Pin Go to the version each project declares in go.mod

setup_go with no GO_VERSION resolves to whatever go.dev currently serves, so every Go app was built against a moving target. When 1.27 landed it broke wanderer outright (#16909): PocketBase pins go 1.25.0 and stack-overflows at startup when built with anything newer. Two problems, both fixed here: setup_go ran before the source was fetched in all 15 install scripts, so the pin could not be read even if someone wanted one. It now runs after the fetch and reads the version out of go.mod. 13 ct/ scripts rebuild with go during update. Eleven never called setup_go at all and rebuilt with whatever the container happened to have; the other two called it before the fetch. All 13 now use the same call as their installer, verified identical string for string. caddy is left alone: xcaddy fetches the Caddy source itself, so there is no local go.mod to read, and it already pins deliberately. wanderer is in #16976.
2026-09-07 13:13:53 +02:00 · 2026-09-02 17:41:34 +02:00
43 changed files with 212 additions and 978 deletions
@@ -1,66 +1,3 @@
-## 2026-08-31
-
-### 🆕 New Scripts
-
-  - Aurral ([#16908](https://github.com/community-scripts/ProxmoxVE/pull/16908))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - openwebui: add UV_HTTP_TIMEOUT and retry loop to prevent uv install hangs [@MickLesk](https://github.com/MickLesk) ([#16917](https://github.com/community-scripts/ProxmoxVE/pull/16917))
-    - bambuddy: force asyncio loop, uvloop breaks camera proxy handlers [@MickLesk](https://github.com/MickLesk) ([#16904](https://github.com/community-scripts/ProxmoxVE/pull/16904))
-    - bookorbit: raise service start timeout, migration can exceed systemd default [@MickLesk](https://github.com/MickLesk) ([#16860](https://github.com/community-scripts/ProxmoxVE/pull/16860))
-    - node-red: remove --unsafe-perm flag [@MickLesk](https://github.com/MickLesk) ([#16859](https://github.com/community-scripts/ProxmoxVE/pull/16859))
-    - directus: add build-essential dependency [@MickLesk](https://github.com/MickLesk) ([#16858](https://github.com/community-scripts/ProxmoxVE/pull/16858))
-
-  - #### ✨ New Features
-
-    - haos-vm: add optional x86-64-v2-AES CPU option, future HA numpy builds need it [@MickLesk](https://github.com/MickLesk) ([#16868](https://github.com/community-scripts/ProxmoxVE/pull/16868))
-
-  - #### 🔧 Refactor
-
-    - omv: migrate to new package repo host (packages.openmediavault.org) is dead [@MickLesk](https://github.com/MickLesk) ([#16918](https://github.com/community-scripts/ProxmoxVE/pull/16918))
-    - yuvomi/aurral: bump NODE_VERSION [@MickLesk](https://github.com/MickLesk) ([#16914](https://github.com/community-scripts/ProxmoxVE/pull/16914))
-    - vaultwarden: relax cargo release profile via env vars to avoid build OOM [@MickLesk](https://github.com/MickLesk) ([#16915](https://github.com/community-scripts/ProxmoxVE/pull/16915))
-    - kima-hub/maintainerr/planka/spliit: bump NODE_VERSION [@MickLesk](https://github.com/MickLesk) ([#16905](https://github.com/community-scripts/ProxmoxVE/pull/16905))
-    - gatus: pin Go toolchain to gatus's own go.mod version [@MickLesk](https://github.com/MickLesk) ([#16893](https://github.com/community-scripts/ProxmoxVE/pull/16893))
-    - immich: tolerate enable-maintenance-mode crash, same as disable-maintenance-mode [@MickLesk](https://github.com/MickLesk) ([#16866](https://github.com/community-scripts/ProxmoxVE/pull/16866))
-    - move the hardware-accelerated scripts onto new core [@MickLesk](https://github.com/MickLesk) ([#16864](https://github.com/community-scripts/ProxmoxVE/pull/16864))
-    - ntopng: use ntop.org's documented apt repo per Debian codename, not always apt-stable [@MickLesk](https://github.com/MickLesk) ([#16862](https://github.com/community-scripts/ProxmoxVE/pull/16862))
-    - Refactor: OpenGist [@MickLesk](https://github.com/MickLesk) ([#16861](https://github.com/community-scripts/ProxmoxVE/pull/16861))
-
-### 💾 Core
-
-  - Refactor VM script settings and fix load_functions errors [@MickLesk](https://github.com/MickLesk) ([core#13](https://github.com/community-scripts/core/pull/13))
- Ask ProxmoxVE to refresh its changelog on merge [@MickLesk](https://github.com/MickLesk) ([core#11](https://github.com/community-scripts/core/pull/11))
- Lift the settings summary and the mode fork into vm-core [@MickLesk](https://github.com/MickLesk) ([core#12](https://github.com/community-scripts/core/pull/12))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - filebrowser-quantum: strip removed disableIndexing key on update, restart service [@MickLesk](https://github.com/MickLesk) ([#16892](https://github.com/community-scripts/ProxmoxVE/pull/16892))
-
-### 📚 Documentation
-
-  - Include engine pull requests in the changelog [@MickLesk](https://github.com/MickLesk) ([#16867](https://github.com/community-scripts/ProxmoxVE/pull/16867))
-
-## 2026-08-30
-
-### 🆕 New Scripts
-
-  - SolidInvoice ([#16869](https://github.com/community-scripts/ProxmoxVE/pull/16869))
- Super-Productivity ([#16870](https://github.com/community-scripts/ProxmoxVE/pull/16870))
- Defguard ([#16871](https://github.com/community-scripts/ProxmoxVE/pull/16871))
- OpenBao ([#16872](https://github.com/community-scripts/ProxmoxVE/pull/16872))
-
-### 🚀 Updated Scripts
-
-  - #### 🔧 Refactor
-
-    - general: remove gitea links overall  [@MickLesk](https://github.com/MickLesk) ([#16863](https://github.com/community-scripts/ProxmoxVE/pull/16863))
-
 ## 2026-08-29

 ### 📚 Documentation
@@ -1,115 +0,0 @@
-## 2026-09-05
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - authentik: scope blueprints chown to avoid recursing into the mp0 bind mount [@MickLesk](https://github.com/MickLesk) ([#17008](https://github.com/community-scripts/ProxmoxVE/pull/17008))
-    - iventoy: run iventoy.sh with bash instead of dash [@MickLesk](https://github.com/MickLesk) ([#17034](https://github.com/community-scripts/ProxmoxVE/pull/17034))
-    - frigate: restart go2rtc.service before frigate starts [@MickLesk](https://github.com/MickLesk) ([#17035](https://github.com/community-scripts/ProxmoxVE/pull/17035))
-    - snapotter: seed AI venv base packages on arm64, warn amd64 has no working CPU bundle [@MickLesk](https://github.com/MickLesk) ([#16903](https://github.com/community-scripts/ProxmoxVE/pull/16903))
-    - tolgee: bump required JDK from 21 to 25 [@MickLesk](https://github.com/MickLesk) ([#17005](https://github.com/community-scripts/ProxmoxVE/pull/17005))
-    - romm: write real version into backend/__version__.py placeholder [@MickLesk](https://github.com/MickLesk) ([#17009](https://github.com/community-scripts/ProxmoxVE/pull/17009))
-
-  - #### 🔧 Refactor
-
-    - Refactor FileFlows: Stop Spinner before read -rp / Switch from "Node" to "Agent"  [@MickLesk](https://github.com/MickLesk) ([#17007](https://github.com/community-scripts/ProxmoxVE/pull/17007))
-
-### 💾 Core
-
-  - update helper: follow renamed ct/ scripts instead of curling a 404 [@MickLesk](https://github.com/MickLesk) ([core#22](https://github.com/community-scripts/core/pull/22))
- Use Proxmox for a template before reaching for linuxcontainers.org [@MickLesk](https://github.com/MickLesk) ([core#23](https://github.com/community-scripts/core/pull/23))
- implement exponential backoff for curl retries in _cs_curl_retry function [@MickLesk](https://github.com/MickLesk) ([core#26](https://github.com/community-scripts/core/pull/26))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - update-apps: follow renamed ct/ scripts instead of erroring out [@MickLesk](https://github.com/MickLesk) ([#16991](https://github.com/community-scripts/ProxmoxVE/pull/16991))
-
-## 2026-09-04
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - fix(shlink): preserve servers.json across web-client updates [@Corgei](https://github.com/Corgei) ([#17023](https://github.com/community-scripts/ProxmoxVE/pull/17023))
-    - fix-update-authentik-2026.8.1 [@thieneret](https://github.com/thieneret) ([#16999](https://github.com/community-scripts/ProxmoxVE/pull/16999))
-    - Fix npm v12 allow-git/allow-remote restrictions across affected scripts [@MickLesk](https://github.com/MickLesk) ([#17014](https://github.com/community-scripts/ProxmoxVE/pull/17014))
-    - Fix/poznote - 1st party Docker parity [@lucas-at-3x-eye](https://github.com/lucas-at-3x-eye) ([#17011](https://github.com/community-scripts/ProxmoxVE/pull/17011))
-
-### 💾 Core
-
-  - setup_go: resolve bare major.minor versions to the latest patch release [@MickLesk](https://github.com/MickLesk) ([core#24](https://github.com/community-scripts/core/pull/24))
-
-## 2026-09-03
-
-### 🚀 Updated Scripts
-
-  - Immich: bump libheif and libraw [@vhsdream](https://github.com/vhsdream) ([#16996](https://github.com/community-scripts/ProxmoxVE/pull/16996))
-
-  - #### 🐞 Bug Fixes
-
-    - romm: allow git-based npm dependency for rom-patcher under npm v12 [@MickLesk](https://github.com/MickLesk) ([#16990](https://github.com/community-scripts/ProxmoxVE/pull/16990))
-    - Pin Go to the version each project declares in go.mod [@MickLesk](https://github.com/MickLesk) ([#16976](https://github.com/community-scripts/ProxmoxVE/pull/16976))
-    - Authentik update 2026.8.1 [@thieneret](https://github.com/thieneret) ([#16980](https://github.com/community-scripts/ProxmoxVE/pull/16980))
-
-## 2026-09-02
-
-### 🆕 New Scripts
-
-  - OwnTracks-Recorder ([#16967](https://github.com/community-scripts/ProxmoxVE/pull/16967))
- PeerTube ([#16966](https://github.com/community-scripts/ProxmoxVE/pull/16966))
- Kaneo ([#16965](https://github.com/community-scripts/ProxmoxVE/pull/16965))
- JDownloader ([#16964](https://github.com/community-scripts/ProxmoxVE/pull/16964))
- ReadMeABook ([#16963](https://github.com/community-scripts/ProxmoxVE/pull/16963))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Enhance backup process in teddycloud.sh [@MickLesk](https://github.com/MickLesk) ([#16946](https://github.com/community-scripts/ProxmoxVE/pull/16946))
-    - mealie: copy Nuxt generate output and use pnpm when lockfile is present [@mjhuff](https://github.com/mjhuff) ([#16938](https://github.com/community-scripts/ProxmoxVE/pull/16938))
-    - OpenThread-BR: Clean build directory before update [@tomfrenzel](https://github.com/tomfrenzel) ([#16949](https://github.com/community-scripts/ProxmoxVE/pull/16949))
-
-  - #### 🔧 Refactor
-
-    - Scripts: use shared core bootstrap for final 114 Script Batch [@MickLesk](https://github.com/MickLesk) ([#16953](https://github.com/community-scripts/ProxmoxVE/pull/16953))
-    - Scripts: use shared core bootstrap for next 115 Script Batch [@MickLesk](https://github.com/MickLesk) ([#16952](https://github.com/community-scripts/ProxmoxVE/pull/16952))
-    - Scripts: use shared core bootstrap for next 115 Script Batch [@MickLesk](https://github.com/MickLesk) ([#16951](https://github.com/community-scripts/ProxmoxVE/pull/16951))
-    - Scripts: use shared core bootstrap for next 100 Script Batch [@MickLesk](https://github.com/MickLesk) ([#16950](https://github.com/community-scripts/ProxmoxVE/pull/16950))
-
-### 💾 Core
-
-  - setup_meilisearch: generate a 32-byte master key [@MickLesk](https://github.com/MickLesk) ([core#20](https://github.com/community-scripts/core/pull/20))
- setup_meilisearch: generate a 32-byte master key [@MickLesk](https://github.com/MickLesk) ([core#19](https://github.com/community-scripts/core/pull/19))
- setup_nodejs: restore the npm allowScripts bypass lost in the migration [@MickLesk](https://github.com/MickLesk) ([core#18](https://github.com/community-scripts/core/pull/18))
-
-## 2026-09-01
-
-### 🆕 New Scripts
-
-  - Mailpit ([#16942](https://github.com/community-scripts/ProxmoxVE/pull/16942))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Revert Aurral to Node22 [@Copilot](https://github.com/Copilot) ([#16930](https://github.com/community-scripts/ProxmoxVE/pull/16930))
-    - jellyfin: verify repo suite via fallback chain and use ensure_dependencies for clearer apt failures [@MickLesk](https://github.com/MickLesk) ([#16916](https://github.com/community-scripts/ProxmoxVE/pull/16916))
-
-  - #### 🔧 Refactor
-
-    - Move the next 25 scripts onto the core engine [@MickLesk](https://github.com/MickLesk) ([#16934](https://github.com/community-scripts/ProxmoxVE/pull/16934))
-
-### 💾 Core
-
-  - Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#15](https://github.com/community-scripts/core/pull/15))
- Report the exit code the engine actually saw [@MickLesk](https://github.com/MickLesk) ([core#17](https://github.com/community-scripts/core/pull/17))
- Silence npm's update notice so the real error stays visible [@MickLesk](https://github.com/MickLesk) ([core#16](https://github.com/community-scripts/core/pull/16))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - fix(add-iptag): merge live IPv4 addresses for running LXCs [@phillf](https://github.com/phillf) ([#16691](https://github.com/community-scripts/ProxmoxVE/pull/16691))
@@ -7,9 +7,8 @@ on:
    - cron: "0 6 * * 1"

