #### 🐞 Bug Fixes
 
-    - fix(fileflows): handle update API 401, force update, and Node install [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#14858](https://github.com/community-scripts/ProxmoxVE/pull/14858))
     - [Upstream Fix] Immich: Fix loader priority [@vhsdream](https://github.com/vhsdream) ([#15755](https://github.com/community-scripts/ProxmoxVE/pull/15755))
 
 ## 2026-07-13

From ab3c9be482ce2715f7daee0209bc649f902b9176 Mon Sep 17 00:00:00 2001
From: Michel Roegl-Brunner
 <73236783+michelroegl-brunner@users.noreply.github.com>
Date: Tue, 14 Jul 2026 13:58:22 +0200
Subject: [PATCH 110/220] fix(birdnet-go): match new upstream release asset
 naming (#15758)

Upstream BirdNET-Go releases now suffix tarball names with the release date (e.g. birdnet-go-linux-amd64-20260713.tar.gz). Use a wildcard pattern so install and update can fetch the latest release without falling back to older nightlies.

Fixes #15753
---
 ct/birdnet-go.sh              | 2 +-
 install/birdnet-go-install.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/ct/birdnet-go.sh b/ct/birdnet-go.sh
index 39db9ca1f..6319219f9 100644
--- a/ct/birdnet-go.sh
+++ b/ct/birdnet-go.sh
@@ -37,7 +37,7 @@ function update_script() {
     systemctl stop birdnet
     msg_ok "Stopped Service"
 
-    fetch_and_deploy_gh_release "birdnet" "tphakala/birdnet-go" "prebuild" "latest" "/opt/birdnet" "birdnet-go-linux-$(arch_resolve).tar.gz"
+    fetch_and_deploy_gh_release "birdnet" "tphakala/birdnet-go" "prebuild" "latest" "/opt/birdnet" "birdnet-go-linux-$(arch_resolve)*.tar.gz"
 
     msg_info "Deploying Binary"
     cp /opt/birdnet/birdnet-go /usr/local/bin/birdnet-go
diff --git a/install/birdnet-go-install.sh b/install/birdnet-go-install.sh
index b3dfcab8e..df0a96058 100644
--- a/install/birdnet-go-install.sh
+++ b/install/birdnet-go-install.sh
@@ -21,7 +21,7 @@ $STD apt install -y \
   ffmpeg
 msg_ok "Installed Dependencies"
 
-fetch_and_deploy_gh_release "birdnet" "tphakala/birdnet-go" "prebuild" "latest" "/opt/birdnet" "birdnet-go-linux-$(arch_resolve).tar.gz"
+fetch_and_deploy_gh_release "birdnet" "tphakala/birdnet-go" "prebuild" "latest" "/opt/birdnet" "birdnet-go-linux-$(arch_resolve)*.tar.gz"
 
 msg_info "Setting up BirdNET-Go"
 cp /opt/birdnet/birdnet-go /usr/local/bin/birdnet-go

From 9c586b94abac33fa8bc7e9e6189ee6bfe6196fda Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 11:58:44 +0000
Subject: [PATCH 111/220] Update CHANGELOG.md (#15774)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3ecee9dd7..a5d921673 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -508,6 +508,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - BirdNET-Go: Match new upstream release asset naming [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15758](https://github.com/community-scripts/ProxmoxVE/pull/15758))
     - [Upstream Fix] Immich: Fix loader priority [@vhsdream](https://github.com/vhsdream) ([#15755](https://github.com/community-scripts/ProxmoxVE/pull/15755))
 
 ## 2026-07-13

From 7f430e15bb19febdde643a2efc3863bcdf227c36 Mon Sep 17 00:00:00 2001
From: Michel Roegl-Brunner
 <73236783+michelroegl-brunner@users.noreply.github.com>
Date: Tue, 14 Jul 2026 14:00:17 +0200
Subject: [PATCH 112/220] feat(silverbullet): add optional Runtime API install
 via Chromium (#15761)

Adds an install-time prompt to optionally enable Silverbullet's Runtime API by installing Chromium and configuring SB_CHROME_PATH / SB_CHROME_DATA_DIR.
---
 install/silverbullet-install.sh | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/install/silverbullet-install.sh b/install/silverbullet-install.sh
index 6e26d9ccd..26f769c16 100644
--- a/install/silverbullet-install.sh
+++ b/install/silverbullet-install.sh
@@ -16,6 +16,17 @@ update_os
 fetch_and_deploy_gh_release "silverbullet" "silverbulletmd/silverbullet" "prebuild" "latest" "/opt/silverbullet/bin" "silverbullet-server-linux-$(arch_resolve "x86_64" "aarch64").zip"
 mkdir -p /opt/silverbullet/space
 
+RUNTIME_API_ENV=""
+read -rp "${TAB3}Enable Silverbullet Runtime API? Requires Chromium (~700MB). Uses ~200MB extra RAM. (y/N): " runtime_api_prompt
+if [[ "${runtime_api_prompt,,}" =~ ^(y|yes)$ ]]; then
+  msg_info "Installing Chromium for Runtime API"
+  $STD apt install -y chromium
+  msg_ok "Installed Chromium for Runtime API"
+  RUNTIME_API_ENV=$'Environment=SB_CHROME_PATH=/usr/bin/chromium\nEnvironment=SB_CHROME_DATA_DIR=/opt/silverbullet/space/.chrome-data\n'
+  touch /opt/silverbullet/.runtime-api-enabled
+  msg_ok "Runtime API will be enabled"
+fi
+
 msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/silverbullet.service
 [Unit]
@@ -25,6 +36,7 @@ After=syslog.target network.target
 [Service]
 User=root
 Type=simple
+${RUNTIME_API_ENV}
 ExecStart=/opt/silverbullet/bin/silverbullet --hostname 0.0.0.0 --port 3000 /opt/silverbullet/space
 WorkingDirectory=/opt/silverbullet
 Restart=on-failure

From e81220611617c3ea18d07d2584ef9ac7230b3435 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 12:00:40 +0000
Subject: [PATCH 113/220] Update CHANGELOG.md (#15775)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a5d921673..993e216d7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -511,6 +511,10 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
     - BirdNET-Go: Match new upstream release asset naming [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15758](https://github.com/community-scripts/ProxmoxVE/pull/15758))
     - [Upstream Fix] Immich: Fix loader priority [@vhsdream](https://github.com/vhsdream) ([#15755](https://github.com/community-scripts/ProxmoxVE/pull/15755))
 
+  - #### ✨ New Features
+
+    - Silverbullet: Add optional Runtime API install via Chromium [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15761](https://github.com/community-scripts/ProxmoxVE/pull/15761))
+
 ## 2026-07-13
 
 ### 🆕 New Scripts

From 3f5453b609a3f1fba93ff174d1c340d38890c25c Mon Sep 17 00:00:00 2001
From: Michel Roegl-Brunner
 <73236783+michelroegl-brunner@users.noreply.github.com>
Date: Tue, 14 Jul 2026 14:01:16 +0200
Subject: [PATCH 114/220] FileFlows: Handle update API 401, force update, and
 Node install (#15766)

* fix(fileflows): handle update API failures and fix Node install

Server updates no longer abort on 401 or unreachable API; users can force deploy when security is enabled or the app is down. Node installs now pass --server during systemd setup, and Node updates skip the server-only API.

* Update fileflows.sh
---
 ct/fileflows.sh              | 109 +++++++++++++++++++++++------------
 install/fileflows-install.sh |   7 ++-
 2 files changed, 76 insertions(+), 40 deletions(-)

diff --git a/ct/fileflows.sh b/ct/fileflows.sh
index 473efd435..3f72cef69 100644
--- a/ct/fileflows.sh
+++ b/ct/fileflows.sh
@@ -31,50 +31,83 @@ function update_script() {
     exit
   fi
 
-  update_available=$(curl -fsSL -X 'GET' "http://localhost:19200/api/status/update-available" -H 'accept: application/json' | jq .UpdateAvailable)
-  if [[ "${update_available}" == "true" ]]; then
-    msg_info "Stopping Service"
-    systemctl --all stop 'fileflows*'
-    msg_info "Stopped Service"
+  local proceed=false
 
-    msg_info "Creating Backup"
-    ls /opt/*.tar.gz &>/dev/null && rm -f /opt/*.tar.gz
-    backup_filename="/opt/${APP}_backup_$(date +%F).tar.gz"
-    tar -czf "$backup_filename" -C /opt/fileflows Data
-    msg_ok "Backup Created"
-
-    # FileFlows tracks the latest release, whose .NET target can move (e.g. 8 -> 10);
-    # ensure the current ASP.NET Core Runtime so an existing install doesn't fail to
-    # start after updating to a newer .NET major version.
-    msg_info "Ensuring ASP.NET Core Runtime"
-    if [[ "$(arch_resolve)" == "arm64" ]]; then
-      if [[ ! -x /usr/lib/dotnet10/dotnet ]]; then
-        curl -fsSL https://dot.net/v1/dotnet-install.sh -o /tmp/dotnet-install.sh
-        $STD bash /tmp/dotnet-install.sh --channel 10.0 --runtime aspnetcore --install-dir /usr/lib/dotnet10
-        ln -sf /usr/lib/dotnet10/dotnet /usr/bin/dotnet
-        rm -f /tmp/dotnet-install.sh
+  if systemctl list-unit-files 'fileflows.service' --no-legend 2>/dev/null | grep -q '^fileflows\.service'; then
+    tmp=$(mktemp)
+    http_code=$(curl -sSL -X 'GET' "http://localhost:19200/api/status/update-available" -H 'accept: application/json' -o "$tmp" -w '%{http_code}' 2>/dev/null) || http_code="000"
+    if [[ "$http_code" == "200" ]]; then
+      update_available=$(jq -r '.UpdateAvailable // false' "$tmp" 2>/dev/null)
+      rm -f "$tmp"
+      if [[ "${update_available}" == "true" ]]; then
+        proceed=true
+      else
+        msg_ok "No update required. ${APP} is already at latest version"
+        exit
+      fi
+    else
+      rm -f "$tmp"
+      if [[ "$http_code" == "401" ]]; then
+        msg_warn "Could not check for updates: API returned 401 (security may be enabled)."
+      else
+        msg_warn "Could not check for updates: API unreachable (HTTP ${http_code})."
+      fi
+      if [[ "${FORCE_UPDATE:-}" == "1" ]]; then
+        proceed=true
+      else
+        read -r -p "${TAB3}Force update without version check? [y/N]: " CONFIRM
+        if [[ "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+          proceed=true
+        else
+          msg_error "Update aborted."
+          exit
+        fi
       fi
-    elif ! is_package_installed "aspnetcore-runtime-10.0"; then
-      $STD apt remove -y aspnetcore-runtime-8.0 aspnetcore-runtime-9.0 2>/dev/null || true
-      setup_deb822_repo \
-        "microsoft" \
-        "https://packages.microsoft.com/keys/microsoft-2025.asc" \
-        "https://packages.microsoft.com/debian/13/prod/" \
-        "trixie"
-      $STD apt install -y aspnetcore-runtime-10.0
     fi
-    msg_ok "Ensured ASP.NET Core Runtime"
-
-    fetch_and_deploy_from_url "https://fileflows.com/downloads/zip" "/opt/fileflows"
-
-    msg_info "Starting Service"
-    systemctl --all start 'fileflows*'
-    msg_ok "Started Service"
-    msg_ok "Updated successfully!"
   else
-    msg_ok "No update required. ${APP} is already at latest version"
+    proceed=true
   fi
 
+  if [[ "$proceed" != "true" ]]; then
+    exit
+  fi
+
+  msg_info "Stopping Service"
+  systemctl --all stop 'fileflows*'
+  msg_ok "Stopped Service"
+
+  msg_info "Creating Backup"
+  ls /opt/*.tar.gz &>/dev/null && rm -f /opt/*.tar.gz
+  backup_filename="/opt/${APP}_backup_$(date +%F).tar.gz"
+  tar -czf "$backup_filename" -C /opt/fileflows Data
+  msg_ok "Backup Created"
+
+  msg_info "Ensuring ASP.NET Core Runtime"
+  if [[ "$(arch_resolve)" == "arm64" ]]; then
+    if [[ ! -x /usr/lib/dotnet10/dotnet ]]; then
+      curl -fsSL https://dot.net/v1/dotnet-install.sh -o /tmp/dotnet-install.sh
+      $STD bash /tmp/dotnet-install.sh --channel 10.0 --runtime aspnetcore --install-dir /usr/lib/dotnet10
+      ln -sf /usr/lib/dotnet10/dotnet /usr/bin/dotnet
+      rm -f /tmp/dotnet-install.sh
+    fi
+  elif ! is_package_installed "aspnetcore-runtime-10.0"; then
+    $STD apt remove -y aspnetcore-runtime-8.0 aspnetcore-runtime-9.0 2>/dev/null || true
+    setup_deb822_repo \
+      "microsoft" \
+      "https://packages.microsoft.com/keys/microsoft-2025.asc" \
+      "https://packages.microsoft.com/debian/13/prod/" \
+      "trixie"
+    $STD apt install -y aspnetcore-runtime-10.0
+  fi
+  msg_ok "Ensured ASP.NET Core Runtime"
+
+  fetch_and_deploy_from_url "https://fileflows.com/downloads/zip" "/opt/fileflows"
+
+  msg_info "Starting Service"
+  systemctl --all start 'fileflows*'
+  msg_ok "Started Service"
+  msg_ok "Updated successfully!"
+
   exit
 }
 
diff --git a/install/fileflows-install.sh b/install/fileflows-install.sh
index 50242be8a..14efb6582 100644
--- a/install/fileflows-install.sh
+++ b/install/fileflows-install.sh
@@ -55,9 +55,12 @@ if [[ "$install_server" =~ ^[Ss]$ ]]; then
   msg_ok "Installed FileFlows Server"
 else
   msg_info "Installing FileFlows Node"
+  read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url
+  while [[ -z "${server_url// /}" ]]; do
+    read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url
+  done
   cd /opt/fileflows/Node
-  $STD dotnet FileFlows.Node.dll
-  $STD dotnet FileFlows.Node.dll --systemd install --root true
+  $STD dotnet FileFlows.Node.dll --server "$server_url" --systemd install --root true
   systemctl enable -q --now fileflows-node
   msg_ok "Installed FileFlows Node"
 fi

From 9055f4b34e2b5f08839c9e36c7b680f90763cb54 Mon Sep 17 00:00:00 2001
From: Michel Roegl-Brunner
 <73236783+michelroegl-brunner@users.noreply.github.com>
Date: Tue, 14 Jul 2026 14:01:40 +0200
Subject: [PATCH 115/220] fix(lychee): preserve uploads and ownership during
 update (#15768)

The update script wiped public/uploads and did not re-apply www-data
ownership, causing HTTP 500 after successful updates. Align with upstream
upgrade steps and sibling Laravel scripts by backing up uploads/dist,
restarting PHP-FPM, running full artisan cache cycle, and adding verbose
diagnostics.

Fixes #15763
---
 ct/lychee.sh | 31 ++++++++++++++++++-------------
 1 file changed, 18 insertions(+), 13 deletions(-)

diff --git a/ct/lychee.sh b/ct/lychee.sh
index 887d1f3ac..7adfff87b 100644
--- a/ct/lychee.sh
+++ b/ct/lychee.sh
@@ -31,33 +31,38 @@ function update_script() {
   fi
 
   if check_for_gh_release "lychee" "LycheeOrg/Lychee"; then
+    PHP_VER=$(php -r 'echo PHP_MAJOR_VERSION . "." . PHP_MINOR_VERSION;')
+
     msg_info "Stopping Services"
-    systemctl stop caddy
+    systemctl stop caddy php${PHP_VER}-fpm
     msg_ok "Stopped Services"
 
-    msg_info "Backing up Data"
-    cp /opt/lychee/.env /opt/lychee.env.bak
-    cp -r /opt/lychee/storage /opt/lychee_storage_backup
-    msg_ok "Backed up Data"
+    create_backup /opt/lychee/.env \
+      /opt/lychee/storage \
+      /opt/lychee/public/uploads \
+      /opt/lychee/public/dist
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "lychee" "LycheeOrg/Lychee" "prebuild" "latest" "/opt/lychee" "Lychee.zip"
 
-    msg_info "Restoring Data"
-    cp /opt/lychee.env.bak /opt/lychee/.env
-    rm -f /opt/lychee.env.bak
-    cp -r /opt/lychee_storage_backup/. /opt/lychee/storage
-    rm -rf /opt/lychee_storage_backup
-    msg_ok "Restored Data"
+    restore_backup
 
     msg_info "Updating Application"
     cd /opt/lychee
     $STD php artisan migrate --force
+    $STD php artisan config:clear
+    $STD php artisan cache:clear
     $STD php artisan optimize:clear
-    chmod -R 775 /opt/lychee/storage /opt/lychee/bootstrap/cache
+    $STD php artisan optimize
+    chown -R www-data:www-data /opt/lychee
+    chmod -R 775 /opt/lychee/storage /opt/lychee/bootstrap/cache \
+      /opt/lychee/public/dist /opt/lychee/public/uploads
+    if [[ "${VERBOSE:-no}" = "yes" ]]; then
+      php artisan lychee:diagnostics || true
+    fi
     msg_ok "Updated Application"
 
     msg_info "Starting Services"
-    systemctl start caddy
+    systemctl start caddy php${PHP_VER}-fpm
     msg_ok "Started Services"
     msg_ok "Updated successfully!"
   fi

From 254e720b4fe79af72e258e55660a6f554e48cf10 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 12:01:44 +0000
Subject: [PATCH 116/220] Update CHANGELOG.md (#15776)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 993e216d7..5df109bec 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -508,6 +508,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - FileFlows: Handle update API 401, force update, and Node install [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15766](https://github.com/community-scripts/ProxmoxVE/pull/15766))
     - BirdNET-Go: Match new upstream release asset naming [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15758](https://github.com/community-scripts/ProxmoxVE/pull/15758))
     - [Upstream Fix] Immich: Fix loader priority [@vhsdream](https://github.com/vhsdream) ([#15755](https://github.com/community-scripts/ProxmoxVE/pull/15755))
 

From bb4e35f9886e6c94f0ac2baa7c77b9318c1deaf2 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 12:02:17 +0000
Subject: [PATCH 117/220] Update CHANGELOG.md (#15777)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5df109bec..e3a97ccb4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -508,6 +508,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - Lychee: Preserve uploads and ownership during update [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15768](https://github.com/community-scripts/ProxmoxVE/pull/15768))
     - FileFlows: Handle update API 401, force update, and Node install [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15766](https://github.com/community-scripts/ProxmoxVE/pull/15766))
     - BirdNET-Go: Match new upstream release asset naming [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15758](https://github.com/community-scripts/ProxmoxVE/pull/15758))
     - [Upstream Fix] Immich: Fix loader priority [@vhsdream](https://github.com/vhsdream) ([#15755](https://github.com/community-scripts/ProxmoxVE/pull/15755))

From 817ee347c7ab5134e59a8fbeee568e82dc37f6f2 Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Tue, 14 Jul 2026 14:08:14 +0200
Subject: [PATCH 118/220] Bump OpenCloud version to v7.2.2 (#15769)

* Bump OpenCloud release version to v7.2.2

* Update OpenCloud version to v7.2.2
---
 ct/opencloud.sh              | 2 +-
 install/opencloud-install.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/ct/opencloud.sh b/ct/opencloud.sh
index b328d90ab..0ce6d9291 100644
--- a/ct/opencloud.sh
+++ b/ct/opencloud.sh
@@ -30,7 +30,7 @@ function update_script() {
     exit
   fi
 
-  RELEASE="v7.2.1"
+  RELEASE="v7.2.2"
   if check_for_gh_release "OpenCloud" "opencloud-eu/opencloud" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
     msg_info "Stopping services"
     systemctl stop opencloud opencloud-wopi
diff --git a/install/opencloud-install.sh b/install/opencloud-install.sh
index 0dc635098..f3f1bc93b 100644
--- a/install/opencloud-install.sh
+++ b/install/opencloud-install.sh
@@ -64,7 +64,7 @@ $STD sudo -u cool coolconfig set-admin-password --user=admin --password="$COOLPA
 echo "$COOLPASS" >~/.coolpass
 msg_ok "Installed Collabora Online"
 
-fetch_and_deploy_gh_release "OpenCloud" "opencloud-eu/opencloud" "singlefile" "v7.2.1" "/usr/bin" "opencloud-*-linux-$(arch_resolve)"
+fetch_and_deploy_gh_release "OpenCloud" "opencloud-eu/opencloud" "singlefile" "v7.2.2" "/usr/bin" "opencloud-*-linux-$(arch_resolve)"
 mv /usr/bin/OpenCloud /usr/bin/opencloud
 
 msg_info "Configuring OpenCloud"

From 9f8bc4b03d84329b21af7e9d2e364c1e367877b8 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 12:08:38 +0000
Subject: [PATCH 119/220] Update CHANGELOG.md (#15778)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e3a97ccb4..28d868983 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -515,6 +515,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### ✨ New Features
 
+    - Bump OpenCloud version to v7.2.2 [@MickLesk](https://github.com/MickLesk) ([#15769](https://github.com/community-scripts/ProxmoxVE/pull/15769))
     - Silverbullet: Add optional Runtime API install via Chromium [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15761](https://github.com/community-scripts/ProxmoxVE/pull/15761))
 
 ## 2026-07-13

From 670d972cc1342521ebaa59d715bd8bf5ca03ef7c Mon Sep 17 00:00:00 2001
From: Michel Roegl-Brunner
 <73236783+michelroegl-brunner@users.noreply.github.com>
Date: Tue, 14 Jul 2026 14:14:20 +0200
Subject: [PATCH 120/220] fix(wanderer): clean deploy and install plugins for
 v0.20.0 update (#15759)

Use CLEAN_INSTALL with create_backup/restore_backup so stale v0.19.x source files no longer break go build after the integrations migration. Also set up the plugins directory and install official WASM bundles.
---
 ct/wanderer.sh              | 13 +++++++++++--
 install/wanderer-install.sh |  9 ++++++++-
 2 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/ct/wanderer.sh b/ct/wanderer.sh
index 432963379..bb0ec71cd 100644
--- a/ct/wanderer.sh
+++ b/ct/wanderer.sh
@@ -30,12 +30,14 @@ function update_script() {
     exit
   fi
 
-  if check_for_gh_release "wanderer" "Flomp/wanderer"; then
+  if check_for_gh_release "wanderer" "open-wanderer/wanderer"; then
     msg_info "Stopping service"
     systemctl stop wanderer-web
     msg_ok "Stopped service"
 
-    fetch_and_deploy_gh_release "wanderer" "open-wanderer/wanderer" "tarball" "latest" "/opt/wanderer/source"
+    create_backup /opt/wanderer/source/search
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "wanderer" "open-wanderer/wanderer" "tarball" "latest" "/opt/wanderer/source"
+    restore_backup
 
     msg_info "Updating wanderer"
     cd /opt/wanderer/source/db
@@ -44,6 +46,13 @@ function update_script() {
     cd /opt/wanderer/source/web
     $STD npm ci
     $STD npm run build
+    mkdir -p /opt/wanderer/data/plugins
+    [[ -e /data/plugins ]] || ln -sfn /opt/wanderer/data/plugins /data/plugins
+    msg_info "Installing wanderer plugins"
+    for plugin in hammerhead komoot strava; do
+      fetch_and_deploy_gh_release "wanderer-plugin-${plugin}" "open-wanderer/wanderer" "prebuild" "${CHECK_UPDATE_RELEASE:-latest}" "/opt/wanderer/data/plugins" "wanderer-plugin-${plugin}.tar.gz" || msg_warn "Failed to install wanderer plugin: ${plugin}"
+    done
+    msg_ok "Installed wanderer plugins"
     msg_ok "Updated wanderer"
 
     msg_info "Starting service"
diff --git a/install/wanderer-install.sh b/install/wanderer-install.sh
index 3cebc9fef..6a8571bbf 100644
--- a/install/wanderer-install.sh
+++ b/install/wanderer-install.sh
@@ -20,7 +20,8 @@ if [[ "$(arch_resolve)" == "arm64" ]]; then
 else
   fetch_and_deploy_gh_release "meilisearch" "meilisearch/meilisearch" "binary" "latest" "/opt/wanderer/source/search"
 fi
-mkdir -p /opt/wanderer/{source,data/pb_data,data/meili_data}
+mkdir -p /opt/wanderer/{source,data/pb_data,data/meili_data,data/plugins}
+[[ -e /data/plugins ]] || ln -sfn /opt/wanderer/data/plugins /data/plugins
 fetch_and_deploy_gh_release "wanderer" "open-wanderer/wanderer" "tarball" "latest" "/opt/wanderer/source"
 
 msg_info "Installing wanderer (patience)"
@@ -32,6 +33,12 @@ $STD npm ci
 $STD npm run build
 msg_ok "Installed wanderer"
 
+msg_info "Installing wanderer plugins"
+for plugin in hammerhead komoot strava; do
+  fetch_and_deploy_gh_release "wanderer-plugin-${plugin}" "open-wanderer/wanderer" "prebuild" "latest" "/opt/wanderer/data/plugins" "wanderer-plugin-${plugin}.tar.gz" || msg_warn "Failed to install wanderer plugin: ${plugin}"
+done
+msg_ok "Installed wanderer plugins"
+
 msg_info "Creating Service"
 MEILI_KEY=$(openssl rand -hex 32)
 POCKETBASE_KEY=$(openssl rand -hex 16)

From 0f37abff3ce52a120fec946195861a7eff20d68d Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 12:14:44 +0000
Subject: [PATCH 121/220] Update CHANGELOG.md (#15779)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 28d868983..bec04bb4f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -508,6 +508,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - Wanderer: Clean deploy and install plugins for v0.20.0 update [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15759](https://github.com/community-scripts/ProxmoxVE/pull/15759))
     - Lychee: Preserve uploads and ownership during update [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15768](https://github.com/community-scripts/ProxmoxVE/pull/15768))
     - FileFlows: Handle update API 401, force update, and Node install [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15766](https://github.com/community-scripts/ProxmoxVE/pull/15766))
     - BirdNET-Go: Match new upstream release asset naming [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15758](https://github.com/community-scripts/ProxmoxVE/pull/15758))

From 108c9dcf43c191a473d2910842cc3806f1ef86da Mon Sep 17 00:00:00 2001
From: "push-app-to-main[bot]"
 <203845782+push-app-to-main[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 14:15:32 +0200
Subject: [PATCH 122/220] Add yuvomi (ct) (#15772)

Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com>
---
 ct/headers/yuvomi         |  6 ++++
 ct/yuvomi.sh              | 64 ++++++++++++++++++++++++++++++++++
 install/yuvomi-install.sh | 72 +++++++++++++++++++++++++++++++++++++++
 3 files changed, 142 insertions(+)
 create mode 100644 ct/headers/yuvomi
 create mode 100644 ct/yuvomi.sh
 create mode 100644 install/yuvomi-install.sh

diff --git a/ct/headers/yuvomi b/ct/headers/yuvomi
new file mode 100644
index 000000000..3247d3dcc
--- /dev/null
+++ b/ct/headers/yuvomi
@@ -0,0 +1,6 @@
+__  __                            _ 
+\ \/ /_  ___   ______  ____ ___  (_)
+ \  / / / / | / / __ \/ __ `__ \/ / 
+ / / /_/ /| |/ / /_/ / / / / / / /  
+/_/\__,_/ |___/\____/_/ /_/ /_/_/   
+                                    
diff --git a/ct/yuvomi.sh b/ct/yuvomi.sh
new file mode 100644
index 000000000..625a0aa61
--- /dev/null
+++ b/ct/yuvomi.sh
@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/ulsklyc/yuvomi
+
+APP="Yuvomi"
+var_tags="${var_tags:-family;planner;calendar}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-1024}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/yuvomi ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "yuvomi" "ulsklyc/yuvomi"; then
+    msg_info "Stopping Service"
+    systemctl stop yuvomi
+    msg_ok "Stopped Service"
+
+    create_backup /opt/yuvomi/data /opt/yuvomi/.env
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "yuvomi" "ulsklyc/yuvomi" "tarball"
+
+    msg_info "Installing Node.js Dependencies"
+    cd /opt/yuvomi
+    $STD npm ci --omit=dev
+    msg_ok "Installed Node.js Dependencies"
+
+    restore_backup
+
+    msg_info "Starting Service"
+    systemctl start yuvomi
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"
diff --git a/install/yuvomi-install.sh b/install/yuvomi-install.sh
new file mode 100644
index 000000000..521049586
--- /dev/null
+++ b/install/yuvomi-install.sh
@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/ulsklyc/yuvomi
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  python3 \
+  make \
+  g++ \
+  libsqlcipher-dev
+msg_ok "Installed Dependencies"
+
+NODE_VERSION="22" setup_nodejs
+
+fetch_and_deploy_gh_release "yuvomi" "ulsklyc/yuvomi" "tarball"
+
+msg_info "Installing Node.js Dependencies"
+cd /opt/yuvomi
+$STD npm ci --omit=dev
+msg_ok "Installed Node.js Dependencies"
+
+msg_info "Configuring Yuvomi"
+mkdir -p /opt/yuvomi/data /opt/yuvomi/backups
+SESSION_SECRET=$(openssl rand -hex 32)
+DB_ENCRYPT_KEY=$(openssl rand -hex 32)
+cat <<EOF >/opt/yuvomi/.env
+PORT=3000
+NODE_ENV=production
+DB_PATH=/opt/yuvomi/data/yuvomi.db
+DB_ENCRYPTION_KEY=${DB_ENCRYPT_KEY}
+SESSION_SECRET=${SESSION_SECRET}
+RATE_LIMIT_WINDOW_MS=60000
+RATE_LIMIT_MAX_ATTEMPTS=5
+RATE_LIMIT_BLOCK_DURATION_MS=900000
+EOF
+msg_ok "Configured Yuvomi"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/yuvomi.service
+[Unit]
+Description=Yuvomi Family Planner
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/yuvomi
+EnvironmentFile=/opt/yuvomi/.env
+ExecStart=/usr/bin/node server/index.js
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now yuvomi
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

From 2bffa47924a7b739ff1f6c4ff33d88c3e5c72588 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 12:16:01 +0000
Subject: [PATCH 123/220] Update CHANGELOG.md (#15780)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index bec04bb4f..c9aad4a0d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -504,6 +504,10 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ## 2026-07-14
 
+### 🆕 New Scripts
+
+  - Yuvomi ([#15772](https://github.com/community-scripts/ProxmoxVE/pull/15772))
+
 ### 🚀 Updated Scripts
 
   - #### 🐞 Bug Fixes

From d4d482746b2334751d558bb569512934b07d1efa Mon Sep 17 00:00:00 2001
From: "push-app-to-main[bot]"
 <203845782+push-app-to-main[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 14:16:10 +0200
Subject: [PATCH 124/220] Add grav (ct) (#15773)

Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com>
---
 ct/grav.sh              |  54 +++++++++++++++++++
 ct/headers/grav         |   6 +++
 install/grav-install.sh | 111 ++++++++++++++++++++++++++++++++++++++++
 3 files changed, 171 insertions(+)
 create mode 100644 ct/grav.sh
 create mode 100644 ct/headers/grav
 create mode 100644 install/grav-install.sh

diff --git a/ct/grav.sh b/ct/grav.sh
new file mode 100644
index 000000000..9271a029e
--- /dev/null
+++ b/ct/grav.sh
@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+source <(curl -s https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Raffaele (rafspiny)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://getgrav.org/
+
+APP="Grav"
+var_tags="${var_tags:-cms}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+    header_info
+    check_container_storage
+    check_container_resources
+
+    if [[ ! -d "/opt/grav" ]]; then
+        msg_error "No ${APP} Installation Found!"
+        exit
+    fi
+
+    if check_for_gh_release "grav" "getgrav/grav"; then
+        msg_info "Creating Backup"
+        cd /opt/grav
+        bin/grav backup -nq
+        msg_ok "Backup Created"
+        bin/gpm self-upgrade -y
+        cd -
+        chown -R www-data:www-data /opt/grav
+        msg_ok "Update Successful"
+    fi
+    exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:80${CL}"
diff --git a/ct/headers/grav b/ct/headers/grav
new file mode 100644
index 000000000..3e041ab1e
--- /dev/null
+++ b/ct/headers/grav
@@ -0,0 +1,6 @@
+   ______                
+  / ____/________ __   __
+ / / __/ ___/ __ `/ | / /
+/ /_/ / /  / /_/ /| |/ / 
+\____/_/   \__,_/ |___/  
+                         
diff --git a/install/grav-install.sh b/install/grav-install.sh
new file mode 100644
index 000000000..8b3c396cf
--- /dev/null
+++ b/install/grav-install.sh
@@ -0,0 +1,111 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Raffaele (rafspiny)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://getgrav.org/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  nginx \
+  logrotate
+msg_ok "Installed Dependencies"
+
+PHP_FPM="YES" setup_php
+
+fetch_and_deploy_gh_release "grav" "getgrav/grav" "prebuild" "latest" "/opt/grav" "grav-admin-v*zip"
+chown -R www-data:www-data /opt/grav
+
+msg_info "Configuring Nginx"
+PHP_VER=$(php -r 'echo PHP_MAJOR_VERSION . "." . PHP_MINOR_VERSION;')
+PHP_FPM_SOCK=$(find /run/php -maxdepth 1 -name "php*-fpm.sock" -type s | sort -V | tail -1)
+unlink /etc/nginx/sites-enabled/default
+rm -f /etc/nginx/sites-available/default
+cat <<EOF >/etc/nginx/sites-available/grav
+server {
+    listen 80;
+    server_name _;
+    root /opt/grav;
+    index index.html index.htm index.php;
+
+    location / {
+        try_files \$uri \$uri/ /index.html /index.htm /index.php\$is_args\$args;
+    }
+
+    ## Begin - Security
+    location ~* /(\.git|cache|bin|logs|backup|tests)/.*$ { return 403; }
+    location ~* /(system|vendor)/.*\.(txt|xml|md|html|json|yaml|yml|php|pl|py|cgi|twig|sh|bat)$ { return 403; }
+    location ~* /user/.*\.(txt|md|json|yaml|yml|php|pl|py|cgi|twig|sh|bat)$ { return 403; }
+    location ~ /(LICENSE\.txt|composer\.lock|composer\.json|nginx\.conf|web\.config|htaccess\.txt|\.htaccess) { return 403; }
+    ## End - Security
+
+    ## Begin - API
+    location ^~ /api/ {
+        try_files \$uri \$uri/ /index.php\$is_args\$args;
+    }
+    ## End - API
+
+    # deny all direct access to these sensitive user folders, whatever the file type
+    location ~* /user/(accounts|config|env)/.*$ { return 403; }
+    # allow public media uploads under user/data to be served directly;
+    # this must come before the user/data deny so it wins the match
+    location ~* /user/data/.*\.(jpe?g|png|gif|webp|avif|bmp|ico|mp4|webm|ogg|ogv|mov|mp3|wav|m4a|flac|pdf)$ { try_files \$uri =404; }
+    # deny everything else under user/data
+    location ~* /user/data/.*$ { return 403; }
+
+
+    ## Begin - Caching
+    location ~* ^/forms-basic-captcha-image.jpg$ {
+        try_files \$uri \$uri/ /index.php\$is_args\$args;
+    }
+
+    location ~* \.(?:ico|css|js|gif|jpe?g|png)$ {
+        expires 30d;
+        add_header Vary Accept-Encoding;
+        log_not_found off;
+    }
+
+    location ~* ^.+\.(?:css|cur|js|jpe?g|gif|htc|ico|png|html|xml|otf|ttf|eot|woff|woff2|svg)$ {
+        access_log off;
+        expires 30d;
+        add_header Cache-Control public;
+        tcp_nodelay off;
+        open_file_cache max=3000 inactive=120s;
+        open_file_cache_valid 45s;
+        open_file_cache_min_uses 2;
+        open_file_cache_errors off;
+    }
+    ## End - Caching
+
+    location ~ ^(.+\.php)(.*)$ {
+        fastcgi_split_path_info ^(.+\.php)(.*)$;
+        if (!-f \$document_root\$fastcgi_script_name) { return 404; }
+        fastcgi_pass unix:${PHP_FPM_SOCK};
+        fastcgi_index index.php;
+        include /etc/nginx/fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
+    }
+
+    location ~ /\.ht {
+        deny all;
+    }
+}
+EOF
+ln -sf /etc/nginx/sites-available/grav /etc/nginx/sites-enabled/grav
+systemctl enable -q --now php${PHP_VER}-fpm
+$STD nginx -t
+systemctl enable -q --now nginx
+$STD nginx -s reload
+msg_ok "Configured Nginx"
+
+motd_ssh
+customize
+cleanup_lxc

From a5b839f91fe1869fc64b217276639e964690cab8 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 12:16:30 +0000
Subject: [PATCH 125/220] Update CHANGELOG.md (#15781)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c9aad4a0d..88c37eb3a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -506,7 +506,8 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ### 🆕 New Scripts
 
-  - Yuvomi ([#15772](https://github.com/community-scripts/ProxmoxVE/pull/15772))
+  - Grav ([#15773](https://github.com/community-scripts/ProxmoxVE/pull/15773))
+- Yuvomi ([#15772](https://github.com/community-scripts/ProxmoxVE/pull/15772))
 
 ### 🚀 Updated Scripts
 

From ed29bb6f6206d007bd40c2038974b7dcf5ccbc31 Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Tue, 14 Jul 2026 22:38:24 +0200
Subject: [PATCH 126/220] AFFiNE: Pin to v0.26.3 (#15782)

* AFFiNE: Pin to v0.26.3

* Update GitHub release version to v0.26.3
---
 ct/affine.sh              | 5 +++--
 install/affine-install.sh | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/ct/affine.sh b/ct/affine.sh
index c6f2849aa..236a225bd 100644
--- a/ct/affine.sh
+++ b/ct/affine.sh
@@ -30,14 +30,15 @@ function update_script() {
     exit
   fi
 
-  if check_for_gh_release "affine_app" "toeverything/AFFiNE"; then
+  RELEASE="v0.26.3"
+  if check_for_gh_release "affine_app" "toeverything/AFFiNE" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
     msg_info "Stopping Services"
     systemctl stop affine-web affine-worker
     msg_ok "Stopped Services"
 
     create_backup /root/.affine/config /root/.affine/storage
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "latest" "/opt/affine"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "${RELEASE}" "/opt/affine"
 
     msg_info "Rebuilding Application (Patience)"
     cd /opt/affine
diff --git a/install/affine-install.sh b/install/affine-install.sh
index 2e29234b6..4c15d2403 100644
--- a/install/affine-install.sh
+++ b/install/affine-install.sh
@@ -30,7 +30,7 @@ PG_DB_NAME="affine" PG_DB_USER="affine" setup_postgresql_db
 NODE_VERSION="22" setup_nodejs
 setup_rust
 
-fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "latest" "/opt/affine"
+fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "v0.26.3" "/opt/affine"
 
 msg_info "Setting up Directories"
 rm -rf /root/.affine

From 80c4b04d83272f4fb8918d62319b070b86615c73 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 20:38:53 +0000
Subject: [PATCH 127/220] Update CHANGELOG.md (#15788)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 88c37eb3a..dea512093 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -513,8 +513,8 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
-    - Wanderer: Clean deploy and install plugins for v0.20.0 update [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15759](https://github.com/community-scripts/ProxmoxVE/pull/15759))
     - Lychee: Preserve uploads and ownership during update [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15768](https://github.com/community-scripts/ProxmoxVE/pull/15768))
+    - Wanderer: Clean deploy and install plugins for v0.20.0 update [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15759](https://github.com/community-scripts/ProxmoxVE/pull/15759))
     - FileFlows: Handle update API 401, force update, and Node install [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15766](https://github.com/community-scripts/ProxmoxVE/pull/15766))
     - BirdNET-Go: Match new upstream release asset naming [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15758](https://github.com/community-scripts/ProxmoxVE/pull/15758))
     - [Upstream Fix] Immich: Fix loader priority [@vhsdream](https://github.com/vhsdream) ([#15755](https://github.com/community-scripts/ProxmoxVE/pull/15755))
@@ -524,6 +524,10 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
     - Bump OpenCloud version to v7.2.2 [@MickLesk](https://github.com/MickLesk) ([#15769](https://github.com/community-scripts/ProxmoxVE/pull/15769))
     - Silverbullet: Add optional Runtime API install via Chromium [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15761](https://github.com/community-scripts/ProxmoxVE/pull/15761))
 
+  - #### 🔧 Refactor
+
+    - AFFiNE: Pin to v0.26.3 [@MickLesk](https://github.com/MickLesk) ([#15782](https://github.com/community-scripts/ProxmoxVE/pull/15782))
+
 ## 2026-07-13
 
 ### 🆕 New Scripts

From 07e31eb5bce1d4bf0efd1601b1f5369e1cd49b4a Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Tue, 14 Jul 2026 22:54:55 +0200
Subject: [PATCH 128/220] Pangolin: Bump to 1.20.0 | BREAKING: Switch to
 PostgreSQL (#15682)

* Pangolin: Bump to 1.20.0 and harden SQLite migrations

Bump the default Pangolin version to 1.20.0 in both CT and install scripts. Update the CT upgrade path to validate required 1.20.0 schema objects, clear stale versionMigrations markers when needed, retry migrations once, and abort with a clear error if the schema is still incomplete to avoid a broken runtime.

