Update CHANGELOG.md

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

.github/dependabot.yml

@@ -1,17 +1,14 @@
-# Keeps the GitHub Actions referenced in .github/workflows up to date.
-# https://docs.github.com/code-security/dependabot/working-with-dependabot/dependabot-options-reference
 version: 2
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
+    labels: []
     schedule:
       interval: "weekly"
-      day: "monday"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-    # One PR per week for all action bumps instead of one PR per action.
+    target-branch: "main"
+    cooldown:
+      default-days: 7
     groups:
-      github-actions:
+      actions:
         patterns:
           - "*"

CHANGELOG.md

@@ -562,6 +562,71 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-10-16
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Pelican Panel: pass the URL to p:environment:setup [@MickLesk](https://github.com/MickLesk) ([#17948](https://github.com/community-scripts/ProxmoxVE/pull/17948))
+    - OneDev: use the onedev.server unit of 16.9 [@MickLesk](https://github.com/MickLesk) ([#17949](https://github.com/community-scripts/ProxmoxVE/pull/17949))
+    - ReadMeABook: start the scheduler with the service [@MickLesk](https://github.com/MickLesk) ([#17950](https://github.com/community-scripts/ProxmoxVE/pull/17950))
+
+## 2026-10-15
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(apprise-api): copy static assets into the served directory [@brokentokin](https://github.com/brokentokin) ([#17940](https://github.com/community-scripts/ProxmoxVE/pull/17940))
+    - Bytestash: modify backup process | Update Resources [@MickLesk](https://github.com/MickLesk) ([#17935](https://github.com/community-scripts/ProxmoxVE/pull/17935))
+    - Zabbix: Add '-y' flag to apt install commands [@MickLesk](https://github.com/MickLesk) ([#17933](https://github.com/community-scripts/ProxmoxVE/pull/17933))
+    - karakeep: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17087](https://github.com/community-scripts/ProxmoxVE/pull/17087))
+
+### 💾 Core
+
+  - Keep VM release lookups working without system.func [@MickLesk](https://github.com/MickLesk) ([core#144](https://github.com/community-scripts/core/pull/144))
+- Stop calling exit 1 "Operation not permitted" at several steps [@MickLesk](https://github.com/MickLesk) ([core#140](https://github.com/community-scripts/core/pull/140))
+
+## 2026-10-14
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Paperclip: fall back to a non-frozen install when the release lockfile is stale [@MickLesk](https://github.com/MickLesk) ([#17922](https://github.com/community-scripts/ProxmoxVE/pull/17922))
+
+  - #### 🔧 Refactor
+
+    - Immich: rebuild the image libraries when the revision record is missing [@MickLesk](https://github.com/MickLesk) ([#17919](https://github.com/community-scripts/ProxmoxVE/pull/17919))
+
+### 💾 Core
+
+  - Show what the failing command printed, and keep verbose output in the log [@MickLesk](https://github.com/MickLesk) ([core#139](https://github.com/community-scripts/core/pull/139))
+- Install jq before the release lookup and show what a non-JSON answer was [@MickLesk](https://github.com/MickLesk) ([core#138](https://github.com/community-scripts/core/pull/138))
+- Refresh the NodeSource key before a same-major Node.js update [@MickLesk](https://github.com/MickLesk) ([core#137](https://github.com/community-scripts/core/pull/137))
+- github: say why a forge could not be reached instead of 'connection failed' [@MickLesk](https://github.com/MickLesk) ([core#136](https://github.com/community-scripts/core/pull/136))
+
+## 2026-10-13
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Fix URL for downloading OneDev latest release [@ryansully](https://github.com/ryansully) ([#17915](https://github.com/community-scripts/ProxmoxVE/pull/17915))
+    - LocalAI: pin the CPU backends when the container has no GPU runtime [@MickLesk](https://github.com/MickLesk) ([#17909](https://github.com/community-scripts/ProxmoxVE/pull/17909))
+    - [Gluetun] Update GitHub repository source install and update. [@CerberusStyle](https://github.com/CerberusStyle) ([#17899](https://github.com/community-scripts/ProxmoxVE/pull/17899))
+    - Immich: Bump to 3.3.1 and restore (failed) geodata/countryInfo.txt on update  [@MickLesk](https://github.com/MickLesk) ([#17894](https://github.com/community-scripts/ProxmoxVE/pull/17894))
+    - WikiJS: use v2 Repo until v3 is stable [@MickLesk](https://github.com/MickLesk) ([#17895](https://github.com/community-scripts/ProxmoxVE/pull/17895))
+
+  - #### 💥 Breaking Changes
+
+    - zammad: Debian 13, new apt repo, Elasticsearch 8 [@durzo](https://github.com/durzo) ([#17836](https://github.com/community-scripts/ProxmoxVE/pull/17836))
+
+### 💾 Core
+
+  - Keep the version key parseable by jq 1.6 [@MickLesk](https://github.com/MickLesk) ([core#134](https://github.com/community-scripts/core/pull/134))
+
 ## 2026-10-12
 