 permissions:
-  contents: write
+  contents: read
  issues: write
-  pull-requests: write

 jobs:
  check-node-versions:
@@ -391,132 +390,6 @@ jobs:

          cat /tmp/drift_report.md

-      # One PR per script, not one for all of them: the bumps are judged
-      # individually (an app can be deliberately held back while the next is a
-      # safe follow), and a combined PR is blocked by its worst member.
-      - name: Open a pull request per drifting script
-        if: steps.check.outputs.drift_count != '0'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-
-          : >/tmp/drift_prs.txt
-
-          while IFS='|' read -r slug our upstream hint repo; do
-            [[ -z "$slug" ]] && continue
-
-            # "dynamic" and "unset" have no literal to rewrite, and a missing
-            # upstream major is nothing to rewrite it to.
-            if [[ ! "$our" =~ ^[0-9]+$ || ! "$upstream" =~ ^[0-9]+$ ]]; then
-              printf '%s|manual||\n' "$slug" >>/tmp/drift_prs.txt
-              continue
-            fi
-
-            # The branch name carries the exact bump, so the PR for it answers
-            # the question on its own: open means it is waiting for a review,
-            # closed means someone said no to this bump. A later upstream
-            # release changes the name and gets its own PR.
-            branch="node-drift/${slug}-${our}-to-${upstream}"
-
-            existing=$(gh pr list --head "$branch" --state all \
-              --json number,state,url,labels --jq '.[0] // empty' 2>/dev/null || echo "")
-
-            if [[ -n "$existing" ]]; then
-              state=$(jq -r '.state' <<<"$existing")
-              url=$(jq -r '.url' <<<"$existing")
-              stale=$(jq -r '[.labels[]?.name] | index("stale") // empty' <<<"$existing")
-
-              case "$state" in
-              OPEN)
-                printf '%s|open|%s\n' "$slug" "$url" >>/tmp/drift_prs.txt
-                continue
-                ;;
-              MERGED)
-                printf '%s|merged|%s\n' "$slug" "$url" >>/tmp/drift_prs.txt
-                continue
-                ;;
-              *)
-                # The stale bot only closes what a human labelled "stale", so
-                # that close carries no verdict on the bump — reopen the case.
-                # A close without it is a decision, and it stands.
-                if [[ -z "$stale" ]]; then
-                  printf '%s|declined|%s\n' "$slug" "$url" >>/tmp/drift_prs.txt
-                  continue
-                fi
-                git push origin --delete "$branch" >/dev/null 2>&1 || true
-                ;;
-              esac
-            fi
-
-            git checkout -q -B "$branch"
-
-            changed=()
-            for f in "install/${slug}-install.sh" "ct/${slug}.sh"; do
-              [[ -f "$f" ]] || continue
-              if grep -qE "NODE_VERSION=\"?${our}\"?" "$f"; then
-                sed -i -E "s/(NODE_VERSION=)\"?${our}\"?/\1\"${upstream}\"/g" "$f"
-                changed+=("$f")
-              fi
-            done
-
-            if [[ ${#changed[@]} -eq 0 ]]; then
-              printf '%s|manual||\n' "$slug" >>/tmp/drift_prs.txt
-              git checkout -q main
-              continue
-            fi
-
-            git add "${changed[@]}"
-            git commit -q -m "${slug}: bump Node.js from ${our} to ${upstream}"
-
-            if ! git push -q -u origin "$branch" 2>/dev/null; then
-              printf '%s|failed||\n' "$slug" >>/tmp/drift_prs.txt
-              git checkout -q main
-              continue
-            fi
-
-            # The test command is written here rather than left to
-            # pr-test-command.yml: a PR opened with GITHUB_TOKEN does not start
-            # another workflow, so that comment would never arrive.
-            body=$(cat <<PR_EOF
-          \`${slug}\` pins Node **${our}**, upstream indicates **${upstream}** (${hint}) — [upstream repo](https://github.com/${repo}).
-
-          Opened automatically by the weekly Node.js version drift check. **Nothing here has been tested.** Run it against a host before merging:
-
-          \`\`\`bash
-          export COMMUNITY_SCRIPTS_URL=https://raw.githubusercontent.com/${GITHUB_REPOSITORY}/${branch}
-          bash -c "\$(curl -fsSL "\$COMMUNITY_SCRIPTS_URL/ct/${slug}.sh")"
-          \`\`\`
-
-          Both lines are needed — each script pins \`_CS_DEFAULT_URL\` to \`main\`, and that pin is what fills \`COMMUNITY_SCRIPTS_URL\` when it is unset.
-
-          If the bump is wrong — upstream ships a newer Node than the app needs, or this script is deliberately held back — **close this PR**. It gets recorded on the drift report and this exact bump is not proposed again.
-          PR_EOF
-            )
-
-            # The label goes on at creation, not in a second call: it is what
-            # exempts the PR from the template check, and that check runs on
-            # "opened" — a label added a moment later can arrive too late.
-            if url=$(gh pr create \
-              --title "${slug}: bump Node.js from ${our} to ${upstream}" \
-              --body "$body" \
-              --base main \
-              --head "$branch" \
-              --label "automated pr" 2>/dev/null); then
-              printf '%s|open|%s\n' "$slug" "$url" >>/tmp/drift_prs.txt
-            else
-              printf '%s|failed||\n' "$slug" >>/tmp/drift_prs.txt
-            fi
-
-            git checkout -q main
-          done </tmp/drift_scripts.txt
-
-          echo "Pull request status per script:"
-          cat /tmp/drift_prs.txt
-
      - name: Create or update summary issue
        if: steps.check.outputs.drift_count != '0'
        env:
@@ -530,31 +403,11 @@ jobs:
          TOTAL="${{ steps.check.outputs.total }}"
          CHECKED="${{ steps.check.outputs.checked }}"

-          # Build checklist from drift data. Each item carries the state of its
-          # own PR, so the list tracks itself instead of relying on someone
-          # ticking a box that the next run would overwrite anyway.
+          # Build checklist from drift data
          CHECKLIST=""
          while IFS='|' read -r slug our_version upstream_major upstream_hint repo; do
            [[ -z "$slug" ]] && continue
-
-            pr_state=""
-            pr_url=""
-            if [[ -f /tmp/drift_prs.txt ]]; then
-              pr_line=$(grep -m1 "^${slug}|" /tmp/drift_prs.txt || echo "")
-              pr_state=$(cut -d'|' -f2 <<<"$pr_line")
-              pr_url=$(cut -d'|' -f3 <<<"$pr_line")
-            fi
-
-            case "$pr_state" in
-            open)     mark="- [ ]"; note="— ${pr_url}" ;;
-            declined) mark="- [x]"; note="— declined in ${pr_url}, not proposed again" ;;
-            merged)   mark="- [x]"; note="— merged in ${pr_url}" ;;
-            manual)   mark="- [ ]"; note="— needs a manual change (no fixed \`NODE_VERSION\` to rewrite)" ;;
-            failed)   mark="- [ ]"; note="— could not open a PR automatically" ;;
-            *)        mark="- [ ]"; note="" ;;
-            esac
-
-            CHECKLIST+="${mark} **\`${slug}\`** — ours: \`${our_version}\` → upstream: \`${upstream_major}\` (${upstream_hint}) — [repo](https://github.com/${repo}) ${note}"$'\n'
+            CHECKLIST+="- [ ] **\`${slug}\`** — ours: \`${our_version}\` → upstream: \`${upstream_major}\` (${upstream_hint}) — [repo](https://github.com/${repo})"$'\n'
          done < /tmp/drift_scripts.txt

