HomelabARR v2.5.2 — Security and install fixes

Security and install fixes. If you run v2.5.1 or older, move to this one.

Fixed

The quick start in the README did not start HomelabARR. Following it on a clean machine, the backend never came up: the step that creates its secret files was missing, the frontend ran as the wrong user and could not write its own config, and the health checks asked an address nothing listens on. All of that is fixed, and every change is now tested by a job that follows the README word for word on a fresh Linux machine and logs in. The first login uses the password printed by scripts/init-secrets.sh, not admin.

One person could lock everyone out of signing in. Behind the bundled web server, the backend counted every visitor as the same address, so the login limit was shared by all users. Each visitor is now counted separately. If you put your own reverse proxy in front, set TRUST_PROXY_HOPS to the number of proxies (the bundled setup needs nothing).

Security updates. A newer qs fixes two advisories that could slow the server with crafted requests, the password-reset store can no longer be steered by a crafted user id, and the images carry a patched libexpat (a high-rated XML flaw).

Updating

docker compose -f homelabarr.yml pull
docker compose -f homelabarr.yml up -d

If you installed from the README, pull the new homelabarr.yml and run bash scripts/init-secrets.sh once: it only adds the secret files you are missing and never overwrites one. If AppArmor is enabled on your host, run sudo bash scripts/install-apparmor.sh again for the updated profiles.

If you follow latest, you already have it.

HomelabARR v2.5.1 — Security rebuild

Security rebuild of v2.5.0. Same features, patched OpenSSL. If you pulled v2.5.0, move to this one.

Fixed

The backend image shipped with an unpatched OpenSSL. v2.5.0's backend carried ten known OpenSSL problems, two rated high. The frontend from that same release was fine.

The image build had a step that updates system packages, and it was working. The build just reused a saved copy of that step from an earlier build instead of running it again — so it re-applied old updates and looked like it had done its job. Nothing failed. Nothing warned. The published image simply had older packages inside than it should have.

The build now refuses to reuse that saved copy whenever it is producing a release, so a version you pin to always carries the patches that existed when it was cut.

Nothing else changed. Everything in v2.5.0 is here, including the log viewer fix.

If you're on v2.5.0

Pull again and recreate:

docker compose -f homelabarr.yml pull
docker compose -f homelabarr.yml up -d

If you follow latest, you already have it.

Coming from something older than v2.5.0? Read the v2.5.0 notes as well — the log viewer fix there needs you to re-pull homelabarr.yml, not just the images.

HomelabARR v2.5.0 — Container logs work again

Bug fix release. If you use the log viewer, this one needs a small step from you.

Fixed

Container logs came back empty. Opening the logs for a container showed the dialog, the auto-refresh control, and nothing else. The socket proxy that sits between HomelabARR and Docker changed how it handles log reads: they used to come with general container access, and now they have to be switched on by name. Ours wasn't, so every log request was refused. It is switched on now.

This is the one thing in this release that needs you to do something — see below.

Changed

The database engine no longer builds itself at install time. It now ships ready to run for every platform we support. This removes an entire way for a build to go wrong quietly: previously the piece that talks to the encrypted database was compiled during install, and if that step was skipped the image still built, still published, and only failed once it was running. That is exactly what happened in April and it cost sixteen days. It can't happen that way again. Your data carries over untouched — we tested it by writing a full database with the old engine and reading it back with the new one.

The trade is size: the backend image grows by about 17 MB.

The socket proxy is pinned to a version you can read. It was pinned to a fingerprint of "whatever was newest at the time", which sounds safer and isn't — nothing could tell us a newer one existed, so it quietly sat three and a half months behind. It now carries a real version number, so updates show up instead of never arriving.

If you're upgrading

Pull the current homelabarr.yml and recreate the proxy. Without this, logs stay empty:

docker compose -f homelabarr.yml up -d --force-recreate socket-proxy

Running your own compose file instead of ours? Add ALLOW_LOGS=1 to the socket-proxy service's environment block. It grants read access to container logs and nothing else.

Also in this release

Routine dependency and security updates across the app, the container images and the build.

HomelabARR v2.4.0 — Demo mode and login hardening

Security and reliability release.