 ### 🆕 New Scripts

ct/apprise-api.sh

@@ -46,7 +46,7 @@ function update_script() {
     $STD uv venv /opt/apprise/.venv
     $STD uv pip install -r requirements.txt gunicorn supervisor -p /opt/apprise/.venv/bin/python
     ln -sf /opt/apprise/.venv/bin/supervisord /opt/apprise/.venv/bin/gunicorn /usr/local/bin/
-    cp -fr apprise_api/static /usr/share/nginx/html/s/
+    cp -fr apprise_api/static/. /usr/share/nginx/html/s/
     mv apprise_api/ webapp
     touch /etc/nginx/server-override.conf
     touch /etc/nginx/location-override.conf

ct/bytestash.sh

@@ -9,8 +9,8 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 APP="ByteStash"
 var_tags="${var_tags:-code}"
 var_disk="${var_disk:-4}"
-var_cpu="${var_cpu:-1}"
-var_ram="${var_ram:-1024}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
@@ -35,9 +35,8 @@ function update_script() {
     systemctl stop bytestash-backend bytestash-frontend
     msg_ok "Services Stopped"
 
-    [[ -d /opt/bytestash/data ]] && create_backup /opt/bytestash/data
     [[ -d /opt/data ]] && create_backup /opt/data
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "bytestash" "jordan-dalby/ByteStash" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="data" fetch_and_deploy_gh_release "bytestash" "jordan-dalby/ByteStash" "tarball"
     restore_backup
 
     msg_info "Configuring ByteStash"
@@ -50,7 +49,6 @@ function update_script() {
     msg_info "Starting Services"
     systemctl start bytestash-backend bytestash-frontend
     msg_ok "Started Services"
-
     msg_ok "Updated successfully!"
   fi
   exit

ct/gluetun.sh

@@ -32,7 +32,7 @@ function update_script() {
     exit
   fi
 
-  if check_for_gh_release "gluetun" "qdm12/gluetun"; then
+  if check_for_gh_release "gluetun" "passteque/gluetun"; then
     msg_info "Stopping Service"
     systemctl stop gluetun
     msg_ok "Stopped Service"

ct/immich.sh

@@ -77,7 +77,7 @@ EOF
   BASE_DIR=${STAGING_DIR}/base-images
   SOURCE_DIR=${STAGING_DIR}/image-source
   cd /tmp
-  RELEASE="v3.3.0"
+  RELEASE="v3.3.1"
   if [[ -f ~/.intel_version ]]; then
     INTEL_SRC="https://raw.githubusercontent.com/immich-app/immich/${RELEASE}/machine-learning"
     curl -fsSL "${INTEL_SRC}/scripts/install-intel-runtime.sh" -o ./intel-runtime 2>/dev/null ||
@@ -102,16 +102,33 @@ EOF
       msg_ok "Updated Intel OpenVINO dependencies"
     fi
   fi
-  if [[ -f ~/.immich_library_revisions ]]; then
-    libraries=("libjxl" "jpegli" "libheif" "libraw" "imagemagick" "libvips")
-    cd "$BASE_DIR"
-    msg_warn "Checking for updates to custom image-processing libraries (recompile time: 2-15min per library)"
-    ensure_dependencies liblcms2-dev libjpeg62-turbo-dev libspng-dev libexif-dev libopenjp2-7-dev
-    $STD git pull
-    for library in "${libraries[@]}"; do
-      compile_"$library"
-    done
-    msg_ok "Image-processing libraries up to date"
+  # Without the revision file the refresh was skipped and sharp failed on an old libvips (#17914).
+  if [[ ! -f ~/.immich_library_revisions ]]; then
+    msg_warn "No record of the compiled image-processing libraries, rebuilding all of them"
+    printf '%s: unknown\n' imagemagick jpegli libheif libjxl libraw libvips >~/.immich_library_revisions
+  fi
+  [[ -d "$BASE_DIR/.git" ]] || $STD git clone -b main https://github.com/immich-app/base-images "$BASE_DIR"
+  libraries=("libjxl" "jpegli" "libheif" "libraw" "imagemagick" "libvips")
+  cd "$BASE_DIR"
+  msg_warn "Checking for updates to custom image-processing libraries (recompile time: 2-15min per library)"
+  ensure_dependencies liblcms2-dev libjpeg62-turbo-dev libspng-dev libexif-dev libopenjp2-7-dev
+  $STD git pull
+  for library in "${libraries[@]}"; do
+    compile_"$library"
+  done
+  msg_ok "Image-processing libraries up to date"
+
+  # 3.3.0 reads geodata/countryInfo.txt; the update before #17823 saved it into app/ instead.
+  if [[ -d /opt/immich/geodata && ! -s /opt/immich/geodata/countryInfo.txt ]]; then
+    msg_info "Restoring geodata/countryInfo.txt"
+    if [[ -s /opt/immich/app/countryInfo.txt ]]; then
+      mv /opt/immich/app/countryInfo.txt /opt/immich/geodata/countryInfo.txt
+    else
+      curl_with_retry "https://download.geonames.org/export/dump/countryInfo.txt" /opt/immich/geodata/countryInfo.txt
+    fi
+    chown immich:immich /opt/immich/geodata/countryInfo.txt
+    systemctl restart immich-web
+    msg_ok "Restored geodata/countryInfo.txt"
   fi
 