          # Build full report table
@@ -571,12 +424,11 @@ jobs:

          ### How to resolve

-          Each item above has its own pull request with the bump already applied and a ready-to-run test command in the description.
-
-          1. Check the upstream Dockerfile / package.json to confirm the required Node.js version
-          2. Run the test command from the PR against a host
-          3. Merge the PR if it works — the item disappears from this list on the next run
-          4. Close the PR if the bump is wrong: the script stays as it is and this exact bump is never proposed again
+          1. Check upstream Dockerfile / package.json to confirm the required Node.js version
+          2. Test the script with the new Node version
+          3. Update \`NODE_VERSION\` in \`install/<slug>-install.sh\`
+          4. Update \`NODE_VERSION\` in \`ct/<slug>.sh\` (update section) if applicable
+          5. Check off the item above once done

          <details>
          <summary>Full report</summary>
@@ -1,55 +0,0 @@
-name: Record closed Node.js drift PR
-
-# The drift check opens one PR per script and treats a closed one as a verdict:
-# that bump is not proposed again. That decision is invisible on the report
-# unless it is written there, so record it as a comment naming the script.
-
-on:
-  pull_request:
-    types: [closed]
-
-jobs:
-  record:
-    if: >
-      github.repository == 'community-scripts/ProxmoxVE' &&
-      github.event.pull_request.merged == false &&
-      startsWith(github.event.pull_request.head.ref, 'node-drift/')
-    runs-on: ubuntu-latest
-    permissions:
-      issues: write
-    steps:
-      - uses: actions/github-script@v9
-        with:
-          script: |
-            const pr = context.payload.pull_request;
-            const owner = context.repo.owner;
-            const repo = context.repo.repo;
-
-            // node-drift/<slug>-<from>-to-<to>
-            const m = pr.head.ref.match(/^node-drift\/(.+)-(\d+)-to-(\d+)$/);
-            if (!m) return;
-            const [, slug, from, to] = m;
-
-            // A close by the stale bot is a lapsed review, not a decision on
-            // the bump, and the drift check reopens those. Saying "declined"
-            // here would contradict it.
-            const stale = pr.labels.some((l) => l.name === 'stale');
-
-            const issues = await github.rest.issues.listForRepo({
-              owner, repo, state: 'open', labels: 'automated,dependencies', per_page: 100,
-            });
-            const issue = issues.data.find(
-              (i) => !i.pull_request && i.title === '[Automated] Node.js Version Drift Report',
-            );
-            if (!issue) return;
-
-            const body = stale
-              ? `\`${slug}\` — PR #${pr.number} (Node ${from} → ${to}) was closed as stale. `
-                + `No decision was recorded, so the next drift check opens it again.`
-              : `\`${slug}\` — PR #${pr.number} (Node ${from} → ${to}) was closed without merging. `
-                + `The script keeps Node ${from} and this bump will not be proposed again. `
-                + `If it was closed by mistake, reopen the PR.`;
-
-            await github.rest.issues.createComment({
-              owner, repo, issue_number: issue.number, body,
-            });
@@ -98,9 +98,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit



-
-
-



@@ -114,14 +111,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit


 <details>
-<summary><h4>September (5 entries)</h4></summary>
-
-[View September 2026 Changelog](.github/changelogs/2026/09.md)
-
-</details>
-
-<details>
-<summary><h4>August (31 entries)</h4></summary>
+<summary><h4>August (29 entries)</h4></summary>

 [View August 2026 Changelog](.github/changelogs/2026/08.md)

@@ -540,92 +530,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 </details>

-## 2026-09-07
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - reactive-resume: repair any wrong WorkingDirectory on update [@MickLesk](https://github.com/MickLesk) ([#17068](https://github.com/community-scripts/ProxmoxVE/pull/17068))
-    - mediamtx: keep mediamtx.yml across updates [@MickLesk](https://github.com/MickLesk) ([#17069](https://github.com/community-scripts/ProxmoxVE/pull/17069))
-    - omnitools: allow remote action while npm ci [@MickLesk](https://github.com/MickLesk) ([#17070](https://github.com/community-scripts/ProxmoxVE/pull/17070))
-
-  - #### ✨ New Features
-
-    - netboot-xyz: add Secure Boot and Legacy assets [@MickLesk](https://github.com/MickLesk) ([#17066](https://github.com/community-scripts/ProxmoxVE/pull/17066))
-
-  - #### 🔧 Refactor
-
-    - heimdall: set up PHP 8.4 on update, keep only the database, run migrations [@MickLesk](https://github.com/MickLesk) ([#17067](https://github.com/community-scripts/ProxmoxVE/pull/17067))
-
-### 📂 Github
-
-  - github: Open per-script Node bump PRs [@MickLesk](https://github.com/MickLesk) ([#17065](https://github.com/community-scripts/ProxmoxVE/pull/17065))
-
-## 2026-09-06
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Fix Sonarqube update script to add +x on sonar.sh [@jarihu](https://github.com/jarihu) ([#17056](https://github.com/community-scripts/ProxmoxVE/pull/17056))
-
-## 2026-09-05
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - authentik: scope blueprints chown to avoid recursing into the mp0 bind mount [@MickLesk](https://github.com/MickLesk) ([#17008](https://github.com/community-scripts/ProxmoxVE/pull/17008))
-    - iventoy: run iventoy.sh with bash instead of dash [@MickLesk](https://github.com/MickLesk) ([#17034](https://github.com/community-scripts/ProxmoxVE/pull/17034))
-    - frigate: restart go2rtc.service before frigate starts [@MickLesk](https://github.com/MickLesk) ([#17035](https://github.com/community-scripts/ProxmoxVE/pull/17035))
-    - snapotter: seed AI venv base packages on arm64, warn amd64 has no working CPU bundle [@MickLesk](https://github.com/MickLesk) ([#16903](https://github.com/community-scripts/ProxmoxVE/pull/16903))
-    - tolgee: bump required JDK from 21 to 25 [@MickLesk](https://github.com/MickLesk) ([#17005](https://github.com/community-scripts/ProxmoxVE/pull/17005))
-    - romm: write real version into backend/__version__.py placeholder [@MickLesk](https://github.com/MickLesk) ([#17009](https://github.com/community-scripts/ProxmoxVE/pull/17009))
-
-  - #### 🔧 Refactor
-
-    - Refactor FileFlows: Stop Spinner before read -rp / Switch from "Node" to "Agent"  [@MickLesk](https://github.com/MickLesk) ([#17007](https://github.com/community-scripts/ProxmoxVE/pull/17007))
-
-### 💾 Core
-
-  - update helper: follow renamed ct/ scripts instead of curling a 404 [@MickLesk](https://github.com/MickLesk) ([core#22](https://github.com/community-scripts/core/pull/22))
- Use Proxmox for a template before reaching for linuxcontainers.org [@MickLesk](https://github.com/MickLesk) ([core#23](https://github.com/community-scripts/core/pull/23))
- implement exponential backoff for curl retries in _cs_curl_retry function [@MickLesk](https://github.com/MickLesk) ([core#26](https://github.com/community-scripts/core/pull/26))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - update-apps: follow renamed ct/ scripts instead of erroring out [@MickLesk](https://github.com/MickLesk) ([#16991](https://github.com/community-scripts/ProxmoxVE/pull/16991))
-
-## 2026-09-04
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - fix(shlink): preserve servers.json across web-client updates [@Corgei](https://github.com/Corgei) ([#17023](https://github.com/community-scripts/ProxmoxVE/pull/17023))
-    - fix-update-authentik-2026.8.1 [@thieneret](https://github.com/thieneret) ([#16999](https://github.com/community-scripts/ProxmoxVE/pull/16999))
-    - Fix npm v12 allow-git/allow-remote restrictions across affected scripts [@MickLesk](https://github.com/MickLesk) ([#17014](https://github.com/community-scripts/ProxmoxVE/pull/17014))
-    - Fix/poznote - 1st party Docker parity [@lucas-at-3x-eye](https://github.com/lucas-at-3x-eye) ([#17011](https://github.com/community-scripts/ProxmoxVE/pull/17011))
-
-### 💾 Core
-
-  - setup_go: resolve bare major.minor versions to the latest patch release [@MickLesk](https://github.com/MickLesk) ([core#24](https://github.com/community-scripts/core/pull/24))
-
-## 2026-09-03
-
-### 🚀 Updated Scripts
-
-  - Immich: bump libheif and libraw [@vhsdream](https://github.com/vhsdream) ([#16996](https://github.com/community-scripts/ProxmoxVE/pull/16996))
-
-  - #### 🐞 Bug Fixes
-
-    - romm: allow git-based npm dependency for rom-patcher under npm v12 [@MickLesk](https://github.com/MickLesk) ([#16990](https://github.com/community-scripts/ProxmoxVE/pull/16990))
-    - Pin Go to the version each project declares in go.mod [@MickLesk](https://github.com/MickLesk) ([#16976](https://github.com/community-scripts/ProxmoxVE/pull/16976))
-    - Authentik update 2026.8.1 [@thieneret](https://github.com/thieneret) ([#16980](https://github.com/community-scripts/ProxmoxVE/pull/16980))
-
 ## 2026-09-02

 ### 🆕 New Scripts
@@ -653,9 +557,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 ### 💾 Core

-  - setup_meilisearch: generate a 32-byte master key [@MickLesk](https://github.com/MickLesk) ([core#20](https://github.com/community-scripts/core/pull/20))
- setup_meilisearch: generate a 32-byte master key [@MickLesk](https://github.com/MickLesk) ([core#19](https://github.com/community-scripts/core/pull/19))
- setup_nodejs: restore the npm allowScripts bypass lost in the migration [@MickLesk](https://github.com/MickLesk) ([core#18](https://github.com/community-scripts/core/pull/18))
+  - setup_nodejs: restore the npm allowScripts bypass lost in the migration [@MickLesk](https://github.com/MickLesk) ([core#18](https://github.com/community-scripts/core/pull/18))