Fixed

Login rate limiting could be bypassed from IPv6. An IPv6 client rotating addresses within its own allocation got a fresh allowance each time, so the limiter never engaged. Attempts are now grouped by subnet, which is how an address block is actually handed out. IPv4 behaviour is unchanged.

Crash reports named the wrong error. When the app hit a fatal error it tried to record the crash, and if that recording failed it reported that failure instead — hiding the real cause. The original error is now reported first, with its stack, and always.

Fake containers appeared on real installs. An instance reached at localhost could be mistaken for a demo and shown eight example containers when Docker legitimately reported none. It now asks the server what it is instead of guessing from the address bar.

Added

Demo mode. Set DEMO_MODE=true and the server refuses password changes, account changes, API key creation and two-factor changes, while everything else stays browsable. Intended for anyone running a public instance with shared credentials. Off unless you switch it on — nothing changes for a normal install.

Changed

ARM images build natively. arm64 was previously produced by emulation, which made some builds take over two hours; each architecture now builds on its own machine. Same images, published far sooner after a fix lands.

Images are published to GitHub Container Registry and Docker Hub for amd64 and arm64, and are signed.

HomelabARR v2.3.0 — Critical backend image fix

⚠️ Upgrade if you pulled between 26 July and 10 August 2026

Backend images built in that window could not open their database. They crash-looped on startup with Could not locate the bindings file and never served traffic. 2.3.0 fixes it.

docker pull ghcr.io/imogenlabs/homelabarr-backend:2.3.0
docker pull ghcr.io/imogenlabs/homelabarr-frontend:2.3.0
# Docker Hub
docker pull smashingtags/homelabarr-backend:2.3.0
docker pull smashingtags/homelabarr-frontend:2.3.0

What happened

Dockerfile.backend ran npm install -g npm@latest. When npm@latest floated from 11.16.0 to 12.0.2, npm 12's new allowScripts policy began blocking package install scripts by default:

npm warn install-scripts 5 packages had install scripts blocked because
they are not covered by allowScripts:
  better-sqlite3-multiple-ciphers@12.11.1 (install: prebuild-install || node-gyp rebuild)

So the native SQLite binding was never compiled. The image built and pushed clean — the defect only appeared at runtime, in server/db.js, after which the container restart-looped without ever binding its port.

Nothing in the repository changed. A single unpinned floating dependency inside an otherwise digest-pinned image did.

Fixes and guardrails

• npm is gone from the backend runtime image. It was only ever a build-time tool, but scanners read the whole filesystem and npm vendors its own dependency tree — the source of every image CVE previously reported on this backend. Removing it retires that class at the source (8 alerts cleared).
• The build now asserts the native module actually loads, so this cannot ship silently again. Verified in both directions: reintroducing the npm upgrade fails the build.
• Unused better-sqlite3 dependency dropped — nothing imported it.
• Backend image 921 MB → 859 MB.
• Node pinned to major 24 (Active LTS).
• End-to-end test lane restored, given real failure diagnostics, and it now runs on main so a break surfaces immediately.

Also in this release

563 commits since v2.2.0 (April 2026), including the test-coverage campaign (73% → 82% lines, 906 tests), the mutation-testing epic, and the adversarial security-review remediation rounds. See CHANGELOG.md for detail.

All images are cosign-signed and published to both GHCR and Docker Hub.

HomelabARR CE v2.2.0 — Deploy fixes + security patches

Deploy bug fixes ported back from the Eight.ly fork, npm security patches, workflow hardening, and wiki cleanup.

🐛 Bug Fixes (Backported from Eight.ly fork)

• Container delete/stop/restart: Docker client was never passed to the CLI manager. All container operations now work correctly. (#146)
• Docker socket permissions: Apps that mount docker.sock (Portainer, etc.) now get group_add injected at deploy time so they can read/write the socket. (#146)
• Read-only template volumes: Temp deploy YAMLs now write to server/data/ instead of next to the source YAML, so deploys don't fail with EACCES on read-only mounts. (#146)
• Deploy progress stream: SSE connected event now includes the server-assigned clientId, fixing "Client not found" 500s on subscribe. (#146)
• Health endpoint: Returns 200 with status DEGRADED when Docker is unavailable instead of 503, so Traefik keeps routing.