   if check_for_gh_release "Immich" "immich-app/immich" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
@@ -489,8 +506,7 @@ function compile_jpegli() {
 function compile_libheif() {
   SOURCE=${SOURCE_DIR}/libheif
   ensure_dependencies libaom-dev
-  LIBHEIF_REVISION="ac1cb05c39008f01525c991ff8b88f84ddf70fd2"
-  # : "${LIBHEIF_REVISION:=$(jq -cr '.revision' "$BASE_DIR"/server/sources/libheif.json)}"
+  LIBHEIF_REVISION="$(jq -cr '.revision' "$BASE_DIR"/server/sources/libheif.json)"
   if [[ "${update:-}" ]] || [[ "$LIBHEIF_REVISION" != "$(grep 'libheif' ~/.immich_library_revisions | awk '{print $2}')" ]]; then
     msg_info "Recompiling libheif"
     [[ -d "$SOURCE" ]] && rm -rf "$SOURCE"

ct/karakeep.sh

@@ -91,7 +91,7 @@ EOF
     sed -i "s/^SERVER_VERSION=.*$/SERVER_VERSION=${CHECK_UPDATE_RELEASE#v}/" /etc/karakeep/karakeep.env
     # Node 24.19.x crashes better-sqlite3 on cleanup (karakeep-app/karakeep#2989); stay on 22 LTS until upstream reverts.
     MODULE_VERSION="$(jq -r '.packageManager | split("@")[1]' /opt/karakeep/package.json)"
-    NODE_VERSION="22" NODE_MODULE="corepack,pnpm@${MODULE_VERSION}" setup_nodejs
+    NODE_VERSION="24" NODE_MODULE="corepack,pnpm@${MODULE_VERSION}" setup_nodejs
     setup_meilisearch
 
     msg_info "Updating Karakeep"

ct/localai.sh

@@ -37,6 +37,15 @@ function update_script() {
     exit
   fi
 
+  # Older installs have no CPU pin; on a host with a GPU but no driver in the
+  # container every model then ends in "backend not found".
+  if ! grep -q '^LOCALAI_FORCE_META_BACKEND_CAPABILITY=' /opt/localai.env 2>/dev/null &&
+    ! ldconfig -p 2>/dev/null | grep -qE 'libcuda[.]so|libamdhip64[.]so|libze_intel_gpu[.]so|libze_loader[.]so'; then
+    echo "LOCALAI_FORCE_META_BACKEND_CAPABILITY=default" >>/opt/localai.env
+    systemctl restart localai
+    msg_ok "Pinned LocalAI to the CPU backends (no GPU runtime in the container)"
+  fi
+
   if check_for_gh_release "localai" "mudler/LocalAI"; then
     msg_info "Stopping Service"
     systemctl stop localai

ct/onedev.sh

@@ -25,7 +25,10 @@ function update_script() {
   check_container_storage
   check_container_resources
 