 ## 2026-09-01

@@ -1189,4 +1091,133 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

  - #### 🔧 Refactor

-    - core: extend new vars and pocketbase values [@MickLesk](https://github.com/MickLesk) ([#16313](https://github.com/community-scripts/ProxmoxVE/pull/16313))
+    - core: extend new vars and pocketbase values [@MickLesk](https://github.com/MickLesk) ([#16313](https://github.com/community-scripts/ProxmoxVE/pull/16313))
+
+## 2026-08-06
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - paperless: change update abort message (endless spinner) [@MickLesk](https://github.com/MickLesk) ([#16299](https://github.com/community-scripts/ProxmoxVE/pull/16299))
+
+  - #### ✨ New Features
+
+    - Vikunja: remove version pin, v2.5.0 fixes the systemd syscall filter crash [@MickLesk](https://github.com/MickLesk) ([#16300](https://github.com/community-scripts/ProxmoxVE/pull/16300))
+
+### 💾 Core
+
+  - #### 🔧 Refactor
+
+    - build.func: filter templates by host architecture during search [@MickLesk](https://github.com/MickLesk) ([#16302](https://github.com/community-scripts/ProxmoxVE/pull/16302))
+
+## 2026-08-05
+
+### 🚀 Updated Scripts
+
+  - #### ✨ New Features
+
+    - NextcloudPI: Bump to Debian Trixie & Tweak broken SSH [@MickLesk](https://github.com/MickLesk) ([#15957](https://github.com/community-scripts/ProxmoxVE/pull/15957))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - fix(monitor-all): reduce polling CPU overhead [@jomplox](https://github.com/jomplox) ([#15907](https://github.com/community-scripts/ProxmoxVE/pull/15907))
+
+## 2026-08-04
+
+### 🆕 New Scripts
+
+  - Hister ([#16259](https://github.com/community-scripts/ProxmoxVE/pull/16259))
+- Obsidian-LiveSync ([#16233](https://github.com/community-scripts/ProxmoxVE/pull/16233))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Actual Budget: allow native module install scripts under npm 11 (Node24) [@MickLesk](https://github.com/MickLesk) ([#16277](https://github.com/community-scripts/ProxmoxVE/pull/16277))
+    - Heimdall-Dashboard: run full composer install on update, force production env [@MickLesk](https://github.com/MickLesk) ([#16278](https://github.com/community-scripts/ProxmoxVE/pull/16278))
+    - xyOps: rebuild xySat satellite during update [@MickLesk](https://github.com/MickLesk) ([#16279](https://github.com/community-scripts/ProxmoxVE/pull/16279))
+    - HAOS: remove non-ASCII dash from CPU model dialog text [@MickLesk](https://github.com/MickLesk) ([#16276](https://github.com/community-scripts/ProxmoxVE/pull/16276))
+    - fix: back up Termix db/data so the update stops destroying encryption keys [@LukeGus](https://github.com/LukeGus) ([#16275](https://github.com/community-scripts/ProxmoxVE/pull/16275))
+    - passwordpusher: dynamically read Ruby version from .ruby-version file [@Copilot](https://github.com/Copilot) ([#16242](https://github.com/community-scripts/ProxmoxVE/pull/16242))
+    - fix(salt): write version cache to ~/.salt, not /~.salt [@TowyTowy](https://github.com/TowyTowy) ([#16265](https://github.com/community-scripts/ProxmoxVE/pull/16265))
+    - AFFiNE: fix version and build type reported by the app itself [@MickLesk](https://github.com/MickLesk) ([#16251](https://github.com/community-scripts/ProxmoxVE/pull/16251))
+    - Passbolt: fetch GPG key from Passbolt's own host instead of the flaky keyserver [@MickLesk](https://github.com/MickLesk) ([#16248](https://github.com/community-scripts/ProxmoxVE/pull/16248))
+
+  - #### ✨ New Features
+
+    - Opencloud: Pin version to 7.4.0 [@vhsdream](https://github.com/vhsdream) ([#16257](https://github.com/community-scripts/ProxmoxVE/pull/16257))
+
+  - #### 🔧 Refactor
+
+    - Bump NodeJS Versions of several scripts [@MickLesk](https://github.com/MickLesk) ([#16230](https://github.com/community-scripts/ProxmoxVE/pull/16230))
+
+### 💾 Core
+
+  - #### 🐞 Bug Fixes
+
+    - tools.func: never delete ubuntu.sources (or other distro base sources) as orphaned [@MickLesk](https://github.com/MickLesk) ([#16250](https://github.com/community-scripts/ProxmoxVE/pull/16250))
+    - tools.func: complete a stale/partial backup manifest instead of trusting it as-is [@MickLesk](https://github.com/MickLesk) ([#16252](https://github.com/community-scripts/ProxmoxVE/pull/16252))
+
+  - #### 🔧 Refactor
+
+    - Refactor: harmonize tools/addon and move boilerplate into core.func [@MickLesk](https://github.com/MickLesk) ([#16202](https://github.com/community-scripts/ProxmoxVE/pull/16202))
+
+## 2026-08-03
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Correction to link in Paperless-NGX update script [@jsspen](https://github.com/jsspen) ([#16241](https://github.com/community-scripts/ProxmoxVE/pull/16241))
+    - fix restore env in split pro [@johanngrobe](https://github.com/johanngrobe) ([#16228](https://github.com/community-scripts/ProxmoxVE/pull/16228))
+
+### 💾 Core
+
+  - #### 🔧 Refactor
+
+    - core: read all interactive prompts from /dev/tty, drain leftover input on read failure (hotfix) [@MickLesk](https://github.com/MickLesk) ([#16235](https://github.com/community-scripts/ProxmoxVE/pull/16235))
+
+## 2026-08-02
+
+### 🆕 New Scripts
+
+  - Portainer as Addon [@MickLesk](https://github.com/MickLesk) ([#16200](https://github.com/community-scripts/ProxmoxVE/pull/16200))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - LibreNMS: Ensure ipmitool dependency is installed [@tremor021](https://github.com/tremor021) ([#16219](https://github.com/community-scripts/ProxmoxVE/pull/16219))
+    - Bitfocus Companion: add libatomic1 dependency [@tremor021](https://github.com/tremor021) ([#16212](https://github.com/community-scripts/ProxmoxVE/pull/16212))
+    - fix(dispatcharr): add recordings and dvr queues to celery worker [@eXistC](https://github.com/eXistC) ([#16204](https://github.com/community-scripts/ProxmoxVE/pull/16204))
+    - add retry for uv - same as immich [@asylumexp](https://github.com/asylumexp) ([#16203](https://github.com/community-scripts/ProxmoxVE/pull/16203))
+    - Fix for cross-seed node version regression [@TorinFrancis](https://github.com/TorinFrancis) ([#16209](https://github.com/community-scripts/ProxmoxVE/pull/16209))
+
+  - #### 🔧 Refactor
+
+    - chore: remove portainer setup from several scripts (moved to addon) [@MickLesk](https://github.com/MickLesk) ([#16201](https://github.com/community-scripts/ProxmoxVE/pull/16201))
+
+## 2026-08-01
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Update bazarr-install.sh [@asylumexp](https://github.com/asylumexp) ([#16191](https://github.com/community-scripts/ProxmoxVE/pull/16191))
+    - fix romm missing 7z [@asylumexp](https://github.com/asylumexp) ([#16194](https://github.com/community-scripts/ProxmoxVE/pull/16194))
+
+  - #### 🔧 Refactor
+
+    - add CLEANUPARR_CONFIG_PATH, CLEANUPARR_LOGS_PATH vars [@asylumexp](https://github.com/asylumexp) ([#16193](https://github.com/community-scripts/ProxmoxVE/pull/16193))
+
+## 2026-07-31
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Docmost: cleanup folder at update [@MickLesk](https://github.com/MickLesk) ([#16177](https://github.com/community-scripts/ProxmoxVE/pull/16177))
+    - Firecrawl: Add dependency [@tremor021](https://github.com/tremor021) ([#16174](https://github.com/community-scripts/ProxmoxVE/pull/16174))
@@ -49,7 +49,7 @@ function update_script() {
  RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
  setup_yq

-  AUTHENTIK_VERSION="version/2026.8.1"
+  AUTHENTIK_VERSION="version/2026.8.0"
  # Source: https://github.com/goauthentik/fips/blob/main/Makefile#L26
  XMLSEC_VERSION="1.3.12"

@@ -84,16 +84,6 @@ function update_script() {
    fi
    msg_ok "Stopped Services"

-    if [[ ! -d /opt/authentik-data/blueprints ]]; then
-      msg_info "Moving blueprints to presistent directory"
-      cp -r /opt/authentik/blueprints /opt/authentik-data/
-      rm -r /opt/authentik/blueprints
-      $STD find /opt/authentik-data -path '*/lost+found' -prune -o -exec chown authentik:authentik {} +
-      yq -i ".blueprints_dir = \"/opt/authentik-data/blueprints\"" /etc/authentik/config.yml
-      msg_ok "blueprints moved to presistent directory"
-      msg_warn "The blueprints provided by authentik are always overwritten when updated! Only manually created custom blueprints remain unchanged between updates."
-    fi
-
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
    GO_VERSION="$(grep -m1 '^go ' /opt/authentik/go.mod | awk '{print $2}')" setup_go

@@ -153,39 +143,21 @@ function update_script() {
    chown -R authentik:authentik /opt/authentik
    msg_ok "Updated python server"

-    cp -r /opt/authentik/blueprints /opt/authentik-data/
-    rm -r /opt/authentik/blueprints
-    $STD find /opt/authentik-data -path '*/lost+found' -prune -o -exec chown authentik:authentik {} +
-
-    if [[ $MAJOR == 2026 && $MINOR -lt 8 ]]; then
-	    msg_info "Updating Worker and Server config (from $MAJOR.$MINOR)"
-      cat <<EOF >>/etc/default/authentik-server
+	  msg_info "Updating Worker and Server config"
+    cat <<EOF >>/etc/default/authentik-server
 RUST_BACKTRACE=full
 EOF
-      cat <<EOF >>/etc/default/authentik-worker
+    cat <<EOF >>/etc/default/authentik-worker
 RUST_BACKTRACE=full
 EOF
-      msg_ok "Updated Worker and Server config (from $MAJOR.$MINOR)"
-
-      msg_info "Updating services (from $MAJOR.$MINOR)"
-	    sed -i "s|ExecStart=/opt/authentik/authentik-server|ExecStart=/opt/authentik/bin/authentik server|g" /etc/systemd/system/authentik-server.service
-	    sed -i "s|ExecStart=/opt/authentik/authentik-worker worker|ExecStart=/opt/authentik/bin/authentik worker|g" /etc/systemd/system/authentik-worker.service
-	    sed -i "s|ExecStart=/opt/authentik/ldap|ExecStart=/opt/authentik/bin/ldap|g" /etc/systemd/system/authentik-ldap.service
-	    sed -i "s|ExecStart=/opt/authentik/radius|ExecStart=/opt/authentik/bin/radius|g" /etc/systemd/system/authentik-radius.service
-	    sed -i "s|ExecStart=/opt/authentik/rac|ExecStart=/opt/authentik/bin/rac|g" /etc/systemd/system/authentik-rac.service
-      systemctl daemon-reload
-      msg_ok "Updated services (from $MAJOR.$MINOR)"
-    fi
-
-    msg_info "Updating Worker and Server config"
-    sed -i "s|/dev/shm\/\?$|/dev/shm/authentik-server|g" /etc/default/authentik-server
-	  sed -i "s|/dev/shm\/\?$|/dev/shm/authentik-worker|g" /etc/default/authentik-worker
-    msg_ok "Updated Worker and Server config"
+    msg_ok "Updated Worker and Server config!"