🔒 Security

• npm vulnerabilities patched: vite, hono, @hono/node-server bumped to address 9 advisories (3 high, 6 moderate). (#145)
• Workflow permissions: Added explicit permissions: contents: read to all workflows missing it. Resolves CodeQL alert. (#144)

📚 Documentation

• Wiki cleanup: Removed Professional Edition section; replaced placeholder octopus with optimized v3b WebP at proper sizes. (#147)

🏗️ Repository

• Repo went public -- HomelabARR CE source is now openly available on GitHub.

HomelabARR CE v2.1.0 — Security, Starred Apps, App Catalog Cleanup

What's New

API Key Authentication

Generate, list, and revoke API keys (hlr_ prefix) from the dashboard. Built for mobile app integration and automation.

User Management

Full user management panel — create users, delete users, reset passwords. Admin-only.

Starred Apps

Star your favorite apps for quick access. Per-user, persists across sessions. "Starred" tab appears when you have favorites.

Activity Log

Backend activity logging with frontend tab in user settings. Tracks logins, deploys, container operations, user management actions.

Security

• All container routes now require authentication — unauthenticated users can no longer see deployed containers
• Picomatch ReDoS vulnerability patched
• Credential security: bcrypt password hashing, JWT signing, crypto-random API keys
• Auth data persisted via Docker volume (homelabarr-config)

App Catalog Cleanup

• Removed 28 dead/abandoned app templates
• Switched 4 apps to LSIO images (fail2ban, changedetection, handbrake, filezilla) with corrected ports and volumes
• Bumped all 10 Kasm virtual desktop images from 1.9.0 to 1.16.0
• Added speedtest-tracker (LSIO)

Mobile Responsive UI

• Horizontal scroll category tabs on mobile
• Compact header layout
• No more horizontal overflow

Wiki Complete Rewrite

• All pages rewritten in plain language
• Architecture diagrams (Mermaid + matplotlib)
• Mobile app page with screenshots
• Traefik + Authelia setup guide
• FAQ organized by user journey
• glightbox for screenshot zoom
• Corrected app counts, branding, and octopus logo

E2E Testing

• 23 Playwright tests (dark mode, catalog, icons, modals, footer)
• CI workflow on PR to dev/staging/main

Developer Experience

• README rewritten for humans
• CONTRIBUTING.md with staging tier and release cycle
• PR template, issue templates (bug, feature, app request)
• Configurable BACKEND_URL env var
• Three-tier CI/CD: dev → staging → main

Housekeeping

• 40+ dead files removed from repo root
• Graceful degradation when Docker socket unavailable
• Deployed app icons and uptime stats

---

Full Changelog: v2.0.1...v2.1.0

v2.0.1 — Stable Maintenance Release

HomelabARR CE is now in maintenance mode 🎉

This release marks the transition to community-driven development.

What's New

• CONTRIBUTING.md — Full guide for community contributions
• GitHub Discussions enabled for feature requests and Q&A
• Dev branch (dev) as community staging area at ce-dev.homelabarr.com
• Backend healthcheck fixed (was reporting unhealthy due to Docker API initialization bug)
• All stale feature branches cleaned up

How Development Works Now

1. Ideas → Discord or GitHub Issues
2. PRs target dev branch
3. Changes go live on ce-dev.homelabarr.com for testing
4. Community approves → merges to main → ships to production

Links

• Demo: ce-demo.homelabarr.com
• Dev/Staging: ce-dev.homelabarr.com
• Discord: discord.gg/Pc7mXX786x
• Reddit: r/homelabarr
• Contributing: CONTRIBUTING.md

HomelabARR CE v2.0.0 — The Big Rebuild

🚀 What's New

Complete UI Overhaul

• Full shadcn/ui component library replacement — modern, accessible, consistent
• Dark mode with premium visual depth (gradient backgrounds, card borders, noise overlays)
• Alphabetical sorting with A→Z / Z→A toggle on all category views
• Default landing on All Apps tab — search works across everything
• Redesigned Help modal with structured sections and real category counts
• Site-wide footer with Imogen Labs branding and community links
• Fixed dialog centering in dark mode
• Category badge colors: Traefik (emerald), Auth (purple), Category (amber)