* extend migration check...

* another try...

* bump pangolin to PSQL

* remove migration paths

* remove old migrations

* use create_backup and restore_backup

* Block Pangolin SQLite upgrades

Update the Pangolin CT upgrade path to fail fast when PostgreSQL is not installed. The script now explains that upgrades to Pangolin 1.20.0+ require PostgreSQL and that SQLite data cannot be migrated automatically.

* fix env

* Update pangolin.sh

* Update pangolin-install.sh
---
 ct/pangolin.sh              | 39 +++++++++++++++++--------------------
 install/pangolin-install.sh | 21 +++++++++++++-------
 2 files changed, 32 insertions(+), 28 deletions(-)

diff --git a/ct/pangolin.sh b/ct/pangolin.sh
index 08d604277..fe5b787a9 100644
--- a/ct/pangolin.sh
+++ b/ct/pangolin.sh
@@ -6,7 +6,7 @@ source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxV
 # Source: https://pangolin.net/ | Github: https://github.com/fosrl/pangolin
 
 APP="Pangolin"
-PANGOLIN_VERSION="${PANGOLIN_VERSION:-1.18.4}"
+PANGOLIN_VERSION="${PANGOLIN_VERSION:-1.20.0}"
 var_tags="${var_tags:-proxy}"
 var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-4096}"
@@ -33,6 +33,15 @@ function update_script() {
 
   ensure_dependencies build-essential python3
 
+  if ! command -v psql &>/dev/null; then
+    msg_error "This installation uses SQLite and cannot be upgraded to Pangolin ${PANGOLIN_VERSION}."
+    echo -e "${INFO}${YW}Starting with Pangolin 1.20.0, PostgreSQL is required as the database backend.${CL}"
+    echo -e "${INFO}${YW}An automatic migration of your existing SQLite data is not supported.${CL}"
+    echo -e "${INFO}${YW}Please create a new LXC with the Pangolin install script, which sets up PostgreSQL automatically.${CL}"
+    echo -e "${INFO}${YW}Your current data is preserved in this container and can be manually migrated if needed.${CL}"
+    exit 1
+  fi
+
   NODE_VERSION="24" setup_nodejs
 
   if check_for_gh_release "pangolin" "fosrl/pangolin" "$PANGOLIN_VERSION" "Pinned to a tested release because Pangolin's schema changes have repeatedly broken unattended updates. To try a newer version at your own risk, run: 'export PANGOLIN_VERSION=<tag>' and re-run update. If it breaks, please open an issue at https://github.com/community-scripts/ProxmoxVE/issues with the error log."; then
@@ -41,13 +50,8 @@ function update_script() {
     systemctl stop gerbil
     msg_info "Service stopped"
 
-    msg_info "Creating backup"
-    tar -czf /opt/pangolin_config_backup.tar.gz -C /opt/pangolin config
-    if [[ -f /opt/pangolin/config/db/db.sqlite ]]; then
-      cp -a /opt/pangolin/config/db/db.sqlite \
-        "/opt/pangolin/config/db/db.sqlite.pre-${PANGOLIN_VERSION}-$(date +%Y%m%d-%H%M%S).bak"
-    fi
-    msg_ok "Created backup"
+    DB_URL=$(sed -n 's/.*connection_string: "\(.*\)".*/\1/p' /opt/pangolin/config/config.yml)
+    create_backup /opt/pangolin/config
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "pangolin" "fosrl/pangolin" "tarball" "$PANGOLIN_VERSION"
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "gerbil" "fosrl/gerbil" "singlefile" "latest" "/usr/bin" "gerbil_linux_$(arch_resolve)"
@@ -55,23 +59,21 @@ function update_script() {
     msg_info "Updating Pangolin"
     cd /opt/pangolin
     $STD npm ci
-    $STD npm run set:sqlite
+    $STD npm run set:pg
     $STD npm run set:oss
     rm -rf server/private
-    $STD npm run db:generate
+    DATABASE_URL="$DB_URL" $STD npm run db:generate
     $STD npm run build
     $STD npm run build:cli
     cp -R .next/standalone ./
+    cp -r server/migrations ./dist/init
     chmod +x ./dist/cli.mjs
     cp server/db/names.json ./dist/names.json
     cp server/db/ios_models.json ./dist/ios_models.json
     cp server/db/mac_models.json ./dist/mac_models.json
     msg_ok "Updated Pangolin"
 
-    msg_info "Restoring config"
-    tar -xzf /opt/pangolin_config_backup.tar.gz -C /opt/pangolin --overwrite
-    rm -f /opt/pangolin_config_backup.tar.gz
-    msg_ok "Restored config"
+    restore_backup
 
     if ! grep -q '^ExecStartPre=/usr/bin/node dist/migrations.mjs' /etc/systemd/system/pangolin.service 2>/dev/null; then
       msg_info "Adding migration step to pangolin.service"
@@ -82,13 +84,8 @@ function update_script() {
 
     msg_info "Running database migrations"
     cd /opt/pangolin
-    SQLITE_DB="/opt/pangolin/config/db/db.sqlite"
-    if [[ -f "$SQLITE_DB" ]]; then
-      if ! sqlite3 "$SQLITE_DB" ".tables" 2>/dev/null | tr ' ' '\n' | grep -qx "statusHistory"; then
-        sqlite3 "$SQLITE_DB" "DELETE FROM versionMigrations;" 2>/dev/null || true
-      fi
-    fi
     ENVIRONMENT=prod $STD node dist/migrations.mjs
+
     msg_ok "Ran database migrations"
 
     msg_info "Updating Badger plugin version"
@@ -112,4 +109,4 @@ description
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}https://<YOUR_PANGOLIN_URL>${CL}"
+echo -e "${GATEWAY}${BGN}https://<YOUR_PANGOLIN_URL> or http://${IP}:3002${CL}"
diff --git a/install/pangolin-install.sh b/install/pangolin-install.sh
index ab3fc5095..0a8f008af 100644
--- a/install/pangolin-install.sh
+++ b/install/pangolin-install.sh
@@ -16,18 +16,19 @@ update_os
 msg_info "Installing Dependencies"
 $STD apt install -y \
   build-essential \
-  python3 \
-  sqlite3 \
   iptables
 msg_ok "Installed Dependencies"
 
 NODE_VERSION="24" setup_nodejs
-PANGOLIN_VERSION="${PANGOLIN_VERSION:-1.18.4}"
+PG_VERSION="17" setup_postgresql
+PG_DB_NAME="pangolin" PG_DB_USER="pangolin" setup_postgresql_db
+PANGOLIN_VERSION="${PANGOLIN_VERSION:-1.20.0}"
 fetch_and_deploy_gh_release "pangolin" "fosrl/pangolin" "tarball" "$PANGOLIN_VERSION"
 fetch_and_deploy_gh_release "gerbil" "fosrl/gerbil" "singlefile" "latest" "/usr/bin" "gerbil_linux_$(arch_resolve)"
 fetch_and_deploy_gh_release "traefik" "traefik/traefik" "prebuild" "latest" "/usr/bin" "traefik_v*_linux_$(arch_resolve).tar.gz"
 
 read -rp "${TAB3}Enter your Pangolin URL (ex: https://pangolin.example.com): " pango_url
+[[ "$pango_url" != https://* && "$pango_url" != http://* ]] && pango_url="https://${pango_url}"
 read -rp "${TAB3}Enter your email address: " pango_email
 
 msg_info "Setup Pangolin"
@@ -36,13 +37,14 @@ BADGER_VERSION=$(get_latest_github_release "fosrl/badger" "false")
 cd /opt/pangolin
 mkdir -p /opt/pangolin/config/{traefik,db,letsencrypt,logs}
 $STD npm ci
-$STD npm run set:sqlite
+$STD npm run set:pg
 $STD npm run set:oss
 rm -rf server/private
-$STD npm run db:generate
+DATABASE_URL="postgresql://pangolin:${PG_DB_PASS}@localhost:5432/pangolin" $STD npm run db:generate
 $STD npm run build
 $STD npm run build:cli
 cp -R .next/standalone ./
+cp -r server/migrations ./dist/init
 
 cat <<EOF >/usr/local/bin/pangctl
 #!/bin/sh
@@ -74,6 +76,9 @@ flags:
   require_email_verification: false
   disable_signup_without_invite: false
   disable_user_create_org: false
+
+postgres:
+  connection_string: "postgresql://pangolin:${PG_DB_PASS}@localhost:5432/pangolin"
 EOF
 
 cat <<EOF >/opt/pangolin/config/traefik/traefik_config.yml
@@ -181,7 +186,8 @@ http:
         servers:
           - url: "http://$LOCAL_IP:3000"
 EOF
-$STD npm run db:push
+export ENVIRONMENT=prod
+$STD node dist/migrations.mjs
 
 . /etc/os-release
 if [ "$VERSION_CODENAME" = "trixie" ]; then
@@ -197,7 +203,8 @@ msg_info "Creating Services"
 cat <<EOF >/etc/systemd/system/pangolin.service
 [Unit]
 Description=Pangolin Service
-After=network.target
+After=network.target postgresql.service
+Wants=postgresql.service
 
 [Service]
 Type=simple

From 2afea1239cce6876a11c45d300ca47c196774dc1 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 20:55:21 +0000
Subject: [PATCH 129/220] Update CHANGELOG.md (#15789)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index dea512093..b87f350c6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -524,6 +524,10 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
     - Bump OpenCloud version to v7.2.2 [@MickLesk](https://github.com/MickLesk) ([#15769](https://github.com/community-scripts/ProxmoxVE/pull/15769))
     - Silverbullet: Add optional Runtime API install via Chromium [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15761](https://github.com/community-scripts/ProxmoxVE/pull/15761))
 
+  - #### 💥 Breaking Changes
+
+    - Pangolin: Bump to 1.20.0 | BREAKING: Switch to PostgreSQL [@MickLesk](https://github.com/MickLesk) ([#15682](https://github.com/community-scripts/ProxmoxVE/pull/15682))
+
   - #### 🔧 Refactor
 
     - AFFiNE: Pin to v0.26.3 [@MickLesk](https://github.com/MickLesk) ([#15782](https://github.com/community-scripts/ProxmoxVE/pull/15782))

From c52a69e8e5b8680eed07037b0fbf1e7f0e5997fc Mon Sep 17 00:00:00 2001
From: "push-app-to-main[bot]"
 <203845782+push-app-to-main[bot]@users.noreply.github.com>
Date: Wed, 15 Jul 2026 20:55:10 +1000
Subject: [PATCH 130/220] Nexterm (#15688)

* Add nexterm (ct)

* Remove architecture check from nexterm.sh

Removed architecture check for dpkg.

* Change var_arm64 default to 'yes' and update fetch commands

* Fix license URL and update service creation messages

* typo

---------

Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com>
Co-authored-by: CanbiZ (MickLesk) <47820557+MickLesk@users.noreply.github.com>
---
 ct/headers/nexterm         |  6 +++
 ct/nexterm.sh              | 66 +++++++++++++++++++++++++++++
 install/nexterm-install.sh | 85 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 157 insertions(+)
 create mode 100644 ct/headers/nexterm
 create mode 100644 ct/nexterm.sh
 create mode 100644 install/nexterm-install.sh

diff --git a/ct/headers/nexterm b/ct/headers/nexterm
new file mode 100644
index 000000000..7d52bc561
--- /dev/null
+++ b/ct/headers/nexterm
@@ -0,0 +1,6 @@
+    _   __          __                    
+   / | / /__  _  __/ /____  _________ ___ 
+  /  |/ / _ \| |/_/ __/ _ \/ ___/ __ `__ \
+ / /|  /  __/>  </ /_/  __/ /  / / / / / /
+/_/ |_/\___/_/|_|\__/\___/_/  /_/ /_/ /_/ 
+                                          
diff --git a/ct/nexterm.sh b/ct/nexterm.sh
new file mode 100644
index 000000000..dd67c4697
--- /dev/null
+++ b/ct/nexterm.sh
@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Mathias Wagner (gnmyt)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://nexterm.dev/
+
+APP="Nexterm"
+var_tags="${var_tags:-server-management}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-6}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /opt/nexterm/server/nexterm-server ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "nexterm-engine" "gnmyt/Nexterm"; then
+    msg_info "Stopping nexterm-engine"
+    systemctl stop nexterm-engine
+    msg_ok "Stopped nexterm-engine"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "nexterm-engine" "gnmyt/Nexterm" "prebuild" "latest" "/opt/nexterm/engine" "nexterm-engine-linux-$(arch_resolve "x64" "arm64").tar.gz"
+
+    msg_info "Starting nexterm-engine"
+    systemctl start nexterm-engine
+    msg_ok "Started nexterm-engine"
+  fi
+
+  if check_for_gh_release "nexterm-server" "gnmyt/Nexterm"; then
+    msg_info "Stopping nexterm-server"
+    systemctl stop nexterm-server
+    msg_ok "Stopped nexterm-server"
+
+    fetch_and_deploy_gh_release "nexterm-server" "gnmyt/Nexterm" "singlefile" "latest" "/opt/nexterm/server" "nexterm-server-linux-$(arch_resolve "x64" "arm64")"
+
+    msg_info "Starting nexterm-server"
+    systemctl start nexterm-server
+    msg_ok "Started nexterm-server"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:6989${CL}"
diff --git a/install/nexterm-install.sh b/install/nexterm-install.sh
new file mode 100644
index 000000000..1ef0ecfe8
--- /dev/null
+++ b/install/nexterm-install.sh
@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Mathias Wagner (gnmyt)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://nexterm.dev/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+fetch_and_deploy_gh_release "nexterm-engine" "gnmyt/Nexterm" "prebuild" "latest" "/opt/nexterm/engine" "nexterm-engine-linux-$(arch_resolve "x64" "arm64").tar.gz"
+fetch_and_deploy_gh_release "nexterm-server" "gnmyt/Nexterm" "singlefile" "latest" "/opt/nexterm/server" "nexterm-server-linux-$(arch_resolve "x64" "arm64")"
+
+msg_info "Configuring Nexterm"
+LOCAL_ENGINE_TOKEN=$(tr -d '-' </proc/sys/kernel/random/uuid)$(tr -d '-' </proc/sys/kernel/random/uuid)
+ENCRYPTION_KEY=$(tr -d '-' </proc/sys/kernel/random/uuid)$(tr -d '-' </proc/sys/kernel/random/uuid)
+mkdir -p /etc/nexterm-engine /etc/nexterm-server /opt/nexterm/data
+cat <<EOF >/etc/nexterm-engine/config.yaml
+server_host: "127.0.0.1"
+server_port: 7800
+registration_token: "${LOCAL_ENGINE_TOKEN}"
+tls: false
+EOF
+cat <<EOF >/etc/nexterm-server/server.env
+NODE_ENV=production
+SERVER_PORT=6989
+LOCAL_ENGINE_TOKEN=${LOCAL_ENGINE_TOKEN}
+ENCRYPTION_KEY=${ENCRYPTION_KEY}
+EOF
+chmod 0640 /etc/nexterm-engine/config.yaml /etc/nexterm-server/server.env
+msg_ok "Configured Nexterm"
+
+msg_info "Creating Services"
+cat <<EOF >/etc/systemd/system/nexterm-server.service
+[Unit]
+Description=Nexterm Server
+Documentation=https://docs.nexterm.dev/
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/nexterm/data
+EnvironmentFile=/etc/nexterm-server/server.env
+ExecStart=/opt/nexterm/server/nexterm-server
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+cat <<EOF >/etc/systemd/system/nexterm-engine.service
+[Unit]
+Description=Nexterm Engine
+Documentation=https://docs.nexterm.dev/
+After=network-online.target nexterm-server.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/etc/nexterm-engine
+Environment=FREERDP_EXTENSION_PATH=/opt/nexterm/engine/lib/freerdp2
+Environment=LD_LIBRARY_PATH=/opt/nexterm/engine/lib
+ExecStart=/opt/nexterm/engine/nexterm-engine
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now nexterm-server
+sleep 5
+systemctl enable -q --now nexterm-engine
+msg_ok "Created Services"
+
+motd_ssh
+customize
+cleanup_lxc

From c99768869daff20a9c193c3c9099c9187a59abd2 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Wed, 15 Jul 2026 10:55:37 +0000
Subject: [PATCH 131/220] Update CHANGELOG.md (#15798)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b87f350c6..05c63577e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -502,6 +502,12 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-07-15
+
+### 🆕 New Scripts
+
+  - Nexterm ([#15688](https://github.com/community-scripts/ProxmoxVE/pull/15688))
+
 ## 2026-07-14
 
 ### 🆕 New Scripts

From 75a1da273f7b2c67b740ae76877bf87b47eb9604 Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Wed, 15 Jul 2026 21:35:28 +0200
Subject: [PATCH 132/220] SnapOtter: refactor deployment and installation
 process (#15797)

---
 ct/snapotter.sh | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/ct/snapotter.sh b/ct/snapotter.sh
index 2ebea2959..f0293ad1d 100644
--- a/ct/snapotter.sh
+++ b/ct/snapotter.sh
@@ -35,14 +35,12 @@ function update_script() {
     systemctl stop snapotter
     msg_ok "Stopped Service"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "snapotter" "snapotter-hq/SnapOtter" "tarball"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "snapotter" "snapotter-hq/SnapOtter" "prebuild" "latest" "/opt/snapotter" "snapotter-*-linux-amd64.tar.gz"
 
     msg_info "Updating SnapOtter"
-    cd /opt/snapotter
-    $STD npm pkg delete scripts.prepare
-    $STD pnpm install --frozen-lockfile
-    $STD pnpm --filter @snapotter/web build
-    sed -i 's/mediapipe==0.10.21/mediapipe>=0.10.21/' /opt/snapotter/docker/feature-manifest.json
+    $STD uv python install 3.11
+    $STD uv venv --seed --python 3.11 /opt/snapotter_data/ai/venv
+    ln -sfn /opt/snapotter /app
     msg_ok "Updated SnapOtter"
 
     msg_info "Starting Service"

From c759617379d0628fd21e11cdead9e9df5b7fa87b Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Wed, 15 Jul 2026 19:35:52 +0000
Subject: [PATCH 133/220] Update CHANGELOG.md (#15802)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 05c63577e..03444fae6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -508,6 +508,12 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - Nexterm ([#15688](https://github.com/community-scripts/ProxmoxVE/pull/15688))
 
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - SnapOtter: refactor update process to prebuild [@MickLesk](https://github.com/MickLesk) ([#15797](https://github.com/community-scripts/ProxmoxVE/pull/15797))
+
 ## 2026-07-14
 
 ### 🆕 New Scripts

From 812267aeddab1ea1c93c040f492c493b2a1b8000 Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Wed, 15 Jul 2026 21:36:13 +0200
Subject: [PATCH 134/220] 2fauth: minor fixes for 8.0.0 (#15795)

---
 ct/2fauth.sh              | 1 +
 install/2fauth-install.sh | 1 +
 2 files changed, 2 insertions(+)

diff --git a/ct/2fauth.sh b/ct/2fauth.sh
index 506f140d8..5b5dc3eb7 100644
--- a/ct/2fauth.sh
+++ b/ct/2fauth.sh
@@ -60,6 +60,7 @@ function update_script() {
     php artisan 2fauth:install
     chown -R www-data: /opt/2fauth
     chmod -R 755 /opt/2fauth
+    $STD php artisan 2fauth:fix-passport-key-permissions
     $STD systemctl restart php8.4-fpm
     $STD systemctl restart nginx
     msg_ok "Configured 2FAuth"
diff --git a/install/2fauth-install.sh b/install/2fauth-install.sh
index 386b5c3de..61c8377ae 100644
--- a/install/2fauth-install.sh
+++ b/install/2fauth-install.sh
@@ -43,6 +43,7 @@ $STD php artisan migrate:refresh
 $STD php artisan passport:install -q -n
 $STD php artisan storage:link
 $STD php artisan config:cache
+$STD php artisan 2fauth:fix-passport-key-permissions
 chown -R www-data: /opt/2fauth
 chmod -R 755 /opt/2fauth
 msg_ok "Setup 2fauth"

From 66eff7ee87841c38aff0525fb8f268a6beab702a Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Wed, 15 Jul 2026 19:36:37 +0000
Subject: [PATCH 135/220] Update CHANGELOG.md (#15803)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 03444fae6..8b1550036 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -512,6 +512,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - 2fauth: minor fixes for 8.0.0 [@MickLesk](https://github.com/MickLesk) ([#15795](https://github.com/community-scripts/ProxmoxVE/pull/15795))
     - SnapOtter: refactor update process to prebuild [@MickLesk](https://github.com/MickLesk) ([#15797](https://github.com/community-scripts/ProxmoxVE/pull/15797))
 
 ## 2026-07-14

From 74a233b8b901421b17852e8693b5411ff09135d5 Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Wed, 15 Jul 2026 21:37:10 +0200
Subject: [PATCH 136/220] Default Docker setup to official repo (#15794)

---
 misc/tools.func | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/misc/tools.func b/misc/tools.func
index 4a35c695d..82f87ffea 100644
--- a/misc/tools.func
+++ b/misc/tools.func
@@ -4663,20 +4663,20 @@ setup_composer() {
 #   - Cleans up legacy repository files
 #
 # Usage:
-#   setup_docker                              # Uses distro package (recommended)
-#   USE_DOCKER_REPO=true setup_docker         # Uses official Docker repo
+#   setup_docker                              # Uses official Docker repo (recommended)
+#   USE_DOCKER_REPO=false setup_docker        # Uses distro docker.io package
 #   DOCKER_PORTAINER="true" setup_docker
 #   DOCKER_LOG_DRIVER="json-file" setup_docker
 #
 # Variables:
-#   USE_DOCKER_REPO        - Set to "true" to use official Docker repository
-#                            (default: false, uses distro docker.io package)
+#   USE_DOCKER_REPO        - Set to "false" to use distro docker.io package
+#                            (default: true, uses official Docker repository)
 #   DOCKER_PORTAINER       - Install Portainer CE (optional, "true" to enable)
 #   DOCKER_LOG_DRIVER      - Log driver (optional, default: "journald")
 #   DOCKER_SKIP_UPDATES    - Skip container update check (optional, "true" to skip)
 #
 # Features:
-#   - Uses stable distro packages by default
+#   - Uses official Docker repository by default
 #   - Migrates from get.docker.com to repository-based installation
 #   - Updates Docker Engine if newer version available
 #   - Interactive per-container update prompt (Y/N, 60 s auto-no)
@@ -4692,7 +4692,7 @@ _docker_is_noninteractive() {
 setup_docker() {
   local docker_installed=false
   local portainer_installed=false
-  local USE_DOCKER_REPO="${USE_DOCKER_REPO:-false}"
+  local USE_DOCKER_REPO="${USE_DOCKER_REPO:-true}"
 
   # Check if Docker is already installed
   if command -v docker &>/dev/null; then
@@ -4707,7 +4707,7 @@ setup_docker() {
     msg_info "Portainer container detected"
   fi
 
-  # Scenario 1: Use distro repository (default, most stable)
+  # Scenario 1: Use distro repository (opt-out via USE_DOCKER_REPO=false)
   if [[ "$USE_DOCKER_REPO" != "true" && "$USE_DOCKER_REPO" != "TRUE" && "$USE_DOCKER_REPO" != "1" ]]; then
 
     # Install or upgrade Docker from distro repo

From b36ad5c3a2db0c15a8df768e8e793ee51a776c4b Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Wed, 15 Jul 2026 19:37:39 +0000
Subject: [PATCH 137/220] Update CHANGELOG.md (#15804)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8b1550036..08054a113 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -515,6 +515,12 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
     - 2fauth: minor fixes for 8.0.0 [@MickLesk](https://github.com/MickLesk) ([#15795](https://github.com/community-scripts/ProxmoxVE/pull/15795))
     - SnapOtter: refactor update process to prebuild [@MickLesk](https://github.com/MickLesk) ([#15797](https://github.com/community-scripts/ProxmoxVE/pull/15797))
 
+### 💾 Core
+
+  - #### 🔧 Refactor
+
+    - tools.func: default Docker setup to official repo [@MickLesk](https://github.com/MickLesk) ([#15794](https://github.com/community-scripts/ProxmoxVE/pull/15794))
+
 ## 2026-07-14
 
 ### 🆕 New Scripts

From d23a2e64e7978d1318ff870927c2ac23cd7cedba Mon Sep 17 00:00:00 2001
From: MickLesk <mickey.leskowitz@gmail.com>
Date: Thu, 16 Jul 2026 09:01:53 +0200
Subject: [PATCH 138/220] migration snapotter

---
 ct/snapotter.sh              | 50 ++++++++++++++++++++++++++++++++++--
 install/snapotter-install.sh | 21 +++++++++++++--
 2 files changed, 67 insertions(+), 4 deletions(-)

diff --git a/ct/snapotter.sh b/ct/snapotter.sh
index f0293ad1d..ce2323f8f 100644
--- a/ct/snapotter.sh
+++ b/ct/snapotter.sh
@@ -30,12 +30,58 @@ function update_script() {
     exit
   fi
 
-  if check_for_gh_release "snapotter" "snapotter-hq/SnapOtter"; then
+  NEEDS_V2_MIGRATION=false
+  grep -q '^DB_PATH=' /opt/snapotter_data/.env 2>/dev/null && NEEDS_V2_MIGRATION=true
+  UPDATE_AVAILABLE=false
+  check_for_gh_release "snapotter" "snapotter-hq/SnapOtter" && UPDATE_AVAILABLE=true
+
+  if [[ "$NEEDS_V2_MIGRATION" == true || "$UPDATE_AVAILABLE" == true ]]; then
     msg_info "Stopping Service"
     systemctl stop snapotter
     msg_ok "Stopped Service"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "snapotter" "snapotter-hq/SnapOtter" "prebuild" "latest" "/opt/snapotter" "snapotter-*-linux-amd64.tar.gz"
+    PG_VERSION="17" setup_postgresql
+    if ! sudo -u postgres psql -tAc "SELECT 1 FROM pg_database WHERE datname = 'snapotter'" | grep -qx '1'; then
+      PG_DB_NAME="snapotter" PG_DB_USER="snapotter" setup_postgresql_db
+    else
+      PG_DB_NAME="snapotter"
+      PG_DB_USER="snapotter"
+      PG_DB_PASS=$(sed -n 's|^DATABASE_URL=postgres://snapotter:\([^@]*\)@.*|\1|p' /opt/snapotter_data/.env | head -n1)
+      if [[ -z "$PG_DB_PASS" ]]; then
+        msg_error "SnapOtter's PostgreSQL database exists, but its password is not available in /opt/snapotter_data/.env"
+        exit 1
+      fi
+    fi
+
+    msg_info "Installing Redis"
+    $STD apt install -y redis-server
+    if grep -q '^appendonly ' /etc/redis/redis.conf; then
+      sed -i 's/^appendonly .*/appendonly yes/' /etc/redis/redis.conf
+    else
+      echo 'appendonly yes' >>/etc/redis/redis.conf
+    fi
+    $STD systemctl enable --now redis-server
+    msg_ok "Installed Redis"
+
+    msg_info "Migrating SnapOtter Configuration"
+    sed -i '/^DB_PATH=/d; /^DATABASE_URL=/d; /^REDIS_URL=/d; /^SQLITE_MIGRATE_PATH=/d' /opt/snapotter_data/.env
+    cat <<EOF >>/opt/snapotter_data/.env
+DATABASE_URL=postgres://${PG_DB_USER}:${PG_DB_PASS}@127.0.0.1:5432/${PG_DB_NAME}
+REDIS_URL=redis://127.0.0.1:6379
+EOF
+    if [[ -f /opt/snapotter_data/snapotter.db ]]; then
+      echo 'SQLITE_MIGRATE_PATH=/opt/snapotter_data/snapotter.db' >>/opt/snapotter_data/.env
+    fi
+    if ! grep -q '^Requires=postgresql.service redis-server.service$' /etc/systemd/system/snapotter.service; then
+      sed -i '/^After=/c\After=network-online.target postgresql.service redis-server.service' /etc/systemd/system/snapotter.service
+      sed -i '/^\[Unit\]/a Wants=network-online.target\nRequires=postgresql.service redis-server.service' /etc/systemd/system/snapotter.service
+    fi
+    systemctl daemon-reload
+    msg_ok "Migrated SnapOtter Configuration"
+
+    if [[ "$UPDATE_AVAILABLE" == true ]]; then
+      CLEAN_INSTALL=1 fetch_and_deploy_gh_release "snapotter" "snapotter-hq/SnapOtter" "prebuild" "latest" "/opt/snapotter" "snapotter-*-linux-amd64.tar.gz"
+    fi
 
     msg_info "Updating SnapOtter"
     $STD uv python install 3.11
diff --git a/install/snapotter-install.sh b/install/snapotter-install.sh
index 7878c441a..b8330b7ca 100644
--- a/install/snapotter-install.sh
+++ b/install/snapotter-install.sh
@@ -39,6 +39,19 @@ msg_ok "Installed Dependencies"
 
 PYTHON_VERSION="3.11" setup_uv
 NODE_VERSION="22" NODE_MODULE="pnpm" setup_nodejs
+PG_VERSION="17" setup_postgresql
+PG_DB_NAME="snapotter" PG_DB_USER="snapotter" setup_postgresql_db
+
+msg_info "Installing Redis"
+$STD apt install -y redis-server
+if grep -q '^appendonly ' /etc/redis/redis.conf; then
+  sed -i 's/^appendonly .*/appendonly yes/' /etc/redis/redis.conf
+else
+  echo 'appendonly yes' >>/etc/redis/redis.conf
+fi
+$STD systemctl enable --now redis-server
+msg_ok "Installed Redis"
+
 fetch_and_deploy_gh_release "caire" "esimov/caire" "prebuild" "latest" "/usr/local/bin" "caire-*-linux-amd64.tar.gz"
 fetch_and_deploy_gh_release "snapotter" "snapotter-hq/SnapOtter" "prebuild" "latest" "/opt/snapotter" "snapotter-*-linux-amd64.tar.gz"
 
@@ -61,7 +74,8 @@ mkdir -p /tmp/snapotter-workspace
 cat <<EOF >/opt/snapotter_data/.env
 PORT=1349
 NODE_ENV=production
-DB_PATH=/opt/snapotter_data/snapotter.db
+DATABASE_URL=postgres://${PG_DB_USER}:${PG_DB_PASS}@127.0.0.1:5432/${PG_DB_NAME}
+REDIS_URL=redis://127.0.0.1:6379
 WORKSPACE_PATH=/tmp/snapotter-workspace
 FILES_STORAGE_PATH=/opt/snapotter_data/files
 PYTHON_VENV_PATH=/opt/snapotter_data/ai/venv
@@ -85,7 +99,9 @@ PNPM_BIN="$(command -v pnpm)"
 cat <<EOF >/etc/systemd/system/snapotter.service
 [Unit]
 Description=SnapOtter Service
-After=network.target
+Wants=network-online.target
+After=network-online.target postgresql.service redis-server.service
+Requires=postgresql.service redis-server.service
 
 [Service]
 Type=simple
@@ -99,6 +115,7 @@ RestartSec=5
 [Install]
 WantedBy=multi-user.target
 EOF
+systemctl daemon-reload
 systemctl enable -q --now snapotter
 msg_ok "Created Service"
 

From 5144f8d0cc82cc05ce0ce4d17563c9be6aac2974 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Thu, 16 Jul 2026 07:02:22 +0000
Subject: [PATCH 139/220] Update CHANGELOG.md (#15809)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 08054a113..571d939bb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -502,6 +502,8 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-07-16
+
 ## 2026-07-15
 
 ### 🆕 New Scripts

From c44789f5f6e734ad7f8c4cd5302da9a600802393 Mon Sep 17 00:00:00 2001
From: Chris <punk.sand7393@fastmail.com>
Date: Thu, 16 Jul 2026 03:30:38 -0400
Subject: [PATCH 140/220] Pin Immich to v3.0.3 (#15790)

---
 ct/immich.sh              | 2 +-
 install/immich-install.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/ct/immich.sh b/ct/immich.sh
index e72c4b7fe..1ea66f467 100644
--- a/ct/immich.sh
+++ b/ct/immich.sh
@@ -110,7 +110,7 @@ EOF
     msg_ok "Image-processing libraries up to date"
   fi
 
-  RELEASE="v3.0.2"
+  RELEASE="v3.0.3"
   if check_for_gh_release "Immich" "immich-app/immich" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
     if [[ $(cat ~/.immich) > "2.5.1" ]]; then
       msg_info "Enabling Maintenance Mode"
diff --git a/install/immich-install.sh b/install/immich-install.sh
index b75d4a7f2..688ae657e 100644
--- a/install/immich-install.sh
+++ b/install/immich-install.sh
@@ -312,7 +312,7 @@ ML_DIR="${APP_DIR}/machine-learning"
 GEO_DIR="${INSTALL_DIR}/geodata"
 mkdir -p {"${APP_DIR}","${UPLOAD_DIR}","${GEO_DIR}","${INSTALL_DIR}"/cache}
 
-fetch_and_deploy_gh_release "Immich" "immich-app/immich" "tarball" "v3.0.2" "$SRC_DIR"
+fetch_and_deploy_gh_release "Immich" "immich-app/immich" "tarball" "v3.0.3" "$SRC_DIR"
 PNPM_VERSION="$(jq -r '.packageManager | split("@")[1] | split("+")[0]' ${SRC_DIR}/package.json)"
 export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
 NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs

From b9f26d66ed5131bcded155ebb83784f303cf4355 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Thu, 16 Jul 2026 07:31:00 +0000
Subject: [PATCH 141/220] Update CHANGELOG.md (#15810)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 571d939bb..07e93f2cf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -504,6 +504,12 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ## 2026-07-16
 
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Pin Immich to v3.0.3 [@vhsdream](https://github.com/vhsdream) ([#15790](https://github.com/community-scripts/ProxmoxVE/pull/15790))
+
 ## 2026-07-15
 
 ### 🆕 New Scripts

From d122341a470838e6ecc8d8fdc678b460ae1e1c6e Mon Sep 17 00:00:00 2001
From: "push-app-to-main[bot]"
 <203845782+push-app-to-main[bot]@users.noreply.github.com>
Date: Thu, 16 Jul 2026 18:01:24 +1000
Subject: [PATCH 142/220] Add notediscovery (ct) (#15811)

Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com>
---
 ct/headers/notediscovery         |  6 +++
 ct/notediscovery.sh              | 64 ++++++++++++++++++++++++++++++++
 install/notediscovery-install.sh | 51 +++++++++++++++++++++++++
 3 files changed, 121 insertions(+)
 create mode 100644 ct/headers/notediscovery
 create mode 100644 ct/notediscovery.sh
 create mode 100644 install/notediscovery-install.sh

diff --git a/ct/headers/notediscovery b/ct/headers/notediscovery
new file mode 100644
index 000000000..df51d962d
--- /dev/null
+++ b/ct/headers/notediscovery
@@ -0,0 +1,6 @@
+    _   __      __       ____  _                                     
+   / | / /___  / /____  / __ \(_)_____________ _   _____  _______  __
+  /  |/ / __ \/ __/ _ \/ / / / / ___/ ___/ __ \ | / / _ \/ ___/ / / /
+ / /|  / /_/ / /_/  __/ /_/ / (__  ) /__/ /_/ / |/ /  __/ /  / /_/ / 
+/_/ |_/\____/\__/\___/_____/_/____/\___/\____/|___/\___/_/   \__, /  
+                                                            /____/   
diff --git a/ct/notediscovery.sh b/ct/notediscovery.sh
new file mode 100644
index 000000000..3b15fd0c7
--- /dev/null
+++ b/ct/notediscovery.sh
@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/gamosoft/NoteDiscovery
+
+APP="NoteDiscovery"
+var_tags="${var_tags:-notes;wiki;knowledge-base}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-512}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/notediscovery ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "notediscovery" "gamosoft/NoteDiscovery"; then
+    msg_info "Stopping Service"
+    systemctl stop notediscovery
+    msg_ok "Stopped Service"
+
+    create_backup /opt/notediscovery/data /opt/notediscovery/config.yaml
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "notediscovery" "gamosoft/NoteDiscovery" "tarball"
+
+    msg_info "Syncing Dependencies"
+    cd /opt/notediscovery
+    $STD uv sync --no-dev
+    msg_ok "Synced Dependencies"
+
+    restore_backup
+
+    msg_info "Starting Service"
+    systemctl start notediscovery
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8000${CL}"
diff --git a/install/notediscovery-install.sh b/install/notediscovery-install.sh
new file mode 100644
index 000000000..26687f8c6
--- /dev/null
+++ b/install/notediscovery-install.sh
@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/gamosoft/NoteDiscovery
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+setup_uv
+
+fetch_and_deploy_gh_release "notediscovery" "gamosoft/NoteDiscovery" "tarball"
+
+msg_info "Installing Dependencies"
+cd /opt/notediscovery
+$STD uv sync --no-dev
+msg_ok "Installed Dependencies"
+
+msg_info "Configuring NoteDiscovery"
+mkdir -p /opt/notediscovery/data
+msg_ok "Configured NoteDiscovery"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/notediscovery.service
+[Unit]
+Description=NoteDiscovery Knowledge Base
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/notediscovery
+ExecStart=/opt/notediscovery/.venv/bin/python /opt/notediscovery/run.py
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now notediscovery
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

From 9bb99c59c583d9c5306635da3a4365c79e82e460 Mon Sep 17 00:00:00 2001
From: "push-app-to-main[bot]"
 <203845782+push-app-to-main[bot]@users.noreply.github.com>
Date: Thu, 16 Jul 2026 18:01:44 +1000
Subject: [PATCH 143/220] Beaverhabits (#15813)

* Add beaverhabits (ct)

* Update URL to include '/register' path

---------

Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com>
Co-authored-by: CanbiZ (MickLesk) <47820557+MickLesk@users.noreply.github.com>
---
 ct/beaverhabits.sh              | 64 +++++++++++++++++++++++++++++++++
 ct/headers/beaverhabits         |  6 ++++
 install/beaverhabits-install.sh | 53 +++++++++++++++++++++++++++
 3 files changed, 123 insertions(+)
 create mode 100644 ct/beaverhabits.sh
 create mode 100644 ct/headers/beaverhabits
 create mode 100644 install/beaverhabits-install.sh

diff --git a/ct/beaverhabits.sh b/ct/beaverhabits.sh
new file mode 100644
index 000000000..168be42d4
--- /dev/null
+++ b/ct/beaverhabits.sh
@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/daya0576/beaverhabits
+
+APP="BeaverHabits"
+var_tags="${var_tags:-habits;tracking;productivity}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-1024}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/beaverhabits ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "beaverhabits" "daya0576/beaverhabits"; then
+    msg_info "Stopping Service"
+    systemctl stop beaverhabits
+    msg_ok "Stopped Service"
+
+    create_backup /opt/beaverhabits/.user
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "beaverhabits" "daya0576/beaverhabits" "tarball"
+
+    msg_info "Syncing Dependencies"
+    cd /opt/beaverhabits
+    $STD uv sync --no-dev
+    msg_ok "Synced Dependencies"
+
+    restore_backup
+
+    msg_info "Starting Service"
+    systemctl start beaverhabits
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8080/register{CL}"
diff --git a/ct/headers/beaverhabits b/ct/headers/beaverhabits
new file mode 100644
index 000000000..0a11d4242
--- /dev/null
+++ b/ct/headers/beaverhabits
@@ -0,0 +1,6 @@
+    ____                             __  __      __    _ __      
+   / __ )___  ____ __   _____  _____/ / / /___ _/ /_  (_) /______
+  / __  / _ \/ __ `/ | / / _ \/ ___/ /_/ / __ `/ __ \/ / __/ ___/
+ / /_/ /  __/ /_/ /| |/ /  __/ /  / __  / /_/ / /_/ / / /_(__  ) 
+/_____/\___/\__,_/ |___/\___/_/  /_/ /_/\__,_/_.___/_/\__/____/  
+                                                                 
diff --git a/install/beaverhabits-install.sh b/install/beaverhabits-install.sh
new file mode 100644
index 000000000..f58f4003a
--- /dev/null
+++ b/install/beaverhabits-install.sh
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/daya0576/beaverhabits
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+PYTHON_VERSION="3.14" setup_uv
+
+fetch_and_deploy_gh_release "beaverhabits" "daya0576/beaverhabits" "tarball"
+
+msg_info "Installing Dependencies"
+cd /opt/beaverhabits
+$STD uv sync --no-dev
+msg_ok "Installed Dependencies"
+
+msg_info "Configuring BeaverHabits"
+mkdir -p /opt/beaverhabits/.user
+msg_ok "Configured BeaverHabits"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/beaverhabits.service
+[Unit]
+Description=BeaverHabits Habit Tracker
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/beaverhabits
+Environment=HABITS_STORAGE=USER_DISK
+Environment=NICEGUI_STORAGE_PATH=/opt/beaverhabits/.user/.nicegui
+ExecStart=/opt/beaverhabits/.venv/bin/gunicorn beaverhabits.main:app --bind 0.0.0.0:8080 -w 1 -k uvicorn_worker.UvicornWorker --max-requests 10000 --log-level info
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now beaverhabits
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

From 6d6d66eec6f5110a223b9689da8c25b8e9e8ce0a Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Thu, 16 Jul 2026 08:01:53 +0000
Subject: [PATCH 144/220] Update CHANGELOG.md (#15814)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 07e93f2cf..5b7b02e1a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -504,6 +504,10 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ## 2026-07-16
 
+### 🆕 New Scripts
+
+  - Notediscovery ([#15811](https://github.com/community-scripts/ProxmoxVE/pull/15811))
+
 ### 🚀 Updated Scripts
 
   - #### 🐞 Bug Fixes

From 775f1a98c219784fc1da25da0cd74dbe3db990e6 Mon Sep 17 00:00:00 2001
From: "push-app-to-main[bot]"
 <203845782+push-app-to-main[bot]@users.noreply.github.com>
Date: Thu, 16 Jul 2026 18:02:13 +1000
Subject: [PATCH 145/220] Sync-In (#15812)

* Add sync-in (ct)

* remove empty lines

---------

Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com>
Co-authored-by: CanbiZ (MickLesk) <47820557+MickLesk@users.noreply.github.com>
---
 ct/headers/sync-in         |  6 +++
 ct/sync-in.sh              | 65 ++++++++++++++++++++++++++++++
 install/sync-in-install.sh | 82 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 153 insertions(+)
 create mode 100644 ct/headers/sync-in
 create mode 100644 ct/sync-in.sh
 create mode 100644 install/sync-in-install.sh

diff --git a/ct/headers/sync-in b/ct/headers/sync-in
new file mode 100644
index 000000000..f5ae41c66
--- /dev/null
+++ b/ct/headers/sync-in
@@ -0,0 +1,6 @@
+   _____                        _     
+  / ___/__  ______  _____      (_)___ 
+  \__ \/ / / / __ \/ ___/_____/ / __ \
+ ___/ / /_/ / / / / /__/_____/ / / / /
+/____/\__, /_/ /_/\___/     /_/_/ /_/ 
+     /____/                           
diff --git a/ct/sync-in.sh b/ct/sync-in.sh
new file mode 100644
index 000000000..4b43c6dd4
--- /dev/null
+++ b/ct/sync-in.sh
@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Sync-in/server
+
+APP="Sync-in"
+var_tags="${var_tags:-files;sync;collaboration}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-20}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/sync-in/node_modules/@sync-in ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "sync-in" "Sync-in/server"; then
+    msg_info "Stopping Service"
+    systemctl stop sync-in
+    msg_ok "Stopped Service"
+
+    msg_info "Updating Sync-in"
+    $STD npm install --prefix /opt/sync-in "@sync-in/server@${CHECK_UPDATE_RELEASE#v}"
+    msg_ok "Updated Sync-in"
+
+    msg_info "Running Database Migrations"
+    cd /opt/sync-in
+    $STD npx sync-in-server migrate-db
+    msg_ok "Ran Database Migrations"
+
+    VERSION=$(node -pe "require('/opt/sync-in/node_modules/@sync-in/server/package.json').version" 2>/dev/null || echo "")
+    [[ -n "$VERSION" ]] && echo "$VERSION" >~/.sync-in
+
+    msg_info "Starting Service"
+    systemctl start sync-in
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8080${CL}"
diff --git a/install/sync-in-install.sh b/install/sync-in-install.sh
new file mode 100644
index 000000000..0550fecca
--- /dev/null
+++ b/install/sync-in-install.sh
@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Sync-in/server
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+NODE_VERSION="22" setup_nodejs
+setup_mariadb
+MARIADB_DB_NAME="sync_in" MARIADB_DB_USER="sync_in" setup_mariadb_db
+
+msg_info "Installing Sync-in"
+mkdir -p /opt/sync-in/data
+$STD npm install --prefix /opt/sync-in @sync-in/server
+msg_ok "Installed Sync-in"
+
+msg_info "Configuring Sync-in"
+ENCRYPT_KEY=$(openssl rand -hex 32)
+ACCESS_SECRET=$(openssl rand -hex 32)
+REFRESH_SECRET=$(openssl rand -hex 32)
+cat <<EOF >/opt/sync-in/environment.yaml
+server:
+  port: 8080
+mysql:
+  url: 'mysql://${MARIADB_DB_USER}:${MARIADB_DB_PASS}@localhost:3306/${MARIADB_DB_NAME}'
+auth:
+  encryptionKey: '${ENCRYPT_KEY}'
+  token:
+    access:
+      secret: '${ACCESS_SECRET}'
+    refresh:
+      secret: '${REFRESH_SECRET}'
+applications:
+  files:
+    dataPath: '/opt/sync-in/data'
+EOF
+msg_ok "Configured Sync-in"
+
+msg_info "Running Database Migrations"
+cd /opt/sync-in
+$STD npx sync-in-server migrate-db
+msg_ok "Ran Database Migrations"
+
+msg_info "Creating Admin User"
+cd /opt/sync-in
+$STD npx sync-in-server create-user
+msg_ok "Created Admin User"
+
+VERSION=$(node -pe "require('/opt/sync-in/node_modules/@sync-in/server/package.json').version" 2>/dev/null || echo "")
+[[ -n "$VERSION" ]] && echo "$VERSION" >~/.sync-in
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/sync-in.service
+[Unit]
+Description=Sync-in Server
+After=network.target mariadb.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/sync-in
+ExecStart=/opt/sync-in/node_modules/.bin/sync-in-server start
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now sync-in
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

From 12dec08523df35d0a2ff82f83f9e676d4556e8b7 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Thu, 16 Jul 2026 08:02:15 +0000
Subject: [PATCH 146/220] Update CHANGELOG.md (#15815)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5b7b02e1a..46862da55 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -506,7 +506,8 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ### 🆕 New Scripts
 
-  - Notediscovery ([#15811](https://github.com/community-scripts/ProxmoxVE/pull/15811))
+  - Beaverhabits ([#15813](https://github.com/community-scripts/ProxmoxVE/pull/15813))
+- Notediscovery ([#15811](https://github.com/community-scripts/ProxmoxVE/pull/15811))
 
 ### 🚀 Updated Scripts
 

From 04a84f505242ebf5c1ce1d91d0a6e928ea179ab5 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Thu, 16 Jul 2026 10:28:25 +0200
Subject: [PATCH 147/220] Update CHANGELOG.md (#15816)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Sam Heinz <sam@samheinz.com>
---
 CHANGELOG.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 46862da55..f4262df4f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -506,8 +506,9 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ### 🆕 New Scripts
 
+  - Sync-In ([#15812](https://github.com/community-scripts/ProxmoxVE/pull/15812))
   - Beaverhabits ([#15813](https://github.com/community-scripts/ProxmoxVE/pull/15813))
-- Notediscovery ([#15811](https://github.com/community-scripts/ProxmoxVE/pull/15811))
+  - Notediscovery ([#15811](https://github.com/community-scripts/ProxmoxVE/pull/15811))
 
 ### 🚀 Updated Scripts
 

From 772430de7e101ddc47bbcd75de047550045e478a Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Thu, 16 Jul 2026 08:28:51 +0000
Subject: [PATCH 148/220] Update CHANGELOG.md (#15818)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f4262df4f..51cae93c6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -507,8 +507,8 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 ### 🆕 New Scripts
 
   - Sync-In ([#15812](https://github.com/community-scripts/ProxmoxVE/pull/15812))
-  - Beaverhabits ([#15813](https://github.com/community-scripts/ProxmoxVE/pull/15813))
-  - Notediscovery ([#15811](https://github.com/community-scripts/ProxmoxVE/pull/15811))
+- Beaverhabits ([#15813](https://github.com/community-scripts/ProxmoxVE/pull/15813))
+- Notediscovery ([#15811](https://github.com/community-scripts/ProxmoxVE/pull/15811))
 
 ### 🚀 Updated Scripts
 

From e15db754a633e997b6ac6d4b7fb0b438bb122768 Mon Sep 17 00:00:00 2001
From: Michel Roegl-Brunner <michel.roegl-brunner@htl-braunau.at>
Date: Thu, 16 Jul 2026 11:44:55 +0200
Subject: [PATCH 149/220] github: close PRs that do not follow the PR template

Add a workflow that validates description, prerequisites, and type-of-change checkboxes, with exemptions for bots, maintainers, and the keep open label.
---
 .../workflows/close-invalid-pr-template.yml   | 163 ++++++++++++++++++
 1 file changed, 163 insertions(+)
 create mode 100644 .github/workflows/close-invalid-pr-template.yml

diff --git a/.github/workflows/close-invalid-pr-template.yml b/.github/workflows/close-invalid-pr-template.yml
new file mode 100644
index 000000000..ce4c9a1bb
--- /dev/null
+++ b/.github/workflows/close-invalid-pr-template.yml
@@ -0,0 +1,163 @@
+name: Close PRs Missing Template
+
+on:
+  pull_request_target:
+    branches: ["main"]
+    types: [opened, edited, reopened, synchronize, labeled]
+
+jobs:
+  validate-pr-template:
+    if: github.repository == 'community-scripts/ProxmoxVE'
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+      issues: write
+      contents: read
+    steps:
+      - name: Close PR if it does not follow the PR template
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const pr = context.payload.pull_request;
+            const prNumber = pr.number;
+            const author = pr.user.login;
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+
+            const allowedBots = [
+              "push-app-to-main[bot]",
+              "push-app-to-main",
+              "community-scripts-pr-app",
+              "github-actions[bot]",
+              "dependabot[bot]",
+            ];
+
+            if (allowedBots.includes(author) || author.endsWith("[bot]")) {
+              core.info(`PR #${prNumber} by bot "${author}" — skipping template validation.`);
+              return;
+            }
+
+            const association = pr.author_association;
+            const exemptAssociations = ["OWNER", "MEMBER", "COLLABORATOR"];
+            if (exemptAssociations.includes(association)) {
+              core.info(`PR #${prNumber} by ${association} "${author}" — skipping template validation.`);
+              return;
+            }
+
+            const labels = pr.labels.map((label) => label.name);
+            const skipLabels = ["automated pr", "keep open"];
+
+            if (skipLabels.some((label) => labels.includes(label))) {
+              core.info(`PR #${prNumber} has a skip label (${labels.join(", ")}) — skipping template validation.`);
+              return;
+            }
+
+            if (pr.draft) {
+              core.info(`PR #${prNumber} is a draft — skipping template validation.`);
+              return;
+            }
+
+            const body = pr.body || "";
+            const failures = [];
+
+            const requiredSections = [
+              "## ✍️ Description",
+              "## ✅ Prerequisites",
+              "## 🛠️ Type of Change",
+            ];
+
+            for (const section of requiredSections) {
+              if (!body.includes(section)) {
+                failures.push(`Missing required section: \`${section}\``);
+              }
+            }
+
+            const descriptionMatch = body.match(
+              /## ✍️ Description\s*\n+([\s\S]*?)(?=\n## )/i
+            );
+            const description = (descriptionMatch?.[1] || "").trim();
+            if (!description) {
+              failures.push("The **Description** section is empty.");
+            }
+
+            const prerequisiteCheckboxes = [
+              "**Self-review completed**",
+              "**Tested thoroughly**",
+              "**No security risks**",
+            ];
+
+            for (const checkbox of prerequisiteCheckboxes) {
+              const escaped = checkbox.replace(/([.*+?^=!:${}()|[\]\/\\])/g, "\\$1");
+              const regex = new RegExp(`- \\[(x|X)\\]\\s*${escaped}`, "i");
+              if (!regex.test(body)) {
+                failures.push(`Prerequisite not checked: ${checkbox}`);
+              }
+            }
+
+            const typeOfChangeCheckboxes = [
+              "🐞 **Bug fix**",
+              "✨ **New feature**",
+              "💥 **Breaking change**",
+              "🆕 **New script**",
+              "🌍 **Website update**",
+              "🔧 **Refactoring / Code Cleanup**",
+              "📝 **Documentation update**",
+            ];
+
+            const hasTypeChecked = typeOfChangeCheckboxes.some((checkbox) => {
+              const escaped = checkbox.replace(/([.*+?^=!:${}()|[\]\/\\])/g, "\\$1");
+              const regex = new RegExp(`- \\[(x|X)\\]\\s*${escaped}`, "i");
+              return regex.test(body);
+            });
+
+            if (!hasTypeChecked) {
+              failures.push("At least one **Type of Change** checkbox must be checked.");
+            }
+
+            if (failures.length === 0) {
+              core.info(`PR #${prNumber} follows the PR template.`);
+              return;
+            }
+
+            core.info(`Closing PR #${prNumber} — template validation failed.`);
+
+            const templateUrl =
+              "https://github.com/community-scripts/ProxmoxVE/blob/main/.github/pull_request_template.md";
+            const failureList = failures.map((item) => `- ${item}`).join("\n");
+
+            const comment = [
+              `👋 Hi @${author},`,
+              ``,
+              `This pull request was closed because it does not follow the [PR template](${templateUrl}).`,
+              ``,
+              `Please fix the following and open a new PR (or reopen this one after updating the description):`,
+              ``,
+              failureList,
+              ``,
+              `> Use the template sections, fill in the description, check all prerequisite boxes, and select at least one type of change.`,
+              ``,
+              `Maintainers can add the \`keep open\` label to exempt a PR from this check.`,
+              ``,
+              `Thank you for contributing! 🙏`,
+            ].join("\n");
+
+            await github.rest.issues.createComment({
+              owner,
+              repo,
+              issue_number: prNumber,
+              body: comment,
+            });
+
+            await github.rest.pulls.update({
+              owner,
+              repo,
+              pull_number: prNumber,
+              state: "closed",
+            });
+
+            await github.rest.issues.addLabels({
+              owner,
+              repo,
+              issue_number: prNumber,
+              labels: ["missing pr template"],
+            });

From 8655282c2dd0ced0be15bc37b07adbc7ef818fb0 Mon Sep 17 00:00:00 2001
From: soupy-boy <50962850+soupy-boy@users.noreply.github.com>
Date: Fri, 17 Jul 2026 00:43:05 -0600
Subject: [PATCH 150/220] autoremove and autoclean after apt full-upgrade
 (#15831)

---
 tools/pve/update-lxcs.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/pve/update-lxcs.sh b/tools/pve/update-lxcs.sh
index 52e9d2528..e083a4fc2 100644
--- a/tools/pve/update-lxcs.sh
+++ b/tools/pve/update-lxcs.sh
@@ -78,7 +78,7 @@ function update_container() {
   alpine) pct exec "$container" -- ash -c "apk -U upgrade" ;;
   archlinux) pct exec "$container" -- bash -c "pacman -Syyu --noconfirm" ;;
   fedora | rocky | centos | alma) pct exec "$container" -- bash -c "dnf -y update && dnf -y upgrade" ;;
-  ubuntu | debian | devuan) pct exec "$container" -- bash -c "apt-get update 2>/dev/null | grep 'packages.*upgraded'; apt list --upgradable 2>/dev/null | cat && apt-get -yq dist-upgrade 2>&1; rm -rf /usr/lib/python3.*/EXTERNALLY-MANAGED || true" ;;
+  ubuntu | debian | devuan) pct exec "$container" -- bash -c "apt-get update 2>/dev/null | grep 'packages.*upgraded'; apt list --upgradable 2>/dev/null | cat && apt-get -yq dist-upgrade 2>&1; apt-get -yq autoremove 2>&1; apt-get -yq autoclean 2>&1; rm -rf /usr/lib/python3.*/EXTERNALLY-MANAGED || true" ;;
   opensuse) pct exec "$container" -- bash -c "zypper ref && zypper --non-interactive dup" ;;
   esac
 }

From a51e1f37f5c33909ebab38a43b0a19cea38a903b Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Fri, 17 Jul 2026 06:43:31 +0000
Subject: [PATCH 151/220] Update CHANGELOG.md (#15836)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 51cae93c6..a3b11f22a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -502,6 +502,14 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-07-17
+
+### 🧰 Tools
+
+  - #### ✨ New Features
+
+    - update-lxc: autoremove and autoclean after apt full-upgrade [@soupy-boy](https://github.com/soupy-boy) ([#15831](https://github.com/community-scripts/ProxmoxVE/pull/15831))
+
 ## 2026-07-16
 
 ### 🆕 New Scripts

From 55002839fb966a65212995bdd5502fb1c7ee697c Mon Sep 17 00:00:00 2001
From: Chris <punk.sand7393@fastmail.com>
Date: Fri, 17 Jul 2026 03:00:32 -0400
Subject: [PATCH 152/220] Pin Opencloud to v7.3.0 (#15826)

---
 ct/opencloud.sh              | 2 +-
 install/opencloud-install.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/ct/opencloud.sh b/ct/opencloud.sh
index 0ce6d9291..51485fec3 100644
--- a/ct/opencloud.sh
+++ b/ct/opencloud.sh
@@ -30,7 +30,7 @@ function update_script() {
     exit
   fi
 
-  RELEASE="v7.2.2"
+  RELEASE="v7.3.0"
   if check_for_gh_release "OpenCloud" "opencloud-eu/opencloud" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
     msg_info "Stopping services"
     systemctl stop opencloud opencloud-wopi
diff --git a/install/opencloud-install.sh b/install/opencloud-install.sh
index f3f1bc93b..d0cb26994 100644
--- a/install/opencloud-install.sh
+++ b/install/opencloud-install.sh
@@ -64,7 +64,7 @@ $STD sudo -u cool coolconfig set-admin-password --user=admin --password="$COOLPA
 echo "$COOLPASS" >~/.coolpass
 msg_ok "Installed Collabora Online"
 
-fetch_and_deploy_gh_release "OpenCloud" "opencloud-eu/opencloud" "singlefile" "v7.2.2" "/usr/bin" "opencloud-*-linux-$(arch_resolve)"
+fetch_and_deploy_gh_release "OpenCloud" "opencloud-eu/opencloud" "singlefile" "v7.3.0" "/usr/bin" "opencloud-*-linux-$(arch_resolve)"
 mv /usr/bin/OpenCloud /usr/bin/opencloud
 
 msg_info "Configuring OpenCloud"

From 3f90af2a214d8bfc2ec9b1d27fcb2c7495fb3a01 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Fri, 17 Jul 2026 07:00:56 +0000
Subject: [PATCH 153/220] Update CHANGELOG.md (#15839)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a3b11f22a..836222dbc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -504,6 +504,12 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ## 2026-07-17
 
+### 🚀 Updated Scripts
+
+  - #### ✨ New Features
+
+    - Pin Opencloud to v7.3.0 [@vhsdream](https://github.com/vhsdream) ([#15826](https://github.com/community-scripts/ProxmoxVE/pull/15826))
+
 ### 🧰 Tools
 
   - #### ✨ New Features

From 5d4eff049323476e96e192b5d9fde03c8ffecd52 Mon Sep 17 00:00:00 2001
From: Michel Roegl-Brunner
 <73236783+michelroegl-brunner@users.noreply.github.com>
Date: Fri, 17 Jul 2026 11:59:05 +0200
Subject: [PATCH 154/220] fix(esphome): install libusb-1.0-0 for ESP-IDF native
 builds (#15838)

ESPHome 2026.7.0 validates openocd-esp32 during native ESP-IDF setup, which requires libusb-1.0.so.0. Add the runtime package to install and update paths.

Fixes #15835
---
 ct/esphome.sh              | 1 +
 install/esphome-install.sh | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/ct/esphome.sh b/ct/esphome.sh
index 4dcf1ea06..086be0e83 100644
--- a/ct/esphome.sh
+++ b/ct/esphome.sh
@@ -28,6 +28,7 @@ function update_script() {
     msg_error "No ${APP} Installation Found!"
     exit
   fi
+  ensure_dependencies libusb-1.0-0
 
   msg_info "Stopping Service"
   systemctl stop esphome-device-builder 2>/dev/null || true
diff --git a/install/esphome-install.sh b/install/esphome-install.sh
index 1b5b7367d..02c46b155 100644
--- a/install/esphome-install.sh
+++ b/install/esphome-install.sh
@@ -14,7 +14,8 @@ network_check
 update_os
 
 msg_info "Installing Dependencies"
-$STD apt install -y git
+$STD apt install -y git \
+  libusb-1.0-0
 msg_ok "Installed Dependencies"
 
 PYTHON_VERSION="3.12" setup_uv

From c991a7eccf5ab4fdf8c50ea4f2bbb6db42b4be9d Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Fri, 17 Jul 2026 09:59:30 +0000
Subject: [PATCH 155/220] Update CHANGELOG.md (#15843)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 836222dbc..4f39a7fa8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -506,6 +506,10 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ### 🚀 Updated Scripts
 
+  - #### 🐞 Bug Fixes
+
+    - esphome: install libusb-1.0-0 for ESP-IDF native builds [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15838](https://github.com/community-scripts/ProxmoxVE/pull/15838))
+
   - #### ✨ New Features
 
     - Pin Opencloud to v7.3.0 [@vhsdream](https://github.com/vhsdream) ([#15826](https://github.com/community-scripts/ProxmoxVE/pull/15826))

From 271df3c3fb8a02c755470264d3693bfdd935589c Mon Sep 17 00:00:00 2001
From: Michel Roegl-Brunner
 <73236783+michelroegl-brunner@users.noreply.github.com>
Date: Fri, 17 Jul 2026 12:18:36 +0200
Subject: [PATCH 156/220] feat(build.func): notify users when already on a
 pinned script version (#15819)

Query PocketBase pinned_version/pin_reason during LXC updates and show an informational message when the installed version matches the pin, so users know not to open issues for missing newer updates.
---
 misc/build.func | 35 +++++++++++++++++++++++++++++------
 1 file changed, 29 insertions(+), 6 deletions(-)

diff --git a/misc/build.func b/misc/build.func
index 93fced258..53509780f 100644
--- a/misc/build.func
+++ b/misc/build.func
@@ -3753,18 +3753,19 @@ run_addon_updates() {
 }
 
 runtime_script_status_guard() {
+  local mode="${1:-}"
   local script_slug="${SCRIPT_SLUG:-${NSAPP:-}}"
   script_slug="$(echo "$script_slug" | tr '[:upper:]' '[:lower:]' | tr ' ' '-')"
   [[ -z "$script_slug" ]] && return 0
 
-  local api_url="https://db.community-scripts.org/api/collections/script_scripts/records?filter=(slug='${script_slug}')&perPage=1&fields=slug,is_disabled,is_deleted,disable_message,deleted_message"
+  local api_url="https://db.community-scripts.org/api/collections/script_scripts/records?filter=(slug='${script_slug}')&perPage=1&fields=slug,is_disabled,is_deleted,disable_message,deleted_message,pinned_version,pin_reason"
   local response
   if ! response=$(curl -fsSL --connect-timeout 2 --max-time 3 "$api_url" 2>/dev/null); then
     msg_warn "Script status check is unavailable. Continuing without status verification."
     return 0
   fi
 
-  local is_deleted is_disabled deleted_message disable_message info_url
+  local is_deleted is_disabled deleted_message disable_message pinned_version pin_reason info_url
   if printf '%s' "$response" | grep -qE '"items":[[:space:]]*\[[[:space:]]*\]'; then
     return 0
   fi
@@ -3774,6 +3775,8 @@ runtime_script_status_guard() {
   is_disabled=$(printf '%s' "$response" | sed -n 's/.*"is_disabled"[[:space:]]*:[[:space:]]*\(true\|false\).*/\1/p' | head -1)
   deleted_message=$(printf '%s' "$response" | sed -n 's/.*"deleted_message"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -1)
   disable_message=$(printf '%s' "$response" | sed -n 's/.*"disable_message"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -1)
+  pinned_version=$(printf '%s' "$response" | sed -n 's/.*"pinned_version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -1)
+  pin_reason=$(printf '%s' "$response" | sed -n 's/.*"pin_reason"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -1)
   is_deleted=${is_deleted:-false}
   is_disabled=${is_disabled:-false}
   info_url="https://community-scripts.org/scripts/${script_slug}"
@@ -3805,6 +3808,26 @@ runtime_script_status_guard() {
     return 1
   fi
 
+  if [[ "$mode" == "update" && -n "$pinned_version" && -n "${NSAPP:-}" ]]; then
+    local current_file="$HOME/.${NSAPP}"
+    if [[ -f "$current_file" ]]; then
+      local installed pinned_clean installed_clean
+      installed="$(<"$current_file")"
+      pinned_clean="$pinned_version"
+      installed_clean="$installed"
+      [[ "$pinned_clean" =~ ^v[0-9] ]] && pinned_clean="${pinned_clean:1}"
+      [[ "$installed_clean" =~ ^v[0-9] ]] && installed_clean="${installed_clean:1}"
+      if [[ "$installed_clean" == "$pinned_clean" ]]; then
+        if [[ -n "$pin_reason" ]]; then
+          msg_info "You are already on the pinned version (${pinned_version}). ${pin_reason}"
+        else
+          msg_info "You are already on the pinned version (${pinned_version}). No newer update is offered intentionally — please do not open an issue unless you see an actual error."
+        fi
+        msg_info "More info: ${info_url}"
+      fi
+    fi
+  fi
+
   return 0
 }
 
@@ -3820,7 +3843,7 @@ runtime_script_status_guard() {
 start() {
   source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/tools.func)
   if command -v pveversion >/dev/null 2>&1; then
-    runtime_script_status_guard || return 0
+    runtime_script_status_guard install || return 0
     install_script || return 0
     return 0
   elif [ ! -z ${PHS_SILENT+x} ] && [[ "${PHS_SILENT}" == "1" ]]; then
@@ -3828,7 +3851,7 @@ start() {
     set_std_mode
     ensure_profile_loaded
     get_lxc_ip
-    runtime_script_status_guard || return 0
+    runtime_script_status_guard update || return 0
     update_script
     run_addon_updates
     update_motd_ip
@@ -3839,7 +3862,7 @@ start() {
     set_std_mode
     ensure_profile_loaded
     get_lxc_ip
-    runtime_script_status_guard || return 0
+    runtime_script_status_guard update || return 0
     update_script
     run_addon_updates
     update_motd_ip
@@ -3869,7 +3892,7 @@ start() {
     esac
     ensure_profile_loaded
     get_lxc_ip
-    runtime_script_status_guard || return 0
+    runtime_script_status_guard update || return 0
     update_script
     run_addon_updates
     update_motd_ip

From f119e8782a74484ae2bfd84801d212a43cd814a2 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Fri, 17 Jul 2026 10:18:59 +0000
Subject: [PATCH 157/220] Update CHANGELOG.md (#15844)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4f39a7fa8..e16f9052e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -514,6 +514,12 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
     - Pin Opencloud to v7.3.0 [@vhsdream](https://github.com/vhsdream) ([#15826](https://github.com/community-scripts/ProxmoxVE/pull/15826))
 
+### 💾 Core
+
+  - #### ✨ New Features
+
+    - feat(build.func): notify users when already on a pinned script version [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15819](https://github.com/community-scripts/ProxmoxVE/pull/15819))
+
 ### 🧰 Tools
 
   - #### ✨ New Features

From 7bf45d5b6601e5b8896cd2a2ebbf0fa3105a1055 Mon Sep 17 00:00:00 2001
From: MickLesk <mickey.leskowitz@gmail.com>
Date: Fri, 17 Jul 2026 12:49:24 +0200
Subject: [PATCH 158/220] fix stupid branch delete bot

---
 .github/workflows/delete-merged-branches.yml | 24 ++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/.github/workflows/delete-merged-branches.yml b/.github/workflows/delete-merged-branches.yml
index aafaf2b44..09a9f8ab1 100644
--- a/.github/workflows/delete-merged-branches.yml
+++ b/.github/workflows/delete-merged-branches.yml
@@ -91,6 +91,30 @@ jobs:
             let skipped = 0;
 
             for (const branch of candidates) {
+              // A branch name can be reused after an earlier PR was merged. Never delete a
+              // branch while it is the head of a current open PR, even if it is also a
+              // candidate from an older merged PR.
+              try {
+                const { data: openPrs } = await github.rest.pulls.list({
+                  owner,
+                  repo,
+                  state: "open",
+                  head: `${owner}:${branch}`,
+                  per_page: 1,
+                });
+
+                if (openPrs.length > 0) {
+                  console.log(`Skipped "${branch}" (head of open PR #${openPrs[0].number})`);
+                  skipped++;
+                  continue;
+                }
+              } catch (error) {
+                // Do not risk deleting a branch if GitHub cannot confirm it has no open PR.
+                console.log(`Failed to check open PRs for "${branch}": ${error.message}`);
+                skipped++;
+                continue;
+              }
+
               // Confirm the branch still exists and isn't protected.
               let branchData;
               try {

From abc31499a2228db9b6cbfee457703d85544c9452 Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Fri, 17 Jul 2026 12:52:57 +0200
Subject: [PATCH 159/220] n8n: unpin / use latest release (#15817)

* n8n: unpin / use latest release

startup issue is fixed, so unpin and set to latest release

* Update n8n installation to latest version
---
 ct/n8n.sh              | 2 +-
 install/n8n-install.sh | 3 +--
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/ct/n8n.sh b/ct/n8n.sh
index 8f9cb483b..658a19b6c 100644
--- a/ct/n8n.sh
+++ b/ct/n8n.sh
@@ -45,7 +45,7 @@ EOF
     systemctl daemon-reload
   fi
 
-  $STD npm install -g n8n@2.27.5
+  $STD npm install -g n8n@latest
   systemctl restart n8n
   msg_ok "Updated n8n"
   msg_ok "Updated successfully!"
diff --git a/install/n8n-install.sh b/install/n8n-install.sh
index 8ddf37d0b..c6f0d421a 100644
--- a/install/n8n-install.sh
+++ b/install/n8n-install.sh
@@ -16,7 +16,6 @@ update_os
 msg_info "Installing Dependencies"
 $STD apt install -y \
   build-essential \
-  python3 \
   python3-setuptools \
   graphicsmagick
 msg_ok "Installed Dependencies"
@@ -24,7 +23,7 @@ msg_ok "Installed Dependencies"
 NODE_VERSION="24" setup_nodejs
 
 msg_info "Installing n8n (Patience)"
-$STD npm install -g n8n@2.27.5
+$STD npm install -g n8n@latest
 msg_ok "Installed n8n"
 
 msg_info "Creating Service"

From 373ae7e143ce9d4411cb43e28133134b3098c606 Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Fri, 17 Jul 2026 12:53:05 +0200
Subject: [PATCH 160/220] MongoDB: Implement kernel version check and patch
 (#15821)

---
 misc/tools.func | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/misc/tools.func b/misc/tools.func
index 82f87ffea..c80a879d8 100644
--- a/misc/tools.func
+++ b/misc/tools.func
@@ -7431,6 +7431,18 @@ setup_mongodb() {
   mkdir -p /var/lib/mongodb
   chown -R mongodb:mongodb /var/lib/mongodb
 
+  local KERNEL_VERSION MONGO_MAJOR
+  KERNEL_VERSION=$(uname -r | cut -d- -f1)
+  MONGO_MAJOR="${MONGO_VERSION%%.*}"
+  if ((MONGO_MAJOR >= 8)) && [[ "$(printf '%s\n' "6.19" "$KERNEL_VERSION" | sort -V | head -n1)" == "6.19" ]]; then
+    mkdir -p /etc/systemd/system/mongod.service.d
+    cat <<EOF >/etc/systemd/system/mongod.service.d/rseq.conf
+[Service]
+Environment=GLIBC_TUNABLES=glibc.pthread.rseq=1
+EOF
+    systemctl daemon-reload
+  fi
+
   $STD systemctl enable mongod || {
     msg_warn "Failed to enable mongod service"
   }

From 7c7d40cfe3f4a22137e087738f04f0fd3cff5407 Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Fri, 17 Jul 2026 12:53:13 +0200
Subject: [PATCH 161/220] tools.func: enhance rbenv with profile updates /
 bundle in bashrc (#15822)

* tools.func: enhance rbenv with profile updates / bundle in bashrc

Added checks to update shell profile files for rbenv integration and removed redundant profile setup code.