-  if [[ ! -f /etc/systemd/system/onedev.service ]]; then
+  # Installs from before 16.9.0 keep their onedev.service; newer ones get onedev.server.service
+  SERVICE="onedev.server"
+  [[ -f /etc/systemd/system/onedev.service ]] && SERVICE="onedev"
+  if [[ ! -f "/etc/systemd/system/${SERVICE}.service" ]]; then
     msg_error "No ${APP} Installation Found!"
     exit
   fi
@@ -34,12 +37,12 @@ function update_script() {
     JAVA_VERSION="21" setup_java
 
     msg_info "Stopping Service"
-    systemctl stop onedev
+    systemctl stop "$SERVICE"
     msg_ok "Stopped Service"
 
     msg_info "Updating OneDev"
     cd /opt
-    curl -fsSL "https://code.onedev.io/onedev/server/~site/onedev-latest.tar.gz" -o onedev-latest.tar.gz
+    curl -fsSL "https://code.onedev.io/onedev/server/~sites/public/onedev-latest.tar.gz" -o onedev-latest.tar.gz
     tar -xzf onedev-latest.tar.gz
     $STD /opt/onedev-latest/bin/upgrade.sh /opt/onedev
     rm -rf /opt/onedev-latest
@@ -48,7 +51,7 @@ function update_script() {
     msg_ok "Updated OneDev"
 
     msg_info "Starting Service"
-    systemctl start onedev
+    systemctl start "$SERVICE"
     msg_ok "Started Service"
     msg_ok "Updated successfully!"
     exit

ct/paperclip.sh

@@ -50,7 +50,10 @@ function update_script() {
     cd /opt/paperclip-ai
     export HUSKY=0
     export NODE_OPTIONS="--max-old-space-size=8192"
-    $STD pnpm install --frozen-lockfile
+    $STD pnpm install --frozen-lockfile || {
+      msg_warn "The lockfile of this release is out of date, resolving dependencies without it"
+      $STD pnpm install --no-frozen-lockfile
+    }
     $STD pnpm build
     unset NODE_OPTIONS
     msg_ok "Rebuilt Paperclip"

ct/pelican-panel.sh

@@ -66,7 +66,8 @@ function update_script() {
     cp -a /opt/backup/storage/app/public /opt/pelican-panel/storage/app/
 
     $STD composer install --no-dev --optimize-autoloader --no-interaction
-    $STD php artisan p:environment:setup
+    PANEL_URL="$(sed -n 's/^APP_URL=//p' /opt/pelican-panel/.env | tr -d "\"'")"
+    $STD php artisan p:environment:setup --url="$PANEL_URL"
     $STD php artisan view:clear
     $STD php artisan config:clear
     $STD php artisan filament:optimize

ct/readmeabook.sh

@@ -31,6 +31,28 @@ function update_script() {
     exit
   fi
 
+  if ! grep -q '^ExecStartPost=-/usr/local/bin/readmeabook-init$' /etc/systemd/system/readmeabook.service; then
+    msg_info "Starting the scheduler with the service"
+    cat <<'EOF' >/usr/local/bin/readmeabook-init
+#!/usr/bin/env bash
+# Upstream's image calls /api/init after every start: it creates the scheduled jobs and starts the scheduler
+url="http://127.0.0.1:${PORT:-3030}"
+for _ in $(seq 1 60); do curl -sf -o /dev/null "$url/api/health" && break; sleep 1; done
+for _ in $(seq 1 30); do [[ "$(redis-cli ping 2>/dev/null)" == PONG ]] && break; sleep 1; done
+for attempt in 1 2 3 4 5; do
+  curl -sf -o /dev/null "$url/api/init" && exit 0
+  sleep "$attempt"
+done
+echo "ReadMeABook did not answer /api/init, scheduled jobs will not run" >&2
+exit 1
+EOF
+    chmod +x /usr/local/bin/readmeabook-init
+    sed -i '/^ExecStart=/a ExecStartPost=-/usr/local/bin/readmeabook-init\nTimeoutStartSec=180' /etc/systemd/system/readmeabook.service
+    systemctl daemon-reload
+    systemctl restart readmeabook
+    msg_ok "Started the scheduler with the service"
+  fi
+
   if check_for_gh_release "readmeabook" "kikootwo/ReadMeABook"; then
     msg_info "Stopping Service"
     systemctl stop readmeabook

ct/wikijs.sh

@@ -32,14 +32,14 @@ function update_script() {
 
   NODE_VERSION="26" NODE_MODULE="yarn,node-gyp" setup_nodejs
 
-  if check_for_gh_release "wikijs" "requarks/wiki"; then
-    msg_info "Verifying whether ${APP}' new release is v3.x+ and current install uses SQLite."
-    SQLITE_INSTALL=$([ -f /opt/wikijs/db.sqlite ] && echo "true" || echo "false")
-    if [[ "${SQLITE_INSTALL}" == "true" && "${CHECK_UPDATE_RELEASE}" =~ ^3.* ]]; then
-      echo "SQLite is not supported in v3.x+, currently there is no update path availble."
-      exit
-    fi
-    msg_ok "There is an update path available for ${APP}"
+  if check_for_gh_release "wikijs" "requarks/wiki-v2"; then
+    #msg_info "Verifying whether ${APP}' new release is v3.x+ and current install uses SQLite."
+    #SQLITE_INSTALL=$([ -f /opt/wikijs/db.sqlite ] && echo "true" || echo "false")
+    #if [[ "${SQLITE_INSTALL}" == "true" && "${CHECK_UPDATE_RELEASE}" =~ ^3.* ]]; then
+    #  echo "SQLite is not supported in v3.x+, currently there is no update path availble."
+    #  exit
+    #fi
+    #msg_ok "There is an update path available for ${APP}"
 
