diff --git a/VERSION b/VERSION index 867bcf888..288b2cd9a 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -6.0.5-rc.4 +6.0.5 diff --git a/deploy/helm/pulse/Chart.yaml b/deploy/helm/pulse/Chart.yaml index f311b9dc2..a3c7d0c70 100644 --- a/deploy/helm/pulse/Chart.yaml +++ b/deploy/helm/pulse/Chart.yaml @@ -2,9 +2,9 @@ apiVersion: v2 name: pulse description: Helm chart for deploying the Pulse hub and optional Docker monitoring agent. type: application -version: 6.0.5-rc.4 -appVersion: "6.0.5-rc.4" -icon: https://raw.githubusercontent.com/rcourtman/Pulse/v6.0.5-rc.4/docs/images/pulse-logo.svg +version: 6.0.5 +appVersion: "6.0.5" +icon: https://raw.githubusercontent.com/rcourtman/Pulse/v6.0.5/docs/images/pulse-logo.svg keywords: - monitoring - proxmox @@ -32,7 +32,7 @@ annotations: description: Smoke tests with kind cluster deployment artifacthub.io/links: | - name: Documentation - url: https://github.com/rcourtman/Pulse/blob/v6.0.5-rc.4/docs/KUBERNETES.md + url: https://github.com/rcourtman/Pulse/blob/v6.0.5/docs/KUBERNETES.md - name: Support url: https://github.com/rcourtman/Pulse/discussions artifacthub.io/maintainers: | diff --git a/deploy/helm/pulse/README.md b/deploy/helm/pulse/README.md index 20f7e4b66..ab7591a90 100644 --- a/deploy/helm/pulse/README.md +++ b/deploy/helm/pulse/README.md @@ -1,6 +1,6 @@ # pulse -![Version: 6.0.5-rc.4](https://img.shields.io/badge/Version-6.0.5--rc.4-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 6.0.5-rc.4](https://img.shields.io/badge/AppVersion-6.0.5--rc.4-informational?style=flat-square) +![Version: 6.0.5](https://img.shields.io/badge/Version-6.0.5-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 6.0.5](https://img.shields.io/badge/AppVersion-6.0.5-informational?style=flat-square) Helm chart for deploying the Pulse hub and optional Docker monitoring agent. diff --git a/docker-compose.yml b/docker-compose.yml index 479842445..4bf91e7b9 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -2,7 +2,7 @@ version: '3.8' services: pulse: - image: ${PULSE_IMAGE:-rcourtman/pulse:6.0.5-rc.4} + image: ${PULSE_IMAGE:-rcourtman/pulse:6.0.5} container_name: pulse restart: unless-stopped logging: diff --git a/docs/RELEASE_NOTES.md b/docs/RELEASE_NOTES.md index cd4a74534..348d9458a 100644 --- a/docs/RELEASE_NOTES.md +++ b/docs/RELEASE_NOTES.md @@ -6,11 +6,9 @@ Pulse release notes live on GitHub: For historical v4 notes that previously lived in this repo, see: `docs/releases/RELEASE_NOTES_v4.md` -For the current v6 support release candidate packet, see: +For historical v6 support release candidate packets, see: - `docs/releases/RELEASE_NOTES_v6.0.5-rc.4.md` - `docs/releases/V6_CHANGELOG_v6.0.5-rc.4.md` - -For historical v6 support release candidate packets, see: - `docs/releases/RELEASE_NOTES_v6.0.5-rc.3.md` - `docs/releases/V6_CHANGELOG_v6.0.5-rc.3.md` - `docs/releases/RELEASE_NOTES_v6.0.5-rc.2.md` @@ -19,6 +17,8 @@ For historical v6 support release candidate packets, see: - `docs/releases/V6_CHANGELOG_v6.0.5-rc.1.md` For the current stable v6 patch packet, see: +- `docs/releases/RELEASE_NOTES_v6.0.5.md` +- `docs/releases/V6_CHANGELOG_v6.0.5.md` - `docs/releases/RELEASE_NOTES_v6.0.4.md` - `docs/releases/V6_CHANGELOG_v6.0.4.md` - `docs/releases/RELEASE_NOTES_v6.0.3.md` diff --git a/docs/UPGRADE_v6.md b/docs/UPGRADE_v6.md index 50ac4e2a2..53211cb6c 100644 --- a/docs/UPGRADE_v6.md +++ b/docs/UPGRADE_v6.md @@ -2,13 +2,10 @@ This guide covers practical upgrade steps for existing Pulse installs moving to v6. -For the current v6 support release candidate packet, see: - -- `docs/releases/RELEASE_NOTES_v6.0.5-rc.4.md` -- `docs/releases/V6_CHANGELOG_v6.0.5-rc.4.md` - For the current stable v6 packet and rollout references, see: +- `docs/releases/RELEASE_NOTES_v6.0.5.md` +- `docs/releases/V6_CHANGELOG_v6.0.5.md` - `docs/releases/RELEASE_NOTES_v6.0.4.md` - `docs/releases/V6_CHANGELOG_v6.0.4.md` - `docs/releases/RELEASE_NOTES_v6.0.3.md` diff --git