* Refactor Ruby version installation script

* Fix comment formatting in tools.func
---
 misc/tools.func | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/misc/tools.func b/misc/tools.func
index c80a879d8..adb7a5ac4 100644
--- a/misc/tools.func
+++ b/misc/tools.func
@@ -8689,6 +8689,7 @@ setup_postgresql_db() {
   export PG_DB_USER
   export PG_DB_PASS
 }
+
 # ------------------------------------------------------------------------------
 # Installs rbenv and ruby-build, installs Ruby and optionally Rails.
 #
@@ -8708,8 +8709,26 @@ setup_ruby() {
   local RBENV_DIR="$HOME/.rbenv"
   local RBENV_BIN="$RBENV_DIR/bin/rbenv"
   local PROFILE_FILE="$HOME/.profile"
+  local BASH_PROFILE_FILE="$HOME/.bash_profile"
+  local BASHRC_FILE="$HOME/.bashrc"
   local TMP_DIR=$(mktemp -d)
 
+  if ! grep -q 'rbenv init' "$PROFILE_FILE" 2>/dev/null; then
+    cat <<'EOF' >>"$PROFILE_FILE"
+export PATH="$HOME/.rbenv/bin:$PATH"
+eval "$(rbenv init -)"
+EOF
+  fi
+  if ! grep -q '.rbenv/shims' "$PROFILE_FILE" 2>/dev/null; then
+    echo 'export PATH="$HOME/.rbenv/shims:$HOME/.rbenv/bin:$PATH"' >>"$PROFILE_FILE"
+  fi
+  if [[ -f "$BASH_PROFILE_FILE" ]] && ! grep -q '.rbenv/shims' "$BASH_PROFILE_FILE"; then
+    echo 'export PATH="$HOME/.rbenv/shims:$HOME/.rbenv/bin:$PATH"' >>"$BASH_PROFILE_FILE"
+  fi
+  if [[ -f "$BASHRC_FILE" ]] && ! grep -q '.rbenv/shims' "$BASHRC_FILE"; then
+    echo 'export PATH="$HOME/.rbenv/shims:$HOME/.rbenv/bin:$PATH"' >>"$BASHRC_FILE"
+  fi
+
   # Get currently installed Ruby version
   local CURRENT_RUBY_VERSION=""
   if [[ -x "$RBENV_BIN" ]]; then

From 853f5e868a231519da977c04b01dedc7d1360e25 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Fri, 17 Jul 2026 10:53:20 +0000
Subject: [PATCH 162/220] Update CHANGELOG.md (#15846)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e16f9052e..0721bdd1e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -512,6 +512,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### ✨ New Features
 
+    - n8n: unpin / use latest release [@MickLesk](https://github.com/MickLesk) ([#15817](https://github.com/community-scripts/ProxmoxVE/pull/15817))
     - Pin Opencloud to v7.3.0 [@vhsdream](https://github.com/vhsdream) ([#15826](https://github.com/community-scripts/ProxmoxVE/pull/15826))
 
 ### 💾 Core
@@ -520,6 +521,10 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
     - feat(build.func): notify users when already on a pinned script version [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15819](https://github.com/community-scripts/ProxmoxVE/pull/15819))
 
+  - #### 💥 Breaking Changes
+
+    - MongoDB: Implement kernel version check and patch [@MickLesk](https://github.com/MickLesk) ([#15821](https://github.com/community-scripts/ProxmoxVE/pull/15821))
+
 ### 🧰 Tools
 
   - #### ✨ New Features

From 8f2b68ed7e577f362390330f85f9c1aeeda86b12 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Fri, 17 Jul 2026 10:53:42 +0000
Subject: [PATCH 163/220] Update CHANGELOG.md (#15847)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0721bdd1e..9471d1a73 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -519,6 +519,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### ✨ New Features
 
+    - tools.func: enhance rbenv with profile updates / bundle in bashrc [@MickLesk](https://github.com/MickLesk) ([#15822](https://github.com/community-scripts/ProxmoxVE/pull/15822))
     - feat(build.func): notify users when already on a pinned script version [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15819](https://github.com/community-scripts/ProxmoxVE/pull/15819))
 
   - #### 💥 Breaking Changes

From 79cee47df6682d044f53b8683bebe272af02696f Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Fri, 17 Jul 2026 14:29:59 +0200
Subject: [PATCH 164/220] SFTPGo: Update APT Repo & Re-Enable Script (#15829)

* SFTPGo: Update APT Repo & Re-Enable Script

* Update sftpgo.sh
---
 ct/sftpgo.sh              | 6 ++++++
 install/sftpgo-install.sh | 4 ++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/ct/sftpgo.sh b/ct/sftpgo.sh
index d96f013d2..5c6a79adf 100644
--- a/ct/sftpgo.sh
+++ b/ct/sftpgo.sh
@@ -28,6 +28,12 @@ function update_script() {
     msg_error "No ${APP} Installation Found!"
     exit
   fi
+
+  setup_deb822_repo \
+  "sftpgo" \
+  "https://oss.sftpgo.com/apt/gpg.key" \
+  "https://oss.sftpgo.com/apt" \
+  "trixie"
   
   msg_info "Updating SFTPGo"
   $STD apt update
diff --git a/install/sftpgo-install.sh b/install/sftpgo-install.sh
index d27d4f761..5547d2e59 100644
--- a/install/sftpgo-install.sh
+++ b/install/sftpgo-install.sh
@@ -19,8 +19,8 @@ msg_ok "Installed Dependencies"
 
 setup_deb822_repo \
   "sftpgo" \
-  "https://ftp.osuosl.org/pub/sftpgo/apt/gpg.key" \
-  "https://ftp.osuosl.org/pub/sftpgo/apt" \
+  "https://oss.sftpgo.com/apt/gpg.key" \
+  "https://oss.sftpgo.com/apt" \
   "trixie"
 
 msg_info "Installing SFTPGo"

From e7557c235541c56752f345baa6ab6b3b8708c36b Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Fri, 17 Jul 2026 12:30:21 +0000
Subject: [PATCH 165/220] Update CHANGELOG.md (#15849)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9471d1a73..eeccce0b8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -515,6 +515,10 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
     - n8n: unpin / use latest release [@MickLesk](https://github.com/MickLesk) ([#15817](https://github.com/community-scripts/ProxmoxVE/pull/15817))
     - Pin Opencloud to v7.3.0 [@vhsdream](https://github.com/vhsdream) ([#15826](https://github.com/community-scripts/ProxmoxVE/pull/15826))
 
+  - #### 🔧 Refactor
+
+    - SFTPGo: Update APT Repo & Re-Enable Script [@MickLesk](https://github.com/MickLesk) ([#15829](https://github.com/community-scripts/ProxmoxVE/pull/15829))
+
 ### 💾 Core
 
   - #### ✨ New Features

From 2ab4a31dd1fa9c40662a8f2761c7d9a8872e8d6f Mon Sep 17 00:00:00 2001
From: "push-app-to-main[bot]"
 <203845782+push-app-to-main[bot]@users.noreply.github.com>
Date: Fri, 17 Jul 2026 14:30:27 +0200
Subject: [PATCH 166/220] OxiCloud (#15823)

* Add oxicloud (ct)

* Update ct/oxicloud.sh

---------

Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com>
Co-authored-by: Sam Heinz <sam@samheinz.com>
---
 ct/headers/oxicloud         |  6 +++
 ct/oxicloud.sh              | 85 +++++++++++++++++++++++++++++++++++
 install/oxicloud-install.sh | 88 +++++++++++++++++++++++++++++++++++++
 3 files changed, 179 insertions(+)
 create mode 100644 ct/headers/oxicloud
 create mode 100644 ct/oxicloud.sh
 create mode 100644 install/oxicloud-install.sh

diff --git a/ct/headers/oxicloud b/ct/headers/oxicloud
new file mode 100644
index 000000000..b48c6ee29
--- /dev/null
+++ b/ct/headers/oxicloud
@@ -0,0 +1,6 @@
+   ____       _ ________                __
+  / __ \_  __(_) ____/ /___  __  ______/ /
+ / / / / |/_/ / /   / / __ \/ / / / __  / 
+/ /_/ />  </ / /___/ / /_/ / /_/ / /_/ /  
+\____/_/|_/_/\____/_/\____/\__,_/\__,_/   
+                                          
diff --git a/ct/oxicloud.sh b/ct/oxicloud.sh
new file mode 100644
index 000000000..bee864391
--- /dev/null
+++ b/ct/oxicloud.sh
@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: vhsdream
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/DioCrafts/OxiCloud
+
+APP="OxiCloud"
+var_tags="${var_tags:-files;documents}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-6144}"
+var_disk="${var_disk:-20}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/oxicloud ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "OxiCloud" "DioCrafts/OxiCloud"; then
+    msg_info "Stopping OxiCloud"
+    systemctl stop oxicloud
+    msg_ok "Stopped OxiCloud"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "OxiCloud" "DioCrafts/OxiCloud" "tarball" "latest" "/opt/oxicloud"
+    TOOLCHAIN="$(grep -oP 'FROM\s+rust:\K[0-9]+\.[0-9]+(\.[0-9]+)?' /opt/oxicloud/Dockerfile | head -1)"
+    RUST_TOOLCHAIN="${TOOLCHAIN:-stable}" setup_rust
+
+    msg_info "Building Frontend SPA"
+    cd /opt/oxicloud/frontend
+    $STD npm ci
+    $STD npm run build
+    msg_ok "Built Frontend SPA"
+
+    msg_info "Updating OxiCloud (Patience)"
+    set -a
+    source /etc/oxicloud/.env
+    set +a
+    cd /opt/oxicloud
+    export DATABASE_URL
+    export RUSTFLAGS="-C target-cpu=native"
+    RAM_MB=$(awk '/MemTotal/ {print int($2/1024)}' /proc/meminfo)
+    CARGO_JOBS=$((RAM_MB / 2560))
+    [[ $CARGO_JOBS -lt 1 ]] && CARGO_JOBS=1
+    [[ $CARGO_JOBS -gt $(nproc) ]] && CARGO_JOBS=$(nproc)
+    $STD cargo build --release -j "$CARGO_JOBS" --bin oxicloud --bin migrate-nfc-filenames
+    mv target/release/oxicloud /usr/local/bin/oxicloud
+    mv target/release/migrate-nfc-filenames /usr/local/bin/migrate-nfc-filenames
+    chmod +x /usr/local/bin/oxicloud /usr/local/bin/migrate-nfc-filenames
+    rm -f /usr/bin/oxicloud
+    rm -rf /opt/oxicloud/static
+    mv /opt/oxicloud/static-dist /opt/oxicloud/static
+    rm -rf /opt/oxicloud/target /opt/oxicloud/frontend/node_modules
+    msg_ok "Updated OxiCloud"
+
+    msg_info "Starting OxiCloud"
+    systemctl start oxicloud
+    msg_ok "Started OxiCloud"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8086${CL}"
diff --git a/install/oxicloud-install.sh b/install/oxicloud-install.sh
new file mode 100644
index 000000000..1b80f103c
--- /dev/null
+++ b/install/oxicloud-install.sh
@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: vhsdream
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/DioCrafts/OxiCloud
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y build-essential
+msg_ok "Installed Dependencies"
+
+NODE_VERSION="24" setup_nodejs
+PG_VERSION="17" setup_postgresql
+PG_DB_NAME="oxicloud" PG_DB_USER="oxicloud" setup_postgresql_db
+fetch_and_deploy_gh_release "OxiCloud" "DioCrafts/OxiCloud" "tarball" "latest" "/opt/oxicloud"
+TOOLCHAIN="$(grep -oP 'FROM\s+rust:\K[0-9]+\.[0-9]+(\.[0-9]+)?' /opt/oxicloud/Dockerfile | head -1)"
+RUST_TOOLCHAIN="${TOOLCHAIN:-stable}" setup_rust
+
+msg_info "Building Frontend SPA"
+cd /opt/oxicloud/frontend
+$STD npm ci
+$STD npm run build
+msg_ok "Built Frontend SPA"
+
+msg_info "Building OxiCloud (Patience)"
+cd /opt/oxicloud
+export DATABASE_URL="postgres://${PG_DB_USER}:${PG_DB_PASS}@localhost/${PG_DB_NAME}"
+export RUSTFLAGS="-C target-cpu=native"
+RAM_MB=$(awk '/MemTotal/ {print int($2/1024)}' /proc/meminfo)
+CARGO_JOBS=$((RAM_MB / 2560))
+[[ $CARGO_JOBS -lt 1 ]] && CARGO_JOBS=1
+[[ $CARGO_JOBS -gt $(nproc) ]] && CARGO_JOBS=$(nproc)
+$STD cargo build --release -j "$CARGO_JOBS" --bin oxicloud --bin migrate-nfc-filenames
+mv target/release/oxicloud /usr/local/bin/oxicloud
+mv target/release/migrate-nfc-filenames /usr/local/bin/migrate-nfc-filenames
+rm -rf /opt/oxicloud/static
+mv /opt/oxicloud/static-dist /opt/oxicloud/static
+rm -rf /opt/oxicloud/target /opt/oxicloud/frontend/node_modules
+msg_ok "Built OxiCloud"
+
+msg_info "Configuring OxiCloud"
+mkdir -p {/mnt/oxicloud,/etc/oxicloud}
+sed -e 's|OXICLOUD_STORAGE_PATH=.*|OXICLOUD_STORAGE_PATH=/mnt/oxicloud|' \
+  -e 's|OXICLOUD_SERVER_HOST=.*|OXICLOUD_SERVER_HOST=0.0.0.0|' \
+  -e 's|OXICLOUD_STATIC_PATH=.*|OXICLOUD_STATIC_PATH=/opt/oxicloud/static|' \
+  -e "s|^#OXICLOUD_BASE_URL=.*|OXICLOUD_BASE_URL=http://${LOCAL_IP}:8086|" \
+  -e "s|OXICLOUD_DB_CONNECTION_STRING=.*|OXICLOUD_DB_CONNECTION_STRING=${DATABASE_URL}|" \
+  -e "s|^DATABASE_URL=.*|DATABASE_URL=${DATABASE_URL}|" \
+  -e "s|^#OXICLOUD_JWT_SECRET=.*|OXICLOUD_JWT_SECRET=$(openssl rand -hex 32)|" \
+  /opt/oxicloud/example.env >/etc/oxicloud/.env
+chmod 600 /etc/oxicloud/.env
+msg_ok "Configured OxiCloud"
+
+msg_info "Creating OxiCloud Service"
+cat <<EOF >/etc/systemd/system/oxicloud.service
+[Unit]
+Description=OxiCloud Service
+After=network.target postgresql.service
+Requires=postgresql.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/oxicloud
+EnvironmentFile=/etc/oxicloud/.env
+ExecStart=/usr/local/bin/oxicloud
+Restart=always
+RestartSec=5
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now oxicloud
+msg_ok "Created OxiCloud Service"
+
+motd_ssh
+customize
+cleanup_lxc

From 13d7bf6c7807fcfa17b348801bd88c227c5a44e0 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Fri, 17 Jul 2026 12:30:43 +0000
Subject: [PATCH 167/220] Update CHANGELOG.md (#15850)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index eeccce0b8..799803123 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -504,6 +504,10 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ## 2026-07-17
 
+### 🆕 New Scripts
+
+  - OxiCloud ([#15823](https://github.com/community-scripts/ProxmoxVE/pull/15823))
+
 ### 🚀 Updated Scripts
 
   - #### 🐞 Bug Fixes

From ff192c45304745f786091593e22633923c9da911 Mon Sep 17 00:00:00 2001
From: "push-app-to-main[bot]"
 <203845782+push-app-to-main[bot]@users.noreply.github.com>
Date: Fri, 17 Jul 2026 14:30:55 +0200
Subject: [PATCH 169/220] Invidious (#15824)

* Add invidious (ct)

* Update install/invidious-install.sh

* Update install/invidious-install.sh

* Update install/invidious-install.sh

* Update ct/invidious.sh

* Update ct/invidious.sh

---------

Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com>
Co-authored-by: Sam Heinz <sam@samheinz.com>
---
 ct/headers/invidious         |   6 ++
 ct/invidious.sh              |  77 ++++++++++++++++++++++
 install/invidious-install.sh | 121 +++++++++++++++++++++++++++++++++++
 3 files changed, 204 insertions(+)
 create mode 100644 ct/headers/invidious
 create mode 100644 ct/invidious.sh
 create mode 100644 install/invidious-install.sh

diff --git a/ct/headers/invidious b/ct/headers/invidious
new file mode 100644
index 000000000..c858744dd
--- /dev/null
+++ b/ct/headers/invidious
@@ -0,0 +1,6 @@
+    ____           _     ___                 
+   /  _/___ _   __(_)___/ (_)___  __  _______
+   / // __ \ | / / / __  / / __ \/ / / / ___/
+ _/ // / / / |/ / / /_/ / / /_/ / /_/ (__  ) 
+/___/_/ /_/|___/_/\__,_/_/\____/\__,_/____/  
+                                             
diff --git a/ct/invidious.sh b/ct/invidious.sh
new file mode 100644
index 000000000..b3b68a632
--- /dev/null
+++ b/ct/invidious.sh
@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: vhsdream
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/iv-org/invidious
+
+APP="Invidious"
+var_tags="${var_tags:-streaming}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-20}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/invidious ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "Invidious" "iv-org/invidious"; then
+    msg_info "Stopping services"
+    $STD systemctl stop invidious-companion invidious
+    msg_ok "Stopped services"
+
+    create_backup /opt/invidious/config/config.yml
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Invidious" "iv-org/invidious" "tarball" "latest" "/opt/invidious"
+    if check_for_gh_release "Invidious-Companion" "iv-org/invidious-companion"; then
+      CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Invidious-Companion" "iv-org/invidious-companion" "prebuild" "latest" "/opt/invidious-companion" "invidious_companion-$(arch_resolve x86_64 aarch64)-unknown-linux-gnu.tar.gz"
+    fi
+
+    msg_info "Rebuilding Invidious"
+    cd /opt/invidious
+    INVIDIOUS_VERSION="$(cat ~/.invidious 2>/dev/null || echo "unknown")"
+    INVIDIOUS_VERSION="${INVIDIOUS_VERSION#v}"
+    sed -i \
+      -e "s~^\(\s*CURRENT_BRANCH\s*=\).*~\1 \"master\"~" \
+      -e "s~^\(\s*CURRENT_COMMIT\s*=\).*~\1 \"\"~" \
+      -e "s~^\(\s*CURRENT_VERSION\s*=\).*~\1 \"${INVIDIOUS_VERSION}\"~" \
+      -e "s~^\(\s*CURRENT_TAG\s*=\).*~\1 \"${INVIDIOUS_VERSION}\"~" \
+      -e "s~^\(\s*ASSET_COMMIT\s*=\).*~\1 \"\"~" \
+      src/invidious.cr
+    $STD make
+    msg_ok "Rebuilt Invidious"
+
+    restore_backup
+
+    msg_info "Starting services"
+    $STD systemctl start invidious invidious-companion
+    msg_ok "Started services"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"
diff --git a/install/invidious-install.sh b/install/invidious-install.sh
new file mode 100644
index 000000000..798b09e92
--- /dev/null
+++ b/install/invidious-install.sh
@@ -0,0 +1,121 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: vhsdream
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/iv-org/invidious
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  build-essential \
+  git \
+  pkg-config \
+  libssl-dev \
+  libxml2-dev \
+  libyaml-dev \
+  libgmp-dev \
+  libreadline-dev \
+  librsvg2-bin \
+  libsqlite3-dev \
+  zlib1g-dev \
+  libpcre2-dev \
+  libevent-dev \
+  fonts-open-sans
+msg_ok "Installed Dependencies"
+
+if [[ "$(arch_resolve amd64 arm64)" == "amd64" ]]; then
+  setup_deb822_repo "crystal" "https://download.opensuse.org/repositories/devel:/languages:/crystal/Debian_13/Release.key" "https://download.opensuse.org/repositories/devel:/languages:/crystal/Debian_13/" "./"
+  $STD apt install -y crystal
+else
+  fetch_and_deploy_gh_release "Crystal" "crystal-lang/crystal" "prebuild" "latest" "/opt/crystal" "crystal-*-linux-aarch64-bundled.tar.gz"
+  ln -sf /opt/crystal/bin/crystal /usr/local/bin/crystal
+  ln -sf /opt/crystal/bin/shards /usr/local/bin/shards
+fi
+
+PG_VERSION="17" setup_postgresql
+PG_DB_NAME="invidious" PG_DB_USER="invidious" setup_postgresql_db
+fetch_and_deploy_gh_release "Invidious" "iv-org/invidious" "tarball" "latest" "/opt/invidious"
+fetch_and_deploy_gh_release "Invidious Companion" "iv-org/invidious-companion" "prebuild" "latest" "/opt/invidious-companion" "invidious_companion-$(arch_resolve x86_64 aarch64)-unknown-linux-gnu.tar.gz"
+
+msg_info "Building Invidious"
+cd /opt/invidious
+INVIDIOUS_VERSION="$(cat ~/.invidious 2>/dev/null || echo "unknown")"
+INVIDIOUS_VERSION="${INVIDIOUS_VERSION#v}"
+sed -i \
+  -e "s~^\(\s*CURRENT_BRANCH\s*=\).*~\1 \"master\"~" \
+  -e "s~^\(\s*CURRENT_COMMIT\s*=\).*~\1 \"\"~" \
+  -e "s~^\(\s*CURRENT_VERSION\s*=\).*~\1 \"${INVIDIOUS_VERSION}\"~" \
+  -e "s~^\(\s*CURRENT_TAG\s*=\).*~\1 \"${INVIDIOUS_VERSION}\"~" \
+  -e "s~^\(\s*ASSET_COMMIT\s*=\).*~\1 \"\"~" \
+  src/invidious.cr
+$STD make
+msg_ok "Built Invidious"
+
+msg_info "Configuring Invidious"
+SECRET_KEY="$(openssl rand -hex 8)"
+HMAC_KEY="$(openssl rand -hex 32)"
+sed -e '\~^db:~,\~dbname:~d' \
+  -e "s~^#database_.*~database_url: postgres://${PG_DB_USER}:${PG_DB_PASS}@localhost:5432/${PG_DB_NAME}~" \
+  -e 's~^#check_tables.*~check_tables: true~' \
+  -e 's~^#invidious_companion:~invidious_companion:~' \
+  -e 's~^#  - private_~  - private_~' \
+  -e "s~^#invidious_companion_key:.*~invidious_companion_key: \"${SECRET_KEY}\"~" \
+  -e "s~^hmac_key:.*~hmac_key: \"${HMAC_KEY}\"~" \
+  /opt/invidious/config/config.example.yml >/opt/invidious/config/config.yml
+chmod 600 /opt/invidious/config/config.yml
+
+cat <<EOF >/etc/logrotate.d/invidious.logrotate
+/opt/invidious/invidious.log {
+  rotate 4
+  weekly
+  notifempty
+  missingok
+  compress
+  minsize 1048576
+}
+EOF
+chmod 0644 /etc/logrotate.d/invidious.logrotate
+msg_ok "Configured Invidious"
+
+msg_info "Migrating database"
+$STD ./invidious --migrate
+msg_ok "Migrated database"
+
+msg_info "Configuring services"
+sed -e 's|^User=invidious|User=root|' \
+  -e 's|^Group=invidious|Group=root|' \
+  -e 's|/home/invidious/invidious|/opt/invidious|g' \
+  /opt/invidious/invidious.service >/etc/systemd/system/invidious.service
+mkdir -p /var/tmp/youtubei.js
+cat <<EOF >/etc/systemd/system/invidious-companion.service
+[Unit]
+Description=Invidious Companion
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/invidious-companion
+Environment=SERVER_SECRET_KEY=${SECRET_KEY}
+Environment=CACHE_DIRECTORY=/var/tmp/youtubei.js
+ExecStart=/opt/invidious-companion/invidious_companion
+Restart=always
+RestartSec=2s
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl -q enable --now invidious invidious-companion
+msg_ok "Configured services"
+
+motd_ssh
+customize
+cleanup_lxc

From b1259e3749cd1340d735a9617ba9151c4027301b Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Fri, 17 Jul 2026 12:31:05 +0000
Subject: [PATCH 170/220] Update CHANGELOG.md (#15852)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 799803123..51e416806 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -506,7 +506,8 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ### 🆕 New Scripts
 
-  - OxiCloud ([#15823](https://github.com/community-scripts/ProxmoxVE/pull/15823))
+  - Invidious ([#15824](https://github.com/community-scripts/ProxmoxVE/pull/15824))
+- OxiCloud ([#15823](https://github.com/community-scripts/ProxmoxVE/pull/15823))
 
 ### 🚀 Updated Scripts
 

From d2ecb9f44c3f3aa57980d9c23c84c8556e387b79 Mon Sep 17 00:00:00 2001
From: Austin <austin@pilz.dev>
Date: Fri, 17 Jul 2026 15:02:47 -0400
Subject: [PATCH 172/220] CLIProxyAPI: fix update deleting config.yaml (#15834)

---
 ct/cliproxyapi.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/ct/cliproxyapi.sh b/ct/cliproxyapi.sh
index 9eb49a1a6..40f9f2b1f 100644
--- a/ct/cliproxyapi.sh
+++ b/ct/cliproxyapi.sh
@@ -36,8 +36,12 @@ function update_script() {
     systemctl stop cliproxyapi
     msg_ok "Stopped CLIProxyAPI"
 
+    create_backup /opt/cliproxyapi/config.yaml
+
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "cliproxyapi" "router-for-me/CLIProxyAPI" "prebuild" "latest" "/opt/cliproxyapi" "CLIProxyAPI_*_linux_$(arch_resolve "amd64" "aarch64").tar.gz"
 
+    restore_backup
+
     msg_info "Starting CLIProxyAPI"
     systemctl start cliproxyapi
     msg_ok "Started CLIProxyAPI"

From 29552c6e2ead168ed296fdd2a61a158144b3401b Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Fri, 17 Jul 2026 19:03:14 +0000
Subject: [PATCH 173/220] Update CHANGELOG.md (#15859)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 51e416806..c09d83fab 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -513,6 +513,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - CLIProxyAPI: fix update deleting config.yaml [@austinpilz](https://github.com/austinpilz) ([#15834](https://github.com/community-scripts/ProxmoxVE/pull/15834))
     - esphome: install libusb-1.0-0 for ESP-IDF native builds [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15838](https://github.com/community-scripts/ProxmoxVE/pull/15838))
 
   - #### ✨ New Features

From b2936ff9ce1e819653eb3ea6081c511e7cbc3c3f Mon Sep 17 00:00:00 2001
From: TowyTowy <85077986+TowyTowy@users.noreply.github.com>
Date: Fri, 17 Jul 2026 21:04:31 +0200
Subject: [PATCH 174/220] fix(apache-guacamole): detect installed extensions
 during update (#15841)

---
 ct/apache-guacamole.sh | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/ct/apache-guacamole.sh b/ct/apache-guacamole.sh
index bbd9673cc..89f1b973b 100644
--- a/ct/apache-guacamole.sh
+++ b/ct/apache-guacamole.sh
@@ -146,7 +146,7 @@ function update_script() {
 
   # Check and upgrade optional extensions
   # TOTP Extension
-  if [[ -f /etc/guacamole/extensions/guacamole-auth-totp-*.jar ]]; then
+  if compgen -G "/etc/guacamole/extensions/guacamole-auth-totp-*.jar" >/dev/null; then
     msg_info "Updating TOTP Extension"
     rm -f /etc/guacamole/extensions/guacamole-auth-totp-*.jar
     curl_download "/tmp/guacamole-auth-totp.tar.gz" "https://downloads.apache.org/guacamole/${LATEST_SERVER}/binary/guacamole-auth-totp-${LATEST_SERVER}.tar.gz"
@@ -158,7 +158,7 @@ function update_script() {
   fi
 
   # DUO Extension
-  if [[ -f /etc/guacamole/extensions/guacamole-auth-duo-*.jar ]]; then
+  if compgen -G "/etc/guacamole/extensions/guacamole-auth-duo-*.jar" >/dev/null; then
     msg_info "Updating DUO Extension"
     rm -f /etc/guacamole/extensions/guacamole-auth-duo-*.jar
     curl_download "/tmp/guacamole-auth-duo.tar.gz" "https://downloads.apache.org/guacamole/${LATEST_SERVER}/binary/guacamole-auth-duo-${LATEST_SERVER}.tar.gz"
@@ -170,7 +170,7 @@ function update_script() {
   fi
 
   # LDAP Extension
-  if [[ -f /etc/guacamole/extensions/guacamole-auth-ldap-*.jar ]]; then
+  if compgen -G "/etc/guacamole/extensions/guacamole-auth-ldap-*.jar" >/dev/null; then
     msg_info "Updating LDAP Extension"
     rm -f /etc/guacamole/extensions/guacamole-auth-ldap-*.jar
     curl_download "/tmp/guacamole-auth-ldap.tar.gz" "https://downloads.apache.org/guacamole/${LATEST_SERVER}/binary/guacamole-auth-ldap-${LATEST_SERVER}.tar.gz"
@@ -182,7 +182,7 @@ function update_script() {
   fi
 
   # Quick Connect Extension
-  if [[ -f /etc/guacamole/extensions/guacamole-auth-quickconnect-*.jar ]]; then
+  if compgen -G "/etc/guacamole/extensions/guacamole-auth-quickconnect-*.jar" >/dev/null; then
     msg_info "Updating Quick Connect Extension"
     rm -f /etc/guacamole/extensions/guacamole-auth-quickconnect-*.jar
     curl_download "/tmp/guacamole-auth-quickconnect.tar.gz" "https://downloads.apache.org/guacamole/${LATEST_SERVER}/binary/guacamole-auth-quickconnect-${LATEST_SERVER}.tar.gz"
@@ -194,7 +194,7 @@ function update_script() {
   fi
 
   # History Recording Storage Extension
-  if [[ -f /etc/guacamole/extensions/guacamole-history-recording-storage-*.jar ]]; then
+  if compgen -G "/etc/guacamole/extensions/guacamole-history-recording-storage-*.jar" >/dev/null; then
     msg_info "Updating History Recording Storage Extension"
     rm -f /etc/guacamole/extensions/guacamole-history-recording-storage-*.jar
     curl_download "/tmp/guacamole-history-recording-storage.tar.gz" "https://downloads.apache.org/guacamole/${LATEST_SERVER}/binary/guacamole-history-recording-storage-${LATEST_SERVER}.tar.gz"

From b5360882c90946d92d5faea0f85dbf7b10c5d8fe Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Fri, 17 Jul 2026 19:04:58 +0000
Subject: [PATCH 175/220] Update CHANGELOG.md (#15860)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c09d83fab..14b0f895e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -513,6 +513,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - apache-guacamole: detect installed extensions during update [@TowyTowy](https://github.com/TowyTowy) ([#15841](https://github.com/community-scripts/ProxmoxVE/pull/15841))
     - CLIProxyAPI: fix update deleting config.yaml [@austinpilz](https://github.com/austinpilz) ([#15834](https://github.com/community-scripts/ProxmoxVE/pull/15834))
     - esphome: install libusb-1.0-0 for ESP-IDF native builds [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15838](https://github.com/community-scripts/ProxmoxVE/pull/15838))
 

From f75b0a8b0e423c8c743ae9c3730ec98b9d94d159 Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Fri, 17 Jul 2026 21:05:10 +0200
Subject: [PATCH 176/220] AFFiNE: Bump to 0.27.0 (#15848)

---
 ct/affine.sh              | 11 +++++++----
 install/affine-install.sh | 10 ++++++----
 2 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/ct/affine.sh b/ct/affine.sh
index 236a225bd..1480c2a99 100644
--- a/ct/affine.sh
+++ b/ct/affine.sh
@@ -30,17 +30,19 @@ function update_script() {
     exit
   fi
 
-  RELEASE="v0.26.3"
+  RELEASE="v0.27.0"
   if check_for_gh_release "affine_app" "toeverything/AFFiNE" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
     msg_info "Stopping Services"
     systemctl stop affine-web affine-worker
     msg_ok "Stopped Services"
 
+    ensure_dependencies cmake
+
     create_backup /root/.affine/config /root/.affine/storage
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "${RELEASE}" "/opt/affine"
 
-    msg_info "Rebuilding Application (Patience)"
+    msg_info "Rebuilding Application (Patience ~25 mins, don't close the console!)"
     cd /opt/affine
     source /root/.profile
     export PATH="/root/.cargo/bin:/root/.rbenv/shims:$PATH"
@@ -51,11 +53,12 @@ function update_script() {
     export VITE_CORE_COMMIT_SHA=$(cat ~/.affine_app)
 
     # Initialize git repo (required for build process)
+    export HUSKY=0
     $STD git init -q
     $STD git config user.email "build@local"
     $STD git config user.name "Build"
     $STD git add -A
-    $STD git commit -q -m "update"
+    $STD git commit -q -m "update" --no-verify --allow-empty
 
     # Force Turbo to run sequentially
     mkdir -p /opt/affine/.turbo
@@ -66,7 +69,7 @@ function update_script() {
 TURBO
 
     $STD corepack enable
-    $STD corepack prepare yarn@4.12.0 --activate
+    $STD corepack prepare yarn@4.13.0 --activate
     $STD yarn config set enableTelemetry 0
 
     export NODE_OPTIONS="--max-old-space-size=2048"
diff --git a/install/affine-install.sh b/install/affine-install.sh
index 4c15d2403..50144d4e0 100644
--- a/install/affine-install.sh
+++ b/install/affine-install.sh
@@ -22,7 +22,8 @@ $STD apt install -y \
   libssl-dev \
   libjemalloc2 \
   redis-server \
-  nginx
+  nginx \
+  cmake
 msg_ok "Installed Dependencies"
 
 PG_VERSION="16" PG_MODULES="pgvector" setup_postgresql
@@ -30,7 +31,7 @@ PG_DB_NAME="affine" PG_DB_USER="affine" setup_postgresql_db
 NODE_VERSION="22" setup_nodejs
 setup_rust
 
-fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "v0.26.3" "/opt/affine"
+fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "v0.27.0" "/opt/affine"
 
 msg_info "Setting up Directories"
 rm -rf /root/.affine
@@ -59,11 +60,12 @@ export PATH="/root/.cargo/bin:$PATH"
 export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
 export VITE_CORE_COMMIT_SHA=$(cat ~/.affine_app)
 # # Initialize git repo (required for build process)
+export HUSKY=0
 $STD git init -q
 $STD git config user.email "build@local"
 $STD git config user.name "Build"
 $STD git add -A
-$STD git commit -q -m "initial"
+$STD git commit -q -m "update" --no-verify --allow-empty
 mkdir -p /opt/affine/.turbo
 cat <<TURBO >/opt/affine/.turbo/config.json
 {
@@ -71,7 +73,7 @@ cat <<TURBO >/opt/affine/.turbo/config.json
 }
 TURBO
 $STD corepack enable
-$STD corepack prepare yarn@4.12.0 --activate
+$STD corepack prepare yarn@4.13.0 --activate
 $STD yarn config set enableTelemetry 0
 export NODE_OPTIONS="--max-old-space-size=4096"
 export TSC_COMPILE_ON_ERROR=true

From 0b15e1950019e693c096dc687760142d14523212 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Fri, 17 Jul 2026 19:05:36 +0000
Subject: [PATCH 177/220] Update CHANGELOG.md (#15861)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 14b0f895e..81d72a7b2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -519,6 +519,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### ✨ New Features
 
+    - AFFiNE: Bump to 0.27.0 [@MickLesk](https://github.com/MickLesk) ([#15848](https://github.com/community-scripts/ProxmoxVE/pull/15848))
     - n8n: unpin / use latest release [@MickLesk](https://github.com/MickLesk) ([#15817](https://github.com/community-scripts/ProxmoxVE/pull/15817))
     - Pin Opencloud to v7.3.0 [@vhsdream](https://github.com/vhsdream) ([#15826](https://github.com/community-scripts/ProxmoxVE/pull/15826))
 

From 78990277f2488b045d1d02d3c406edfbbbb924ce Mon Sep 17 00:00:00 2001
From: Copilot <198982749+Copilot@users.noreply.github.com>
Date: Fri, 17 Jul 2026 21:13:19 +0200
Subject: [PATCH 178/220] Fix DocuSeal missing Leptonica deps on install and
 update (#15858)

* Initial plan

* Fix DocuSeal leptonica dependencies

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
---
 ct/docuseal.sh              | 2 ++
 install/docuseal-install.sh | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/ct/docuseal.sh b/ct/docuseal.sh
index d856d1694..9fbdca313 100644
--- a/ct/docuseal.sh
+++ b/ct/docuseal.sh
@@ -35,6 +35,8 @@ function update_script() {
     systemctl stop docuseal docuseal-sidekiq
     msg_ok "Stopped Services"
 
+    ensure_dependencies libleptonica-dev libleptonica6
+
     create_backup /opt/docuseal/.env \
       /opt/docuseal/data
 
diff --git a/install/docuseal-install.sh b/install/docuseal-install.sh
index 82c89bfc6..e502256e3 100644
--- a/install/docuseal-install.sh
+++ b/install/docuseal-install.sh
@@ -23,6 +23,8 @@ $STD apt install -y \
   libreadline-dev \
   zlib1g-dev \
   libffi-dev \
+  libleptonica-dev \
+  libleptonica6 \
   libvips42 \
   libvips-dev \
   libheif1 \

From c0a327dad8de829d571c9a44b4d5c602e453dc48 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Fri, 17 Jul 2026 19:13:41 +0000
Subject: [PATCH 179/220] Update CHANGELOG.md (#15862)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 81d72a7b2..d6aa7f1e6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -513,6 +513,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - Fix DocuSeal missing Leptonica deps on install and update [@Copilot](https://github.com/Copilot) ([#15858](https://github.com/community-scripts/ProxmoxVE/pull/15858))
     - apache-guacamole: detect installed extensions during update [@TowyTowy](https://github.com/TowyTowy) ([#15841](https://github.com/community-scripts/ProxmoxVE/pull/15841))
     - CLIProxyAPI: fix update deleting config.yaml [@austinpilz](https://github.com/austinpilz) ([#15834](https://github.com/community-scripts/ProxmoxVE/pull/15834))
     - esphome: install libusb-1.0-0 for ESP-IDF native builds [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15838](https://github.com/community-scripts/ProxmoxVE/pull/15838))

From 3f7228f9c6c53a65db7dd08a846cf4514606756a Mon Sep 17 00:00:00 2001
From: Michel Roegl-Brunner
 <73236783+michelroegl-brunner@users.noreply.github.com>
Date: Fri, 17 Jul 2026 21:16:15 +0200
Subject: [PATCH 180/220] fix(webtrees): initialize database schema before
 admin user creation (#15837)

PR #14818 replaced the setup wizard curl with CLI commands but omitted
the schema migration step, causing fresh installs to fail when creating
the admin user. Trigger schema init via HTTP after config-ini.