     msg_info "Stopping Service"
     systemctl stop wikijs
@@ -47,15 +47,17 @@ function update_script() {
 
     msg_info "Backing up Data"
     mkdir /opt/wikijs-backup
-    $SQLITE_INSTALL && cp /opt/wikijs/db.sqlite /opt/wikijs-backup
+    #$SQLITE_INSTALL && 
+    cp /opt/wikijs/db.sqlite /opt/wikijs-backup
     cp -R /opt/wikijs/{config.yml,/data} /opt/wikijs-backup
     msg_ok "Backed up Data"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "wikijs" "requarks/wiki" "prebuild" "latest" "/opt/wikijs" "wiki-js.tar.gz"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "wikijs" "requarks/wiki-v2" "prebuild" "latest" "/opt/wikijs" "wiki-js.tar.gz"
 
     msg_info "Restoring Data"
     cp -R /opt/wikijs-backup/* /opt/wikijs
-    $SQLITE_INSTALL && $STD npm rebuild sqlite3
+    #$SQLITE_INSTALL && 
+    $STD npm rebuild sqlite3
     rm -rf /opt/wikijs-backup
     msg_ok "Restored Data"
 

ct/zabbix.sh

@@ -86,16 +86,16 @@ function update_script() {
   rm -rf /tmp/zabbix-release_*.deb
   apt_update_safe
 
-  $STD apt install --only-upgrade zabbix-server-pgsql zabbix-frontend-php php8.4-pgsql
+  $STD apt install --only-upgrade -y zabbix-server-pgsql zabbix-frontend-php php8.4-pgsql
 
   if [[ "$AGENT_SERVICE" == "zabbix-agent2" ]]; then
-    $STD apt install --only-upgrade zabbix-agent2 zabbix-agent2-plugin-postgresql
+    $STD apt install --only-upgrade -y zabbix-agent2 zabbix-agent2-plugin-postgresql
     if [ -f /etc/zabbix/zabbix_agent2.d/plugins.d/nvidia.conf ]; then
       sed -i 's|^Plugins.NVIDIA.System.Path=.*|# Plugins.NVIDIA.System.Path=/usr/libexec/zabbix/zabbix-agent2-plugin-nvidia-gpu|' \
         /etc/zabbix/zabbix_agent2.d/plugins.d/nvidia.conf
     fi
   elif [[ "$AGENT_SERVICE" == "zabbix-agent" ]]; then
-    $STD apt install --only-upgrade zabbix-agent
+    $STD apt install --only-upgrade -y zabbix-agent
   fi
 
   if command -v fping >/dev/null 2>&1; then

ct/zammad.sh

@@ -12,7 +12,7 @@ var_disk="${var_disk:-8}"
 var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-4096}"
 var_os="${var_os:-debian}"
-var_version="${var_version:-12}"
+var_version="${var_version:-13}"
 var_arm64="${var_arm64:-no}"
 var_unprivileged="${var_unprivileged:-1}"
 
@@ -34,6 +34,64 @@ function update_script() {
   systemctl stop zammad
   msg_ok "Stopped Service"
 