a/docs/release-control/v6/internal/subsystems/deployment-installability.md b/docs/release-control/v6/internal/subsystems/deployment-installability.md index b2200b2d2..6728fa0a9 100644 --- a/docs/release-control/v6/internal/subsystems/deployment-installability.md +++ b/docs/release-control/v6/internal/subsystems/deployment-installability.md @@ -861,23 +861,23 @@ TLS floor in the dynamic config. ## Current State -The active support prerelease `v6.0.5-rc.4` cut sets the repo-root `VERSION`, +The active stable `v6.0.5` cut sets the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` -fallback, and Helm chart release metadata to the same `6.0.5-rc.4` release -version. This support prerelease keeps `rollback_version=v6.0.4`, publishes a -versioned public GitHub prerelease plus versioned Docker and Helm artifacts, -and does not move stable/latest install pointers or stable semver aliases. It -queues the v6.0.4 stable line's customer-support fixes for Gemini Patrol -tool-call readiness, remembered-login submit persistence, Proxmox SATA/SAT -SMART temperature fallback, legacy agent update token recovery, threshold-aware -temperature display severity, PBS backup polling memory bounds, physical disk -SMART/Proxmox merge identity, Proxmox token preservation diagnostics, legacy -OIDC SSO discovery with CSP nonce handling, mobile onboarding URL handoff -sanitization, SSO browser-session display labels, route-aware Proxmox host -URLs, MSP report scheduling with a portal alert rollup, per-disk-type -temperature thresholds, PBS backup discovery recovery, host fingerprint -auto-discovery, and surfaced agent auth failures behind RC validation instead -of publishing another same-day stable patch. +fallback, and Helm chart release metadata to the same `6.0.5` release +version. This patch release uses the stable hotfix path with +`rollback_version=v6.0.4`, `hotfix_exception=true`, a release-owner reason, +and no fabricated same-version RC tag. It advances the v6.0.4 stable line with +customer-support fixes for Gemini Patrol tool-call readiness, remembered-login +submit persistence, Proxmox SATA/SAT SMART temperature fallback, legacy agent +update token recovery, threshold-aware temperature display severity, PBS backup +polling memory bounds, physical disk SMART/Proxmox merge identity, Proxmox +token preservation diagnostics, legacy OIDC SSO discovery with CSP nonce +handling, mobile onboarding URL handoff sanitization, SSO browser-session +display labels, route-aware Proxmox host URLs, MSP report scheduling with a +portal alert rollup, per-disk-type temperature thresholds, PBS backup discovery +recovery, host fingerprint auto-discovery, surfaced agent auth failures, +paid-runtime activation fingerprint reuse, billing-period license status, and +pinned installer execution hardening to a stable patch. The initial GA promotion metadata remains `promoted_from_tag=v6.0.0-rc.7`, `rollback_version=v5.1.35`, @@ -931,8 +931,8 @@ compose image default, standalone installer fallback constant, and packaged Helm metadata. A draft release workflow failure caused by stale image or chart pins is a release-packet blocker until the defaults, tests, and evidence record are refreshed from the new branch head. -For the active support prerelease `v6.0.5-rc.4` cut, the repo-root compose -default and `scripts/install-docker.sh` fallback must both pin `6.0.5-rc.4` +For the active stable `v6.0.5` cut, the repo-root compose +default and `scripts/install-docker.sh` fallback must both pin `6.0.5` until the next governed stable cut moves them forward. The stable promotion guard remains in force by rejecting leftover `-rc.