Fixes #15828
---
 install/webtrees-install.sh | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/install/webtrees-install.sh b/install/webtrees-install.sh
index c2be2e79e..69b735e46 100644
--- a/install/webtrees-install.sh
+++ b/install/webtrees-install.sh
@@ -47,6 +47,8 @@ msg_ok "Configured Caddy"
 
 msg_info "Automating Webtrees Setup"
 cd /opt/webtrees
+mkdir -p /opt/webtrees/data
+chown -R www-data:www-data /opt/webtrees/data
 WT_ADMIN_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c15)
 $STD sudo -u www-data php /opt/webtrees/index.php config-ini \
   --dbhost=127.0.0.1 \
@@ -56,6 +58,15 @@ $STD sudo -u www-data php /opt/webtrees/index.php config-ini \
   --dbname=webtrees \
   --tblpfx=wt_ \
   --base-url="http://${LOCAL_IP}"
+msg_info "Initializing Webtrees database schema"
+for i in {1..15}; do
+  if curl -sf "http://127.0.0.1/" >/dev/null 2>&1; then
+    break
+  fi
+  sleep 2
+done
+$STD mariadb -u webtrees -p"${MARIADB_DB_PASS}" -h 127.0.0.1 webtrees -e "SHOW TABLES LIKE 'wt_user';" | grep -q wt_user
+msg_ok "Initialized Webtrees database schema"
 $STD sudo -u www-data php /opt/webtrees/index.php user Admin \
   --create \
   --real-name="Administrator" \

From c24bba00ded0fd9b6ebcde69477786ec825910d3 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Fri, 17 Jul 2026 19:16:42 +0000
Subject: [PATCH 181/220] Update CHANGELOG.md (#15863)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d6aa7f1e6..ab484bb31 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -513,6 +513,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - webtrees: initialize database schema before admin user creation [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15837](https://github.com/community-scripts/ProxmoxVE/pull/15837))
     - Fix DocuSeal missing Leptonica deps on install and update [@Copilot](https://github.com/Copilot) ([#15858](https://github.com/community-scripts/ProxmoxVE/pull/15858))
     - apache-guacamole: detect installed extensions during update [@TowyTowy](https://github.com/TowyTowy) ([#15841](https://github.com/community-scripts/ProxmoxVE/pull/15841))
     - CLIProxyAPI: fix update deleting config.yaml [@austinpilz](https://github.com/austinpilz) ([#15834](https://github.com/community-scripts/ProxmoxVE/pull/15834))

From 7f1b0ead93e011757dd52b07846060db9ff56e95 Mon Sep 17 00:00:00 2001
From: Sir106 <sir106@users.noreply.github.com>
Date: Sat, 18 Jul 2026 22:19:31 +0200
Subject: [PATCH 182/220] [tools.update-lxcs] feat: optional reporting
 success/failures to heathchecks.io (or others) (#15701)

* feat: add  task monitoring option via  e.g. healthchecks.io. To be configured via PING variable in config file.

* attach logfile on failure to healthcheck.io message

* fixed error status when updating lxc even if finished successful

---------

Co-authored-by: Sir106 <sir106@id-e.de>
---
 tools/pve/cron-update-lxcs.sh | 11 ++++++--
 tools/pve/update-lxcs-cron.sh | 48 ++++++++++++++++++++++++++++++-----
 2 files changed, 51 insertions(+), 8 deletions(-)

diff --git a/tools/pve/cron-update-lxcs.sh b/tools/pve/cron-update-lxcs.sh
index c97975c44..437c7e472 100644
--- a/tools/pve/cron-update-lxcs.sh
+++ b/tools/pve/cron-update-lxcs.sh
@@ -116,6 +116,9 @@ add() {
 # Add container IDs to exclude from updates (comma-separated):
 # EXCLUDE=100,101,102
 EXCLUDE=
+
+# Healthchecks.io Ping URL (optional)
+# PING_URL=
 CONF
     ok "Created config ${CONF_FILE}"
   fi
@@ -235,9 +238,11 @@ view_cron_config() {
   fi
   if [[ -f "$CONF_FILE" ]]; then
     echo -e " \e[36mConfig file:\e[0m ${CONF_FILE}"
-    local excludes
+    local excludes ping_url
     excludes=$(grep -oP '^\s*EXCLUDE\s*=\s*\K.*' "$CONF_FILE" 2>/dev/null || true)
+    ping_url=$(grep -oP '^\s*PING_URL\s*=\s*\K.*' "$CONF_FILE" 2>/dev/null | tr -d '"' | tr -d "'" || true)
     echo -e " \e[36mExcluded:\e[0m    ${excludes:-(none)}"
+    echo -e " \e[36mPing URL:\e[0m    ${ping_url:-(none)}"
     echo ""
     echo -e " \e[90m--- ${CONF_FILE} ---\e[0m"
     cat "$CONF_FILE"
@@ -284,9 +289,11 @@ show_status() {
   fi
 
   if [[ -f "$CONF_FILE" ]]; then
-    local excludes
+    local excludes ping_url
     excludes=$(grep -oP '^\s*EXCLUDE\s*=\s*\K.*' "$CONF_FILE" 2>/dev/null || echo "(none)")
+    ping_url=$(grep -oP '^\s*PING_URL\s*=\s*\K.*' "$CONF_FILE" 2>/dev/null | tr -d '"' | tr -d "'" || echo "(none)")
     echo -e "   \e[36mExcluded:\e[0m  ${excludes:-"(none)"}"
+    echo -e "   \e[36mPing URL:\e[0m  ${ping_url:-"(none)"}"
   fi
 
   if [[ -f "$LOG_FILE" ]]; then
diff --git a/tools/pve/update-lxcs-cron.sh b/tools/pve/update-lxcs-cron.sh
index d7abc4cae..0e021944a 100644
--- a/tools/pve/update-lxcs-cron.sh
+++ b/tools/pve/update-lxcs-cron.sh
@@ -11,14 +11,15 @@
 export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 
 CONF_FILE="/etc/update-lxcs.conf"
-
-echo -e "\n $(date)"
+LOG_FILE="/var/log/update-lxcs-cron.log"
+PING_URL=""
 
 # Collect excluded containers from arguments
 excluded_containers=("$@")
 
-# Merge exclusions from config file if it exists
+# Merge exclusions and healthchecks URL from config file if it exists
 if [[ -f "$CONF_FILE" ]]; then
+  PING_URL=$(grep -oP '^\s*PING_URL\s*=\s*\K.+' "$CONF_FILE" 2>/dev/null | tr -d '"' | tr -d "'" || true)
   conf_exclude=$(grep -oP '^\s*EXCLUDE\s*=\s*\K[0-9,]+' "$CONF_FILE" 2>/dev/null || true)
   IFS=',' read -ra conf_ids <<<"$conf_exclude"
   for id in "${conf_ids[@]}"; do
@@ -27,6 +28,17 @@ if [[ -f "$CONF_FILE" ]]; then
   done
 fi
 
+# Overwrite logfile on each run when healthchecks is used
+if [[ -n "$PING_URL" ]]; then
+  true > "$LOG_FILE"
+fi
+
+if [[ -n "$PING_URL" ]]; then
+  curl -fsS -m 10 --retry 5 "${PING_URL}/start" -o /dev/null 2>/dev/null || true
+fi
+
+echo -e "\n $(date)"
+
 function update_container() {
   local container=$1
   local name
@@ -38,12 +50,36 @@ function update_container() {
   alpine) pct exec "$container" -- ash -c "apk -U upgrade" ;;
   archlinux) pct exec "$container" -- bash -c "pacman -Syyu --noconfirm" ;;
   fedora | rocky | centos | alma) pct exec "$container" -- bash -c "dnf -y update && dnf -y upgrade" ;;
-  ubuntu | debian | devuan) pct exec "$container" -- bash -c "apt-get update && DEBIAN_FRONTEND=noninteractive apt-get -o Dpkg::Options::='--force-confold' dist-upgrade -y; rm -rf /usr/lib/python3.*/EXTERNALLY-MANAGED" ;;
+  ubuntu | debian | devuan) pct exec "$container" -- bash -c "apt-get update; DEBIAN_FRONTEND=noninteractive apt-get -o Dpkg::Options::='--force-confold' dist-upgrade -y; status=\$?; rm -rf /usr/lib/python3.*/EXTERNALLY-MANAGED || true; exit \$status" ;;
   opensuse) pct exec "$container" -- bash -c "zypper ref && zypper --non-interactive dup" ;;
   *) echo " [Warn] Unknown OS type '$os' for container $container, skipping" ;;
   esac
 }
 
+update_status=0
+
+# Define exit handler to send healthchecks.io status (with logfile on failure/success)
+function exit_handler() {
+  local exit_code=$?
+  if [[ -n "$PING_URL" ]]; then
+    sync
+    if [[ $exit_code -ne 0 || $update_status -ne 0 ]]; then
+      if [[ -f "$LOG_FILE" ]]; then
+        curl -fsS -m 10 --retry 5 --data-binary @"$LOG_FILE" "${PING_URL}/fail" -o /dev/null 2>/dev/null || true
+      else
+        curl -fsS -m 10 --retry 5 "${PING_URL}/fail" -o /dev/null 2>/dev/null || true
+      fi
+    else
+      if [[ -f "$LOG_FILE" ]]; then
+        curl -fsS -m 10 --retry 5 --data-binary @"$LOG_FILE" "$PING_URL" -o /dev/null 2>/dev/null || true
+      else
+        curl -fsS -m 10 --retry 5 "$PING_URL" -o /dev/null 2>/dev/null || true
+      fi
+    fi
+  fi
+}
+trap exit_handler EXIT
+
 for container in $(pct list | awk '{if(NR>1) print $1}'); do
   excluded=false
   for excluded_container in "${excluded_containers[@]}"; do
@@ -65,7 +101,7 @@ for container in $(pct list | awk '{if(NR>1) print $1}'); do
       echo -e "[Info] Starting $container"
       pct start "$container"
       sleep 5
-      update_container "$container" || echo " [Error] Update failed for $container"
+      update_container "$container" || { echo " [Error] Update failed for $container"; update_status=1; }
       # check if patchmon agent is present in container and run a report if found
       if pct exec "$container" -- [ -e "/usr/local/bin/patchmon-agent" ]; then
         echo -e "${BL}[Info]${GN} patchmon-agent found in ${BL} $container ${CL}, triggering report. \n"
@@ -74,7 +110,7 @@ for container in $(pct list | awk '{if(NR>1) print $1}'); do
       echo -e "[Info] Shutting down $container"
       pct shutdown "$container" --timeout 60 &
     elif [ "$status" == "status: running" ]; then
-      update_container "$container" || echo " [Error] Update failed for $container"
+      update_container "$container" || { echo " [Error] Update failed for $container"; update_status=1; }
       # check if patchmon agent is present in container and run a report if found
       if pct exec "$container" -- [ -e "/usr/local/bin/patchmon-agent" ]; then
         echo -e "${BL}[Info]${GN} patchmon-agent found in ${BL} $container ${CL}, triggering report. \n"

From 09c85021fc000ab151201a3b699edc00be7f062c Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Sat, 18 Jul 2026 20:19:59 +0000
Subject: [PATCH 183/220] Update CHANGELOG.md (#15877)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ab484bb31..b9b1f82b2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -502,6 +502,14 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-07-18
+
+### 🧰 Tools
+
+  - #### ✨ New Features
+
+    - [tools.update-lxcs] feat: optional reporting success/failures to heathchecks.io (or others) [@sir106](https://github.com/sir106) ([#15701](https://github.com/community-scripts/ProxmoxVE/pull/15701))
+
 ## 2026-07-17
 
 ### 🆕 New Scripts

From eb5a5b2cb769681fec7c27d761d9286d83969e4b Mon Sep 17 00:00:00 2001
From: Michel Roegl-Brunner
 <73236783+michelroegl-brunner@users.noreply.github.com>
Date: Sat, 18 Jul 2026 23:21:19 +0200
Subject: [PATCH 184/220] add configurable host CA inheritance for LXC
 bootstrap (#15840)

Introduce host CA certificate propagation in the shared LXC build flow so containers can trust enterprise/private PKI roots during early package bootstrap. Add an advanced-install toggle with default auto behavior so unattended installs remain seamless while interactive users can explicitly opt out.

Co-authored-by: Michel Roegl-Brunner <michel.roegl-brunner@example.com>
---
 misc/build.func | 143 +++++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 136 insertions(+), 7 deletions(-)

diff --git a/misc/build.func b/misc/build.func
index 53509780f..f22692d42 100644
--- a/misc/build.func
+++ b/misc/build.func
@@ -1009,6 +1009,7 @@ base_settings() {
 
   APT_CACHER=${var_apt_cacher:-""}
   APT_CACHER_IP=${var_apt_cacher_ip:-""}
+  INHERIT_HOST_CA="${var_inherit_host_ca:-auto}"
 
   # Runtime check: Verify APT cacher is reachable if configured
   if [[ -n "$APT_CACHER_IP" && "$APT_CACHER" == "yes" ]]; then
@@ -1088,7 +1089,7 @@ load_vars_file() {
 
   # Allowed var_* keys
   local VAR_WHITELIST=(
-    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_keyctl
+    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_inherit_host_ca var_keyctl
     var_gateway var_hostname var_ipv6_method var_mac var_mknod var_mount_fs var_mtu
     var_net var_nesting var_ns var_os var_protection var_pw var_ram var_tags var_timezone var_tun var_unprivileged
     var_verbose var_version var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage var_searchdomain
@@ -1285,6 +1286,12 @@ load_vars_file() {
             continue
           fi
           ;;
+        var_inherit_host_ca)
+          if [[ "$var_val" != "yes" && "$var_val" != "no" && "$var_val" != "auto" ]]; then
+            msg_warn "Invalid host CA inheritance value '$var_val' in $file (must be yes/no/auto), ignoring"
+            continue
+          fi
+          ;;
         var_container_storage | var_template_storage)
           # Validate that the storage exists and is active on the current node
           local _storage_status
@@ -1324,7 +1331,7 @@ default_var_settings() {
   # Allowed var_* keys (alphabetically sorted)
   # Note: Removed var_ctid (can only exist once), var_ipv6_static (static IPs are unique)
   local VAR_WHITELIST=(
-    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_keyctl
+    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_inherit_host_ca var_keyctl
     var_gateway var_hostname var_ipv6_method var_mac var_mknod var_mount_fs var_mtu
     var_net var_nesting var_ns var_os var_protection var_pw var_ram var_tags var_timezone var_tun var_unprivileged
     var_verbose var_version var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage
@@ -1407,6 +1414,7 @@ var_ssh=no
 # HTTP/HTTPS proxy (optional - for networks requiring a proxy)
 # var_http_proxy=http://proxy.local:8080
 # var_http_no_proxy=localhost,127.0.0.1,.local
+# var_inherit_host_ca=auto
 
 # Features/Tags/verbosity
 var_fuse=no
@@ -1507,7 +1515,7 @@ get_app_defaults_path() {
 if ! declare -p VAR_WHITELIST >/dev/null 2>&1; then
   # Note: Removed var_ctid (can only exist once), var_ipv6_static (static IPs are unique)
   declare -ag VAR_WHITELIST=(
-    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_keyctl
+    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_inherit_host_ca var_keyctl
     var_gateway var_hostname var_ipv6_method var_mac var_mknod var_mount_fs var_mtu
     var_net var_nesting var_ns var_os var_protection var_pw var_ram var_tags var_timezone var_tun var_unprivileged
     var_verbose var_version var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage var_searchdomain
@@ -1657,6 +1665,7 @@ _build_current_app_vars_tmp() {
   _apt_cacher_ip="${APT_CACHER_IP:-}"
   _http_proxy="${HTTP_PROXY:-${var_http_proxy:-}}"
   _http_no_proxy="${HTTP_NO_PROXY:-${var_http_no_proxy:-}}"
+  _inherit_host_ca="${INHERIT_HOST_CA:-${var_inherit_host_ca:-auto}}"
   _fuse="${ENABLE_FUSE:-no}"
   _tun="${ENABLE_TUN:-no}"
   _gpu="${ENABLE_GPU:-no}"
@@ -1710,6 +1719,7 @@ _build_current_app_vars_tmp() {
     [ -n "$_apt_cacher_ip" ] && echo "var_apt_cacher_ip=$(_sanitize_value "$_apt_cacher_ip")"
     [ -n "$_http_proxy" ] && echo "var_http_proxy=$(_sanitize_value "$_http_proxy")"
     [ -n "$_http_no_proxy" ] && echo "var_http_no_proxy=$(_sanitize_value "$_http_no_proxy")"
+    [ -n "$_inherit_host_ca" ] && echo "var_inherit_host_ca=$(_sanitize_value "$_inherit_host_ca")"
 
     [ -n "$_fuse" ] && echo "var_fuse=$(_sanitize_value "$_fuse")"
     [ -n "$_tun" ] && echo "var_tun=$(_sanitize_value "$_tun")"
@@ -1874,7 +1884,7 @@ advanced_settings() {
     TAGS="community-script${var_tags:+;${var_tags}}"
   fi
   local STEP=1
-  local MAX_STEP=30
+  local MAX_STEP=31
 
   # Store values for back navigation - inherit from var_* app defaults
   local _ct_type="${var_unprivileged:-1}"
@@ -1896,6 +1906,7 @@ advanced_settings() {
   local _apt_cacher_ip="${var_apt_cacher_ip:-}"
   local _http_proxy="${var_http_proxy:-}"
   local _http_no_proxy="${var_http_no_proxy:-}"
+  local _inherit_host_ca="${var_inherit_host_ca:-auto}"
   local _mtu="${var_mtu:-}"
   local _sd="${var_searchdomain:-}"
   local _ns="${var_ns:-}"
@@ -2725,9 +2736,47 @@ advanced_settings() {
       ;;
 
     # ═══════════════════════════════════════════════════════════════════════════
-    # STEP 25: Container Timezone
+    # STEP 25: Host CA Inheritance
     # ═══════════════════════════════════════════════════════════════════════════
     25)
+      local host_ca_count=0
+      local host_ca_dir="/usr/local/share/ca-certificates"
+      local cert
+      shopt -s nullglob
+      for cert in "$host_ca_dir"/*.crt; do
+        host_ca_count=$((host_ca_count + 1))
+      done
+      shopt -u nullglob
+
+      if [[ $host_ca_count -eq 0 ]]; then
+        _inherit_host_ca="auto"
+        ((STEP++))
+        continue
+      fi
+
+      local host_ca_default_flag=""
+      [[ "$_inherit_host_ca" == "no" ]] && host_ca_default_flag="--defaultno"
+      if whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
+        --title "HOST CA INHERITANCE" \
+        --ok-button "Next" --cancel-button "Back" \
+        $host_ca_default_flag \
+        --yesno "\nInherit host CA certificates into this container?\n\nDetected on host: ${host_ca_count} certificate(s) in:\n${host_ca_dir}\n\nRecommended for private PKI / TLS-inspection environments.\n\n(App default: ${var_inherit_host_ca:-auto})" 16 72; then
+        _inherit_host_ca="yes"
+      else
+        if [ $? -eq 1 ]; then
+          _inherit_host_ca="no"
+        else
+          ((STEP--))
+          continue
+        fi
+      fi
+      ((STEP++))
+      ;;
+
+    # ═══════════════════════════════════════════════════════════════════════════
+    # STEP 26: Container Timezone
+    # ═══════════════════════════════════════════════════════════════════════════
+    26)
       local tz_hint="$_ct_timezone"
       [[ -z "$tz_hint" ]] && tz_hint="(empty - will use host timezone)"
 
@@ -2750,9 +2799,9 @@ advanced_settings() {
       ;;
 
     # ═══════════════════════════════════════════════════════════════════════════
-    # STEP 26: Container Protection
+    # STEP 27: Container Protection
     # ═══════════════════════════════════════════════════════════════════════════
-    26)
+    27)
       local protect_default_flag="--defaultno"
       [[ "$_protect_ct" == "yes" || "$_protect_ct" == "1" ]] && protect_default_flag=""
 
@@ -2904,6 +2953,7 @@ Leave empty to skip."
       local apt_display="${_apt_cacher:-no}"
       [[ "$_apt_cacher" == "yes" && -n "$_apt_cacher_ip" ]] && apt_display="$_apt_cacher_ip"
       local http_proxy_display="${_http_proxy:-(none)}"
+      local inherit_ca_display="${_inherit_host_ca:-auto}"
 
       local post_install_display="${_post_install:-(none)}"
       local post_install_warn=""
@@ -2934,6 +2984,7 @@ Advanced:
   Timezone: $tz_display
   APT Cacher: $apt_display
   HTTP Proxy: $http_proxy_display
+  Inherit Host CAs: $inherit_ca_display
   Verbose: $_verbose
   Post-Install Script: ${post_install_display}${post_install_warn}"
 
@@ -2979,6 +3030,7 @@ Advanced:
   APT_CACHER_IP="$_apt_cacher_ip"
   HTTP_PROXY="$_http_proxy"
   HTTP_NO_PROXY="$_http_no_proxy"
+  INHERIT_HOST_CA="$_inherit_host_ca"
   VERBOSE="$_verbose"
   var_post_install="$_post_install"
 
@@ -2997,6 +3049,7 @@ Advanced:
   var_sdn_vnet="$_sdn_vnet"
   var_http_proxy="$_http_proxy"
   var_http_no_proxy="$_http_no_proxy"
+  var_inherit_host_ca="$_inherit_host_ca"
 
   # Format optional values
   [[ -n "$_mtu" ]] && MTU=",mtu=$_mtu" || MTU=""
@@ -3945,6 +3998,81 @@ EOF
   msg_ok "Applied HTTP proxy in container"
 }
 
+# ------------------------------------------------------------------------------
+# _apply_host_ca_certs_in_container()
+#
+# - Copies administrator-provided CA certificates from the Proxmox host into the
+#   container before base package bootstrap
+# - Source: /usr/local/share/ca-certificates/*.crt (Debian convention)
+# - Refreshes the container trust store when update-ca-certificates is available
+# - No-op when no host certificates are present; failures are non-fatal
+# ------------------------------------------------------------------------------
+_apply_host_ca_certs_in_container() {
+  local host_ca_dir="/usr/local/share/ca-certificates"
+  [[ -z "${CTID:-}" ]] && return 0
+  local inherit_host_ca="${INHERIT_HOST_CA:-${var_inherit_host_ca:-auto}}"
+
+  local -a host_certs=()
+  local cert
+  shopt -s nullglob
+  for cert in "$host_ca_dir"/*.crt; do
+    host_certs+=("$cert")
+  done
+  shopt -u nullglob
+
+  [[ ${#host_certs[@]} -eq 0 ]] && return 0
+
+  case "${inherit_host_ca,,}" in
+  no | false | 0 | off)
+    msg_info "Skipping host CA inheritance by configuration"
+    return 0
+    ;;
+  esac
+
+  msg_info "Inheriting host CA certificates into container"
+
+  local found=${#host_certs[@]}
+  local copied=0
+  local skipped=0
+  local cert_name
+
+  pct exec "$CTID" -- mkdir -p /usr/local/share/ca-certificates >/dev/null 2>&1 || {
+    msg_warn "Failed to create CA certificate directory in container"
+    return 0
+  }
+
+  for cert in "${host_certs[@]}"; do
+    cert_name="$(basename "$cert")"
+    if [[ ! -r "$cert" || "$cert_name" != *.crt ]]; then
+      msg_warn "Skipping invalid or unreadable host CA certificate: ${cert_name}"
+      skipped=$((skipped + 1))
+      continue
+    fi
+
+    if pct push "$CTID" "$cert" "/usr/local/share/ca-certificates/${cert_name}" >/dev/null 2>&1; then
+      pct exec "$CTID" -- chmod 644 "/usr/local/share/ca-certificates/${cert_name}" >/dev/null 2>&1 || true
+      copied=$((copied + 1))
+    else
+      msg_warn "Failed to push host CA certificate: ${cert_name}"
+      skipped=$((skipped + 1))
+    fi
+  done
+
+  if [[ $copied -eq 0 ]]; then
+    msg_warn "No host CA certificates were copied (${found} found, ${skipped} skipped)"
+    return 0
+  fi
+
+  local refresh_shell="bash"
+  [[ "$var_os" == "alpine" ]] && refresh_shell="ash"
+
+  if pct exec "$CTID" -- "$refresh_shell" -c 'command -v update-ca-certificates >/dev/null 2>&1 && update-ca-certificates' >/dev/null 2>&1; then
+    msg_ok "Inherited ${copied} host CA certificate(s) and updated trust store (${skipped} skipped)"
+  else
+    msg_warn "Copied ${copied} host CA certificate(s), but trust store update failed or update-ca-certificates is unavailable (${skipped} skipped)"
+  fi
+}
+
 # ------------------------------------------------------------------------------
 # build_container()
 #
@@ -4565,6 +4693,7 @@ EOF
   local install_exit_code=0
 
   _apply_http_proxy_in_container
+  _apply_host_ca_certs_in_container
 
   # Continue with standard container setup
   if [ "$var_os" == "alpine" ]; then

From 658aad229ae262256d4565c2d62d99653b2e6d78 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Sat, 18 Jul 2026 21:21:41 +0000
Subject: [PATCH 185/220] Update CHANGELOG.md (#15878)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b9b1f82b2..e41f26298 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -504,6 +504,12 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ## 2026-07-18
 
+### 💾 Core
+
+  - #### ✨ New Features
+
+    - core: add configurable host CA inheritance during bootstrap [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15840](https://github.com/community-scripts/ProxmoxVE/pull/15840))
+
 ### 🧰 Tools
 
   - #### ✨ New Features

From 38ed344e0a80e5f7e8a91b71e26cec51c84e5347 Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Sun, 19 Jul 2026 00:10:06 +0200
Subject: [PATCH 186/220] tools.func: Safe Delete Directorys & Update
 PYTHON_VERSION with setup_uv (#15870)

---
 misc/tools.func | 32 +++++++++++++++++++++-----------
 1 file changed, 21 insertions(+), 11 deletions(-)

diff --git a/misc/tools.func b/misc/tools.func
index adb7a5ac4..64669fad1 100644
--- a/misc/tools.func
+++ b/misc/tools.func
@@ -2544,7 +2544,7 @@ fetch_and_deploy_gh_tag() {
 
   mkdir -p "$target"
   if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-    rm -rf "${target:?}/"*
+    find "${target:?}" -mindepth 1 -delete
   fi
 
   tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
@@ -2737,7 +2737,7 @@ fetch_and_deploy_gl_tag() {
 
   mkdir -p "$target"
   if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-    rm -rf "${target:?}/"*
+    find "${target:?}" -mindepth 1 -delete
   fi
 
   tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
@@ -3472,7 +3472,7 @@ fetch_and_deploy_codeberg_release() {
 
     mkdir -p "$target"
     if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-      rm -rf "${target:?}/"*
+      find "${target:?}" -mindepth 1 -delete
     fi
 
     tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
@@ -3575,7 +3575,7 @@ fetch_and_deploy_codeberg_release() {
 
     mkdir -p "$target"
     if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-      rm -rf "${target:?}/"*
+      find "${target:?}" -mindepth 1 -delete
     fi
 
     tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
@@ -3694,7 +3694,7 @@ fetch_and_deploy_codeberg_release() {
     unpack_tmp=$(mktemp -d)
     mkdir -p "$target"
     if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-      rm -rf "${target:?}/"*
+      find "${target:?}" -mindepth 1 -delete
     fi
 
     if [[ "$filename" == *.zip ]]; then
@@ -4112,7 +4112,7 @@ fetch_and_deploy_gh_release() {
 
     mkdir -p "$target"
     if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-      rm -rf "${target:?}/"*
+      find "${target:?}" -mindepth 1 -delete
     fi
 
     tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
@@ -4292,7 +4292,7 @@ fetch_and_deploy_gh_release() {
     unpack_tmp=$(mktemp -d)
     mkdir -p "$target"
     if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-      rm -rf "${target:?}/"*
+      find "${target:?}" -mindepth 1 -delete
     fi
 
     if [[ "$filename" == *.zip ]]; then
@@ -7157,7 +7157,7 @@ setup_meilisearch() {
         MEILI_DB_PATH="${MEILI_DB_PATH:-/var/lib/meilisearch/data}"
 
         msg_info "Removing old MeiliSearch database for migration"
-        rm -rf "${MEILI_DB_PATH:?}"/*
+        find "${MEILI_DB_PATH:?}" -mindepth 1 -delete
 
         # Import dump using CLI flag (this is the supported method)
         local DUMP_FILE="${MEILI_DUMP_DIR}/${DUMP_UID}.dump"
@@ -9131,6 +9131,16 @@ setup_uv() {
       msg_ok "uvx wrapper installed"
     fi
 
+    # Install specific Python version if requested (even when uv is already up to date)
+    if [[ -n "${PYTHON_VERSION:-}" ]]; then
+      msg_info "Installing Python $PYTHON_VERSION via uv"
+      $STD uv python install "$PYTHON_VERSION" || {
+        msg_error "Failed to install Python $PYTHON_VERSION"
+        return 150
+      }
+      msg_ok "Python $PYTHON_VERSION installed"
+    fi
+
     return 0
   fi
 
@@ -9390,7 +9400,7 @@ fetch_and_deploy_from_url() {
   mkdir -p "$directory"
 
   if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-    rm -rf "${directory:?}/"*
+    find "${directory:?}" -mindepth 1 -delete
   fi
 
   local unpack_tmp
@@ -9966,7 +9976,7 @@ fetch_and_deploy_gl_release() {
 
     mkdir -p "$target"
     if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-      rm -rf "${target:?}/"*
+      find "${target:?}" -mindepth 1 -delete
     fi
 
     tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
@@ -10128,7 +10138,7 @@ fetch_and_deploy_gl_release() {
     unpack_tmp=$(mktemp -d)
     mkdir -p "$target"
     if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-      rm -rf "${target:?}/"*
+      find "${target:?}" -mindepth 1 -delete
     fi
 
     if [[ "$filename" == *.zip ]]; then

From 3242b9a2d158a614b28ee5be877b3d7fa641363f Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Sat, 18 Jul 2026 22:10:27 +0000
Subject: [PATCH 187/220] Update CHANGELOG.md (#15879)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e41f26298..18ab9de36 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -510,6 +510,10 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
     - core: add configurable host CA inheritance during bootstrap [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15840](https://github.com/community-scripts/ProxmoxVE/pull/15840))
 
+  - #### 🔧 Refactor
+
+    - tools.func: Safe Delete Directorys & Update PYTHON_VERSION with setup_uv [@MickLesk](https://github.com/MickLesk) ([#15870](https://github.com/community-scripts/ProxmoxVE/pull/15870))
+
 ### 🧰 Tools
 
   - #### ✨ New Features

From e7f6a6d4cdf048e9b19b700e7dd217f94a54dcaf Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Sun, 19 Jul 2026 00:17:24 +0000
Subject: [PATCH 188/220] Archive old changelog entries (#15883)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 .github/changelogs/2026/07.md | 170 ++++++++++++++++++++++++++++++++++
 CHANGELOG.md                  | 131 +-------------------------
 2 files changed, 175 insertions(+), 126 deletions(-)

diff --git a/.github/changelogs/2026/07.md b/.github/changelogs/2026/07.md
index 2ecd58f89..36a2207bc 100644
--- a/.github/changelogs/2026/07.md
+++ b/.github/changelogs/2026/07.md
@@ -1,3 +1,173 @@
+## 2026-07-18
+
+### 💾 Core
+
+  - #### ✨ New Features
+
+    - core: add configurable host CA inheritance during bootstrap [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15840](https://github.com/community-scripts/ProxmoxVE/pull/15840))
+
+  - #### 🔧 Refactor
+
+    - tools.func: Safe Delete Directorys & Update PYTHON_VERSION with setup_uv [@MickLesk](https://github.com/MickLesk) ([#15870](https://github.com/community-scripts/ProxmoxVE/pull/15870))
+
+### 🧰 Tools
+
+  - #### ✨ New Features
+
+    - [tools.update-lxcs] feat: optional reporting success/failures to heathchecks.io (or others) [@sir106](https://github.com/sir106) ([#15701](https://github.com/community-scripts/ProxmoxVE/pull/15701))
+
+## 2026-07-17
+
+### 🆕 New Scripts
+
+  - Invidious ([#15824](https://github.com/community-scripts/ProxmoxVE/pull/15824))
+- OxiCloud ([#15823](https://github.com/community-scripts/ProxmoxVE/pull/15823))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - webtrees: initialize database schema before admin user creation [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15837](https://github.com/community-scripts/ProxmoxVE/pull/15837))
+    - Fix DocuSeal missing Leptonica deps on install and update [@Copilot](https://github.com/Copilot) ([#15858](https://github.com/community-scripts/ProxmoxVE/pull/15858))
+    - apache-guacamole: detect installed extensions during update [@TowyTowy](https://github.com/TowyTowy) ([#15841](https://github.com/community-scripts/ProxmoxVE/pull/15841))
+    - CLIProxyAPI: fix update deleting config.yaml [@austinpilz](https://github.com/austinpilz) ([#15834](https://github.com/community-scripts/ProxmoxVE/pull/15834))
+    - esphome: install libusb-1.0-0 for ESP-IDF native builds [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15838](https://github.com/community-scripts/ProxmoxVE/pull/15838))
+
+  - #### ✨ New Features
+
+    - AFFiNE: Bump to 0.27.0 [@MickLesk](https://github.com/MickLesk) ([#15848](https://github.com/community-scripts/ProxmoxVE/pull/15848))
+    - n8n: unpin / use latest release [@MickLesk](https://github.com/MickLesk) ([#15817](https://github.com/community-scripts/ProxmoxVE/pull/15817))
+    - Pin Opencloud to v7.3.0 [@vhsdream](https://github.com/vhsdream) ([#15826](https://github.com/community-scripts/ProxmoxVE/pull/15826))
+
+  - #### 🔧 Refactor
+
+    - SFTPGo: Update APT Repo & Re-Enable Script [@MickLesk](https://github.com/MickLesk) ([#15829](https://github.com/community-scripts/ProxmoxVE/pull/15829))
+
+### 💾 Core
+
+  - #### ✨ New Features
+
+    - tools.func: enhance rbenv with profile updates / bundle in bashrc [@MickLesk](https://github.com/MickLesk) ([#15822](https://github.com/community-scripts/ProxmoxVE/pull/15822))
+    - feat(build.func): notify users when already on a pinned script version [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15819](https://github.com/community-scripts/ProxmoxVE/pull/15819))
+
+  - #### 💥 Breaking Changes
+
+    - MongoDB: Implement kernel version check and patch [@MickLesk](https://github.com/MickLesk) ([#15821](https://github.com/community-scripts/ProxmoxVE/pull/15821))
+
+### 🧰 Tools
+
+  - #### ✨ New Features
+
+    - update-lxc: autoremove and autoclean after apt full-upgrade [@soupy-boy](https://github.com/soupy-boy) ([#15831](https://github.com/community-scripts/ProxmoxVE/pull/15831))
+
+## 2026-07-16
+
+### 🆕 New Scripts
+
+  - Sync-In ([#15812](https://github.com/community-scripts/ProxmoxVE/pull/15812))
+- Beaverhabits ([#15813](https://github.com/community-scripts/ProxmoxVE/pull/15813))
+- Notediscovery ([#15811](https://github.com/community-scripts/ProxmoxVE/pull/15811))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Pin Immich to v3.0.3 [@vhsdream](https://github.com/vhsdream) ([#15790](https://github.com/community-scripts/ProxmoxVE/pull/15790))
+
+## 2026-07-15
+
+### 🆕 New Scripts
+
+  - Nexterm ([#15688](https://github.com/community-scripts/ProxmoxVE/pull/15688))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - 2fauth: minor fixes for 8.0.0 [@MickLesk](https://github.com/MickLesk) ([#15795](https://github.com/community-scripts/ProxmoxVE/pull/15795))
+    - SnapOtter: refactor update process to prebuild [@MickLesk](https://github.com/MickLesk) ([#15797](https://github.com/community-scripts/ProxmoxVE/pull/15797))
+
+### 💾 Core
+
+  - #### 🔧 Refactor
+
+    - tools.func: default Docker setup to official repo [@MickLesk](https://github.com/MickLesk) ([#15794](https://github.com/community-scripts/ProxmoxVE/pull/15794))
+
+## 2026-07-14
+
+### 🆕 New Scripts
+
+  - Grav ([#15773](https://github.com/community-scripts/ProxmoxVE/pull/15773))
+- Yuvomi ([#15772](https://github.com/community-scripts/ProxmoxVE/pull/15772))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Lychee: Preserve uploads and ownership during update [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15768](https://github.com/community-scripts/ProxmoxVE/pull/15768))
+    - Wanderer: Clean deploy and install plugins for v0.20.0 update [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15759](https://github.com/community-scripts/ProxmoxVE/pull/15759))
+    - FileFlows: Handle update API 401, force update, and Node install [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15766](https://github.com/community-scripts/ProxmoxVE/pull/15766))
+    - BirdNET-Go: Match new upstream release asset naming [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15758](https://github.com/community-scripts/ProxmoxVE/pull/15758))
+    - [Upstream Fix] Immich: Fix loader priority [@vhsdream](https://github.com/vhsdream) ([#15755](https://github.com/community-scripts/ProxmoxVE/pull/15755))
+
+  - #### ✨ New Features
+
+    - Bump OpenCloud version to v7.2.2 [@MickLesk](https://github.com/MickLesk) ([#15769](https://github.com/community-scripts/ProxmoxVE/pull/15769))
+    - Silverbullet: Add optional Runtime API install via Chromium [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15761](https://github.com/community-scripts/ProxmoxVE/pull/15761))
+
+  - #### 💥 Breaking Changes
+
+    - Pangolin: Bump to 1.20.0 | BREAKING: Switch to PostgreSQL [@MickLesk](https://github.com/MickLesk) ([#15682](https://github.com/community-scripts/ProxmoxVE/pull/15682))
+
+  - #### 🔧 Refactor
+
+    - AFFiNE: Pin to v0.26.3 [@MickLesk](https://github.com/MickLesk) ([#15782](https://github.com/community-scripts/ProxmoxVE/pull/15782))
+
+## 2026-07-13
+
+### 🆕 New Scripts
+
+  - LeafWiki ([#15748](https://github.com/community-scripts/ProxmoxVE/pull/15748))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(hyperion): keep service running after container reboot [@TowyTowy](https://github.com/TowyTowy) ([#15653](https://github.com/community-scripts/ProxmoxVE/pull/15653))
+    - Change sign-in URL to admin URL in affine.sh [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15741](https://github.com/community-scripts/ProxmoxVE/pull/15741))
+    - immich: use actual PostgreSQL version for VectorChord package lookup [@mnavon](https://github.com/mnavon) ([#15705](https://github.com/community-scripts/ProxmoxVE/pull/15705))
+    - fix storyteller release selection for stable web tags [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15736](https://github.com/community-scripts/ProxmoxVE/pull/15736))
+    - Docmost: Fix update procedure [@MickLesk](https://github.com/MickLesk) ([#15732](https://github.com/community-scripts/ProxmoxVE/pull/15732))
+    - fix(shinobi): remove obsolete --unsafe-perm npm flag [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15730](https://github.com/community-scripts/ProxmoxVE/pull/15730))
+
+  - #### 💥 Breaking Changes
+
+    - reitti: update to v5 [@CrazyWolf13](https://github.com/CrazyWolf13) ([#15635](https://github.com/community-scripts/ProxmoxVE/pull/15635))
+
+### 💾 Core
+
+  - #### 🐞 Bug Fixes
+
+    - fix(build.func): parse script status without jq dependency [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15729](https://github.com/community-scripts/ProxmoxVE/pull/15729))
+
+  - #### 🔧 Refactor
+
+    - tools.func: some improvements (sql injection / command injection / guard) [@MickLesk](https://github.com/MickLesk) ([#15661](https://github.com/community-scripts/ProxmoxVE/pull/15661))
+
+## 2026-07-12
+
+### 🆕 New Scripts
+
+  - AFFiNE ([#15690](https://github.com/community-scripts/ProxmoxVE/pull/15690))
+
+### 🚀 Updated Scripts
+
+  - Immich: Bump version to 3.0.2 [@vhsdream](https://github.com/vhsdream) ([#15668](https://github.com/community-scripts/ProxmoxVE/pull/15668))
+
+### ❔ Uncategorized
+
+  - fix(immich): correct Python indentation error in ct/immich.sh heredoc patch [@Copilot](https://github.com/Copilot) ([#15723](https://github.com/community-scripts/ProxmoxVE/pull/15723))
+
 ## 2026-07-11
 