+  if grep -qs "dl.packager.io" /etc/apt/sources.list.d/zammad*; then
+    msg_info "Migrating Zammad Repository"
+    rm -f /etc/apt/keyrings/pkgr-zammad.gpg
+    setup_deb822_repo \
+      "zammad" \
+      "https://go.packager.io/srv/deb/zammad/zammad/gpg-key.asc" \
+      "https://go.packager.io/srv/deb/zammad/zammad/stable/debian" \
+      "$(get_os_info version_id)" \
+      "main"
+    msg_ok "Migrated Zammad Repository"
+  fi
+
+  REBUILD_INDEX=false
+  if [[ "$(dpkg-query -W -f='${Version}' elasticsearch 2>/dev/null)" == 7.* ]]; then
+    msg_info "Upgrading Elasticsearch to 8.x"
+    systemctl stop elasticsearch
+    if /usr/share/elasticsearch/bin/elasticsearch-plugin list 2>/dev/null | grep -q "ingest-attachment"; then
+      $STD /usr/share/elasticsearch/bin/elasticsearch-plugin remove ingest-attachment
+    fi
+    rm -f /etc/apt/sources.list.d/elastic-7.x.list /usr/share/keyrings/elasticsearch-keyring.gpg
+    setup_deb822_repo \
+      "elasticsearch" \
+      "https://artifacts.elastic.co/GPG-KEY-elasticsearch" \
+      "https://artifacts.elastic.co/packages/8.x/apt" \
+      "stable" \
+      "main"
+    ES_JAVA_OPTS="-Xms1g -Xmx1g" $STD apt install -y elasticsearch
+    if [[ -f /etc/elasticsearch/jvm.options.dpkg-dist ]]; then
+      mv /etc/elasticsearch/jvm.options.dpkg-dist /etc/elasticsearch/jvm.options
+    fi
+    rm -f /etc/elasticsearch/elasticsearch.yml.dpkg-dist
+    rm -rf /var/lib/elasticsearch/*
+    cat <<EOF >/etc/elasticsearch/jvm.options.d/heap.options
+-Xms2g
+-Xmx2g
+EOF
+    cat <<EOF >/etc/elasticsearch/elasticsearch.yml
+path.data: /var/lib/elasticsearch
+path.logs: /var/log/elasticsearch
+discovery.type: single-node
+network.host: 127.0.0.1
+xpack.security.enabled: false
+xpack.security.transport.ssl.enabled: false
+xpack.security.http.ssl.enabled: false
+bootstrap.memory_lock: false
+EOF
+    systemctl daemon-reload
+    systemctl restart -q elasticsearch
+    for i in $(seq 1 30); do
+      if curl -s http://127.0.0.1:9200 >/dev/null 2>&1; then
+        break
+      fi
+      sleep 2
+    done
+    REBUILD_INDEX=true
+    msg_ok "Upgraded Elasticsearch to 8.x"
+  fi
+
   msg_info "Updating Zammad"
   apt_update_safe
   $STD apt-mark hold zammad
@@ -42,6 +100,12 @@ function update_script() {
   $STD apt upgrade -y
   msg_ok "Updated Zammad"
 
+  if [[ "$REBUILD_INDEX" == true ]]; then
+    msg_info "Rebuilding Search Index"
+    $STD zammad run rake zammad:searchindex:rebuild
+    msg_ok "Rebuilt Search Index"
+  fi
+
   msg_info "Starting Service"
   systemctl start zammad
   msg_ok "Started Service"

install/apprise-api-install.sh

@@ -29,7 +29,7 @@ cp ./requirements.txt /etc/requirements.txt
 $STD uv venv /opt/apprise/.venv
 $STD uv pip install -r requirements.txt gunicorn supervisor -p /opt/apprise/.venv/bin/python
 ln -sf /opt/apprise/.venv/bin/supervisord /opt/apprise/.venv/bin/gunicorn /usr/local/bin/
-cp -fr apprise_api/static /usr/share/nginx/html/s/
+cp -fr apprise_api/static/. /usr/share/nginx/html/s/
 mv apprise_api/ webapp
 touch /etc/nginx/server-override.conf
 touch /etc/nginx/location-override.conf

install/gluetun-install.sh

@@ -27,7 +27,7 @@ ln -sf /usr/sbin/openvpn /usr/sbin/openvpn2.6
 msg_ok "Configured iptables"
 
 
-fetch_and_deploy_gh_release "gluetun" "qdm12/gluetun" "tarball"
+fetch_and_deploy_gh_release "gluetun" "passteque/gluetun" "tarball"
 GO_VERSION="$(grep -m1 '^go ' /opt/gluetun/go.mod | awk '{print $2}')" setup_go
 
 msg_info "Building Gluetun"

install/immich-install.sh

@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os
 
-RELEASE="v3.3.0"
+RELEASE="v3.3.1"
 if lscpu | grep -q 'GenuineIntel'; then
   echo ""
   echo ""
@@ -268,8 +268,7 @@ msg_ok "(2/6) Compiled jpegli"
 
 msg_info "(3/6) Compiling libheif"
 SOURCE=${SOURCE_DIR}/libheif
-LIBHEIF_REVISION="ac1cb05c39008f01525c991ff8b88f84ddf70fd2"
-# : "${LIBHEIF_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libheif.json)}"
+LIBHEIF_REVISION="$(jq -cr '.revision' "$BASE_DIR"/server/sources/libheif.json)"
 $STD git clone https://github.com/strukturag/libheif.git "$SOURCE"
 cd "$SOURCE"
 $STD git reset --hard "$LIBHEIF_REVISION"

