v3.0.1

A small patch on v3.0.0: a security update to a library used by single sign-on, library updates, clean
release builds and three dashboard fixes. No new settings and no database change; going back to v3.0.0 is
safe.

Security

• go-jose (used by single sign-on) is updated to v4.1.6 for advisories
  GHSA-6mp9-8xrw-74r4 and GHSA-mgcc-cww5-fp2q. Exposure was low: tokens
  and signing keys come from the configured identity provider over TLS.
  go-jose now refuses RSA keys larger than 4096 bits: if the identity
  provider's key set holds one, single sign-on fails until that key is
  removed. Common providers use 2048 or 4096 bit keys.

Fixed

• The Go build information in release binaries and images marked them
  as built from a modified source tree (+dirty, vcs.modified=true;
  the version Sentinel reports was right), because the release build
  rewrote the committed frontend bundle with an older esbuild and wrote
  its output inside the source tree. The build now uses the same pinned
  esbuild as the committed bundle, keeps its output out of the tree, and
  fails if the tree is not clean before anything is published.
• A remote update started from another browser, or through the API,
  showed "Updating" only for a few seconds after it had finished. Every
  open dashboard now shows "Updating" for the whole update.
• After a GHCR switch on a remote container, the row kept its
  "Updating" badge until the page was reloaded. It now refreshes on its
  own.
• On an install where the global Version Scope was never saved (every
  new install), the container page listed "Available Versions" and named
  the scope as if it were Relaxed, while updates were checked as Strict,
  the default. The page now uses the same scope as the update check.

Changed

• Dependency updates: go-oidc v3.21.0, oauth2 v0.37.0, Prometheus
  client_golang v1.25.0 and common v0.72.1, bbolt v1.5.0 (same database
  format, so a v3.0.0 rollback still opens it), protobuf v1.36.12,
  golang-jwt v5.3.1. An identity provider key set that holds a key of a
  type or algorithm Sentinel does not support no longer makes every
  single sign-on login fail: that key is skipped.
• A remote update now sends the same "update started" container_update
  event as a local one, so every open browser shows an info toast. If the
  hub then refuses the update (a paused host, a failed signature check),
  that toast is followed by the failure.
• /metrics responses carry a Vary: Accept header.
• esbuild is pinned to v0.28.2 and runs through go run, so building the
  frontend needs no separate install.
• The remote rollback rule (which earlier image a rollback goes back to)
  now lives in one place, shared by the check that offers the Rollback
  button and the code that carries the rollback out, so they cannot
  disagree.

Known limits

Behaviour that is known and not fixed yet (Reject, a removed remote container, a hub restart during an agent
self-update) is now listed on the wiki page Known Limits.

Full changelog: v3.0.0...v3.0.1