 ### 🆕 New Scripts
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 18ab9de36..e97facb0a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -77,6 +77,9 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 
 
+
+
+
 
 
 
@@ -90,7 +93,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 
 <details>
-<summary><h4>July (11 entries)</h4></summary>
+<summary><h4>July (18 entries)</h4></summary>
 
 [View July 2026 Changelog](.github/changelogs/2026/07.md)
 
@@ -1153,128 +1156,4 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - chore(ct): sync coredns defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#15182](https://github.com/community-scripts/ProxmoxVE/pull/15182))
 - chore(ct): sync gatus defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#15184](https://github.com/community-scripts/ProxmoxVE/pull/15184))
-- chore(ct): sync bitmagnet defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#15183](https://github.com/community-scripts/ProxmoxVE/pull/15183))
-
-## 2026-06-18
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - flowise: add deps / uv / python 3.11 [@MickLesk](https://github.com/MickLesk) ([#15177](https://github.com/community-scripts/ProxmoxVE/pull/15177))
-
-  - #### 💥 Breaking Changes
-
-    - refactor: crafty-controller [@CrazyWolf13](https://github.com/CrazyWolf13) ([#15178](https://github.com/community-scripts/ProxmoxVE/pull/15178))
-
-## 2026-06-17
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - kasm: fix release detection [@CrazyWolf13](https://github.com/CrazyWolf13) ([#15151](https://github.com/community-scripts/ProxmoxVE/pull/15151))
-
-  - #### ✨ New Features
-
-    - trek: update install and upgrade workflow for v3.1.0 [@MickLesk](https://github.com/MickLesk) ([#15165](https://github.com/community-scripts/ProxmoxVE/pull/15165))
-
-  - #### 💥 Breaking Changes
-
-    - TREK: Pin version [@tremor021](https://github.com/tremor021) ([#15156](https://github.com/community-scripts/ProxmoxVE/pull/15156))
-
-  - #### 🔧 Refactor
-
-    - chore(paperless-ngx): pin version to prevent v3 update [@tomfrenzel](https://github.com/tomfrenzel) ([#15171](https://github.com/community-scripts/ProxmoxVE/pull/15171))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - immich public proxy: replace npm install with npm ci for consistent dependency installation [@MickLesk](https://github.com/MickLesk) ([#15166](https://github.com/community-scripts/ProxmoxVE/pull/15166))
-
-## 2026-06-16
-
-### 🆕 New Scripts
-
-  - Feishin ([#15130](https://github.com/community-scripts/ProxmoxVE/pull/15130))
-- Kiwix ([#15131](https://github.com/community-scripts/ProxmoxVE/pull/15131))
-- Add runtime status guard and deleted script stubs [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15125](https://github.com/community-scripts/ProxmoxVE/pull/15125))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - fix(degoog): use localhost for valkey url [@ethan-hgwr](https://github.com/ethan-hgwr) ([#15149](https://github.com/community-scripts/ProxmoxVE/pull/15149))
-    - Fix InvoiceShelf install/update Yarn package manager mismatch [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15141](https://github.com/community-scripts/ProxmoxVE/pull/15141))
-    - fix storyteller install failure with yarn 4 corepack [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15140](https://github.com/community-scripts/ProxmoxVE/pull/15140))
-    - fix: generate policy-compliant OpenObserve root password [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15137](https://github.com/community-scripts/ProxmoxVE/pull/15137))
-
-## 2026-06-15
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Watcharr: Clean install on update [@tremor021](https://github.com/tremor021) ([#15119](https://github.com/community-scripts/ProxmoxVE/pull/15119))
-    - Vaultwarden: extend version check for VaultWarden update [@MickLesk](https://github.com/MickLesk) ([#15105](https://github.com/community-scripts/ProxmoxVE/pull/15105))
-
-  - #### ✨ New Features
-
-    - degoog: add curl-impersonate to script [@MickLesk](https://github.com/MickLesk) ([#15117](https://github.com/community-scripts/ProxmoxVE/pull/15117))
-
-### 💾 Core
-
-  - #### ✨ New Features
-
-    - tools.func: extend mesa-vulkan-drivers and vulkan-tools to installation for ARC GPU's [@MickLesk](https://github.com/MickLesk) ([#15106](https://github.com/community-scripts/ProxmoxVE/pull/15106))
-
-  - #### 🔧 Refactor
-
-    - core: improve mirror selection and error handling [@MickLesk](https://github.com/MickLesk) ([#15108](https://github.com/community-scripts/ProxmoxVE/pull/15108))
-    - core: implement gateway validation for DHCP and static networks [@MickLesk](https://github.com/MickLesk) ([#15107](https://github.com/community-scripts/ProxmoxVE/pull/15107))
-
-## 2026-06-14
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Iinvoiceninja: fix nginx setup assets port [@MickLesk](https://github.com/MickLesk) ([#15090](https://github.com/community-scripts/ProxmoxVE/pull/15090))
-    - CheckMK: remove stale backup site before creating new backup during update [@MickLesk](https://github.com/MickLesk) ([#15088](https://github.com/community-scripts/ProxmoxVE/pull/15088))
-
-  - #### 🔧 Refactor
-
-    - Refactor: Implement backup functions for scripts C-D [@tremor021](https://github.com/tremor021) ([#15096](https://github.com/community-scripts/ProxmoxVE/pull/15096))
-
-## 2026-06-13
-
-### 🆕 New Scripts
-
-  - BookOrbit ([#15080](https://github.com/community-scripts/ProxmoxVE/pull/15080))
-
-### 🚀 Updated Scripts
-
-  - Update authentik version to 2026.5.3 [@thieneret](https://github.com/thieneret) ([#15093](https://github.com/community-scripts/ProxmoxVE/pull/15093))
-
-  - #### 🐞 Bug Fixes
-
-    - Immich: Update image-processing libraries [@vhsdream](https://github.com/vhsdream) ([#15082](https://github.com/community-scripts/ProxmoxVE/pull/15082))
-    - HomeBox: Support v0.26.0 [@tomfrenzel](https://github.com/tomfrenzel) ([#15086](https://github.com/community-scripts/ProxmoxVE/pull/15086))
-
-  - #### 🔧 Refactor
-
-    - Refactor: Implement backup functions for scripts A-B [@tremor021](https://github.com/tremor021) ([#15075](https://github.com/community-scripts/ProxmoxVE/pull/15075))
-
-## 2026-06-12
-
-### 🆕 New Scripts
-
-  - Twenty ([#15047](https://github.com/community-scripts/ProxmoxVE/pull/15047))
-- Alpine-Cinny ([#15044](https://github.com/community-scripts/ProxmoxVE/pull/15044))
-
-### 💾 Core
-
-  - #### ✨ New Features
-
-    - [core] Implement backup and restore functions [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15067](https://github.com/community-scripts/ProxmoxVE/pull/15067))
\ No newline at end of file
+- chore(ct): sync bitmagnet defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#15183](https://github.com/community-scripts/ProxmoxVE/pull/15183))
\ No newline at end of file

From c07dc4a4c39dd2719c5e32a479c52679fe8fa238 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Sun, 19 Jul 2026 00:17:46 +0000
Subject: [PATCH 189/220] Update CHANGELOG.md (#15884)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e97facb0a..2b3332fdf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -505,6 +505,8 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-07-19
+
 ## 2026-07-18
 
 ### 💾 Core

From bbd5a3f522a90f38369abc72f186605825c57ad5 Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Sun, 19 Jul 2026 09:41:52 +0200
Subject: [PATCH 190/220] Revert "add configurable host CA inheritance for LXC
 bootstrap (#15840)" (#15886)

This reverts commit eb5a5b2cb769681fec7c27d761d9286d83969e4b.
---
 misc/build.func | 143 +++---------------------------------------------
 1 file changed, 7 insertions(+), 136 deletions(-)

diff --git a/misc/build.func b/misc/build.func
index f22692d42..53509780f 100644
--- a/misc/build.func
+++ b/misc/build.func
@@ -1009,7 +1009,6 @@ base_settings() {
 
   APT_CACHER=${var_apt_cacher:-""}
   APT_CACHER_IP=${var_apt_cacher_ip:-""}
-  INHERIT_HOST_CA="${var_inherit_host_ca:-auto}"
 
   # Runtime check: Verify APT cacher is reachable if configured
   if [[ -n "$APT_CACHER_IP" && "$APT_CACHER" == "yes" ]]; then
@@ -1089,7 +1088,7 @@ load_vars_file() {
 
   # Allowed var_* keys
   local VAR_WHITELIST=(
-    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_inherit_host_ca var_keyctl
+    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_keyctl
     var_gateway var_hostname var_ipv6_method var_mac var_mknod var_mount_fs var_mtu
     var_net var_nesting var_ns var_os var_protection var_pw var_ram var_tags var_timezone var_tun var_unprivileged
     var_verbose var_version var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage var_searchdomain
@@ -1286,12 +1285,6 @@ load_vars_file() {
             continue
           fi
           ;;
-        var_inherit_host_ca)
-          if [[ "$var_val" != "yes" && "$var_val" != "no" && "$var_val" != "auto" ]]; then
-            msg_warn "Invalid host CA inheritance value '$var_val' in $file (must be yes/no/auto), ignoring"
-            continue
-          fi
-          ;;
         var_container_storage | var_template_storage)
           # Validate that the storage exists and is active on the current node
           local _storage_status
@@ -1331,7 +1324,7 @@ default_var_settings() {
   # Allowed var_* keys (alphabetically sorted)
   # Note: Removed var_ctid (can only exist once), var_ipv6_static (static IPs are unique)
   local VAR_WHITELIST=(
-    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_inherit_host_ca var_keyctl
+    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_keyctl
     var_gateway var_hostname var_ipv6_method var_mac var_mknod var_mount_fs var_mtu
     var_net var_nesting var_ns var_os var_protection var_pw var_ram var_tags var_timezone var_tun var_unprivileged
     var_verbose var_version var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage
@@ -1414,7 +1407,6 @@ var_ssh=no
 # HTTP/HTTPS proxy (optional - for networks requiring a proxy)
 # var_http_proxy=http://proxy.local:8080
 # var_http_no_proxy=localhost,127.0.0.1,.local
-# var_inherit_host_ca=auto
 
 # Features/Tags/verbosity
 var_fuse=no
@@ -1515,7 +1507,7 @@ get_app_defaults_path() {
 if ! declare -p VAR_WHITELIST >/dev/null 2>&1; then
   # Note: Removed var_ctid (can only exist once), var_ipv6_static (static IPs are unique)
   declare -ag VAR_WHITELIST=(
-    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_inherit_host_ca var_keyctl
+    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_keyctl
     var_gateway var_hostname var_ipv6_method var_mac var_mknod var_mount_fs var_mtu
     var_net var_nesting var_ns var_os var_protection var_pw var_ram var_tags var_timezone var_tun var_unprivileged
     var_verbose var_version var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage var_searchdomain
@@ -1665,7 +1657,6 @@ _build_current_app_vars_tmp() {
   _apt_cacher_ip="${APT_CACHER_IP:-}"
   _http_proxy="${HTTP_PROXY:-${var_http_proxy:-}}"
   _http_no_proxy="${HTTP_NO_PROXY:-${var_http_no_proxy:-}}"
-  _inherit_host_ca="${INHERIT_HOST_CA:-${var_inherit_host_ca:-auto}}"
   _fuse="${ENABLE_FUSE:-no}"
   _tun="${ENABLE_TUN:-no}"
   _gpu="${ENABLE_GPU:-no}"
@@ -1719,7 +1710,6 @@ _build_current_app_vars_tmp() {
     [ -n "$_apt_cacher_ip" ] && echo "var_apt_cacher_ip=$(_sanitize_value "$_apt_cacher_ip")"
     [ -n "$_http_proxy" ] && echo "var_http_proxy=$(_sanitize_value "$_http_proxy")"
     [ -n "$_http_no_proxy" ] && echo "var_http_no_proxy=$(_sanitize_value "$_http_no_proxy")"
-    [ -n "$_inherit_host_ca" ] && echo "var_inherit_host_ca=$(_sanitize_value "$_inherit_host_ca")"
 
     [ -n "$_fuse" ] && echo "var_fuse=$(_sanitize_value "$_fuse")"
     [ -n "$_tun" ] && echo "var_tun=$(_sanitize_value "$_tun")"
@@ -1884,7 +1874,7 @@ advanced_settings() {
     TAGS="community-script${var_tags:+;${var_tags}}"
   fi
   local STEP=1
-  local MAX_STEP=31
+  local MAX_STEP=30
 
   # Store values for back navigation - inherit from var_* app defaults
   local _ct_type="${var_unprivileged:-1}"
@@ -1906,7 +1896,6 @@ advanced_settings() {
   local _apt_cacher_ip="${var_apt_cacher_ip:-}"
   local _http_proxy="${var_http_proxy:-}"
   local _http_no_proxy="${var_http_no_proxy:-}"
-  local _inherit_host_ca="${var_inherit_host_ca:-auto}"
   local _mtu="${var_mtu:-}"
   local _sd="${var_searchdomain:-}"
   local _ns="${var_ns:-}"
@@ -2736,47 +2725,9 @@ advanced_settings() {
       ;;
 
     # ═══════════════════════════════════════════════════════════════════════════
-    # STEP 25: Host CA Inheritance
+    # STEP 25: Container Timezone
     # ═══════════════════════════════════════════════════════════════════════════
     25)
-      local host_ca_count=0
-      local host_ca_dir="/usr/local/share/ca-certificates"
-      local cert
-      shopt -s nullglob
-      for cert in "$host_ca_dir"/*.crt; do
-        host_ca_count=$((host_ca_count + 1))
-      done
-      shopt -u nullglob
-
-      if [[ $host_ca_count -eq 0 ]]; then
-        _inherit_host_ca="auto"
-        ((STEP++))
-        continue
-      fi
-
-      local host_ca_default_flag=""
-      [[ "$_inherit_host_ca" == "no" ]] && host_ca_default_flag="--defaultno"
-      if whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
-        --title "HOST CA INHERITANCE" \
-        --ok-button "Next" --cancel-button "Back" \
-        $host_ca_default_flag \
-        --yesno "\nInherit host CA certificates into this container?\n\nDetected on host: ${host_ca_count} certificate(s) in:\n${host_ca_dir}\n\nRecommended for private PKI / TLS-inspection environments.\n\n(App default: ${var_inherit_host_ca:-auto})" 16 72; then
-        _inherit_host_ca="yes"
-      else
-        if [ $? -eq 1 ]; then
-          _inherit_host_ca="no"
-        else
-          ((STEP--))
-          continue
-        fi
-      fi
-      ((STEP++))
-      ;;
-
-    # ═══════════════════════════════════════════════════════════════════════════
-    # STEP 26: Container Timezone
-    # ═══════════════════════════════════════════════════════════════════════════
-    26)
       local tz_hint="$_ct_timezone"
       [[ -z "$tz_hint" ]] && tz_hint="(empty - will use host timezone)"
 
@@ -2799,9 +2750,9 @@ advanced_settings() {
       ;;
 
     # ═══════════════════════════════════════════════════════════════════════════
-    # STEP 27: Container Protection
+    # STEP 26: Container Protection
     # ═══════════════════════════════════════════════════════════════════════════
-    27)
+    26)
       local protect_default_flag="--defaultno"
       [[ "$_protect_ct" == "yes" || "$_protect_ct" == "1" ]] && protect_default_flag=""
 
@@ -2953,7 +2904,6 @@ Leave empty to skip."
       local apt_display="${_apt_cacher:-no}"
       [[ "$_apt_cacher" == "yes" && -n "$_apt_cacher_ip" ]] && apt_display="$_apt_cacher_ip"
       local http_proxy_display="${_http_proxy:-(none)}"
-      local inherit_ca_display="${_inherit_host_ca:-auto}"
 
       local post_install_display="${_post_install:-(none)}"
       local post_install_warn=""
@@ -2984,7 +2934,6 @@ Advanced:
   Timezone: $tz_display
   APT Cacher: $apt_display
   HTTP Proxy: $http_proxy_display
-  Inherit Host CAs: $inherit_ca_display
   Verbose: $_verbose
   Post-Install Script: ${post_install_display}${post_install_warn}"
 
@@ -3030,7 +2979,6 @@ Advanced:
   APT_CACHER_IP="$_apt_cacher_ip"
   HTTP_PROXY="$_http_proxy"
   HTTP_NO_PROXY="$_http_no_proxy"
-  INHERIT_HOST_CA="$_inherit_host_ca"
   VERBOSE="$_verbose"
   var_post_install="$_post_install"
 
@@ -3049,7 +2997,6 @@ Advanced:
   var_sdn_vnet="$_sdn_vnet"
   var_http_proxy="$_http_proxy"
   var_http_no_proxy="$_http_no_proxy"
-  var_inherit_host_ca="$_inherit_host_ca"
 
   # Format optional values
   [[ -n "$_mtu" ]] && MTU=",mtu=$_mtu" || MTU=""
@@ -3998,81 +3945,6 @@ EOF
   msg_ok "Applied HTTP proxy in container"
 }
 
-# ------------------------------------------------------------------------------
-# _apply_host_ca_certs_in_container()
-#
-# - Copies administrator-provided CA certificates from the Proxmox host into the
-#   container before base package bootstrap
-# - Source: /usr/local/share/ca-certificates/*.crt (Debian convention)
-# - Refreshes the container trust store when update-ca-certificates is available
-# - No-op when no host certificates are present; failures are non-fatal
-# ------------------------------------------------------------------------------
-_apply_host_ca_certs_in_container() {
-  local host_ca_dir="/usr/local/share/ca-certificates"
-  [[ -z "${CTID:-}" ]] && return 0
-  local inherit_host_ca="${INHERIT_HOST_CA:-${var_inherit_host_ca:-auto}}"
-
-  local -a host_certs=()
-  local cert
-  shopt -s nullglob
-  for cert in "$host_ca_dir"/*.crt; do
-    host_certs+=("$cert")
-  done
-  shopt -u nullglob
-
-  [[ ${#host_certs[@]} -eq 0 ]] && return 0
-
-  case "${inherit_host_ca,,}" in
-  no | false | 0 | off)
-    msg_info "Skipping host CA inheritance by configuration"
-    return 0
-    ;;
-  esac
-
-  msg_info "Inheriting host CA certificates into container"
-
-  local found=${#host_certs[@]}
-  local copied=0
-  local skipped=0
-  local cert_name
-
-  pct exec "$CTID" -- mkdir -p /usr/local/share/ca-certificates >/dev/null 2>&1 || {
-    msg_warn "Failed to create CA certificate directory in container"
-    return 0
-  }
-
-  for cert in "${host_certs[@]}"; do
-    cert_name="$(basename "$cert")"
-    if [[ ! -r "$cert" || "$cert_name" != *.crt ]]; then
-      msg_warn "Skipping invalid or unreadable host CA certificate: ${cert_name}"
-      skipped=$((skipped + 1))
-      continue
-    fi
-
-    if pct push "$CTID" "$cert" "/usr/local/share/ca-certificates/${cert_name}" >/dev/null 2>&1; then
-      pct exec "$CTID" -- chmod 644 "/usr/local/share/ca-certificates/${cert_name}" >/dev/null 2>&1 || true
-      copied=$((copied + 1))
-    else
-      msg_warn "Failed to push host CA certificate: ${cert_name}"
-      skipped=$((skipped + 1))
-    fi
-  done
-
-  if [[ $copied -eq 0 ]]; then
-    msg_warn "No host CA certificates were copied (${found} found, ${skipped} skipped)"
-    return 0
-  fi
-
-  local refresh_shell="bash"
-  [[ "$var_os" == "alpine" ]] && refresh_shell="ash"
-
-  if pct exec "$CTID" -- "$refresh_shell" -c 'command -v update-ca-certificates >/dev/null 2>&1 && update-ca-certificates' >/dev/null 2>&1; then
-    msg_ok "Inherited ${copied} host CA certificate(s) and updated trust store (${skipped} skipped)"
-  else
-    msg_warn "Copied ${copied} host CA certificate(s), but trust store update failed or update-ca-certificates is unavailable (${skipped} skipped)"
-  fi
-}
-
 # ------------------------------------------------------------------------------
 # build_container()
 #
@@ -4693,7 +4565,6 @@ EOF
   local install_exit_code=0
 
   _apply_http_proxy_in_container
-  _apply_host_ca_certs_in_container
 
   # Continue with standard container setup
   if [ "$var_os" == "alpine" ]; then

From 8c7da1e036ad04618ffbb0b1861e7e4d50e8aab4 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Sun, 19 Jul 2026 07:42:15 +0000
Subject: [PATCH 191/220] Update CHANGELOG.md (#15887)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2b3332fdf..7ee82801f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -507,6 +507,10 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ## 2026-07-19
 
+### 💾 Core
+
+  - Revert "core: add configurable host CA inheritance during bootstrap" [@MickLesk](https://github.com/MickLesk) ([#15886](https://github.com/community-scripts/ProxmoxVE/pull/15886))
+
 ## 2026-07-18
 
 ### 💾 Core

From b2898debce3cecec3f2787164cabce4179a585b7 Mon Sep 17 00:00:00 2001
From: Chris <punk.sand7393@fastmail.com>
Date: Sun, 19 Jul 2026 05:16:44 -0400
Subject: [PATCH 192/220] [FIX] BookOrbit: add missing `restore_backup` during
 update (#15881)

- Otherwise the `.env` file is not restored and the sed command fails
---
 ct/bookorbit.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ct/bookorbit.sh b/ct/bookorbit.sh
index 7b0e95c13..b955ddd5a 100644
--- a/ct/bookorbit.sh
+++ b/ct/bookorbit.sh
@@ -53,6 +53,7 @@ function update_script() {
     mkdir -p /opt/bookorbit/server/migrations
     cp -r /opt/bookorbit/server/src/db/migrations/. /opt/bookorbit/server/migrations/
     chmod +x /opt/bookorbit/server/bin/kepubify/*
+    restore_backup
     APP_VER=$(cat ~/.bookorbit)
     sed -i "s/^APP_VERSION=.*/APP_VERSION=v$APP_VER/" /opt/bookorbit/.env
     msg_ok "Rebuilt Application"

From beacf9e43af8488322944e64b21ec1f4329935c5 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Sun, 19 Jul 2026 09:17:11 +0000
Subject: [PATCH 193/220] Update CHANGELOG.md (#15892)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7ee82801f..f3d5c185b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -507,6 +507,12 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ## 2026-07-19
 
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - [FIX] BookOrbit: add missing `restore_backup` during update [@vhsdream](https://github.com/vhsdream) ([#15881](https://github.com/community-scripts/ProxmoxVE/pull/15881))
+
 ### 💾 Core
 
   - Revert "core: add configurable host CA inheritance during bootstrap" [@MickLesk](https://github.com/MickLesk) ([#15886](https://github.com/community-scripts/ProxmoxVE/pull/15886))

From 8f9c4eb13ba859292c27bb41af31d784f13ef48e Mon Sep 17 00:00:00 2001
From: thieneret <123479547+thieneret@users.noreply.github.com>
Date: Sun, 19 Jul 2026 13:21:14 +0200
Subject: [PATCH 194/220] update authentik to 2026.5.5 (#15855)

---
 ct/authentik.sh              | 7 ++++---
 install/authentik-install.sh | 6 +++---
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/ct/authentik.sh b/ct/authentik.sh
index c8b99db82..ec597f15c 100644
--- a/ct/authentik.sh
+++ b/ct/authentik.sh
@@ -38,13 +38,14 @@ function update_script() {
 
   NODE_VERSION="24" setup_nodejs
   setup_go
-  UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.3" setup_uv
+  $STD uv cache clean
+  UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.6" setup_uv
   RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
   setup_yq
 
-  AUTHENTIK_VERSION="version/2026.5.3"
+  AUTHENTIK_VERSION="version/2026.5.5"
   # Source: https://github.com/goauthentik/fips/blob/main/Makefile#L26
-  XMLSEC_VERSION="1.3.11"
+  XMLSEC_VERSION="1.3.12"
 
   if check_for_gh_release "geoipupdate" "maxmind/geoipupdate"; then
     fetch_and_deploy_gh_release "geoipupdate" "maxmind/geoipupdate" "binary"
diff --git a/install/authentik-install.sh b/install/authentik-install.sh
index 13e4fbe3d..02f89c922 100644
--- a/install/authentik-install.sh
+++ b/install/authentik-install.sh
@@ -54,12 +54,12 @@ NODE_VERSION="24" setup_nodejs
 setup_yq
 setup_go
 RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
-UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.3" setup_uv
+UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.6" setup_uv
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db
 
-XMLSEC_VERSION="1.3.11"
-AUTHENTIK_VERSION="version/2026.5.3"
+XMLSEC_VERSION="1.3.12"
+AUTHENTIK_VERSION="version/2026.5.5"
 fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec"
 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
 fetch_and_deploy_gh_release "geoipupdate" "maxmind/geoipupdate" "binary"

From 8f0083850e466b2609acf54196ca4190cf32b618 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Sun, 19 Jul 2026 11:21:43 +0000
Subject: [PATCH 195/220] Update CHANGELOG.md (#15896)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f3d5c185b..b7a4ce291 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -511,6 +511,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - update authentik to 2026.5.5 [@thieneret](https://github.com/thieneret) ([#15855](https://github.com/community-scripts/ProxmoxVE/pull/15855))
     - [FIX] BookOrbit: add missing `restore_backup` during update [@vhsdream](https://github.com/vhsdream) ([#15881](https://github.com/community-scripts/ProxmoxVE/pull/15881))
 
 ### 💾 Core

From 787e27a4acf73ff21bca566623363e80c64510c3 Mon Sep 17 00:00:00 2001
From: Sam Heinz <sam@samheinz.com>
Date: Sun, 19 Jul 2026 22:02:56 +1000
Subject: [PATCH 196/220] change trek repo to liketrek/TREK (#15893)

---
 ct/trek.sh              | 8 ++++----
 install/trek-install.sh | 6 +++---
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/ct/trek.sh b/ct/trek.sh
index be958f75f..9df637780 100644
--- a/ct/trek.sh
+++ b/ct/trek.sh
@@ -3,7 +3,7 @@ source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxV
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/mauriceboe/TREK
+# Source: https://github.com/liketrek/TREK
 
 APP="TREK"
 var_tags="${var_tags:-travel;planning;collaboration}"
@@ -32,7 +32,7 @@ function update_script() {
 
   NODE_VERSION="24" setup_nodejs
 
-  if check_for_gh_release "trek" "mauriceboe/TREK"; then
+  if check_for_gh_release "trek" "liketrek/TREK"; then
     MIGRATION=0
     grep -qF "ExecStart=/usr/bin/node --import tsx src/index.ts" \
       /etc/systemd/system/trek.service && MIGRATION=1
@@ -47,7 +47,7 @@ function update_script() {
       /opt/trek/data \
       /opt/trek/uploads
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "trek" "mauriceboe/TREK" "tarball"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "trek" "liketrek/TREK" "tarball"
 
     msg_info "Building TREK"
     cd /opt/trek
@@ -79,7 +79,7 @@ function update_script() {
       cat <<EOF >/etc/systemd/system/trek.service
 [Unit]
 Description=TREK Travel Planner
-Documentation=https://github.com/mauriceboe/TREK
+Documentation=https://github.com/liketrek/TREK
 After=network-online.target
 Wants=network-online.target
 
diff --git a/install/trek-install.sh b/install/trek-install.sh
index c189afc1b..1161ce73a 100644
--- a/install/trek-install.sh
+++ b/install/trek-install.sh
@@ -3,7 +3,7 @@
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/mauriceboe/TREK
+# Source: https://github.com/liketrek/TREK
 
 source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
 color
@@ -20,7 +20,7 @@ $STD apt install -y \
 msg_ok "Installed Dependencies"
 
 NODE_VERSION="24" setup_nodejs
-fetch_and_deploy_gh_release "trek" "mauriceboe/TREK" "tarball"
+fetch_and_deploy_gh_release "trek" "liketrek/TREK" "tarball"
 
 msg_info "Setup TREK"
 cd /opt/trek
@@ -78,7 +78,7 @@ msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/trek.service
 [Unit]
 Description=TREK Travel Planner
-Documentation=https://github.com/mauriceboe/TREK
+Documentation=https://github.com/liketrek/TREK
 After=network-online.target
 Wants=network-online.target
 

From 0dbea508d3f12cb1039b8221917958670b145b52 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Sun, 19 Jul 2026 12:03:22 +0000
Subject: [PATCH 197/220] Update CHANGELOG.md (#15898)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b7a4ce291..c3ecd3284 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -511,6 +511,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - change trek repo to liketrek/TREK [@asylumexp](https://github.com/asylumexp) ([#15893](https://github.com/community-scripts/ProxmoxVE/pull/15893))
     - update authentik to 2026.5.5 [@thieneret](https://github.com/thieneret) ([#15855](https://github.com/community-scripts/ProxmoxVE/pull/15855))
     - [FIX] BookOrbit: add missing `restore_backup` during update [@vhsdream](https://github.com/vhsdream) ([#15881](https://github.com/community-scripts/ProxmoxVE/pull/15881))
 

From e425d9c02cc62397a0353eed10126b8aefa47daf Mon Sep 17 00:00:00 2001
From: tdn131 <32997056+tdn131@users.noreply.github.com>
Date: Sun, 19 Jul 2026 14:52:42 +0200
Subject: [PATCH 198/220] Update OPNsense from 26.1 to 26.7 (#15895)

---
 vm/opnsense-vm.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/vm/opnsense-vm.sh b/vm/opnsense-vm.sh
index 3b18e3b74..4d15f25be 100644
--- a/vm/opnsense-vm.sh
+++ b/vm/opnsense-vm.sh
@@ -24,7 +24,7 @@ RANDOM_UUID="$(cat /proc/sys/kernel/random/uuid)"
 METHOD=""
 NSAPP="opnsense-vm"
 var_os="opnsense"
-var_version="26.1"
+var_version="26.7"
 #
 GEN_MAC=02:$(openssl rand -hex 5 | awk '{print toupper($0)}' | sed 's/\(..\)/\1:/g; s/.$//')
 GEN_MAC_LAN=02:$(openssl rand -hex 5 | awk '{print toupper($0)}' | sed 's/\(..\)/\1:/g; s/.$//')
@@ -814,7 +814,7 @@ if [ -n "$WAN_BRG" ]; then
   msg_ok "WAN interface added"
   sleep 5 # Brief pause after adding network interface
 fi
-send_line_to_vm "sh ./opnsense-bootstrap.sh.in -y -f -r 26.1"
+send_line_to_vm "sh ./opnsense-bootstrap.sh.in -y -f -r 26.7"
 msg_ok "OPNsense VM is being installed, do not close the terminal, or the installation will fail."
 #We need to wait for the OPNsense build proccess to finish, this takes a few minutes
 sleep 1000

From a1058256be2fd1a3568441ac93e2cc48257d9647 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Sun, 19 Jul 2026 12:53:02 +0000
Subject: [PATCH 199/220] Update CHANGELOG.md (#15899)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c3ecd3284..f9386336b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -515,6 +515,10 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
     - update authentik to 2026.5.5 [@thieneret](https://github.com/thieneret) ([#15855](https://github.com/community-scripts/ProxmoxVE/pull/15855))
     - [FIX] BookOrbit: add missing `restore_backup` during update [@vhsdream](https://github.com/vhsdream) ([#15881](https://github.com/community-scripts/ProxmoxVE/pull/15881))
 
+  - #### ✨ New Features
+
+    - Update OPNsense from 26.1 to 26.7 [@tdn131](https://github.com/tdn131) ([#15895](https://github.com/community-scripts/ProxmoxVE/pull/15895))
+
 ### 💾 Core
 
   - Revert "core: add configurable host CA inheritance during bootstrap" [@MickLesk](https://github.com/MickLesk) ([#15886](https://github.com/community-scripts/ProxmoxVE/pull/15886))

From b098501a3751c366ce794d8b968acdcea4f675d5 Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Sun, 19 Jul 2026 14:53:46 +0200
Subject: [PATCH 200/220] tools.func: centralize deploy tail + trap-based
 tmpdir cleanup (#15872)

* tools.func: replace rm -rf with find for safer directory cleanup

* tools.func: replace rm -rf with find for safer directory cleanup

* refactor(tools.func): centralize deploy tail + trap-based tmpdir cleanup

Extract the duplicated post-download logic of the fetch_and_deploy_*
helpers into two shared functions and switch per-branch cleanup to a
single RETURN trap.

- _deploy_source_tarball: shared source-tarball tail (6 call sites)
- _deploy_unpacked_archive: shared prebuild-archive tail (3 call sites)
- RETURN trap per function guarantees tmpdir/unpack_tmp cleanup on every
  return path, replacing ~40 manual `rm -rf "$tmpdir"` lines
- CLEAN_INSTALL now lives in the helpers instead of 12 copies

Behavior-preserving except: codeberg prebuild gains .txz support and
uses helper return codes; from_url resets shopt on error paths.

* Add _download_source_tarball with retry/validation

Introduce `_download_source_tarball` helper that validates gzip integrity after download and retries up to 3 times. This guards against truncated-but-valid-HTTP responses from GitHub/GitLab/Codeberg on-the-fly archive generation. Replace ad-hoc curl/curl_download calls in fetch_and_deploy_* functions with the new helper. Also remove redundant tmpdir cleanup before early returns (tmpdir is cleaned up at function exit).

* Fix Manyfold Ruby setup home initialization

Create the `manyfold` service user before calling `setup_ruby` so `/home/manyfold` exists when rbenv profile snippets are written. Also harden `setup_ruby` by creating `$HOME` if missing, preventing profile-write failures for installers that pass a home directory before creating the user.