` defaults when the governed `VERSION` is a stable release. diff --git a/docs/releases/RELEASE_NOTES_v6.0.5.md b/docs/releases/RELEASE_NOTES_v6.0.5.md new file mode 100644 index 000000000..583a1cd6a --- /dev/null +++ b/docs/releases/RELEASE_NOTES_v6.0.5.md @@ -0,0 +1,71 @@ +# Pulse v6.0.5 Release Notes + +`v6.0.5` is a stable patch release for the Pulse v6 line. It follows +`v6.0.4` and promotes the support fixes that were validated through the +`v6.0.5-rc.4` line, plus the paid-runtime activation continuity and +license-period status fixes needed for Pro customers. It includes Patrol +Gemini model readiness, remembered-login submit persistence, Proxmox SMART +temperature fallback for direct SATA/SAT disks, and the additional +installability and monitoring fixes listed below. + +## Added + +- Reports can now be scheduled with weekly or monthly cadence, explicit + resource or tag scoping, and PDF or CSV delivery by email or to disk. The + MSP provider portal shows a per-workspace alert rollup so provider + operators see client alert pressure at a glance. +- Physical disk temperature thresholds are now configurable per disk type, + and explicit per-disk overrides beat the per-type defaults. +- OIDC provider settings now support editing requested scopes, and SSO + provider restriction fields can be cleared once set. +- Kubernetes shared toolbar filters are now URL-backed so saved views keep + exclusions, Docker container filters support `-term` search exclusions and + persistent saved views, and saved views are reachable from the FilterBar + mobile expanded body. + +## Fixed + +- Paid runtime activation now preserves a stable installation fingerprint + across activation clears and restores, so reactivation of the same Pro + install reuses the existing installation slot instead of consuming new + slots with generated fingerprints. +- License grants now carry the paid billing period separately from the short + refresh lease, so status screens can show the real subscription/trial period + while enforcement keeps using renewable grant expiry. +- Server installation helpers now reject unsafe piped execution paths and + keep `--version vX.Y.Z` handling aligned between self-refetch and pinned + update flows. +- Fixed a PBS backup discovery regression from the rc.3 bounded-polling + change: snapshot groups beyond the bound were synthesized without + verification, size, or file data, so real deployments saw backups as + Unverified with a collapsed timeline. Bounds are now derived from real + snapshot data. +- Hosts now participate in the discovery fingerprint model so they + auto-discover instead of requiring manual entry. +- Agent auth failures and staleness are now surfaced in the UI instead of an + agent silently retrying 401 responses forever while the node stayed green, + and the recovery guidance points at the Pulse UI. +- The Pro binary now blocks in-app self-update so a paid install can no + longer silently downgrade itself to the community build. +- Registry rebuilds no longer write no-op relationship-change rows, which + previously grew resource history by hundreds of thousands of rows per day + on busy deployments. +- Mock-mode data churn is paced to realistic homelab rates, so demo and + evaluation deployments stop generating phantom restart and state-flap + events. +- Docker Swarm workload dedupe now picks cluster-scoped winners + deterministically. +- Legacy 3-segment OIDC SSO login and callback paths are served again so + bookmarked or configured legacy SSO URLs keep working after upgrade. +- Relay pairing help now points at the Pulse Mobile install page so a + pairing QR has an obvious companion app to scan it with. +- v5 migration recovery states are clarified so interrupted migrations + explain what happened and what to do next. + +## Upgrade Notes + +Use the normal v6 install or update flow for `v6.0.5`. The rollback target for +this patch release is `v6.0.4`. + +Paid Pulse Pro, Relay, and eligible legacy customers should continue to use the +private download page and private runtime image for paid runtime features. diff --git a/docs/releases/V6_CHANGELOG_v6.0.5.md b/docs/releases/V6_CHANGELOG_v6.0.5.md new file mode 100644 index 000000000..5d623cae4 --- /dev/null +++ b/docs/releases/V6_CHANGELOG_v6.0.5.md @@ -0,0 +1,81 @@ +# Pulse v6.0.5 + +_This changelog describes