    msg_info "Updating services"
-    sed -i 's/authentik Go Server (API Gateway)/authentik Server/g' /etc/systemd/system/authentik-server.service
-	  sed -i '/ExecStart=/i ExecStartPre=/usr/bin/mkdir -p "${TMPDIR}"' /etc/systemd/system/authentik-server.service
-    sed -i '/ExecStart=/i ExecStartPre=/usr/bin/mkdir -p "${TMPDIR}"' /etc/systemd/system/authentik-worker.service
+	  sed -i "s|ExecStart=/opt/authentik/authentik-server|ExecStart=/opt/authentik/bin/authentik server|g" /etc/systemd/system/authentik-server.service
+	  sed -i "s|ExecStart=/opt/authentik/authentik-worker worker|ExecStart=/opt/authentik/bin/authentik worker|g" /etc/systemd/system/authentik-worker.service
+	  sed -i "s|ExecStart=/opt/authentik/ldap|ExecStart=/opt/authentik/bin/ldap|g" /etc/systemd/system/authentik-ldap.service
+	  sed -i "s|ExecStart=/opt/authentik/radius|ExecStart=/opt/authentik/bin/radius|g" /etc/systemd/system/authentik-radius.service
+	  sed -i "s|ExecStart=/opt/authentik/rac|ExecStart=/opt/authentik/bin/rac|g" /etc/systemd/system/authentik-rac.service
    systemctl daemon-reload
    msg_ok "Updated services"

@@ -226,9 +198,8 @@ done
 $STD pct exec "$CTID" -- bash -c "mkdir -p /opt/authentik-data/{certs,media,geoip,templates}; \
  cp /opt/authentik/tests/GeoLite2-ASN-Test.mmdb /opt/authentik-data/geoip/GeoLite2-ASN.mmdb; \
  cp /opt/authentik/tests/GeoLite2-City-Test.mmdb /opt/authentik-data/geoip/GeoLite2-City.mmdb; \
-  cp -r /opt/authentik/blueprints /opt/authentik-data/; \
-  rm -r /opt/authentik/blueprints; \
-  find /opt/authentik-data -path '*/lost+found' -prune -o -exec chown authentik:authentik {} +"
+  chown authentik:authentik /opt/authentik-data; \
+  chown -R authentik:authentik /opt/authentik-data/{certs,media,geoip,templates}"
 msg_ok "Attached data storage volume"

 msg_info "Starting Services"
@@ -48,7 +48,7 @@ function update_script() {

    msg_info "Rebuilding Frontend"
    cd /opt/baserow/web-frontend
-    $STD npm install --allow-remote=all
+    $STD npm install
    $STD npm run build
    msg_ok "Rebuilt Frontend"

@@ -44,7 +44,7 @@ function update_script() {

    msg_info "Configuring BentoPDF"
    cd /opt/bentopdf
-    $STD npm ci --no-audit --no-fund --allow-remote=all
+    $STD npm ci --no-audit --no-fund
    export NODE_OPTIONS="--max-old-space-size=3072"
    export SIMPLE_MODE=true
    export VITE_USE_CDN=true
@@ -51,7 +51,7 @@ function update_script() {

    msg_info "Updating CryptPad"
    cd /opt/cryptpad
-    $STD npm ci --allow-git=all
+    $STD npm ci
    $STD npm run install:components
    if [ -f "/opt/cryptpad/install-onlyoffice.sh" ]; then
      $STD bash /opt/cryptpad/install-onlyoffice.sh --accept-license
@@ -37,9 +37,12 @@ function update_script() {
    sleep 1
    msg_ok "Stopped Service"

-    create_backup /opt/Heimdall/database/app.sqlite
+    msg_info "Backing up Data"
+    cp -R /opt/Heimdall/database database-backup
+    cp -R /opt/Heimdall/public public-backup
+    sleep 1
+    msg_ok "Backed up Data"

-    PHP_VERSION="8.4" PHP_FPM="YES" setup_php
    setup_composer
    fetch_and_deploy_gh_release "Heimdall" "linuxserver/Heimdall" "tarball"

@@ -49,15 +52,20 @@ function update_script() {
    rm -f bootstrap/cache/*.php
    export COMPOSER_ALLOW_SUPERUSER=1
    $STD composer install --no-dev --no-interaction --prefer-dist --optimize-autoloader
+    $STD php artisan optimize:clear
    msg_ok "Updated Heimdall-Dashboard"

-    restore_backup
+    msg_info "Restoring Data"
+    cd ~
+    cp -R database-backup/* /opt/Heimdall/database
+    cp -R public-backup/* /opt/Heimdall/public
+    sleep 1
+    msg_ok "Restored Data"

-    msg_info "Migrating Database"
-    cd /opt/Heimdall
-    $STD php artisan migrate --force
-    $STD php artisan optimize:clear
-    msg_ok "Migrated Database"
+    msg_info "Cleaning Up"
+    rm -rf {public-backup,database-backup}
+    sleep 1
+    msg_ok "Cleaned Up"

    msg_info "Starting Service"
    systemctl start heimdall.service
@@ -477,7 +477,7 @@ function compile_jpegli() {
 function compile_libheif() {
  SOURCE=${SOURCE_DIR}/libheif
  ensure_dependencies libaom-dev
-  LIBHEIF_REVISION="ac1cb05c39008f01525c991ff8b88f84ddf70fd2"
+  LIBHEIF_REVISION="62f1b8c76ed4d8305071fdacbe74ef9717bacac5"
  # : "${LIBHEIF_REVISION:=$(jq -cr '.revision' "$BASE_DIR"/server/sources/libheif.json)}"
  if [[ "${update:-}" ]] || [[ "$LIBHEIF_REVISION" != "$(grep 'libheif' ~/.immich_library_revisions | awk '{print $2}')" ]]; then
    msg_info "Recompiling libheif"
@@ -509,7 +509,7 @@ function compile_libheif() {

 function compile_libraw() {
  SOURCE=${SOURCE_DIR}/libraw
-  LIBRAW_REVISION="e419de08001de28ae6988ecb22df47e52b9c5eaa"
+  LIBRAW_REVISION="b860248a89d9082b8e0a1e202e516f46af9adb29"
  # : "${LIBRAW_REVISION:=$(jq -cr '.revision' "$BASE_DIR"/server/sources/libraw.json)}"
  if [[ "$LIBRAW_REVISION" != "$(grep 'libraw' ~/.immich_library_revisions | awk '{print $2}')" ]]; then
    msg_info "Recompiling libraw"
@@ -45,7 +45,7 @@ function update_script() {

    msg_info "Installing Dependencies"
    cd /opt/librechat
-    $STD npm ci --allow-remote=all
+    $STD npm ci
    msg_ok "Installed Dependencies"

    msg_info "Building Frontend"
@@ -37,9 +37,7 @@ function update_script() {
    systemctl stop mediamtx
    msg_ok "Service stopped"

-    create_backup /opt/mediamtx/mediamtx.yml
    fetch_and_deploy_gh_release "mediamtx" "bluenviron/mediamtx" "prebuild" "latest" "/opt/mediamtx" "mediamtx*linux_$(arch_resolve).tar.gz"
-    restore_backup

    msg_info "Starting service"
    systemctl start mediamtx
@@ -58,14 +58,6 @@ function update_script() {
    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-linux-bin" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-linux.bin"
    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-dsk" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz.dsk"
    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-pdsk" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz.pdsk"
-
-    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-efi" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.efi"
-    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-kpxe" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.kpxe"
-    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-lkrn" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.lkrn"
-    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-dsk" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.dsk"
-    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-pdsk" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.pdsk"
-    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-metal-legacy-efi" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-metal-legacy.efi"
-    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-metal-legacy-kpxe" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-metal-legacy.kpxe"
    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-arm64" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-arm64.efi"
    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-arm64-snp" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-arm64-snp.efi"
    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-arm64-snponly" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-arm64-snponly.efi"
@@ -78,12 +70,6 @@ function update_script() {
    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-arm64-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-arm64.img"
    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-multiarch-iso" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-multiarch.iso"
    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-multiarch-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-multiarch.img"
-    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-iso" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.iso"
-    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.img"
-    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-sb-iso" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sb.iso"
-    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-sb-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sb.img"
-    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-sb-arm64-iso" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sb-arm64.iso"
-    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-sb-arm64-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sb-arm64.img"
    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-checksums" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sha256-checksums.txt"

    msg_info "Restoring Configuration"
@@ -40,7 +40,7 @@ function update_script() {
    msg_info "Building OmniTools"
    cd /opt/omnitools
    export HUSKY=0
-    $STD npm ci --allow-remote=all
+    $STD npm ci
    $STD npm run build
    msg_ok "Built OmniTools"

@@ -63,7 +63,7 @@ function update_script() {

    msg_info "Updating Pangolin"
    cd /opt/pangolin
-    $STD npm ci --allow-remote=all
+    $STD npm ci
    $STD npm run set:pg
    $STD npm run set:oss
    rm -rf server/private
@@ -35,7 +35,6 @@ function update_script() {
  if check_for_gh_release "poznote" "timothepoznanski/poznote"; then
    msg_info "Stopping Service"
    systemctl stop nginx
-    systemctl stop poznote-reminder-worker poznote-s3-backup-worker 2>/dev/null || true
    msg_ok "Stopped Service"