* Update install/manyfold-install.sh

---------

Co-authored-by: Sam Heinz <sam@samheinz.com>
---
 install/manyfold-install.sh |   3 +-
 misc/tools.func             | 510 +++++++++++++-----------------------
 2 files changed, 177 insertions(+), 336 deletions(-)

diff --git a/install/manyfold-install.sh b/install/manyfold-install.sh
index dfc43b49e..0a025b1cf 100644
--- a/install/manyfold-install.sh
+++ b/install/manyfold-install.sh
@@ -31,13 +31,14 @@ NODE_VERSION="24" NODE_MODULE="corepack,yarn" setup_nodejs
 
 fetch_and_deploy_gh_release "manyfold" "manyfold3d/manyfold" "tarball" "latest" "/opt/manyfold/app"
 
+useradd -m -s /usr/bin/bash manyfold
+
 RUBY_INSTALL_VERSION=$(cat /opt/manyfold/app/.ruby-version)
 RUBY_VERSION=${RUBY_INSTALL_VERSION} RUBY_INSTALL_RAILS="true" HOME=/home/manyfold setup_ruby
 
 msg_info "Configuring Manyfold"
 YARN_VERSION=$(grep '"packageManager":' /opt/manyfold/app/package.json | sed -E 's/.*"(yarn@[0-9\.]+)".*/\1/')
 RELEASE=$(get_latest_github_release "manyfold3d/manyfold")
-useradd -m -s /usr/bin/bash manyfold
 cat <<EOF >/opt/manyfold/.env
 export APP_VERSION=${RELEASE}
 export GUID=1002
diff --git a/misc/tools.func b/misc/tools.func
index 64669fad1..cc5e66162 100644
--- a/misc/tools.func
+++ b/misc/tools.func
@@ -2483,6 +2483,150 @@ verify_gpg_fingerprint() {
   return 65
 }
 
+# ------------------------------------------------------------------------------
+# _download_source_tarball <url> <dest> [curl args...]
+#
+# Downloads a source .tar.gz to <dest> and verifies the gzip stream is complete
+# before returning. Source forges (GitHub/GitLab/Codeberg) build these archives
+# on the fly; for large repos the response is occasionally a truncated-but-
+# cleanly-closed gzip that curl accepts as success (HTTP 200) and which then
+# fails at extraction time. We validate with `gzip -t` and re-download on
+# failure, and abort stalled transfers (--speed-time) so a hung generation
+# retries instead of blocking for minutes. Extra args pass through to curl
+# (e.g. auth headers like -H "PRIVATE-TOKEN: ...").
+#
+# Returns: 0 on success, 250 on persistent failure.
+# ------------------------------------------------------------------------------
+_download_source_tarball() {
+  local url="$1" dest="$2"
+  shift 2
+  local attempt max=3
+  for ((attempt = 1; attempt <= max; attempt++)); do
+    if curl --connect-timeout 15 --max-time 900 --speed-limit 1024 --speed-time 60 \
+      -fsSL "$@" -o "$dest" "$url" && gzip -t "$dest" 2>/dev/null; then
+      return 0
+    fi
+    rm -f "$dest"
+    ((attempt < max)) && {
+      msg_warn "Source archive download failed or incomplete (attempt ${attempt}/${max}), retrying..."
+      sleep $((attempt * 3))
+    }
+  done
+  return 250
+}
+
+# ------------------------------------------------------------------------------
+# _deploy_source_tarball <tarball_path> <target> <workdir>
+#
+# Shared tail for the *source tarball* modes of the fetch_and_deploy_* helpers
+# (GitHub/GitLab/Codeberg archive tarballs that contain a single top-level
+# directory). Extracts <tarball_path> into <workdir>, then copies the contents
+# of that top-level directory into <target>.
+#
+#   - Honors CLEAN_INSTALL=1 (wipes <target> first, dotfiles included).
+#   - Does NOT own <workdir>: the caller creates it and is responsible for its
+#     cleanup (typically via a RETURN trap on its tmpdir).
+#   - cp failures are non-fatal here, matching the previous inline behavior.
+#
+# Returns: 0 on success (or non-fatal cp failure), 251 on extraction failure.
+# ------------------------------------------------------------------------------
+_deploy_source_tarball() {
+  local tarball="$1" target="$2" workdir="$3"
+
+  mkdir -p "$target"
+  if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
+    find "${target:?}" -mindepth 1 -delete
+  fi
+
+  tar --no-same-owner -xzf "$tarball" -C "$workdir" || {
+    msg_error "Failed to extract tarball"
+    return 251
+  }
+
+  local unpack_dir
+  unpack_dir=$(find "$workdir" -mindepth 1 -maxdepth 1 -type d | head -n1)
+
+  shopt -s dotglob nullglob
+  cp -r "$unpack_dir"/* "$target/"
+  shopt -u dotglob nullglob
+  return 0
+}
+
+# ------------------------------------------------------------------------------
+# _deploy_unpacked_archive <archive_path> <target> <workdir>
+#
+# Shared tail for the *prebuild* modes of the fetch_and_deploy_*_release helpers
+# (release assets shipped as .zip / .tar.* / .tgz / .txz). Extracts the archive
+# into <workdir>, then copies its payload into <target>. If the archive contains
+# a single top-level directory, that directory is stripped (its contents land
+# directly in <target>); otherwise the archive contents are copied as-is.
+#
+#   - Honors CLEAN_INSTALL=1 (wipes <target> first, dotfiles included).
+#   - Does NOT own <workdir>: the caller creates it and cleans it up.
+#
+# Returns: 0 on success, 65 on unsupported format, 251 on extraction failure,
+#          252 on copy failure / empty archive.
+# ------------------------------------------------------------------------------
+_deploy_unpacked_archive() {
+  local archive="$1" target="$2" workdir="$3"
+  local filename="${archive##*/}"
+
+  mkdir -p "$target"
+  if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
+    find "${target:?}" -mindepth 1 -delete
+  fi
+
+  if [[ "$filename" == *.zip ]]; then
+    ensure_dependencies unzip
+    unzip -q "$archive" -d "$workdir" || {
+      msg_error "Failed to extract ZIP archive"
+      return 251
+    }
+  elif [[ "$filename" == *.tar.* || "$filename" == *.tgz || "$filename" == *.txz ]]; then
+    tar --no-same-owner -xf "$archive" -C "$workdir" || {
+      msg_error "Failed to extract TAR archive"
+      return 251
+    }
+  else
+    msg_error "Unsupported archive format: $filename"
+    return 65
+  fi
+
+  local top_entries inner_dir
+  top_entries=$(find "$workdir" -mindepth 1 -maxdepth 1)
+  if [[ "$(echo "$top_entries" | wc -l)" -eq 1 && -d "$top_entries" ]]; then
+    inner_dir="$top_entries"
+    shopt -s dotglob nullglob
+    if compgen -G "$inner_dir/*" >/dev/null; then
+      cp -r "$inner_dir"/* "$target/" || {
+        msg_error "Failed to copy contents from $inner_dir to $target"
+        shopt -u dotglob nullglob
+        return 252
+      }
+    else
+      msg_error "Inner directory is empty: $inner_dir"
+      shopt -u dotglob nullglob
+      return 252
+    fi
+    shopt -u dotglob nullglob
+  else
+    shopt -s dotglob nullglob
+    if compgen -G "$workdir/*" >/dev/null; then
+      cp -r "$workdir"/* "$target/" || {
+        msg_error "Failed to copy contents to $target"
+        shopt -u dotglob nullglob
+        return 252
+      }
+    else
+      msg_error "Unpacked archive is empty"
+      shopt -u dotglob nullglob
+      return 252
+    fi
+    shopt -u dotglob nullglob
+  fi
+  return 0
+}
+
 # ------------------------------------------------------------------------------
 # Fetches and deploys a GitHub tag-based source tarball.
 #
@@ -2531,36 +2675,19 @@ fetch_and_deploy_gh_tag() {
 
   local tmpdir
   tmpdir=$(mktemp -d) || return 1
+  trap 'rm -rf "$tmpdir"' RETURN
   local tarball_url="https://github.com/${repo}/archive/refs/tags/${version}.tar.gz"
   local filename="${app_lc}-${version}.tar.gz"
 
   msg_info "Fetching GitHub tag: ${app} (${version})"
 
-  download_file "$tarball_url" "$tmpdir/$filename" || {
+  _download_source_tarball "$tarball_url" "$tmpdir/$filename" || {
     msg_error "Download failed: $tarball_url"
-    rm -rf "$tmpdir"
     return 7
   }
 
-  mkdir -p "$target"
-  if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-    find "${target:?}" -mindepth 1 -delete
-  fi
+  _deploy_source_tarball "$tmpdir/$filename" "$target" "$tmpdir" || return 251
 
-  tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
-    msg_error "Failed to extract tarball"
-    rm -rf "$tmpdir"
-    return 251
-  }
-
-  local unpack_dir
-  unpack_dir=$(find "$tmpdir" -mindepth 1 -maxdepth 1 -type d | head -n1)
-
-  shopt -s dotglob nullglob
-  cp -r "$unpack_dir"/* "$target/"
-  shopt -u dotglob nullglob
-
-  rm -rf "$tmpdir"
   echo "$version" >"$version_file"
   msg_ok "Deployed ${app} ${version} to ${target}"
   return 0
@@ -2725,35 +2852,18 @@ fetch_and_deploy_gl_tag() {
 
   local tmpdir
   tmpdir=$(mktemp -d) || return 1
+  trap 'rm -rf "$tmpdir"' RETURN
   local filename="${app_lc}-${version_safe}.tar.gz"
 
   msg_info "Fetching GitLab tag: ${app} (${resolved_tag})"
 
-  curl $download_timeout -fsSL "${header[@]}" -o "$tmpdir/$filename" "$tarball_url" || {
+  _download_source_tarball "$tarball_url" "$tmpdir/$filename" "${header[@]}" || {
     msg_error "Download failed: $tarball_url"
-    rm -rf "$tmpdir"
     return 7
   }
 
-  mkdir -p "$target"
-  if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-    find "${target:?}" -mindepth 1 -delete
-  fi
+  _deploy_source_tarball "$tmpdir/$filename" "$target" "$tmpdir" || return 251
 
-  tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
-    msg_error "Failed to extract tarball"
-    rm -rf "$tmpdir"
-    return 251
-  }
-
-  local unpack_dir
-  unpack_dir=$(find "$tmpdir" -mindepth 1 -maxdepth 1 -type d | head -n1)
-
-  shopt -s dotglob nullglob
-  cp -r "$unpack_dir"/* "$target/"
-  shopt -u dotglob nullglob
-
-  rm -rf "$tmpdir"
   echo "$resolved_tag" >"$version_file"
   msg_ok "Deployed ${app} ${resolved_tag} to ${target}"
   return 0
@@ -3450,6 +3560,7 @@ fetch_and_deploy_codeberg_release() {
 
     local tmpdir
     tmpdir=$(mktemp -d) || return 252
+    trap 'rm -rf "$tmpdir"' RETURN
 
     msg_info "Fetching Codeberg tag: $app ($tag_name)"
 
@@ -3460,37 +3571,19 @@ fetch_and_deploy_codeberg_release() {
 
     # Codeberg archive URL format: https://codeberg.org/{owner}/{repo}/archive/{tag}.tar.gz
     local archive_url="https://codeberg.org/$repo/archive/${tag_name}.tar.gz"
-    if curl_download "$tmpdir/$filename" "$archive_url"; then
+    if _download_source_tarball "$archive_url" "$tmpdir/$filename"; then
       download_success=true
     fi
 
     if [[ "$download_success" != "true" ]]; then
       msg_error "Download failed for $app ($tag_name)"
-      rm -rf "$tmpdir"
       return 250
     fi
 
-    mkdir -p "$target"
-    if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-      find "${target:?}" -mindepth 1 -delete
-    fi
-
-    tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
-      msg_error "Failed to extract tarball"
-      rm -rf "$tmpdir"
-      return 251
-    }
-
-    local unpack_dir
-    unpack_dir=$(find "$tmpdir" -mindepth 1 -maxdepth 1 -type d | head -n1)
-
-    shopt -s dotglob nullglob
-    cp -r "$unpack_dir"/* "$target/"
-    shopt -u dotglob nullglob
+    _deploy_source_tarball "$tmpdir/$filename" "$target" "$tmpdir" || return 251
 
     echo "$version" >"$version_file"
     msg_ok "Deployed: $app ($version)"
-    rm -rf "$tmpdir"
     return 0
   fi
 
@@ -3509,7 +3602,7 @@ fetch_and_deploy_codeberg_release() {
 
   local codeberg_rel_json
   codeberg_rel_json=$(mktemp /tmp/tools-codeberg-rel-XXXXXX) || return 73
-  trap 'rm -f "$codeberg_rel_json"' RETURN
+  trap 'rm -f "$codeberg_rel_json"; rm -rf "${tmpdir:-}" "${unpack_tmp:-}"' RETURN
 
   local attempt=0 success=false resp http_code
 
@@ -3563,32 +3656,16 @@ fetch_and_deploy_codeberg_release() {
 
     # Codeberg archive URL format
     local archive_url="https://codeberg.org/$repo/archive/${tag_name}.tar.gz"
-    if curl_download "$tmpdir/$filename" "$archive_url"; then
+    if _download_source_tarball "$archive_url" "$tmpdir/$filename"; then
       download_success=true
     fi
 
     if [[ "$download_success" != "true" ]]; then
       msg_error "Download failed for $app ($tag_name)"
-      rm -rf "$tmpdir"
       return 250
     fi
 
-    mkdir -p "$target"
-    if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-      find "${target:?}" -mindepth 1 -delete
-    fi
-
-    tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
-      msg_error "Failed to extract tarball"
-      rm -rf "$tmpdir"
-      return 251
-    }
-    local unpack_dir
-    unpack_dir=$(find "$tmpdir" -mindepth 1 -maxdepth 1 -type d | head -n1)
-
-    shopt -s dotglob nullglob
-    cp -r "$unpack_dir"/* "$target/"
-    shopt -u dotglob nullglob
+    _deploy_source_tarball "$tmpdir/$filename" "$target" "$tmpdir" || return 251
 
   ### Binary Mode ###
   elif [[ "$mode" == "binary" ]]; then
@@ -3636,14 +3713,12 @@ fetch_and_deploy_codeberg_release() {
 
     if [[ -z "$url_match" ]]; then
       msg_error "No suitable .deb asset found for $app"
-      rm -rf "$tmpdir"
       return 252
     fi
 
     filename="${url_match##*/}"
     curl_download "$tmpdir/$filename" "$url_match" || {
       msg_error "Download failed: $url_match"
-      rm -rf "$tmpdir"
       return 250
     }
 
@@ -3651,7 +3726,6 @@ fetch_and_deploy_codeberg_release() {
     $STD apt install -y "$tmpdir/$filename" || {
       $STD dpkg -i "$tmpdir/$filename" || {
         _diagnose_deb_failure "$tmpdir/$filename"
-        rm -rf "$tmpdir"
         return 100
       }
     }
@@ -3662,7 +3736,6 @@ fetch_and_deploy_codeberg_release() {
     pattern="${pattern#\"}"
     [[ -z "$pattern" ]] && {
       msg_error "Mode 'prebuild' requires 6th parameter (asset filename pattern)"
-      rm -rf "$tmpdir"
       return 65
     }
 
@@ -3679,77 +3752,18 @@ fetch_and_deploy_codeberg_release() {
 
     [[ -z "$asset_url" ]] && {
       msg_error "No asset matching '$pattern' found"
-      rm -rf "$tmpdir"
       return 252
     }
 
     filename="${asset_url##*/}"
     curl_download "$tmpdir/$filename" "$asset_url" || {
       msg_error "Download failed: $asset_url"
-      rm -rf "$tmpdir"
       return 250
     }
 
     local unpack_tmp
     unpack_tmp=$(mktemp -d)
-    mkdir -p "$target"
-    if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-      find "${target:?}" -mindepth 1 -delete
-    fi
-
-    if [[ "$filename" == *.zip ]]; then
-      ensure_dependencies unzip
-      unzip -q "$tmpdir/$filename" -d "$unpack_tmp" || {
-        msg_error "Failed to extract ZIP archive"
-        rm -rf "$tmpdir" "$unpack_tmp"
-        return 251
-      }
-    elif [[ "$filename" == *.tar.* || "$filename" == *.tgz ]]; then
-      tar --no-same-owner -xf "$tmpdir/$filename" -C "$unpack_tmp" || {
-        msg_error "Failed to extract TAR archive"
-        rm -rf "$tmpdir" "$unpack_tmp"
-        return 251
-      }
-    else
-      msg_error "Unsupported archive format: $filename"
-      rm -rf "$tmpdir" "$unpack_tmp"
-      return 251
-    fi
-
-    local top_dirs
-    top_dirs=$(find "$unpack_tmp" -mindepth 1 -maxdepth 1 -type d | wc -l)
-    local top_entries inner_dir
-    top_entries=$(find "$unpack_tmp" -mindepth 1 -maxdepth 1)
-    if [[ "$(echo "$top_entries" | wc -l)" -eq 1 && -d "$top_entries" ]]; then
-      inner_dir="$top_entries"
-      shopt -s dotglob nullglob
-      if compgen -G "$inner_dir/*" >/dev/null; then
-        cp -r "$inner_dir"/* "$target/" || {
-          msg_error "Failed to copy contents from $inner_dir to $target"
-          rm -rf "$tmpdir" "$unpack_tmp"
-          return 252
-        }
-      else
-        msg_error "Inner directory is empty: $inner_dir"
-        rm -rf "$tmpdir" "$unpack_tmp"
-        return 252
-      fi
-      shopt -u dotglob nullglob
-    else
-      shopt -s dotglob nullglob
-      if compgen -G "$unpack_tmp/*" >/dev/null; then
-        cp -r "$unpack_tmp"/* "$target/" || {
-          msg_error "Failed to copy contents to $target"
-          rm -rf "$tmpdir" "$unpack_tmp"
-          return 252
-        }
-      else
-        msg_error "Unpacked archive is empty"
-        rm -rf "$tmpdir" "$unpack_tmp"
-        return 252
-      fi
-      shopt -u dotglob nullglob
-    fi
+    _deploy_unpacked_archive "$tmpdir/$filename" "$target" "$unpack_tmp" || return
 
   ### Singlefile Mode ###
   elif [[ "$mode" == "singlefile" ]]; then
@@ -3757,7 +3771,6 @@ fetch_and_deploy_codeberg_release() {
     pattern="${pattern#\"}"
     [[ -z "$pattern" ]] && {
       msg_error "Mode 'singlefile' requires 6th parameter (asset filename pattern)"
-      rm -rf "$tmpdir"
       return 65
     }
 
@@ -3774,7 +3787,6 @@ fetch_and_deploy_codeberg_release() {
 
     [[ -z "$asset_url" ]] && {
       msg_error "No asset matching '$pattern' found"
-      rm -rf "$tmpdir"
       return 252
     }
 
@@ -3787,7 +3799,6 @@ fetch_and_deploy_codeberg_release() {
 
     curl_download "$target/$target_file" "$asset_url" || {
       msg_error "Download failed: $asset_url"
-      rm -rf "$tmpdir"
       return 250
     }
 
@@ -3797,13 +3808,11 @@ fetch_and_deploy_codeberg_release() {
 
   else
     msg_error "Unknown mode: $mode"
-    rm -rf "$tmpdir"
     return 65
   fi
 
   echo "$version" >"$version_file"
   msg_ok "Deployed: $app ($version)"
-  rm -rf "$tmpdir"
 }
 
 # ------------------------------------------------------------------------------
@@ -4090,6 +4099,7 @@ fetch_and_deploy_gh_release() {
 
   local tmpdir
   tmpdir=$(mktemp -d) || return 1
+  trap 'rm -rf "$tmpdir" "${unpack_tmp:-}"' RETURN
   local filename="" url=""
 
   msg_info "Fetching GitHub release: $app ($version)"
@@ -4104,28 +4114,12 @@ fetch_and_deploy_gh_release() {
     local direct_tarball_url="https://github.com/$repo/archive/refs/tags/$tag_name.tar.gz"
     filename="${app_lc}-${version_safe}.tar.gz"
 
-    curl_download "$tmpdir/$filename" "$direct_tarball_url" || {
+    _download_source_tarball "$direct_tarball_url" "$tmpdir/$filename" || {
       msg_error "Download failed: $direct_tarball_url"
-      rm -rf "$tmpdir"
       return 250
     }
 
-    mkdir -p "$target"
-    if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-      find "${target:?}" -mindepth 1 -delete
-    fi
-
-    tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
-      msg_error "Failed to extract tarball"
-      rm -rf "$tmpdir"
-      return 251
-    }
-    local unpack_dir
-    unpack_dir=$(find "$tmpdir" -mindepth 1 -maxdepth 1 -type d | head -n1)
-
-    shopt -s dotglob nullglob
-    cp -r "$unpack_dir"/* "$target/"
-    shopt -u dotglob nullglob
+    _deploy_source_tarball "$tmpdir/$filename" "$target" "$tmpdir" || return 251
 
     ### Binary Mode ###
   elif [[ "$mode" == "binary" ]]; then
@@ -4210,14 +4204,12 @@ fetch_and_deploy_gh_release() {
 
     if [[ -z "$url_match" ]]; then
       msg_error "No suitable .deb asset found for $app"
-      rm -rf "$tmpdir"
       return 252
     fi
 
     filename="${url_match##*/}"
     curl_download "$tmpdir/$filename" "$url_match" || {
       msg_error "Download failed: $url_match"
-      rm -rf "$tmpdir"
       return 250
     }
 
@@ -4230,7 +4222,6 @@ fetch_and_deploy_gh_release() {
     DEBIAN_FRONTEND=noninteractive SYSTEMD_OFFLINE=1 $STD apt install -y $dpkg_opts "$tmpdir/$filename" || {
       SYSTEMD_OFFLINE=1 $STD dpkg -i "$tmpdir/$filename" || {
         _diagnose_deb_failure "$tmpdir/$filename"
-        rm -rf "$tmpdir"
         return 100
       }
     }
@@ -4241,7 +4232,6 @@ fetch_and_deploy_gh_release() {
     pattern="${pattern#\"}"
     [[ -z "$pattern" ]] && {
       msg_error "Mode 'prebuild' requires 6th parameter (asset filename pattern)"
-      rm -rf "$tmpdir"
       return 65
     }
 
@@ -4277,79 +4267,18 @@ fetch_and_deploy_gh_release() {
 
     [[ -z "$asset_url" ]] && {
       msg_error "No asset matching '$pattern' found"
-      rm -rf "$tmpdir"
       return 252
     }
 
     filename="${asset_url##*/}"
     curl_download "$tmpdir/$filename" "$asset_url" || {
       msg_error "Download failed: $asset_url"
-      rm -rf "$tmpdir"
       return 250
     }
 
     local unpack_tmp
     unpack_tmp=$(mktemp -d)
-    mkdir -p "$target"
-    if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-      find "${target:?}" -mindepth 1 -delete
-    fi
-
-    if [[ "$filename" == *.zip ]]; then
-      ensure_dependencies unzip
-      unzip -q "$tmpdir/$filename" -d "$unpack_tmp" || {
-        msg_error "Failed to extract ZIP archive"
-        rm -rf "$tmpdir" "$unpack_tmp"
-        return 251
-      }
-    elif [[ "$filename" == *.tar.* || "$filename" == *.tgz || "$filename" == *.txz ]]; then
-      tar --no-same-owner -xf "$tmpdir/$filename" -C "$unpack_tmp" || {
-        msg_error "Failed to extract TAR archive"
-        rm -rf "$tmpdir" "$unpack_tmp"
-        return 251
-      }
-    else
-      msg_error "Unsupported archive format: $filename"
-      rm -rf "$tmpdir" "$unpack_tmp"
-      return 65
-    fi
-
-    local top_dirs
-    top_dirs=$(find "$unpack_tmp" -mindepth 1 -maxdepth 1 -type d | wc -l)
-    local top_entries inner_dir
-    top_entries=$(find "$unpack_tmp" -mindepth 1 -maxdepth 1)
-    if [[ "$(echo "$top_entries" | wc -l)" -eq 1 && -d "$top_entries" ]]; then
-      # Strip leading folder
-      inner_dir="$top_entries"
-      shopt -s dotglob nullglob
-      if compgen -G "$inner_dir/*" >/dev/null; then
-        cp -r "$inner_dir"/* "$target/" || {
-          msg_error "Failed to copy contents from $inner_dir to $target"
-          rm -rf "$tmpdir" "$unpack_tmp"
-          return 252
-        }
-      else
-        msg_error "Inner directory is empty: $inner_dir"
-        rm -rf "$tmpdir" "$unpack_tmp"
-        return 252
-      fi
-      shopt -u dotglob nullglob
-    else
-      # Copy all contents
-      shopt -s dotglob nullglob
-      if compgen -G "$unpack_tmp/*" >/dev/null; then
-        cp -r "$unpack_tmp"/* "$target/" || {
-          msg_error "Failed to copy contents to $target"
-          rm -rf "$tmpdir" "$unpack_tmp"
-          return 252
-        }
-      else
-        msg_error "Unpacked archive is empty"
-        rm -rf "$tmpdir" "$unpack_tmp"
-        return 252
-      fi
-      shopt -u dotglob nullglob
-    fi
+    _deploy_unpacked_archive "$tmpdir/$filename" "$target" "$unpack_tmp" || return
 
     ### Singlefile Mode ###
   elif [[ "$mode" == "singlefile" ]]; then
@@ -4357,7 +4286,6 @@ fetch_and_deploy_gh_release() {
     pattern="${pattern#\"}"
     [[ -z "$pattern" ]] && {
       msg_error "Mode 'singlefile' requires 6th parameter (asset filename pattern)"
-      rm -rf "$tmpdir"
       return 65
     }
 
@@ -4392,7 +4320,6 @@ fetch_and_deploy_gh_release() {
     fi
     [[ -z "$asset_url" ]] && {
       msg_error "No asset matching '$pattern' found"
-      rm -rf "$tmpdir"
       return 252
     }
 
@@ -4405,7 +4332,6 @@ fetch_and_deploy_gh_release() {
 
     curl_download "$target/$target_file" "$asset_url" || {
       msg_error "Download failed: $asset_url"
-      rm -rf "$tmpdir"
       return 250
     }
 
@@ -4415,13 +4341,11 @@ fetch_and_deploy_gh_release() {
 
   else
     msg_error "Unknown mode: $mode"
-    rm -rf "$tmpdir"
     return 65
   fi
 
   echo "$version" >"$version_file"
   msg_ok "Deployed: $app ($version)"
-  rm -rf "$tmpdir"
 }
 
 # ------------------------------------------------------------------------------
@@ -8713,6 +8637,11 @@ setup_ruby() {
   local BASHRC_FILE="$HOME/.bashrc"
   local TMP_DIR=$(mktemp -d)
 
+  # Ensure HOME exists: callers may pass a not-yet-created home (e.g. a service
+  # user that is created later in the install), so the profile writes below do
+  # not fail on a missing directory.
+  mkdir -p "$HOME"
+
   if ! grep -q 'rbenv init' "$PROFILE_FILE" 2>/dev/null; then
     cat <<'EOF' >>"$PROFILE_FILE"
 export PATH="$HOME/.rbenv/bin:$PATH"
@@ -9343,10 +9272,10 @@ fetch_and_deploy_from_url() {
     msg_error "Failed to create temporary directory"
     return 252
   }
+  trap 'rm -rf "$tmpdir" "${unpack_tmp:-}"' RETURN
 
   curl -fsSL -o "$tmpdir/$filename" "$url" || {
     msg_error "Download failed: $url"
-    rm -rf "$tmpdir"
     return 250
   }
 
@@ -9366,7 +9295,6 @@ fetch_and_deploy_from_url() {
     archive_type="tar"
   else
     msg_error "Unsupported or unknown archive type: $file_desc"
-    rm -rf "$tmpdir"
     return 65
   fi
 
@@ -9379,19 +9307,16 @@ fetch_and_deploy_from_url() {
     $STD apt install -y "$tmpdir/$filename" || {
       $STD dpkg -i "$tmpdir/$filename" || {
         _diagnose_deb_failure "$tmpdir/$filename"
-        rm -rf "$tmpdir"
         return 100
       }
     }
 
-    rm -rf "$tmpdir"
     msg_ok "Successfully installed .deb package"
     return 0
   fi
 
   if [[ -z "$directory" ]]; then
     msg_error "Directory parameter is required for archive extraction"
-    rm -rf "$tmpdir"
     return 65
   fi
 
@@ -9410,13 +9335,11 @@ fetch_and_deploy_from_url() {
     ensure_dependencies unzip
     unzip -q "$tmpdir/$filename" -d "$unpack_tmp" || {
       msg_error "Failed to extract ZIP archive"
-      rm -rf "$tmpdir" "$unpack_tmp"
       return 251
     }
   elif [[ "$archive_type" == "tar" ]]; then
     tar --no-same-owner -xf "$tmpdir/$filename" -C "$unpack_tmp" || {
       msg_error "Failed to extract TAR archive"
-      rm -rf "$tmpdir" "$unpack_tmp"
       return 251
     }
   fi
@@ -9430,12 +9353,12 @@ fetch_and_deploy_from_url() {
     if compgen -G "$inner_dir/*" >/dev/null; then
       cp -r "$inner_dir"/* "$directory/" || {
         msg_error "Failed to copy contents from $inner_dir to $directory"
-        rm -rf "$tmpdir" "$unpack_tmp"
+        shopt -u dotglob nullglob
         return 252
       }
     else
       msg_error "Inner directory is empty: $inner_dir"
-      rm -rf "$tmpdir" "$unpack_tmp"
+      shopt -u dotglob nullglob
       return 252
     fi
     shopt -u dotglob nullglob
@@ -9444,18 +9367,17 @@ fetch_and_deploy_from_url() {
     if compgen -G "$unpack_tmp/*" >/dev/null; then
       cp -r "$unpack_tmp"/* "$directory/" || {
         msg_error "Failed to copy contents to $directory"
-        rm -rf "$tmpdir" "$unpack_tmp"
+        shopt -u dotglob nullglob
         return 252
       }
     else
       msg_error "Unpacked archive is empty"
-      rm -rf "$tmpdir" "$unpack_tmp"
+      shopt -u dotglob nullglob
       return 252
     fi
     shopt -u dotglob nullglob
   fi
 
-  rm -rf "$tmpdir" "$unpack_tmp"
   msg_ok "Successfully deployed archive to $directory"
   return 0
 }
@@ -9856,7 +9778,7 @@ fetch_and_deploy_gl_release() {
 
   local gl_rel_json
   gl_rel_json=$(mktemp /tmp/tools-gl-rel-XXXXXX) || return 73
-  trap 'rm -f "$gl_rel_json"' RETURN
+  trap 'rm -f "$gl_rel_json"; rm -rf "${tmpdir:-}" "${unpack_tmp:-}"' RETURN
 
   local repo_encoded
   repo_encoded=$(printf '%s' "$repo" | sed 's|/|%2F|g')
@@ -9968,28 +9890,12 @@ fetch_and_deploy_gl_release() {
     local direct_tarball_url="https://gitlab.com/$repo/-/archive/$tag_name/${app_lc}-${version_safe}.tar.gz"
     filename="${app_lc}-${version_safe}.tar.gz"
 
-    curl $download_timeout -fsSL "${header[@]}" -o "$tmpdir/$filename" "$direct_tarball_url" || {
+    _download_source_tarball "$direct_tarball_url" "$tmpdir/$filename" "${header[@]}" || {
       msg_error "Download failed: $direct_tarball_url"
-      rm -rf "$tmpdir"
       return 1
     }
 
-    mkdir -p "$target"
-    if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-      find "${target:?}" -mindepth 1 -delete
-    fi
-
-    tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
-      msg_error "Failed to extract tarball"
-      rm -rf "$tmpdir"
-      return 1
-    }
-    local unpack_dir
-    unpack_dir=$(find "$tmpdir" -mindepth 1 -maxdepth 1 -type d | head -n1)
-
-    shopt -s dotglob nullglob
-    cp -r "$unpack_dir"/* "$target/"
-    shopt -u dotglob nullglob
+    _deploy_source_tarball "$tmpdir/$filename" "$target" "$tmpdir" || return 1
 
   ### Binary Mode ###
   elif [[ "$mode" == "binary" ]]; then
@@ -10059,14 +9965,12 @@ fetch_and_deploy_gl_release() {
 
     if [[ -z "$url_match" ]]; then
       msg_error "No suitable .deb asset found for $app"
-      rm -rf "$tmpdir"
       return 1
     fi
 
     filename="${url_match##*/}"
     curl $download_timeout -fsSL "${header[@]}" -o "$tmpdir/$filename" "$url_match" || {
       msg_error "Download failed: $url_match"
-      rm -rf "$tmpdir"
       return 1
     }
 
@@ -10077,7 +9981,6 @@ fetch_and_deploy_gl_release() {
     DEBIAN_FRONTEND=noninteractive SYSTEMD_OFFLINE=1 $STD apt install -y $dpkg_opts "$tmpdir/$filename" || {
       SYSTEMD_OFFLINE=1 $STD dpkg -i "$tmpdir/$filename" || {
         _diagnose_deb_failure "$tmpdir/$filename"
-        rm -rf "$tmpdir"
         return 1
       }
     }
@@ -10088,7 +9991,6 @@ fetch_and_deploy_gl_release() {
     pattern="${pattern#\"}"
     [[ -z "$pattern" ]] && {
       msg_error "Mode 'prebuild' requires 6th parameter (asset filename pattern)"
-      rm -rf "$tmpdir"
       return 1
     }
 
@@ -10123,75 +10025,18 @@ fetch_and_deploy_gl_release() {
 
     [[ -z "$asset_url" ]] && {
       msg_error "No asset matching '$pattern' found"
-      rm -rf "$tmpdir"
       return 1
     }
 
     filename="${asset_url##*/}"
     curl $download_timeout -fsSL "${header[@]}" -o "$tmpdir/$filename" "$asset_url" || {
       msg_error "Download failed: $asset_url"
-      rm -rf "$tmpdir"
       return 1
     }
 
     local unpack_tmp
     unpack_tmp=$(mktemp -d)
-    mkdir -p "$target"
-    if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-      find "${target:?}" -mindepth 1 -delete
-    fi
-
-    if [[ "$filename" == *.zip ]]; then
-      ensure_dependencies unzip
-      unzip -q "$tmpdir/$filename" -d "$unpack_tmp" || {
-        msg_error "Failed to extract ZIP archive"
-        rm -rf "$tmpdir" "$unpack_tmp"
-        return 1
-      }
-    elif [[ "$filename" == *.tar.* || "$filename" == *.tgz || "$filename" == *.txz ]]; then
-      tar --no-same-owner -xf "$tmpdir/$filename" -C "$unpack_tmp" || {
-        msg_error "Failed to extract TAR archive"
-        rm -rf "$tmpdir" "$unpack_tmp"
-        return 1
-      }
-    else
-      msg_error "Unsupported archive format: $filename"
-      rm -rf "$tmpdir" "$unpack_tmp"
-      return 1
-    fi
-
-    local top_entries inner_dir
-    top_entries=$(find "$unpack_tmp" -mindepth 1 -maxdepth 1)
-    if [[ "$(echo "$top_entries" | wc -l)" -eq 1 && -d "$top_entries" ]]; then
-      inner_dir="$top_entries"
-      shopt -s dotglob nullglob
-      if compgen -G "$inner_dir/*" >/dev/null; then
-        cp -r "$inner_dir"/* "$target/" || {
-          msg_error "Failed to copy contents from $inner_dir to $target"
-          rm -rf "$tmpdir" "$unpack_tmp"
-          return 1
-        }
-      else
-        msg_error "Inner directory is empty: $inner_dir"
-        rm -rf "$tmpdir" "$unpack_tmp"
-        return 1
-      fi
-      shopt -u dotglob nullglob
-    else
-      shopt -s dotglob nullglob
-      if compgen -G "$unpack_tmp/*" >/dev/null; then
-        cp -r "$unpack_tmp"/* "$target/" || {
-          msg_error "Failed to copy contents to $target"
-          rm -rf "$tmpdir" "$unpack_tmp"
-          return 1
-        }
-      else
-        msg_error "Unpacked archive is empty"
-        rm -rf "$tmpdir" "$unpack_tmp"
-        return 1
-      fi
-      shopt -u dotglob nullglob
-    fi
+    _deploy_unpacked_archive "$tmpdir/$filename" "$target" "$unpack_tmp" || return
 
   ### Singlefile Mode ###
   elif [[ "$mode" == "singlefile" ]]; then
@@ -10199,7 +10044,6 @@ fetch_and_deploy_gl_release() {
     pattern="${pattern#\"}"
     [[ -z "$pattern" ]] && {
       msg_error "Mode 'singlefile' requires 6th parameter (asset filename pattern)"
-      rm -rf "$tmpdir"
       return 1
     }
 
@@ -10234,7 +10078,6 @@ fetch_and_deploy_gl_release() {
 
     [[ -z "$asset_url" ]] && {
       msg_error "No asset matching '$pattern' found"
-      rm -rf "$tmpdir"
       return 1
     }
 
@@ -10247,7 +10090,6 @@ fetch_and_deploy_gl_release() {
 
     curl $download_timeout -fsSL "${header[@]}" -o "$target/$target_file" "$asset_url" || {
       msg_error "Download failed: $asset_url"
-      rm -rf "$tmpdir"
       return 1
     }
 
@@ -10257,13 +10099,11 @@ fetch_and_deploy_gl_release() {
 
   else
     msg_error "Unknown mode: $mode"
-    rm -rf "$tmpdir"
     return 1
   fi
 
   echo "$version" >"$version_file"
   msg_ok "Deployed: $app ($version)"
-  rm -rf "$tmpdir"
 }
 
 # ------------------------------------------------------------------------------

From d81c9f3ed2827b24d03dc807cdf215750b5e2f1f Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Sun, 19 Jul 2026 12:54:11 +0000
Subject: [PATCH 201/220] Update CHANGELOG.md (#15900)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f9386336b..99aa845ce 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -517,6 +517,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### ✨ New Features
 
+    - tools.func: centralize deploy tail + trap-based tmpdir cleanup [@MickLesk](https://github.com/MickLesk) ([#15872](https://github.com/community-scripts/ProxmoxVE/pull/15872))
     - Update OPNsense from 26.1 to 26.7 [@tdn131](https://github.com/tdn131) ([#15895](https://github.com/community-scripts/ProxmoxVE/pull/15895))
 
 ### 💾 Core

From e1ce55b547a70405704d5669fd33e5e5890e2bde Mon Sep 17 00:00:00 2001
From: TowyTowy <85077986+TowyTowy@users.noreply.github.com>
Date: Sun, 19 Jul 2026 19:01:41 +0200
Subject: [PATCH 202/220] fix(build.func): expand glob in SSH key "Scan
 Folder/Glob" so it can find keys (#15873)

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Sam Heinz <sam@samheinz.com>
---
 misc/build.func | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/misc/build.func b/misc/build.func
index 53509780f..6c5d20bfc 100644
--- a/misc/build.func
+++ b/misc/build.func
@@ -3600,9 +3600,9 @@ configure_ssh_settings() {
     glob_path=$(whiptail --backtitle "$backtitle" \
       --inputbox "Enter a folder or glob to scan (e.g. /root/.ssh/*.pub)" 10 72 --title "Scan Folder/Glob" 3>&1 1>&2 2>&3)
     if [[ -n "$glob_path" ]]; then
-      shopt -s nullglob
-      read -r -a _scan_files <<<"$glob_path"
-      shopt -u nullglob
+      [[ -d "$glob_path" ]] && glob_path="${glob_path%/}/*"
+      local -a _scan_files
+      mapfile -t _scan_files < <(compgen -G "$glob_path")
       if [[ "${#_scan_files[@]}" -gt 0 ]]; then
         ssh_build_choices_from_files "${_scan_files[@]}"
         if [[ "$COUNT" -gt 0 ]]; then

From 026fd25e7ac9a30cb3fbecde649183c6cc3f1c48 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Sun, 19 Jul 2026 17:02:04 +0000
Subject: [PATCH 203/220] Update CHANGELOG.md (#15904)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 99aa845ce..00f6294f1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -524,6 +524,10 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - Revert "core: add configurable host CA inheritance during bootstrap" [@MickLesk](https://github.com/MickLesk) ([#15886](https://github.com/community-scripts/ProxmoxVE/pull/15886))
 
+  - #### 🐞 Bug Fixes
+
+    - fix(build.func): expand glob in SSH key "Scan Folder/Glob" so it can find keys [@TowyTowy](https://github.com/TowyTowy) ([#15873](https://github.com/community-scripts/ProxmoxVE/pull/15873))
+
 ## 2026-07-18
 
 ### 💾 Core

From 3042cd5cee902f3ddc21f74a4ec2321394bd6fff Mon Sep 17 00:00:00 2001
From: Michel Roegl-Brunner
 <73236783+michelroegl-brunner@users.noreply.github.com>
Date: Mon, 20 Jul 2026 10:29:05 +0200
Subject: [PATCH 204/220] fix(wanderer): use PocketBase-relative plugin symlink
 in unprivileged LXC (#15911)

The /data/plugins symlink fails in default unprivileged containers with Operation not permitted. Link plugins via /opt/wanderer/source/db/data/plugins instead so PluginDir() can discover them without root-level symlinks.