14 New AI & Machine Learning Apps

Ollama, Open WebUI, ComfyUI, Stable Diffusion WebUI, Text Generation WebUI, LocalAI, Faster Whisper, LiteLLM, Flowise, Dify, InvokeAI, Fooocus, Jan, GPT4All — all with NVIDIA GPU runtime configs

Category Restructure

• selfhosted → self-hosted
• mediaserver → media-servers
• mediamanager → media-management
• downloadclients → downloads
• encoder → transcoding
• kasmworkspace → virtual-desktops
• coding → merged into self-hosted
• sharing → merged into self-hosted
• New: ai category

166 App Icons

Every active app now has a real logo — zero letter-circle fallbacks

Housekeeping

• 30 dead apps removed (Alltube, Bliss, Comixed, Conreq, Crewlink, Dashmachine, and more)
• 19 legacy apps moved to apps/legacy/ (drag to myapps/ if you still want them)
• Leaderboard removed (was placeholder data)
• local-persist plugin removed (dead dependency)
• Internal scaffolding removed (.config/, .subactions/, templates)
• cf-companion added (smashingtags/cf-companion — auto Cloudflare DNS)
• All ${*IMAGE} template variables resolved

⚠️ Breaking Changes

• Category folder names changed — custom configs referencing old names must update paths
• 30+ apps removed — check apps/legacy/ or myapps/
• Leaderboard tab removed
• local-persist plugin removed — switch to named volumes

🏗️ Infrastructure

• Dockerfile properly copies public/ assets
• nginx icon caching set to 1-hour (was 1-year immutable)
• CI: provenance/sbom disabled on PR builds (fixes Docker load+attestation conflict)
• Template variable resolution in CLI bridge

📦 Docker Images

docker pull ghcr.io/smashingtags/homelabarr-frontend:v2.0.0
docker pull ghcr.io/smashingtags/homelabarr-backend:v2.0.0

v1.4.0 — Security Hardening, Auto-DNS, Deploy UX

What's New

CF Companion — Automatic Cloudflare DNS

Deploy a container with Traefik labels, DNS record appears in Cloudflare automatically. No more manual CNAME creation. Built into the Traefik stack — zero extra setup.

• New standalone project: smashingtags/cf-companion
• Replaces the unmaintained upstream (20+ open issues, multiple crash bugs)
• Available on Docker Hub and GHCR, amd64 + arm64

Deploy UX Improvements

• Success notification after deployment completes
• Container name field in deploy modal
• Domain field hidden in Local mode (no more confusion)
• Help text on domain field — "Just the domain (e.g. example.com)"
• SSE stream stays alive when clicking "Run in Background"

Security Hardening

• Docker Scout: Frontend A, Backend B
• SSRF fix — strict provider allowlist on mount endpoints
• CORS fix — local network origin validation replaces wildcard
• Session IDs — crypto.randomBytes replaces Math.random
• Directory traversal — path sanitization on all user input
• Rate limiting — 100 req/min global
• Helmet security headers enabled
• SLSA provenance + SBOM attestations on every build
• Non-root container user on all images
• Removed unused Python/pip from backend image

Base Image Updates

• nginx 1.27 → 1.29.6-alpine3.23-slim
• Node 20 → 24 LTS (Krypton)
• Alpine 3.21 → 3.23 with apk upgrade at build
• docker-cli 29.3.0 from Alpine edge
• Python wiki deps pinned to patched versions

Branding & Docs

• HomelabARR favicon replaces legacy icon
• 16 contributors credited in README
• r/homelabarr subreddit linked everywhere
• Security transparency section with scanning tool table
• Docker Scout score screenshots in README
• Docker Hub READMEs updated with full product info
• myapps/ category added to CLI bridge for custom templates
• Auto-DNS featured in quick-start guide and wiki

CI/CD

• Docker Hub + GHCR dual push (was GHCR only — Docker Hub images were 8 months stale)
• Snyk workflow removed (CodeQL covers it)
• Dependabot action bumps merged

Links

• Docker Hub: frontend | backend
• Discord: discord.gg/Pc7mXX786x
• Reddit: r/homelabarr
• Wiki: wiki.homelabarr.com
• Website: homelabarr.com
• AI Agents: imogenlabs.ai