    create_backup /var/www/html/data
@@ -49,178 +48,8 @@ function update_script() {

    restore_backup

-    msg_info "Running Poznote Initialization"
-    chmod +x /opt/poznote/init.sh
-    $STD /opt/poznote/init.sh
-    msg_ok "Initialized Poznote Data Directory"
-
-    msg_info "Updating Nginx Configuration"
-    [[ -f /etc/nginx/sites-available/poznote ]] && cp /etc/nginx/sites-available/poznote /etc/nginx/sites-available/poznote.bak
-    PHP_SOCK=$(get_php_fpm_socket)
-    cat <<EOF >/etc/nginx/sites-available/poznote
-# The Excalidraw editor must keep its window.opener relationship with
-# libraries.excalidraw.com so "Add to Excalidraw" can hand the chosen library
-# back to the already-open editor tab; COOP same-origin would sever it.
-map \$uri \$poznote_coop {
-    default                  "same-origin";
-    /excalidraw_editor.php   "unsafe-none";
-}
-
-server {
-    listen 8040;
-    root /var/www/html;
-    index index.php index.html;
-
-    gzip on;
-    gzip_comp_level 5;
-    gzip_min_length 1024;
-    gzip_vary on;
-    gzip_proxied any;
-    gzip_types text/css application/javascript text/javascript application/json
-               image/svg+xml application/manifest+json font/ttf font/otf;
-
-    location ~* \.webmanifest$ {
-        default_type application/manifest+json;
-        try_files \$uri =404;
-    }
-
-    client_max_body_size 800M;
-
-    location /api/v1 {
-        try_files \$uri \$uri/ /api/v1/index.php?\$query_string;
-    }
-
-    location = /api/health {
-        rewrite ^ /api_health.php last;
-    }
-
-    location = /api/info {
-        rewrite ^ /api_health.php last;
-    }
-
-    location / {
-        try_files \$uri \$uri/ @poznote_public;
-    }
-
-    location @poznote_public {
-        rewrite ^/folder/([^/]+)/?$ /public_folder.php?token=\$1 last;
-        rewrite ^/workspace/([^/]+)/?$ /public_note.php?token=\$1 last;
-        rewrite ^/([^/]+)/?$ /public_slug.php?slug=\$1 last;
-    }
-
-    add_header X-Frame-Options "SAMEORIGIN" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header X-XSS-Protection "1; mode=block" always;
-    add_header Cross-Origin-Opener-Policy \$poznote_coop always;
-    add_header Cross-Origin-Resource-Policy "same-origin" always;
-    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;
-
-    location ~* ^/data/.*\.(php[0-9]?|phtml|phar|pht)$ {
-        deny all;
-    }
-
-    location ~ \.php$ {
-        include fastcgi_params;
-        fastcgi_pass unix:${PHP_SOCK};
-        fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
-        fastcgi_param DOCUMENT_ROOT \$document_root;
-        fastcgi_param PATH_INFO \$fastcgi_path_info;
-
-        fastcgi_param HTTP_X_FORWARDED_FOR \$http_x_forwarded_for;
-        fastcgi_param HTTP_X_FORWARDED_PROTO \$http_x_forwarded_proto;
-        fastcgi_param HTTP_X_FORWARDED_HOST \$http_x_forwarded_host;
-        fastcgi_param HTTP_X_FORWARDED_PORT \$http_x_forwarded_port;
-        fastcgi_param HTTP_X_REAL_IP \$http_x_real_ip;
-        fastcgi_param HTTPS \$https if_not_empty;
-
-        # fastcgi_read_timeout 600;
-        # fastcgi_send_timeout 600;
-        # Left at nginx's 60s default, not Docker's 600s:
-        # a stalled git-sync request can hold the PHP session lock, otherwise
-    }
-
-    location ~ /\. {
-        deny all;
-    }
-
-    location ~ ^/data/users/[0-9]+/backgrounds/ {
-        try_files \$uri =404;
-    }
-
-    location ~ ^/data/css/[A-Za-z0-9._-]+\.css$ {
-        try_files \$uri =404;
-    }
-
-    location ~ ^/(data|config)/ {
-        deny all;
-    }
-
-    location ~* ^/pwa/poznote(-[0-9]+)?\.png$ {
-        expires 1y;
-        add_header Cache-Control "public, immutable";
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Cross-Origin-Resource-Policy "cross-origin" always;
-        try_files \$uri =404;
-    }
-
-    location ~* \.(?:js|css|png|jpg|jpeg|gif|svg|ico|woff2?|ttf|otf|eot|webp|webmanifest)$ {
-        expires 1y;
-        add_header Cache-Control "public, immutable";
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Cross-Origin-Resource-Policy "same-origin" always;
-        try_files \$uri =404;
-    }
-}
-EOF
-    msg_ok "Updated Nginx Configuration"
-
-    if [[ ! -f /etc/systemd/system/poznote-reminder-worker.service ]]; then
-      msg_info "Creating Reminder Worker Service"
-      cat <<EOF >/etc/systemd/system/poznote-reminder-worker.service
-[Unit]
-Description=Poznote Reminder Email Worker
-After=network.target
-
-[Service]
-Type=simple
-User=www-data
-Group=www-data
-Restart=always
-ExecStart=/usr/bin/php /var/www/html/workers/reminder-email-worker.php
-WorkingDirectory=/var/www/html
-
-[Install]
-WantedBy=multi-user.target
-EOF
-      systemctl daemon-reload
-      msg_ok "Created Reminder Worker Service"
-    fi
-
-    if [[ ! -f /etc/systemd/system/poznote-s3-backup-worker.service ]]; then
-      msg_info "Creating S3 Backup Worker Service"
-      cat <<EOF >/etc/systemd/system/poznote-s3-backup-worker.service
-[Unit]
-Description=Poznote S3 Backup Worker
-After=network.target
-
-[Service]
-Type=simple
-User=www-data
-Group=www-data
-Restart=always
-ExecStart=/usr/bin/php /var/www/html/workers/s3-backup-worker.php
-WorkingDirectory=/var/www/html
-
-[Install]
-WantedBy=multi-user.target
-EOF
-      systemctl daemon-reload
-      msg_ok "Created S3 Backup Worker Service"
-    fi
-
    msg_info "Starting Service"
    systemctl start nginx
-    systemctl enable -q --now poznote-reminder-worker poznote-s3-backup-worker
    msg_ok "Started Service"
    msg_ok "Updated successfully!"
  fi
@@ -55,7 +55,7 @@ function update_script() {
    msg_ok "Updated Reactive Resume"

    msg_info "Updating Service"
-    sed -i -E 's|^WorkingDirectory=/opt/reactive-resume(/.*)?$|WorkingDirectory=/opt/reactive-resume/apps/server|; s|ExecStart=/usr/bin/node .output/server/index.mjs|ExecStart=/usr/bin/node dist/index.mjs|' /etc/systemd/system/reactive-resume.service
+    sed -i 's|WorkingDirectory=/opt/reactive-resume/apps/web|WorkingDirectory=/opt/reactive-resume/apps/server|; s|ExecStart=/usr/bin/node .output/server/index.mjs|ExecStart=/usr/bin/node dist/index.mjs|' /etc/systemd/system/reactive-resume.service
    systemctl daemon-reload
    msg_ok "Updated Service"

@@ -51,7 +51,6 @@ function update_script() {
      /opt/romm/frontend/dist/assets/ruffle

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "romm" "rommapp/romm" "tarball" "latest" "/opt/romm"
-    echo "__version__ = \"$(cat ~/.romm)\"" >/opt/romm/backend/__version__.py

    find /opt/romm/backend/alembic/versions -maxdepth 1 -type f -name '1.*.py' -delete 2>/dev/null || true
    find /opt/romm/backend/alembic/versions -maxdepth 1 -type f -name '2.0.0_.py' -delete 2>/dev/null || true
@@ -66,7 +65,7 @@ function update_script() {
    $STD uv run alembic upgrade head
    if [[ -f /opt/romm/backend/utils/rom_patcher/package.json ]]; then
      cd /opt/romm/backend/utils/rom_patcher
-      $STD npm install --ignore-scripts --no-audit --no-fund --allow-git=all
+      $STD npm install --ignore-scripts --no-audit --no-fund
      if [[ -d node_modules/rom-patcher/rom-patcher-js ]]; then
        rm -rf rom-patcher-js
        cp -r node_modules/rom-patcher/rom-patcher-js ./rom-patcher-js
@@ -61,12 +61,7 @@ function update_script() {

  if [[ -d /opt/shlink-web-client ]]; then
    if check_for_gh_release "shlink-web-client" "shlinkio/shlink-web-client"; then
-      create_backup /opt/shlink-web-client/servers.json
-
      CLEAN_INSTALL=1 fetch_and_deploy_gh_release "shlink-web-client" "shlinkio/shlink-web-client" "prebuild" "latest" "/opt/shlink-web-client" "shlink-web-client_*_dist.zip"
-
-      restore_backup
-
      msg_ok "Updated Web Client"
    fi
  fi
@@ -88,13 +88,6 @@ EOF
    msg_info "Updating SnapOtter"
    $STD uv python install 3.11
    $STD uv venv --seed --python 3.11 /opt/snapotter_data/ai/venv
-    if [[ "$(arch_resolve)" == "arm64" ]]; then
-      $STD uv pip install --python /opt/snapotter_data/ai/venv/bin/python \
-        numpy==1.26.4 Pillow==12.3.0 opencv-python-headless==4.10.0.84 fonttools \
-        'huggingface-hub[hf_xet,hf_transfer]==0.36.2'
-    else
-      msg_warn "SnapOtter AI Features have no working CPU-only bundle for amd64 upstream (published bundle is Python 3.12/GPU-CUDA only). Use the official Docker image instead: https://docs.snapotter.com"
-    fi
    ln -sfn /opt/snapotter /app
    msg_ok "Updated SnapOtter"

@@ -54,7 +54,6 @@ function update_script() {
    cp -rp ${BACKUP_DIR}/extensions/ /opt/sonarqube/extensions/
    cp -p ${BACKUP_DIR}/conf/sonar.properties /opt/sonarqube/conf/sonar.properties
    rm -rf ${BACKUP_DIR}
-    chmod +x /opt/sonarqube/bin/linux-x86-64/sonar.sh
    chown -R sonarqube:sonarqube /opt/sonarqube
    msg_ok "Restored Backup"

@@ -37,8 +37,6 @@ function update_script() {
    systemctl stop tolgee
    msg_ok "Stopped Service"

-    JAVA_VERSION="25" setup_java
-
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "tolgee" "tolgee/tolgee-platform" "singlefile" "latest" "/opt/tolgee" "tolgee-*.jar"
    find /opt/tolgee -maxdepth 1 -type f -name 'tolgee-*.jar' -exec mv {} /opt/tolgee/tolgee.jar \;

@@ -158,8 +158,6 @@ EOF
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "wanderer" "open-wanderer/wanderer" "tarball" "latest"
    restore_backup

-    GO_VERSION="$(grep -m1 '^go ' /opt/wanderer/db/go.mod | awk '{print $2}')" setup_go
-
    msg_info "Updating wanderer"
    cd /opt/wanderer/db
    $STD go mod tidy
@@ -58,7 +58,7 @@ PG_VERSION="17" setup_postgresql
 PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db

 XMLSEC_VERSION="1.3.12"
-AUTHENTIK_VERSION="version/2026.8.1"
+AUTHENTIK_VERSION="version/2026.8.0"
 fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec"
 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
 GO_VERSION="$(grep -m1 '^go ' /opt/authentik/go.mod | awk '{print $2}')" setup_go
@@ -146,7 +146,7 @@ yq -i ".secret_key = \"$(openssl rand -base64 128 | tr -dc 'a-zA-Z0-9' | head -c
 yq -i ".postgresql.password = \"${PG_DB_PASS}\"" /etc/authentik/config.yml
 yq -i ".events.context_processors.geoip = \"/opt/authentik-data/geoip/GeoLite2-City.mmdb\"" /etc/authentik/config.yml
 yq -i ".events.context_processors.asn = \"/opt/authentik-data/geoip/GeoLite2-ASN.mmdb\"" /etc/authentik/config.yml
-yq -i ".blueprints_dir = \"/opt/authentik-data/blueprints\"" /etc/authentik/config.yml
+yq -i ".blueprints_dir = \"/opt/authentik/blueprints\"" /etc/authentik/config.yml
 yq -i ".cert_discovery_dir = \"/opt/authentik-data/certs\"" /etc/authentik/config.yml
 yq -i ".email.template_dir = \"/opt/authentik-data/templates\"" /etc/authentik/config.yml
 yq -i ".storage.file.path = \"/opt/authentik-data\"" /etc/authentik/config.yml
@@ -154,7 +154,7 @@ yq -i ".disable_startup_analytics = \"true\"" /etc/authentik/config.yml
 $STD useradd -U -s /usr/sbin/nologin -r -M -d /opt/authentik authentik
 chown -R authentik:authentik /opt/authentik
 cat <<EOF >/etc/default/authentik-server
-TMPDIR=/dev/shm/authentik-server
+TMPDIR=/dev/shm/
 UV_LINK_MODE=copy
 UV_PYTHON_DOWNLOADS=0
 UV_NATIVE_TLS=1
@@ -170,7 +170,7 @@ AUTHENTIK_LISTEN__HTTPS="[::]:9443"
 AUTHENTIK_LISTEN__METRICS="[::]:9300"
 EOF
 cat <<EOF >/etc/default/authentik-worker
-TMPDIR=/dev/shm/authentik-worker
+TMPDIR=/dev/shm/
 UV_LINK_MODE=copy
 UV_PYTHON_DOWNLOADS=0
 UV_NATIVE_TLS=1
@@ -214,7 +214,6 @@ User=authentik
 Group=authentik
 EnvironmentFile=/etc/default/authentik-server
 ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
-ExecStartPre=/usr/bin/mkdir -p "\${TMPDIR}"
 ExecStart=/opt/authentik/bin/authentik server
 WorkingDirectory=/opt/authentik/
 Restart=always
@@ -235,7 +234,6 @@ Group=authentik
 Type=simple
 EnvironmentFile=/etc/default/authentik-worker
 ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
-ExecStartPre=/usr/bin/mkdir -p "\${TMPDIR}"
 ExecStart=/opt/authentik/bin/authentik worker
 WorkingDirectory=/opt/authentik
 Restart=always
@@ -45,7 +45,7 @@ msg_ok "Installed Backend Dependencies"