install/karakeep-install.sh

@@ -33,7 +33,7 @@ fetch_and_deploy_gh_release "karakeep" "karakeep-app/karakeep" "tarball"
 cd /opt/karakeep
 # Node 24.19.x crashes better-sqlite3 on cleanup (karakeep-app/karakeep#2989); stay on 22 LTS until upstream reverts.
 MODULE_VERSION="$(jq -r '.packageManager | split("@")[1]' /opt/karakeep/package.json)"
-NODE_VERSION="22" NODE_MODULE="pnpm@${MODULE_VERSION}" setup_nodejs
+NODE_VERSION="24" NODE_MODULE="pnpm@${MODULE_VERSION}" setup_nodejs
 
 msg_info "Installing external JavaScript Extension for yt-dlp"
 $STD pip install -U yt-dlp-ejs --break-system-packages

install/localai-install.sh

@@ -39,6 +39,12 @@ LOCALAI_MODELS_PATH=/opt/localai_data/models
 LOCALAI_BACKENDS_PATH=/opt/localai_data/backends
 LOCALAI_LOG_LEVEL=info
 EOF
+# LocalAI picks the backend variant from the GPU it sees in sysfs, which is the
+# host's card even when no driver was installed in here, and a CUDA/ROCm/SYCL
+# backend then never starts. Pin the CPU variants unless a runtime is present.
+if ! ldconfig -p 2>/dev/null | grep -qE 'libcuda[.]so|libamdhip64[.]so|libze_intel_gpu[.]so|libze_loader[.]so'; then
+  echo "LOCALAI_FORCE_META_BACKEND_CAPABILITY=default" >>/opt/localai.env
+fi
 # LocalAI refuses to start on a wildcard bind with nothing to identify callers,
 # and binding the wildcard is what makes the container reachable at all.
 if [[ "$var_auth" == "yes" ]]; then

install/onedev-install.sh

@@ -24,11 +24,11 @@ JAVA_VERSION="21" setup_java
 msg_info "Installing OneDev"
 RELEASE=$(get_latest_github_release "theonedev/onedev" false)
 cd /opt
-curl -fsSL "https://code.onedev.io/onedev/server/~site/onedev-latest.tar.gz" -o onedev-latest.tar.gz
+curl -fsSL "https://code.onedev.io/onedev/server/~sites/public/onedev-latest.tar.gz" -o onedev-latest.tar.gz
 tar -xzf onedev-latest.tar.gz
 mv /opt/onedev-latest /opt/onedev
 $STD /opt/onedev/bin/server.sh install
-systemctl start onedev
+systemctl start onedev.server
 rm -rf /opt/onedev-latest.tar.gz
 echo "${RELEASE}" >~/.onedev
 msg_ok "Installed OneDev"

install/paperclip-install.sh

@@ -31,7 +31,11 @@ msg_info "Building Paperclip"
 cd /opt/paperclip-ai
 export HUSKY=0
 export NODE_OPTIONS="--max-old-space-size=8192"
-$STD pnpm install --frozen-lockfile
+# Upstream tags ship with a stale pnpm-lock.yaml now and then (paperclipai/paperclip#13923).
+$STD pnpm install --frozen-lockfile || {
+  msg_warn "The lockfile of this release is out of date, resolving dependencies without it"
+  $STD pnpm install --no-frozen-lockfile
+}
 $STD pnpm build
 unset NODE_OPTIONS
 msg_ok "Built Paperclip"

install/pelican-panel-install.sh

@@ -26,8 +26,7 @@ fetch_and_deploy_gh_release "pelican-panel" "pelican-dev/panel" "prebuild" "late
 msg_info "Installing Pelican Panel"
 cd /opt/pelican-panel
 $STD composer install --no-dev --optimize-autoloader --no-interaction
-$STD php artisan p:environment:setup
-sed -i "s|^APP_URL=.*|APP_URL=http://${LOCAL_IP}|" /opt/pelican-panel/.env
+$STD php artisan p:environment:setup --url="http://${LOCAL_IP}"
 echo "yes" | $STD php artisan p:environment:database --driver mariadb --host localhost --port 3306 --database "$MARIADB_DB_NAME" --username "$MARIADB_DB_USER" --password "$MARIADB_DB_PASS"
 $STD php artisan p:environment:queue-service --no-interaction
 echo "* * * * * php /opt/pelican-panel/artisan schedule:run >> /dev/null 2>&1" | crontab -u www-data -

install/readmeabook-install.sh

@@ -63,6 +63,20 @@ fi
 msg_ok "Built ReadMeABook"
 