the stable `v6.0.5` patch release compared with +stable `v6.0.4`._ + +## Added + +- MSP reports now support scheduled delivery with weekly or monthly cadence, + explicit resource or tag scoping, and PDF or CSV output by email or to + disk, and the MSP provider portal now shows a per-workspace alert rollup. +- Physical disk temperature thresholds are now configurable per disk type, + with explicit per-disk overrides beating per-type defaults. +- OIDC provider settings now support editing requested scopes, and SSO + provider restriction fields can be cleared once set. +- Kubernetes shared toolbar filters are now URL-backed so saved views keep + exclusions, Docker container filters support `-term` search exclusions and + persistent saved views, and saved views appear in the FilterBar mobile + expanded body. + +## Fixed + +- Paid runtime activation now writes and reuses a durable installation fingerprint + so repeated activation on the same Pro install reuses the existing + installation slot. +- License grants now include the billing `current_period_end` alongside the + short renewable grant lease, allowing client status to show the real paid + period without weakening enforcement. +- Server installer execution now rejects unsafe piped invocation and keeps + pinned `--version vX.Y.Z` update flows aligned. +- Patrol readiness checks now detect Gemini tool-call capability from Gemini + candidate parts as well as top-level tool-call lists. +- Remembered-login state now persists the saved username when the checkbox is + enabled during submit. +- Proxmox SMART temperature collection now retries direct SATA/SAT disks with an + explicit SAT probe when smartctl auto-detection returns health but no + temperature. +- Legacy agent update token recovery now handles v5-to-v6 update paths where a + running agent can provide connection details even when stored state is absent. +- Temperature displays now resolve configured alert thresholds across node, + workload, Docker, standalone agent, and drawer surfaces. +- PBS backup polling now keeps a bounded read-state working set during backup + discovery. +- PBS backup discovery now derives its memory bounds from real snapshot data, + fixing an rc.3 regression where groups beyond the bound were synthesized + without verification, size, file, or per-snapshot time data. +- Physical disk SMART and Proxmox records now merge through canonical disk + identity so NVMe, size, SMART, and temperature metadata survive enrichment. +- Proxmox install/update flows now preserve generated token state and expose + smoke diagnostics for setup validation. +- Legacy OIDC SSO discovery now persists and advertises configured providers, + with CSP nonce handling for embedded frontend assets. +- Legacy 3-segment OIDC SSO login and callback paths are served again for + installs configured before the route consolidation. +- Pulse Mobile pairing now omits unsafe non-HTTPS Pulse web handoff URLs from + QR/deep-link payloads while keeping relay pairing usable and returning an + `instance_url_not_https` diagnostic for settings copy. +- OIDC and SAML browser sessions now expose a separate display label for app + chrome while authorization remains bound to the stable provider-scoped + principal. +- Proxmox host setup now prefers route-aware host URLs. +- Hosts now join the discovery fingerprint model so they auto-discover. +- Agent auth failures and staleness are now surfaced instead of a silent 401 + retry loop, with recovery guidance pointing at the Pulse UI. +- The Pro binary now blocks in-app self-update to prevent a silent downgrade + to the community build. +- Registry rebuilds no longer emit no-op relationship-change records, keeping + resource history growth bounded on busy deployments. +- Mock-mode churn is paced to homelab rates so demo deployments stop + generating phantom change events. +- Docker Swarm workload dedupe now picks cluster-scoped winners + deterministically. +- Relay pairing help now