Skip to content

v1.6.0-rc.13

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 09 Aug 04:17
v1.6.0-rc.13
103bfdc
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v1.6.0-rc.13

Full Changelog: v1.6.0-rc.12...v1.6.0-rc.13

[1.6.0-rc.13] — 2026-08-08

Security

Fixed

  • Icon bundle no longer silently drops referenced icons at image build time (#683). The bundle is regenerated from the locked @iconify-json packages during every Docker image build, but the extractor only looked up plain icon entries — lucide:history (the Audit navigation icon in the Lucide icon theme) became an alias in lucide 1.2.121 and vanished from shipped images, rendering blank. The extractor now resolves alias chains, and references that never existed in the locked collections are fixed: iconoir:history → iconoir:clock-rotate-right, iconoir:gitlab → iconoir:gitlab-full, iconoir:stack → iconoir:multiple-pages, and the Font Awesome brand glyphs (GitHub/GitLab/Google/Microsoft registry icons) gained the previously missing @iconify-json/fa6-brands package. A new test asserts every icon referenced in icons.ts exists in the committed bundle.
  • Star History chart is now self-hosted (#671). The homepage card and README embed rendered a broken image after api.star-history.com's global outage (their GitHub tokens rate-limited; starchart.cc also failing). A new /api/star-history route on the website fetches stargazer timestamps from the GitHub API server-side (optional GITHUB_TOKEN, edge-cached six hours with stale-while-revalidate, short-lived fallback SVG on fetch failure) and renders the chart in the site's own palette for both themes; the README uses a <picture> element with theme-matched variants. No third-party chart service remains in the path, and api.star-history.com is dropped from the site's CSP img-src.
  • Digest-update comparison no longer anchors on an arbitrary RepoDigests[0] entry (#669). A local Docker image can carry multiple repo@digest entries for one Image ID (pull/retag accumulation, no ordering guarantee); getRepoDigest blindly took index 0, so a stale or foreign-repo entry landing first anchored the whole digest-update pipeline to the wrong manifest and produced a persistent digest-update false positive that survived applying the update. getOrderedRepoDigests (app/watchers/providers/docker/docker-helpers.ts) now returns every RepoDigests entry whose repo component matches the container's own image reference, ordered, falling back to the full list only when nothing matches; the container model gained an optional image.digest.repoDigests field carrying that ordered list, re-derived from the live Docker image inspect on every discovery/refresh cycle. handleDigestWatch (app/watchers/providers/docker/image-comparison.ts) now walks that candidate list — a cheap raw-value check first, then a normalize-and-compare registry call per remaining candidate, skipping anchors whose manifest lookup fails — and re-anchors digest.repo to whichever candidate actually matched, so a store already poisoned with a stale digest.repo self-heals on its own. A genuine same-tag republish (no candidate matches) still flags an update exactly as before; if every candidate fails to normalize, the failure now propagates instead of being silently coerced into a false "no update".
Assets 9
Loading