 msg_info "Creating Service"
+cat <<'EOF' >/usr/local/bin/readmeabook-init
+#!/usr/bin/env bash
+# Upstream's image calls /api/init after every start: it creates the scheduled jobs and starts the scheduler
+url="http://127.0.0.1:${PORT:-3030}"
+for _ in $(seq 1 60); do curl -sf -o /dev/null "$url/api/health" && break; sleep 1; done
+for _ in $(seq 1 30); do [[ "$(redis-cli ping 2>/dev/null)" == PONG ]] && break; sleep 1; done
+for attempt in 1 2 3 4 5; do
+  curl -sf -o /dev/null "$url/api/init" && exit 0
+  sleep "$attempt"
+done
+echo "ReadMeABook did not answer /api/init, scheduled jobs will not run" >&2
+exit 1
+EOF
+chmod +x /usr/local/bin/readmeabook-init
 cat <<EOF >/etc/systemd/system/readmeabook.service
 [Unit]
 Description=ReadMeABook
@@ -75,6 +89,8 @@ User=root
 WorkingDirectory=/opt/readmeabook
 EnvironmentFile=/opt/readmeabook/.env
 ExecStart=${START_CMD}
+ExecStartPost=-/usr/local/bin/readmeabook-init
+TimeoutStartSec=180
 Restart=on-failure
 RestartSec=10
 

install/wikijs-install.sh

@@ -20,7 +20,7 @@ msg_ok "Installed Dependencies"
 NODE_VERSION="26" NODE_MODULE="yarn,node-gyp" setup_nodejs
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="wiki" PG_DB_USER="wikijs_user" PG_DB_EXTENSIONS="pg_trgm" setup_postgresql_db
-fetch_and_deploy_gh_release "wikijs" "requarks/wiki" "prebuild" "latest" "/opt/wikijs" "wiki-js.tar.gz"
+fetch_and_deploy_gh_release "wikijs" "requarks/wiki-v2" "prebuild" "latest" "/opt/wikijs" "wiki-js.tar.gz"
 
 msg_info "Configuring Wiki.js"
 mv /opt/wikijs/config.sample.yml /opt/wikijs/config.yml

install/zammad-install.sh

@@ -16,29 +16,31 @@ update_os
 msg_info "Installing Dependencies"
 $STD apt install -y \
   git \
-  nginx \
-  apt-transport-https
+  nginx
 msg_ok "Installed Dependencies"
 
 msg_info "Setting up Elasticsearch"
 setup_deb822_repo \
   "elasticsearch" \
   "https://artifacts.elastic.co/GPG-KEY-elasticsearch" \
-  "https://artifacts.elastic.co/packages/7.x/apt" \
+  "https://artifacts.elastic.co/packages/8.x/apt" \
   "stable" \
   "main"
-$STD apt install -y elasticsearch
-sed -i 's/^#\{0,2\} *-Xms[0-9]*g.*/-Xms2g/' /etc/elasticsearch/jvm.options
-sed -i 's/^#\{0,2\} *-Xmx[0-9]*g.*/-Xmx2g/' /etc/elasticsearch/jvm.options
+ES_JAVA_OPTS="-Xms1g -Xmx1g" $STD apt install -y elasticsearch
+cat <<EOF >/etc/elasticsearch/jvm.options.d/heap.options
+-Xms2g
+-Xmx2g
+EOF
 cat <<EOF >/etc/elasticsearch/elasticsearch.yml
 path.data: /var/lib/elasticsearch
 path.logs: /var/log/elasticsearch
 discovery.type: single-node
 network.host: 127.0.0.1
 xpack.security.enabled: false
+xpack.security.transport.ssl.enabled: false
+xpack.security.http.ssl.enabled: false
 bootstrap.memory_lock: false
 EOF
-$STD /usr/share/elasticsearch/bin/elasticsearch-plugin install ingest-attachment -b
 systemctl daemon-reload
 systemctl enable -q elasticsearch
 systemctl restart -q elasticsearch
@@ -53,8 +55,8 @@ msg_ok "Setup Elasticsearch"
 msg_info "Installing Zammad"
 setup_deb822_repo \
   "zammad" \
-  "https://dl.packager.io/srv/zammad/zammad/key" \
-  "https://dl.packager.io/srv/deb/zammad/zammad/stable/debian" \
+  "https://go.packager.io/srv/deb/zammad/zammad/gpg-key.asc" \
+  "https://go.packager.io/srv/deb/zammad/zammad/stable/debian" \
   "$(get_os_info version_id)" \
   "main"
 $STD apt install -y zammad