 msg_info "Building Frontend"
 cd /opt/baserow/web-frontend
-NODE_OPTIONS="--max-old-space-size=4096" $STD npm install --legacy-peer-deps --allow-remote=all
+NODE_OPTIONS="--max-old-space-size=4096" $STD npm install --legacy-peer-deps
 NODE_OPTIONS="--max-old-space-size=4096" $STD npm run build
 msg_ok "Built Frontend"

@@ -24,7 +24,7 @@ fetch_and_deploy_gh_release "bentopdf" "alam00000/bentopdf" "tarball" "latest" "

 msg_info "Setup BentoPDF"
 cd /opt/bentopdf
-$STD npm ci --no-audit --no-fund --allow-remote=all
+$STD npm ci --no-audit --no-fund
 cp ./.env.example ./.env.production
 export NODE_OPTIONS="--max-old-space-size=3072"
 export SIMPLE_MODE=true
@@ -24,7 +24,7 @@ fetch_and_deploy_gh_release "cryptpad" "cryptpad/cryptpad" "tarball"

 msg_info "Setup CryptPad"
 cd /opt/cryptpad
-$STD npm ci --allow-git=all
+$STD npm ci
 $STD npm run install:components
 if [[ "$onlyoffice" =~ ^[Yy]$ ]]; then
  $STD bash -c "./install-onlyoffice.sh --accept-license"
@@ -45,7 +45,7 @@ $STD ln -svf /usr/bin/ffmpeg /usr/local/bin/ffmpeg
 $STD ln -svf /usr/bin/ffprobe /usr/local/bin/ffprobe
 $STD rm -rf /opt/fileflows/Server/runtimes/win-*

-read -r -p "${TAB3}Do you want to install FileFlows Server or Agent? (S/A): " install_server
+read -r -p "${TAB3}Do you want to install FileFlows Server or Node? (S/N): " install_server

 if [[ "$install_server" =~ ^[Ss]$ ]]; then
  msg_info "Installing FileFlows Server"
@@ -54,23 +54,15 @@ if [[ "$install_server" =~ ^[Ss]$ ]]; then
  systemctl enable -q --now fileflows
  msg_ok "Installed FileFlows Server"
 else
-  msg_info "Installing FileFlows Agent"
-  stop_spinner
+  msg_info "Installing FileFlows Node"
  read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url
  while [[ -z "${server_url// /}" ]]; do
    read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url
  done
-  cd /opt/fileflows/Agent
-  before_units="$(systemctl list-unit-files 'fileflows*' --no-legend 2>/dev/null | awk '{print $1}' | sort || true)"
-  $STD dotnet FileFlows.Agent.dll --server "$server_url" --systemd install --root true
-  after_units="$(systemctl list-unit-files 'fileflows*' --no-legend 2>/dev/null | awk '{print $1}' | sort || true)"
-  agent_unit="$(comm -13 <(echo "$before_units") <(echo "$after_units") | head -n1)"
-  if [[ -n "$agent_unit" ]]; then
-    systemctl enable -q --now "$agent_unit"
-  else
-    msg_warn "Could not detect the FileFlows Agent systemd unit; start it manually (systemctl list-unit-files 'fileflows*')."
-  fi
-  msg_ok "Installed FileFlows Agent"
+  cd /opt/fileflows/Node
+  $STD dotnet FileFlows.Node.dll --server "$server_url" --systemd install --root true
+  systemctl enable -q --now fileflows-node
+  msg_ok "Installed FileFlows Node"
 fi

 motd_ssh
@@ -15,7 +15,7 @@ update_os

 fetch_and_deploy_gh_release "flatnotes" "dullage/flatnotes" "tarball"
 USE_UVX="YES" setup_uv
-NODE_VERSION="24" setup_nodejs
+NODE_VERSION="22" setup_nodejs

 msg_info "Setting up Flatnotes"
 cd /opt/flatnotes
@@ -362,7 +362,6 @@ Restart=always
 RestartSec=1
 User=root
 EnvironmentFile=/etc/frigate.env
-ExecStartPre=+/usr/bin/systemctl restart go2rtc.service
 ExecStartPre=+rm -f /dev/shm/logs/frigate/current
 ExecStart=/bin/bash -c "bash /opt/frigate/docker/main/rootfs/etc/s6-overlay/s6-rc.d/frigate/run 2> >(/usr/bin/ts '%%Y-%%m-%%d %%H:%%M:%%.S ' >&2) | /usr/bin/ts '%%Y-%%m-%%d %%H:%%M:%%.S '"
 StandardOutput=file:/dev/shm/logs/frigate/current
@@ -266,7 +266,7 @@ msg_ok "(2/6) Compiled jpegli"

 msg_info "(3/6) Compiling libheif"
 SOURCE=${SOURCE_DIR}/libheif
-LIBHEIF_REVISION="ac1cb05c39008f01525c991ff8b88f84ddf70fd2"
+LIBHEIF_REVISION="62f1b8c76ed4d8305071fdacbe74ef9717bacac5"
 # : "${LIBHEIF_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libheif.json)}"
 $STD git clone https://github.com/strukturag/libheif.git "$SOURCE"
 cd "$SOURCE"
@@ -292,7 +292,7 @@ msg_ok "(3/6) Compiled libheif"

 msg_info "(4/6) Compiling libraw"
 SOURCE=${SOURCE_DIR}/libraw
-LIBRAW_REVISION="e419de08001de28ae6988ecb22df47e52b9c5eaa"
+LIBRAW_REVISION="b860248a89d9082b8e0a1e202e516f46af9adb29"
 # : "${LIBRAW_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libraw.json)}"
 $STD git clone https://github.com/LibRaw/LibRaw.git "$SOURCE"
 cd "$SOURCE"
@@ -31,8 +31,8 @@ Environment=IVENTOY_API_ALL=1
 Environment=IVENTOY_AUTO_RUN=1
 Environment=LIBRARY_PATH=/opt/iventoy/lib/lin64
 Environment=LD_LIBRARY_PATH=/opt/iventoy/lib/lin64
-ExecStart=/bin/bash /opt/iventoy/iventoy.sh -R start
-ExecStop=/bin/bash /opt/iventoy/iventoy.sh stop
+ExecStart=/bin/sh /opt/iventoy/iventoy.sh -R start
+ExecStop=/bin/sh /opt/iventoy/iventoy.sh stop
 Restart=on-failure
 RestartSec=5

@@ -25,7 +25,7 @@ fetch_and_deploy_gh_release "rag-api" "danny-avila/rag_api" "tarball"

 msg_info "Installing LibreChat Dependencies"
 cd /opt/librechat
-$STD npm ci --allow-remote=all
+$STD npm ci
 msg_ok "Installed LibreChat Dependencies"

 msg_info "Building Frontend"
@@ -41,14 +41,6 @@ USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-lkrn" "netbo
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-linux-bin" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-linux.bin"
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-dsk" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz.dsk"
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-pdsk" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz.pdsk"
-
-USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-efi" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.efi"
-USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-kpxe" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.kpxe"
-USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-lkrn" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.lkrn"
-USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-dsk" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.dsk"
-USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-pdsk" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.pdsk"
-USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-metal-legacy-efi" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-metal-legacy.efi"
-USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-metal-legacy-kpxe" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-metal-legacy.kpxe"
 # ARM64 bootloaders
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-arm64" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-arm64.efi"
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-arm64-snp" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-arm64-snp.efi"
@@ -63,12 +55,6 @@ USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-arm64-iso" "
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-arm64-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-arm64.img"
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-multiarch-iso" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-multiarch.iso"
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-multiarch-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-multiarch.img"
-USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-iso" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.iso"
-USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.img"
-USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-sb-iso" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sb.iso"
-USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-sb-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sb.img"
-USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-sb-arm64-iso" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sb-arm64.iso"
-USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-sb-arm64-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sb-arm64.img"
 # SHA256 checksums
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-checksums" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sha256-checksums.txt"

@@ -23,7 +23,7 @@ fetch_and_deploy_gh_release "omnitools" "iib0011/omni-tools" "tarball"
 msg_info "Building OmniTools"
 cd /opt/omnitools
 export HUSKY=0
-$STD npm ci --allow-remote=all
+$STD npm ci
 $STD npm run build
 msg_ok "Built OmniTools"

@@ -45,7 +45,7 @@ SECRET_KEY=$(openssl rand -base64 48 | tr -dc 'A-Za-z0-9' | head -c 32)
 BADGER_VERSION=$(get_latest_github_release "fosrl/badger" "false")
 cd /opt/pangolin
 mkdir -p /opt/pangolin/config/{traefik,db,letsencrypt,logs}
-$STD npm ci --allow-remote=all
+$STD npm ci
 $STD npm run set:pg
 $STD npm run set:oss
 rm -rf server/private
@@ -28,73 +28,16 @@ touch /var/www/html/data/database/poznote.db
 chown -R www-data:www-data /var/www/html
 msg_ok "Deployed Poznote"

-msg_info "Running Poznote Initialization"
-chmod +x /opt/poznote/init.sh
-$STD /opt/poznote/init.sh
-msg_ok "Initialized Poznote Data Directory"
-
 msg_info "Configuring Nginx"
 PHP_SOCK=$(get_php_fpm_socket)
 cat <<EOF >/etc/nginx/sites-available/poznote
-# The Excalidraw editor must keep its window.opener relationship with
-# libraries.excalidraw.com so "Add to Excalidraw" can hand the chosen library
-# back to the already-open editor tab; COOP same-origin would sever it.
-map \$uri \$poznote_coop {
-    default                  "same-origin";
-    /excalidraw_editor.php   "unsafe-none";
-}
-
 server {
    listen 8040;
    root /var/www/html;
    index index.php index.html;