Fixes #15799
---
 ct/wanderer.sh              | 4 ++--
 install/wanderer-install.sh | 3 ++-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/ct/wanderer.sh b/ct/wanderer.sh
index bb0ec71cd..e0b3ed0be 100644
--- a/ct/wanderer.sh
+++ b/ct/wanderer.sh
@@ -46,8 +46,8 @@ function update_script() {
     cd /opt/wanderer/source/web
     $STD npm ci
     $STD npm run build
-    mkdir -p /opt/wanderer/data/plugins
-    [[ -e /data/plugins ]] || ln -sfn /opt/wanderer/data/plugins /data/plugins
+    mkdir -p /opt/wanderer/data/plugins /opt/wanderer/source/db/data
+    [[ -e /opt/wanderer/source/db/data/plugins ]] || ln -sfn /opt/wanderer/data/plugins /opt/wanderer/source/db/data/plugins
     msg_info "Installing wanderer plugins"
     for plugin in hammerhead komoot strava; do
       fetch_and_deploy_gh_release "wanderer-plugin-${plugin}" "open-wanderer/wanderer" "prebuild" "${CHECK_UPDATE_RELEASE:-latest}" "/opt/wanderer/data/plugins" "wanderer-plugin-${plugin}.tar.gz" || msg_warn "Failed to install wanderer plugin: ${plugin}"
diff --git a/install/wanderer-install.sh b/install/wanderer-install.sh
index 6a8571bbf..ae8514c6b 100644
--- a/install/wanderer-install.sh
+++ b/install/wanderer-install.sh
@@ -21,8 +21,9 @@ else
   fetch_and_deploy_gh_release "meilisearch" "meilisearch/meilisearch" "binary" "latest" "/opt/wanderer/source/search"
 fi
 mkdir -p /opt/wanderer/{source,data/pb_data,data/meili_data,data/plugins}
-[[ -e /data/plugins ]] || ln -sfn /opt/wanderer/data/plugins /data/plugins
 fetch_and_deploy_gh_release "wanderer" "open-wanderer/wanderer" "tarball" "latest" "/opt/wanderer/source"
+mkdir -p /opt/wanderer/source/db/data
+[[ -e /opt/wanderer/source/db/data/plugins ]] || ln -sfn /opt/wanderer/data/plugins /opt/wanderer/source/db/data/plugins
 
 msg_info "Installing wanderer (patience)"
 cd /opt/wanderer/source/db

From a6a608614f10e5a34eb5aeb61e6ada47d28d2cc7 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Mon, 20 Jul 2026 08:29:28 +0000
Subject: [PATCH 205/220] Update CHANGELOG.md (#15916)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 00f6294f1..e6571b4b5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -505,6 +505,14 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-07-20
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(wanderer): use PocketBase-relative plugin symlink in unprivileged LXC [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15911](https://github.com/community-scripts/ProxmoxVE/pull/15911))
+
 ## 2026-07-19
 
 ### 🚀 Updated Scripts

From 31b70249976cb550375f1405a339d9641e4285f0 Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Mon, 20 Jul 2026 11:43:34 +0200
Subject: [PATCH 206/220] Fix Omada package version extraction (#15908)

Update both `ct/omada.sh` and `install/omada-install.sh` to parse the Omada version directly from the `_v..._linux` segment of the Debian filename. This removes the old dependency on a timestamp suffix format and ensures `.omada` gets a valid version when TP-Link package naming varies.
---
 ct/omada.sh              | 2 +-
 install/omada-install.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/ct/omada.sh b/ct/omada.sh
index 0c0c74811..f03e04cb3 100644
--- a/ct/omada.sh
+++ b/ct/omada.sh
@@ -43,7 +43,7 @@ function update_script() {
     grep -o 'https://static\.tp-link\.com/upload/software/[^"]*linux_x64[^"]*\.deb' |
     head -n1)
   OMADA_PKG=$(basename "${OMADA_URL}")
-  VERSION=$(sed -n 's/.*_v\([0-9.]*\)_.*_\([0-9]\{14\}\)\.deb$/\1-\2/p' <<<"${OMADA_PKG}")
+  VERSION=$(sed -n 's/.*_v\([0-9.]*\)_linux.*/\1/p' <<<"${OMADA_PKG}")
 
   CURRENT_VERSION=$(cat $HOME/.omada 2>/dev/null || echo "0")
 
diff --git a/install/omada-install.sh b/install/omada-install.sh
index 9b6f42a02..ea66e4b74 100644
--- a/install/omada-install.sh
+++ b/install/omada-install.sh
@@ -42,7 +42,7 @@ OMADA_PKG=$(basename "${OMADA_URL}")
 curl_download "${OMADA_PKG}" "${OMADA_URL}"
 $STD dpkg -i "${OMADA_PKG}"
 rm -rf "${OMADA_PKG}"
-VERSION=$(sed -n 's/.*_v\([0-9.]*\)_.*_\([0-9]\{14\}\)\.deb$/\1-\2/p' <<<"${OMADA_PKG}")
+VERSION=$(sed -n 's/.*_v\([0-9.]*\)_linux.*/\1/p' <<<"${OMADA_PKG}")
 echo "${VERSION}" >$HOME/.omada
 msg_ok "Installed Omada Controller"
 

From d6cd545e988fbcc918be44238517b8bf68d7be2b Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Mon, 20 Jul 2026 09:43:57 +0000
Subject: [PATCH 207/220] Update CHANGELOG.md (#15920)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e6571b4b5..0a641ccf6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -511,6 +511,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - Omada: fix package version extraction [@MickLesk](https://github.com/MickLesk) ([#15908](https://github.com/community-scripts/ProxmoxVE/pull/15908))
     - fix(wanderer): use PocketBase-relative plugin symlink in unprivileged LXC [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15911](https://github.com/community-scripts/ProxmoxVE/pull/15911))
 
 ## 2026-07-19

From 9ea82fa99258e24128b87f92051956f8f42c98d3 Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Mon, 20 Jul 2026 11:46:33 +0200
Subject: [PATCH 208/220] core: Improve GPU detection and mapping logic
 (#15918)

Refactor GPU detection logic to map DRI nodes to their owning GPUs based on vendor IDs. Update messages for detected Intel and AMD GPUs.
---
 misc/build.func | 42 +++++++++++++++++++++++-------------------
 1 file changed, 23 insertions(+), 19 deletions(-)

diff --git a/misc/build.func b/misc/build.func
index 6c5d20bfc..ca33a36f8 100644
--- a/misc/build.func
+++ b/misc/build.func
@@ -4233,27 +4233,31 @@ $PCT_OPTIONS_STRING"
       return 0
     fi
 
-    # Check for Intel GPU - look for Intel vendor ID [8086]
-    if grep -q "\[8086:" <<<"$pci_vga_info"; then
-      msg_custom "🎮" "${BL}" "Detected Intel GPU"
-      if [[ -d /dev/dri ]]; then
-        for d in /dev/dri/renderD* /dev/dri/card*; do
-          [[ -e "$d" ]] && INTEL_DEVICES+=("$d")
-        done
-      fi
+    # Map each DRI render/card node to its owning GPU via the PCI vendor ID
+    # exposed in sysfs (/sys/class/drm/<node>/device/vendor). This is required
+    # on multi-GPU hosts: globbing every /dev/dri node onto the first detected
+    # vendor would pass through *both* GPUs and skip the selection prompt.
+    if [[ -d /dev/dri ]]; then
+      for d in /dev/dri/renderD* /dev/dri/card*; do
+        [[ -e "$d" ]] || continue
+        local node vendor
+        node=$(basename "$d")
+        vendor=$(cat "/sys/class/drm/${node}/device/vendor" 2>/dev/null || true)
+        case "$vendor" in
+        0x8086) INTEL_DEVICES+=("$d") ;;        # Intel
+        0x1002 | 0x1022) AMD_DEVICES+=("$d") ;; # AMD/ATI
+        0x10de) ;;                              # NVIDIA - handled via /dev/nvidia* below
+        *) msg_debug "Unmapped GPU vendor '${vendor:-unknown}' for $d" ;;
+        esac
+      done
     fi
 
-    # Check for AMD GPU - look for AMD vendor IDs [1002] (AMD/ATI) or [1022] (AMD)
-    if grep -qE "\[1002:|\[1022:" <<<"$pci_vga_info"; then
-      msg_custom "🎮" "${RD}" "Detected AMD GPU"
-      if [[ -d /dev/dri ]]; then
-        # Only add if not already claimed by Intel
-        if [[ ${#INTEL_DEVICES[@]} -eq 0 ]]; then
-          for d in /dev/dri/renderD* /dev/dri/card* /dev/kfd; do
-            [[ -e "$d" ]] && AMD_DEVICES+=("$d")
-          done
-        fi
-      fi
+    [[ ${#INTEL_DEVICES[@]} -gt 0 ]] && msg_custom "🎮" "${BL}" "Detected Intel GPU"
+    [[ ${#AMD_DEVICES[@]} -gt 0 ]] && msg_custom "🎮" "${RD}" "Detected AMD GPU"
+
+    # AMD compute (ROCm) additionally needs /dev/kfd alongside the render nodes
+    if [[ ${#AMD_DEVICES[@]} -gt 0 && -e /dev/kfd ]]; then
+      AMD_DEVICES+=("/dev/kfd")
     fi
 
     # Check for NVIDIA GPU - look for NVIDIA vendor ID [10de]

From beeb497519c643936dfb7558eae3b04cbfb855cd Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Mon, 20 Jul 2026 09:46:56 +0000
Subject: [PATCH 209/220] Update CHANGELOG.md (#15922)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0a641ccf6..a8ca47c30 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -514,6 +514,12 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
     - Omada: fix package version extraction [@MickLesk](https://github.com/MickLesk) ([#15908](https://github.com/community-scripts/ProxmoxVE/pull/15908))
     - fix(wanderer): use PocketBase-relative plugin symlink in unprivileged LXC [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15911](https://github.com/community-scripts/ProxmoxVE/pull/15911))
 
+### 💾 Core
+
+  - #### 🔧 Refactor
+
+    - core: Improve GPU detection and mapping logic [@MickLesk](https://github.com/MickLesk) ([#15918](https://github.com/community-scripts/ProxmoxVE/pull/15918))
+
 ## 2026-07-19
 
 ### 🚀 Updated Scripts

From 2c13cb6a382dda067b5c1d574006921c3c5eb90a Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Mon, 20 Jul 2026 11:53:27 +0200
Subject: [PATCH 210/220] Meilisearch : use dumpless Meilisearch upgrades
 (#15921)

---
 misc/tools.func | 168 ++++++++++++++----------------------------------
 1 file changed, 50 insertions(+), 118 deletions(-)

diff --git a/misc/tools.func b/misc/tools.func
index cc5e66162..af82098dc 100644
--- a/misc/tools.func
+++ b/misc/tools.func
@@ -6981,7 +6981,7 @@ setup_meilisearch() {
       CURRENT_VERSION=$(/usr/bin/meilisearch --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1) || CURRENT_VERSION="0.0.0"
       NEW_VERSION="${CHECK_UPDATE_RELEASE#v}"
 
-      # Extract major.minor for comparison (Meilisearch requires dump/restore between minor versions)
+      # Extract major.minor for comparison (Meilisearch changes its on-disk DB format between minor versions)
       local CURRENT_MAJOR_MINOR NEW_MAJOR_MINOR
       CURRENT_MAJOR_MINOR=$(echo "$CURRENT_VERSION" | cut -d. -f1,2)
       NEW_MAJOR_MINOR=$(echo "$NEW_VERSION" | cut -d. -f1,2)
@@ -6993,140 +6993,72 @@ setup_meilisearch() {
         msg_info "MeiliSearch version change detected (${CURRENT_VERSION} → ${NEW_VERSION}), preparing data migration"
       fi
 
-      # Read config values for dump/restore
-      local MEILI_HOST MEILI_PORT MEILI_MASTER_KEY MEILI_DUMP_DIR
+      # Read connection + storage paths for the in-place (dumpless) upgrade
+      local MEILI_HOST MEILI_PORT MEILI_DB_PATH
       MEILI_HOST="${MEILISEARCH_HOST:-127.0.0.1}"
       MEILI_PORT="${MEILISEARCH_PORT:-7700}"
-      MEILI_DUMP_DIR="${MEILISEARCH_DUMP_DIR:-/var/lib/meilisearch/dumps}"
-      MEILI_MASTER_KEY=$(grep -E "^master_key\s*=" /etc/meilisearch.toml 2>/dev/null | sed 's/.*=\s*"\(.*\)"/\1/' | tr -d ' ' || true)
+      MEILI_DB_PATH=$(grep -E "^db_path\s*=" /etc/meilisearch.toml 2>/dev/null | sed 's/.*=\s*"\(.*\)"/\1/' | tr -d ' ' || true)
+      MEILI_DB_PATH="${MEILI_DB_PATH:-/var/lib/meilisearch/data}"
 
-      # Create dump before update if migration is needed
-      local DUMP_UID=""
-      if [[ "$NEEDS_MIGRATION" == "true" ]] && [[ -n "$MEILI_MASTER_KEY" ]]; then
-        msg_info "Creating MeiliSearch data dump before upgrade"
+      systemctl stop meilisearch
 
-        # Trigger dump creation
-        local DUMP_RESPONSE
-        DUMP_RESPONSE=$(curl -s -X POST "http://${MEILI_HOST}:${MEILI_PORT}/dumps" \
-          -H "Authorization: Bearer ${MEILI_MASTER_KEY}" \
-          -H "Content-Type: application/json" 2>/dev/null) || true
-
-        # The initial response only contains taskUid, not dumpUid
-        # dumpUid is only available after the task completes
-        local TASK_UID
-        TASK_UID=$(echo "$DUMP_RESPONSE" | grep -oP '"taskUid":\s*\K[0-9]+' || true)
-
-        if [[ -n "$TASK_UID" ]]; then
-          msg_info "Waiting for dump task ${TASK_UID} to complete..."
-          local MAX_WAIT=120
-          local WAITED=0
-          local TASK_RESULT=""
-
-          while [[ $WAITED -lt $MAX_WAIT ]]; do
-            TASK_RESULT=$(curl -s "http://${MEILI_HOST}:${MEILI_PORT}/tasks/${TASK_UID}" \
-              -H "Authorization: Bearer ${MEILI_MASTER_KEY}" 2>/dev/null) || true
-
-            local TASK_STATUS
-            TASK_STATUS=$(echo "$TASK_RESULT" | grep -oP '"status":\s*"\K[^"]+' || true)
-
-            if [[ "$TASK_STATUS" == "succeeded" ]]; then
-              # Extract dumpUid from the completed task details
-              DUMP_UID=$(echo "$TASK_RESULT" | grep -oP '"dumpUid":\s*"\K[^"]+' || true)
-              if [[ -n "$DUMP_UID" ]]; then
-                msg_ok "MeiliSearch dump created successfully: ${DUMP_UID}"
-              else
-                msg_warn "Dump task succeeded but could not extract dumpUid"
-              fi
-              break
-            elif [[ "$TASK_STATUS" == "failed" ]]; then
-              local ERROR_MSG
-              ERROR_MSG=$(echo "$TASK_RESULT" | grep -oP '"message":\s*"\K[^"]+' || echo "Unknown error")
-              msg_warn "MeiliSearch dump failed: ${ERROR_MSG}"
-              break
-            fi
-            sleep 2
-            WAITED=$((WAITED + 2))
-          done
-
-          if [[ $WAITED -ge $MAX_WAIT ]]; then
-            msg_warn "MeiliSearch dump timed out after ${MAX_WAIT}s"
-          fi
-        else
-          msg_warn "Could not trigger MeiliSearch dump (no taskUid in response)"
-          msg_info "Response was: ${DUMP_RESPONSE:-empty}"
-        fi
-      fi
-
-      if [[ "$NEEDS_MIGRATION" == "true" ]] && [[ -z "$DUMP_UID" ]]; then
-        msg_error "MeiliSearch migration requires a successful dump before upgrade"
-        msg_error "Ensure the service is running and master_key is configured, or set MEILISEARCH_SKIP_MIGRATION=1 to force (data loss risk)"
-        if [[ "${MEILISEARCH_SKIP_MIGRATION:-}" != "1" ]]; then
+      # Safety backup of the data dir before any in-place migration.
+      # Dumpless upgrade mutates the DB in place and cannot be rolled back on
+      # failure, so keep a tarball to restore from. (No master_key/API needed.)
+      local MEILI_BACKUP=""
+      if [[ "$NEEDS_MIGRATION" == "true" ]]; then
+        MEILI_BACKUP="/var/lib/meilisearch/pre-upgrade-${CURRENT_VERSION}.tar.gz"
+        msg_info "Backing up data dir before upgrade → ${MEILI_BACKUP}"
+        if ! tar -czf "$MEILI_BACKUP" -C "$MEILI_DB_PATH" . 2>/dev/null; then
+          msg_error "MeiliSearch data backup failed — aborting upgrade to avoid data loss"
+          systemctl start meilisearch
           return 100
         fi
-        msg_warn "MEILISEARCH_SKIP_MIGRATION=1 — proceeding without dump (manual reindex may be required)"
+        msg_ok "Backup created: ${MEILI_BACKUP}"
       fi
 
-      # Stop service and update binary
-      systemctl stop meilisearch
+      # Replace the binary
       if [[ "$(arch_resolve)" == "arm64" ]]; then
         fetch_and_deploy_gh_release "meilisearch" "meilisearch/meilisearch" "singlefile" "latest" "/usr/bin" "meilisearch-linux-aarch64"
       else
         fetch_and_deploy_gh_release "meilisearch" "meilisearch/meilisearch" "binary"
       fi
 
-      # If migration needed and dump was created, remove old data and import dump
-      if [[ "$NEEDS_MIGRATION" == "true" ]] && [[ -n "$DUMP_UID" ]]; then
-        local MEILI_DB_PATH
-        MEILI_DB_PATH=$(grep -E "^db_path\s*=" /etc/meilisearch.toml 2>/dev/null | sed 's/.*=\s*"\(.*\)"/\1/' | tr -d ' ' || true)
-        MEILI_DB_PATH="${MEILI_DB_PATH:-/var/lib/meilisearch/data}"
+      if [[ "$NEEDS_MIGRATION" == "true" ]]; then
+        # One-time in-place migration via --experimental-dumpless-upgrade.
+        # Meilisearch migrates the on-disk DB during this startup; subsequent
+        # normal (systemd) starts run without the flag.
+        msg_info "Migrating data in place (dumpless upgrade ${CURRENT_VERSION} → ${NEW_VERSION})"
+        /usr/bin/meilisearch --config-file-path /etc/meilisearch.toml --experimental-dumpless-upgrade >/dev/null 2>&1 &
+        local MEILI_PID=$!
 
-        msg_info "Removing old MeiliSearch database for migration"
-        find "${MEILI_DB_PATH:?}" -mindepth 1 -delete
-
-        # Import dump using CLI flag (this is the supported method)
-        local DUMP_FILE="${MEILI_DUMP_DIR}/${DUMP_UID}.dump"
-        if [[ -f "$DUMP_FILE" ]]; then
-          msg_info "Importing dump: ${DUMP_FILE}"
-
-          # Start meilisearch with --import-dump flag
-          # This is a one-time import that happens during startup
-          /usr/bin/meilisearch --config-file-path /etc/meilisearch.toml --import-dump "$DUMP_FILE" >/dev/null 2>&1 &
-          local MEILI_PID=$!
-
-          # Wait for meilisearch to become healthy (import happens during startup)
-          msg_info "Waiting for MeiliSearch to import and start..."
-          local MAX_WAIT=300
-          local WAITED=0
-          while [[ $WAITED -lt $MAX_WAIT ]]; do
-            if curl -sf "http://${MEILI_HOST}:${MEILI_PORT}/health" &>/dev/null; then
-              msg_ok "MeiliSearch is healthy after import"
-              break
-            fi
-            # Check if process is still running
-            if ! kill -0 $MEILI_PID 2>/dev/null; then
-              msg_warn "MeiliSearch process exited during import"
-              break
-            fi
-            sleep 3
-            WAITED=$((WAITED + 3))
-          done
-
-          # Stop the manual process
-          kill $MEILI_PID 2>/dev/null || true
-          wait $MEILI_PID 2>/dev/null || true
-          sleep 2
-
-          # Start via systemd for proper management
-          systemctl start meilisearch
-
-          if systemctl is-active --quiet meilisearch; then
-            msg_ok "MeiliSearch migrated successfully"
-          else
-            msg_warn "MeiliSearch failed to start after migration - check logs with: journalctl -u meilisearch"
+        local MAX_WAIT=300
+        local WAITED=0
+        local MIGRATED=false
+        while [[ $WAITED -lt $MAX_WAIT ]]; do
+          if curl -sf "http://${MEILI_HOST}:${MEILI_PORT}/health" &>/dev/null; then
+            MIGRATED=true
+            break
           fi
+          # Bail early if the migration process died
+          if ! kill -0 $MEILI_PID 2>/dev/null; then
+            msg_warn "MeiliSearch process exited during migration"
+            break
+          fi
+          sleep 3
+          WAITED=$((WAITED + 3))
+        done
+
+        # Stop the one-shot migration process and hand over to systemd
+        kill $MEILI_PID 2>/dev/null || true
+        wait $MEILI_PID 2>/dev/null || true
+        sleep 2
+        systemctl start meilisearch
+
+        if [[ "$MIGRATED" == "true" ]] && systemctl is-active --quiet meilisearch; then
+          msg_ok "MeiliSearch migrated successfully (backup kept at ${MEILI_BACKUP})"
         else
-          msg_warn "Dump file not found: ${DUMP_FILE}"
-          systemctl start meilisearch
+          msg_error "MeiliSearch migration failed. Restore with: systemctl stop meilisearch; rm -rf ${MEILI_DB_PATH:?}/*; tar -xzf ${MEILI_BACKUP} -C ${MEILI_DB_PATH}; then reinstall the previous version"
         fi
       else
         systemctl start meilisearch

From b6a8ca1a3a85f32618b65b2ee5d565c0984e5b79 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Mon, 20 Jul 2026 09:53:51 +0000
Subject: [PATCH 211/220] Update CHANGELOG.md (#15923)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a8ca47c30..ef27f7d43 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -516,6 +516,10 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ### 💾 Core
 
+  - #### ✨ New Features
+
+    - Meilisearch : use dumpless Meilisearch upgrades [@MickLesk](https://github.com/MickLesk) ([#15921](https://github.com/community-scripts/ProxmoxVE/pull/15921))
+
   - #### 🔧 Refactor
 
     - core: Improve GPU detection and mapping logic [@MickLesk](https://github.com/MickLesk) ([#15918](https://github.com/community-scripts/ProxmoxVE/pull/15918))

From fa9377cd4533a7223eda7c47b427c769f2c8feb7 Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Mon, 20 Jul 2026 11:54:04 +0200
Subject: [PATCH 212/220] Zammad : bind Elasticsearch to 127.0.0.1 (#15909)

---
 install/zammad-install.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/install/zammad-install.sh b/install/zammad-install.sh
index 1cd56f63b..750f30214 100644
--- a/install/zammad-install.sh
+++ b/install/zammad-install.sh
@@ -32,6 +32,7 @@ sed -i 's/^#\{0,2\} *-Xms[0-9]*g.*/-Xms2g/' /etc/elasticsearch/jvm.options
 sed -i 's/^#\{0,2\} *-Xmx[0-9]*g.*/-Xmx2g/' /etc/elasticsearch/jvm.options
 cat <<EOF >/etc/elasticsearch/elasticsearch.yml
 discovery.type: single-node
+network.host: 127.0.0.1
 xpack.security.enabled: false
 bootstrap.memory_lock: false
 EOF
@@ -40,7 +41,7 @@ systemctl daemon-reload
 systemctl enable -q elasticsearch
 systemctl restart -q elasticsearch
 for i in $(seq 1 30); do
-  if curl -s http://localhost:9200 >/dev/null 2>&1; then
+  if curl -s http://127.0.0.1:9200 >/dev/null 2>&1; then
     break
   fi
   sleep 2
@@ -55,7 +56,7 @@ setup_deb822_repo \
   "$(get_os_info version_id)" \
   "main"
 $STD apt install -y zammad
-$STD zammad run rails r "Setting.set('es_url', 'http://localhost:9200')"
+$STD zammad run rails r "Setting.set('es_url', 'http://127.0.0.1:9200')"
 $STD zammad run rake zammad:searchindex:rebuild
 msg_ok "Installed Zammad"
 

From 1dba4eb2eef0f2f71dc764a8948fa18015f57323 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Mon, 20 Jul 2026 09:54:29 +0000
Subject: [PATCH 213/220] Update CHANGELOG.md (#15924)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ef27f7d43..0544fb282 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -511,6 +511,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - Zammad : bind Elasticsearch to 127.0.0.1 [@MickLesk](https://github.com/MickLesk) ([#15909](https://github.com/community-scripts/ProxmoxVE/pull/15909))
     - Omada: fix package version extraction [@MickLesk](https://github.com/MickLesk) ([#15908](https://github.com/community-scripts/ProxmoxVE/pull/15908))
     - fix(wanderer): use PocketBase-relative plugin symlink in unprivileged LXC [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15911](https://github.com/community-scripts/ProxmoxVE/pull/15911))
 

From f8cc69e2447b813cf16e68d3f0f4c7f1c2c019d6 Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Mon, 20 Jul 2026 11:55:01 +0200
Subject: [PATCH 214/220] Gotify: Migration to v3 (#15912)

---
 ct/gotify.sh              | 24 ++++++++++++++++++++++++
 install/gotify-install.sh |  2 +-
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/ct/gotify.sh b/ct/gotify.sh
index 0615a2342..cf15fc124 100644
--- a/ct/gotify.sh
+++ b/ct/gotify.sh
@@ -36,6 +36,30 @@ function update_script() {
     fetch_and_deploy_gh_release "gotify" "gotify/server" "prebuild" "latest" "/opt/gotify" "gotify-linux-$(arch_resolve).zip"
     chmod +x /opt/gotify/gotify-linux-$(arch_resolve)
 
+    if [[ ! -f /opt/gotify/gotify-server.env ]]; then
+      gotify_old_config=""
+      for f in /opt/gotify/config.yml /etc/gotify/config.yml; do
+        [[ -f "$f" ]] && gotify_old_config="$f" && break
+      done
+      if [[ -n "$gotify_old_config" ]]; then
+        msg_info "Migrating ${gotify_old_config} to env format (Gotify 3.x)"
+        if /opt/gotify/gotify-linux-$(arch_resolve) migrate-config "$gotify_old_config" >/opt/gotify/gotify-server.env 2>/dev/null; then
+          mv "$gotify_old_config" "${gotify_old_config}.bak"
+          msg_ok "Migrated config to /opt/gotify/gotify-server.env (backup: ${gotify_old_config}.bak)"
+        else
+          rm -f /opt/gotify/gotify-server.env
+          msg_warn "Config migration failed — left ${gotify_old_config} in place, review manually"
+        fi
+      fi
+    fi
+
+    if ! grep -qE '^ExecStart=.* serve' /etc/systemd/system/gotify.service 2>/dev/null; then
+      msg_info "Migrating service to serve subcommand (Gotify 3.x)"
+      sed -i -E 's|^(ExecStart=/opt/gotify/.*gotify-linux-[^ ]+)$|\1 serve|' /etc/systemd/system/gotify.service
+      systemctl daemon-reload
+      msg_ok "Migrated service to serve subcommand"
+    fi
+
     msg_info "Starting Service"
     systemctl start gotify
     msg_ok "Started Service"
diff --git a/install/gotify-install.sh b/install/gotify-install.sh
index 44444c74f..c9623be69 100644
--- a/install/gotify-install.sh
+++ b/install/gotify-install.sh
@@ -27,7 +27,7 @@ After=network.target
 Type=simple
 User=root
 WorkingDirectory=/opt/gotify
-ExecStart=/opt/gotify/./gotify-linux-$(arch_resolve)
+ExecStart=/opt/gotify/gotify-linux-$(arch_resolve) serve
 Restart=always
 RestartSec=3
 

From a61dc9c585b002c216b86aeb137afaeaacfbe9cb Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Mon, 20 Jul 2026 09:55:26 +0000
Subject: [PATCH 215/220] Update CHANGELOG.md (#15925)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0544fb282..8df890164 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -515,6 +515,10 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
     - Omada: fix package version extraction [@MickLesk](https://github.com/MickLesk) ([#15908](https://github.com/community-scripts/ProxmoxVE/pull/15908))
     - fix(wanderer): use PocketBase-relative plugin symlink in unprivileged LXC [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15911](https://github.com/community-scripts/ProxmoxVE/pull/15911))
 
+  - #### 💥 Breaking Changes
+
+    - Gotify: Migration to v3 [@MickLesk](https://github.com/MickLesk) ([#15912](https://github.com/community-scripts/ProxmoxVE/pull/15912))
+
 ### 💾 Core
 
   - #### ✨ New Features

From 5b4e5263299bc0055bc43dda506c930719fe5893 Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Mon, 20 Jul 2026 11:57:41 +0200
Subject: [PATCH 216/220] tools.func: add support for extracting 7z archives
 (#15919)

---
 misc/tools.func | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/misc/tools.func b/misc/tools.func
index af82098dc..1cc7dc257 100644
--- a/misc/tools.func
+++ b/misc/tools.func
@@ -2587,6 +2587,16 @@ _deploy_unpacked_archive() {
       msg_error "Failed to extract TAR archive"
       return 251
     }
+  elif [[ "$filename" == *.7z ]]; then
+    if [[ -f /etc/alpine-release ]]; then
+      ensure_dependencies 7zip
+    else
+      ensure_dependencies p7zip-full
+    fi
+    7z x -y -o"$workdir" "$archive" >/dev/null 2>&1 || {
+      msg_error "Failed to extract 7z archive"
+      return 251
+    }
   else
     msg_error "Unsupported archive format: $filename"
     return 65

From f15e9c320bdbb866f121eb3043867822eaf2414a Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Mon, 20 Jul 2026 09:58:10 +0000
Subject: [PATCH 217/220] Update CHANGELOG.md (#15926)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8df890164..9ca9a991a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -523,6 +523,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### ✨ New Features
 
+    - tools.func: add support for extracting 7z archives [@MickLesk](https://github.com/MickLesk) ([#15919](https://github.com/community-scripts/ProxmoxVE/pull/15919))
     - Meilisearch : use dumpless Meilisearch upgrades [@MickLesk](https://github.com/MickLesk) ([#15921](https://github.com/community-scripts/ProxmoxVE/pull/15921))
 
   - #### 🔧 Refactor

From 8505d284295b99cbee5f90cffaf66d553f182efc Mon Sep 17 00:00:00 2001
From: MickLesk <mickey.leskowitz@gmail.com>
Date: Mon, 20 Jul 2026 12:15:57 +0200
Subject: [PATCH 218/220] Set explicit Elasticsearch paths

Define `path.data` and `path.logs` in the Zammad install script's Elasticsearch config so the service uses the expected data and log directories when running in the single-node local setup.
---
 install/zammad-install.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/install/zammad-install.sh b/install/zammad-install.sh
index 750f30214..20777142c 100644
--- a/install/zammad-install.sh
+++ b/install/zammad-install.sh
@@ -31,6 +31,8 @@ $STD apt install -y elasticsearch
 sed -i 's/^#\{0,2\} *-Xms[0-9]*g.*/-Xms2g/' /etc/elasticsearch/jvm.options
 sed -i 's/^#\{0,2\} *-Xmx[0-9]*g.*/-Xmx2g/' /etc/elasticsearch/jvm.options
 cat <<EOF >/etc/elasticsearch/elasticsearch.yml
+path.data: /var/lib/elasticsearch
+path.logs: /var/log/elasticsearch
 discovery.type: single-node
 network.host: 127.0.0.1
 xpack.security.enabled: false

From e925e29966aaf294d59265b175cf2465956fc8f0 Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Mon, 20 Jul 2026 14:39:29 +0200
Subject: [PATCH 219/220] RomM: use backup helpers in update / clear folder
 (#15915)

* RomM: use backup helpers in update / clear folder

Replace manual .env backup/restore with create_backup and restore_backup helpers, and add CLEAN_INSTALL=1 flag to fetch_and_deploy_gh_release.

* add screenscraper env

* add rom_patcher

* add ruffle and emulatorJS
---
 ct/romm.sh              | 27 ++++++++++++++++++++++-----
 install/romm-install.sh | 17 +++++++++++++++++
 2 files changed, 39 insertions(+), 5 deletions(-)

diff --git a/ct/romm.sh b/ct/romm.sh
index 7a34a8e75..eb05d2168 100644
--- a/ct/romm.sh
+++ b/ct/romm.sh
@@ -37,18 +37,29 @@ function update_script() {
     systemctl stop romm-backend romm-worker romm-scheduler romm-watcher
     msg_ok "Stopped Services"
 
-    msg_info "Backing up configuration"
-    cp /opt/romm/.env /opt/romm/.env.backup
-    msg_ok "Backed up configuration"
+    create_backup /opt/romm/.env
+    BACKUP_DIR=/opt/romm-players.backup create_backup \
+      /opt/romm/frontend/dist/assets/emulatorjs \
+      /opt/romm/frontend/dist/assets/ruffle
 
-    fetch_and_deploy_gh_release "romm" "rommapp/romm" "tarball" "latest" "/opt/romm"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "romm" "rommapp/romm" "tarball" "latest" "/opt/romm"
+
+    restore_backup
 
     msg_info "Updating ROMM"
-    cp /opt/romm/.env.backup /opt/romm/.env
     cd /opt/romm
     $STD uv sync --all-extras
     cd /opt/romm/backend
     $STD uv run alembic upgrade head
+    if [[ -f /opt/romm/backend/utils/rom_patcher/package.json ]]; then
+      cd /opt/romm/backend/utils/rom_patcher
+      $STD npm install --ignore-scripts --no-audit --no-fund
+      if [[ -d node_modules/rom-patcher/rom-patcher-js ]]; then
+        rm -rf rom-patcher-js
+        cp -r node_modules/rom-patcher/rom-patcher-js ./rom-patcher-js
+      fi
+      rm -rf node_modules
+    fi
     cd /opt/romm/frontend
     $STD npm install
     $STD npm run build
@@ -73,6 +84,12 @@ function update_script() {
     msg_ok "Started Services"
     msg_ok "Updated successfully"
   fi
+
+  if check_for_gh_release "EmulatorJS" "EmulatorJS/EmulatorJS" "v4.2.3"; then
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "EmulatorJS" "EmulatorJS/EmulatorJS" "prebuild" "v4.2.3" "/opt/romm/frontend/dist/assets/emulatorjs" "4.2.3.7z"
+    systemctl restart romm-backend romm-worker romm-scheduler romm-watcher
+    msg_ok "Updated EmulatorJS successfully"
+  fi
   exit
 }
 
diff --git a/install/romm-install.sh b/install/romm-install.sh
index bf126dea0..d88410082 100644
--- a/install/romm-install.sh
+++ b/install/romm-install.sh
@@ -134,6 +134,8 @@ else
 fi
 
 fetch_and_deploy_gh_release "romm" "rommapp/romm" "tarball"
+fetch_and_deploy_gh_release "ruffle" "ruffle-rs/ruffle" "prebuild" "latest" "/opt/romm/frontend/dist/assets/ruffle" "ruffle-*-web-selfhosted.zip"
+fetch_and_deploy_gh_release "EmulatorJS" "EmulatorJS/EmulatorJS" "prebuild" "v4.2.3" "/opt/romm/frontend/dist/assets/emulatorjs" "4.2.3.7z"
 
 msg_info "Creating environment file"
 sed -i 's/^supervised no/supervised systemd/' /etc/redis/redis.conf
@@ -159,6 +161,9 @@ ROMM_AUTH_SECRET_KEY=$AUTH_SECRET_KEY
 DISABLE_DOWNLOAD_ENDPOINT_AUTH=false
 DISABLE_CSRF_PROTECTION=false
 
+SCREENSCRAPER_DEV_ID=
+SCREENSCRAPER_DEV_PASSWORD=
+
 ENABLE_RESCAN_ON_FILESYSTEM_CHANGE=true
 RESCAN_ON_FILESYSTEM_CHANGE_DELAY=5
 
@@ -181,6 +186,18 @@ cd /opt/romm/backend
 $STD uv run alembic upgrade head
 msg_ok "Set up RomM Backend"
 
+if [[ -f /opt/romm/backend/utils/rom_patcher/package.json ]]; then
+  msg_info "Building ROM Patcher helper"
+  cd /opt/romm/backend/utils/rom_patcher
+  $STD npm install --ignore-scripts --no-audit --no-fund
+  if [[ -d node_modules/rom-patcher/rom-patcher-js ]]; then
+    rm -rf rom-patcher-js
+    cp -r node_modules/rom-patcher/rom-patcher-js ./rom-patcher-js
+  fi
+  rm -rf node_modules
+  msg_ok "Built ROM Patcher helper"
+fi
+
 msg_info "Setting up RomM Frontend"
 cd /opt/romm/frontend
 $STD npm install

From 640865356458d3daa6bb860e883fadfd8b263e74 Mon Sep 17 00:00:00 2001
From: "community-scripts-pr-app[bot]"
 <189241966+community-scripts-pr-app[bot]@users.noreply.github.com>
Date: Mon, 20 Jul 2026 12:39:57 +0000
Subject: [PATCH 220/220] Update CHANGELOG.md (#15928)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9ca9a991a..81c5b70d1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -511,6 +511,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - RomM: use backup helpers in update / clear folder [@MickLesk](https://github.com/MickLesk) ([#15915](https://github.com/community-scripts/ProxmoxVE/pull/15915))
     - Zammad : bind Elasticsearch to 127.0.0.1 [@MickLesk](https://github.com/MickLesk) ([#15909](https://github.com/community-scripts/ProxmoxVE/pull/15909))
     - Omada: fix package version extraction [@MickLesk](https://github.com/MickLesk) ([#15908](https://github.com/community-scripts/ProxmoxVE/pull/15908))
     - fix(wanderer): use PocketBase-relative plugin symlink in unprivileged LXC [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15911](https://github.com/community-scripts/ProxmoxVE/pull/15911))