points at the Pulse Mobile install page. +- v5 migration recovery states are clarified for interrupted migrations. +- Docker, Helm, installer, and release-helper metadata now track the active + stable patch version. + +## Release Metadata + +- Version: `v6.0.5` +- Rollback target: `v6.0.4` +- Promotion path: stable patch hotfix from `main` diff --git a/scripts/install-docker.sh b/scripts/install-docker.sh index f8d3c3a6f..16735b0c5 100755 --- a/scripts/install-docker.sh +++ b/scripts/install-docker.sh @@ -6,7 +6,7 @@ set -euo pipefail SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)" DOCKER_IMAGE_REPO="${DOCKER_IMAGE_REPO:-rcourtman/pulse}" -CANONICAL_DEFAULT_PULSE_VERSION="6.0.5-rc.4" +CANONICAL_DEFAULT_PULSE_VERSION="6.0.5" resolve_default_pulse_version() { if [ -n "${PULSE_IMAGE_VERSION:-}" ]; then diff --git a/scripts/installtests/build_release_assets_test.go b/scripts/installtests/build_release_assets_test.go index b4414892d..0b8b87586 100644 --- a/scripts/installtests/build_release_assets_test.go +++ b/scripts/installtests/build_release_assets_test.go @@ -265,6 +265,8 @@ func TestCurrentStablePatchReleasePacketTracksInstallMetadata(t *testing.T) { "remembered-login submit persistence", "Proxmox SMART temperature fallback", "direct SATA/SAT disks", + "paid-runtime activation continuity", + "license-period status fixes", "rollback target for this patch release is `v"+previous+"`", ) assertFileContainsAll(t, changelogPath, @@ -275,6 +277,9 @@ func TestCurrentStablePatchReleasePacketTracksInstallMetadata(t *testing.T) { "Remembered-login state now persists", "Proxmox SMART temperature collection", "explicit SAT probe", + "Paid runtime activation now writes and reuses a durable installation fingerprint", + "License grants now include the billing `current_period_end`", + "Server installer execution now rejects unsafe piped invocation", ) assertFileContainsAll(t, repoFile("docs", "RELEASE_NOTES.md"), "docs/releases/RELEASE_NOTES_v"+version+".md", @@ -340,6 +345,9 @@ func TestCurrentSupportPrereleasePacketTracksInstallMetadata(t *testing.T) { "portal alert rollup", "per-disk-type temperature thresholds", "PBS backup discovery recovery", + "paid-runtime activation continuity fixes", + "license-period status corrections", + "installer hardening", "rollback target for this release candidate is `v"+previous+"`", ) assertFileContainsAll(t, changelogPath, @@ -363,6 +371,9 @@ func TestCurrentSupportPrereleasePacketTracksInstallMetadata(t *testing.T) { "per-workspace alert rollup", "Physical disk temperature thresholds are now configurable per disk type", "PBS backup discovery now derives its memory bounds from real snapshot data", + "Paid runtime activation now writes and reuses a durable installation fingerprint", + "License grants now include the billing `current_period_end`", + "Server installer execution now rejects unsafe piped invocation", ) assertFileContainsAll(t, repoFile("docs", "RELEASE_NOTES.md"), "docs/releases/RELEASE_NOTES_v"+version+".md", diff --git a/scripts/installtests/install_docker_sh_test.go b/scripts/installtests/install_docker_sh_test.go index 1162f4be3..893a44908 100644 --- a/scripts/installtests/install_docker_sh_test.go +++ b/scripts/installtests/install_docker_sh_test.go @@ -212,6 +212,8 @@ func TestInstallDockerProofTracksStablePatchReleaseContract(t *testing.T) { "The active stable `v"+version+"` cut sets the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and Helm chart release metadata to the same `"+version+"` release version.", "This patch release uses the stable hotfix path with `rollback_version=v"+previous+"`, `hotfix_exception=true`, a release-owner reason, and no fabricated same-version RC tag.", "It advances the v"+previous+" stable line with customer-support fixes", + "paid-runtime activation fingerprint reuse", + "pinned installer execution hardening", "For the active stable `v"+version+"` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `"+version+"`", ) }