-    gzip on;
-    gzip_comp_level 5;
-    gzip_min_length 1024;
-    gzip_vary on;
-    gzip_proxied any;
-    gzip_types text/css application/javascript text/javascript application/json
-               image/svg+xml application/manifest+json font/ttf font/otf;
-
-    location ~* \.webmanifest$ {
-        default_type application/manifest+json;
-        try_files \$uri =404;
-    }
-
-    client_max_body_size 800M;
-
-    location /api/v1 {
-        try_files \$uri \$uri/ /api/v1/index.php?\$query_string;
-    }
-
-    location = /api/health {
-        rewrite ^ /api_health.php last;
-    }
-
-    location = /api/info {
-        rewrite ^ /api_health.php last;
-    }
-
    location / {
-        try_files \$uri \$uri/ @poznote_public;
-    }
-
-    location @poznote_public {
-        rewrite ^/folder/([^/]+)/?$ /public_folder.php?token=\$1 last;
-        rewrite ^/workspace/([^/]+)/?$ /public_note.php?token=\$1 last;
-        rewrite ^/([^/]+)/?$ /public_slug.php?slug=\$1 last;
-    }
-
-    add_header X-Frame-Options "SAMEORIGIN" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header X-XSS-Protection "1; mode=block" always;
-    add_header Cross-Origin-Opener-Policy \$poznote_coop always;
-    add_header Cross-Origin-Resource-Policy "same-origin" always;
-    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;
-
-    location ~* ^/data/.*\.(php[0-9]?|phtml|phar|pht)$ {
-        deny all;
+        try_files \$uri \$uri/ /index.php?\$query_string;
    }

    location ~ \.php$ {
@@ -102,93 +45,16 @@ server {
        fastcgi_pass unix:${PHP_SOCK};
        fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
        fastcgi_param DOCUMENT_ROOT \$document_root;
-        fastcgi_param PATH_INFO \$fastcgi_path_info;
-
-        fastcgi_param HTTP_X_FORWARDED_FOR \$http_x_forwarded_for;
-        fastcgi_param HTTP_X_FORWARDED_PROTO \$http_x_forwarded_proto;
-        fastcgi_param HTTP_X_FORWARDED_HOST \$http_x_forwarded_host;
-        fastcgi_param HTTP_X_FORWARDED_PORT \$http_x_forwarded_port;
-        fastcgi_param HTTP_X_REAL_IP \$http_x_real_ip;
-        fastcgi_param HTTPS \$https if_not_empty;
-
-        # fastcgi_read_timeout 600;
-        # fastcgi_send_timeout 600;
-        # Left at nginx's 60s default, not Docker's 600s:
-        # a stalled git-sync request can hold the PHP session lock, otherwise
    }

-    location ~ /\. {
+    location ~ /\.ht {
        deny all;
    }
-
-    location ~ ^/data/users/[0-9]+/backgrounds/ {
-        try_files \$uri =404;
-    }
-
-    location ~ ^/data/css/[A-Za-z0-9._-]+\.css$ {
-        try_files \$uri =404;
-    }
-
-    location ~ ^/(data|config)/ {
-        deny all;
-    }
-
-    location ~* ^/pwa/poznote(-[0-9]+)?\.png$ {
-        expires 1y;
-        add_header Cache-Control "public, immutable";
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Cross-Origin-Resource-Policy "cross-origin" always;
-        try_files \$uri =404;
-    }
-
-    location ~* \.(?:js|css|png|jpg|jpeg|gif|svg|ico|woff2?|ttf|otf|eot|webp|webmanifest)$ {
-        expires 1y;
-        add_header Cache-Control "public, immutable";
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Cross-Origin-Resource-Policy "same-origin" always;
-        try_files \$uri =404;
-    }
 }
 EOF
 nginx_enable_site poznote
 msg_ok "Configured Nginx"

-msg_info "Creating Background Worker Services"
-cat <<EOF >/etc/systemd/system/poznote-reminder-worker.service
-[Unit]
-Description=Poznote Reminder Email Worker
-After=network.target
-
-[Service]
-Type=simple
-User=www-data
-Group=www-data
-Restart=always
-ExecStart=/usr/bin/php /var/www/html/workers/reminder-email-worker.php
-WorkingDirectory=/var/www/html
-
-[Install]
-WantedBy=multi-user.target
-EOF
-cat <<EOF >/etc/systemd/system/poznote-s3-backup-worker.service
-[Unit]
-Description=Poznote S3 Backup Worker
-After=network.target
-
-[Service]
-Type=simple
-User=www-data
-Group=www-data
-Restart=always
-ExecStart=/usr/bin/php /var/www/html/workers/s3-backup-worker.php
-WorkingDirectory=/var/www/html
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now poznote-reminder-worker poznote-s3-backup-worker
-msg_ok "Created Background Worker Services"
-
 motd_ssh
 customize
 cleanup_lxc
@@ -161,7 +161,6 @@ else
 fi

 fetch_and_deploy_gh_release "romm" "rommapp/romm" "tarball"
-echo "__version__ = \"$(cat ~/.romm)\"" >/opt/romm/backend/__version__.py

 msg_info "Creating environment file"
 sed -i 's/^supervised no/supervised systemd/' /etc/redis/redis.conf
@@ -215,7 +214,7 @@ msg_ok "Set up RomM Backend"
 if [[ -f /opt/romm/backend/utils/rom_patcher/package.json ]]; then
  msg_info "Building ROM Patcher helper"
  cd /opt/romm/backend/utils/rom_patcher
-  $STD npm install --ignore-scripts --no-audit --no-fund --allow-git=all
+  $STD npm install --ignore-scripts --no-audit --no-fund
  if [[ -d node_modules/rom-patcher/rom-patcher-js ]]; then
    rm -rf rom-patcher-js
    cp -r node_modules/rom-patcher/rom-patcher-js ./rom-patcher-js
@@ -34,12 +34,7 @@ $STD apt install -y \
  python3 \
  python3-dev \
  gcc \
-  g++ \
-  libavif-bin \
-  libavif-dev \
-  libopencv-dev \
-  python3-opencv \
-  libgles2
+  g++
 msg_ok "Installed Dependencies"

 PYTHON_VERSION="3.11" setup_uv
@@ -64,13 +59,11 @@ msg_info "Setting up Python Environment"
 mkdir -p /opt/snapotter_data/ai/models/rembg
 $STD uv python install 3.11
 $STD uv venv --seed --python 3.11 /opt/snapotter_data/ai/venv
-if [[ "$(arch_resolve)" == "arm64" ]]; then
-  $STD uv pip install --python /opt/snapotter_data/ai/venv/bin/python \
-    numpy==1.26.4 Pillow==12.3.0 opencv-python-headless==4.10.0.84 fonttools \
-    'huggingface-hub[hf_xet,hf_transfer]==0.36.2'
-else
-  msg_warn "SnapOtter AI Features have no working CPU-only bundle for amd64 upstream (published bundle is Python 3.12/GPU-CUDA only). Use the official Docker image instead: https://docs.snapotter.com"
-fi
+#if [[ -f /opt/snapotter/packages/ai/python/requirements.txt ]]; then
+#  $STD uv pip install \
+#    --python /opt/snapotter_data/ai/venv/bin/python \
+#    -r /opt/snapotter/packages/ai/python/requirements.txt
+#fi
 ln -sfn /opt/snapotter /app
 msg_ok "Set up Python Environment"

@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os

-JAVA_VERSION="25" setup_java
+JAVA_VERSION="21" setup_java
 PG_VERSION="16" setup_postgresql
 PG_DB_NAME="tolgee" PG_DB_USER="tolgee" setup_postgresql_db

@@ -13,6 +13,7 @@ setting_up_container
 network_check
 update_os

+setup_go
 NODE_VERSION="22" setup_nodejs
 mkdir -p /opt/{wanderer,wanderer_data/pb_data,wanderer_data/meili_data,wanderer_data/plugins}
 MEILISEARCH_DB_PATH="/opt/wanderer_data/meili_data" setup_meilisearch
@@ -20,8 +21,6 @@ fetch_and_deploy_gh_release "wanderer" "open-wanderer/wanderer" "tarball" "lates
 mkdir -p /opt/wanderer/db/data
 [[ -e /opt/wanderer/db/data/plugins ]] || ln -sfn /opt/wanderer_data/plugins /opt/wanderer/db/data/plugins

-GO_VERSION="$(grep -m1 '^go ' /opt/wanderer/db/go.mod | awk '{print $2}')" setup_go
-
 msg_info "Installing wanderer (patience)"
 cd /opt/wanderer/db
 $STD go mod tidy
@@ -155,29 +155,13 @@ function sanitize_service_name() {
  return 0
 }

-function script_exists() {
+function validate_service_script() {
  local name="$1"
  sanitize_service_name "$name" || return 1
  curl -fsSL --max-time 10 -o /dev/null \
    "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/${name}.sh" 2>/dev/null
 }

-# A container keeps the slug it was built with, so a renamed ct/ script leaves it
-# pointing at a name that no longer exists. Try the successors, but only accept one
-# that is really there -- guessing wrong would run a foreign app's updater.
-function resolve_service_script() {
-  local n="$1" c
-  script_exists "$n" && { printf '%s' "$n"; return 0; }
-  for c in "${n#alpine-}" "$(printf '%s' "$n" | sed -E 's/-v[0-9]+$//')"; do
-    [[ -n "$c" && "$c" != "$n" ]] || continue
-    script_exists "$c" && { printf '%s' "$c"; return 0; }
-  done
-  case "$n" in
-  pbs) script_exists proxmox-backup-server && { printf '%s' proxmox-backup-server; return 0; } ;;
-  esac
-  return 1
-}
-
 function detect_service() {
  local container="$1"
  local tmpdir update_file
@@ -500,18 +484,12 @@ for container in $CHOICE; do
    continue
  fi

-  resolved_service="$(resolve_service_script "${service}")"
-  if [ -z "${resolved_service}" ]; then
+  if ! validate_service_script "${service}"; then
    echo -e "${RD}[ERROR]${CL} Service '${service}' does not resolve to ct/${service}.sh"
    log_result "$container" "${service}" "ERROR" "No matching ct/${service}.sh script found"
    log_write "Container $container: ERROR — ct/${service}.sh not found"
    continue
  fi
-  if [ "${resolved_service}" != "${service}" ]; then
-    echo -e "${BL}[INFO]${CL} Script was renamed: ${service} -> ${GN}${resolved_service}${CL}"
-    log_write "Container $container: slug ${service} resolved to ${resolved_service}"
-    service="${resolved_service}"
-  fi

  echo -e "${BL}[INFO]${CL} Detected service: ${GN}${service}${CL}"
  log_write "Container $container: detected service '${service}'"