v2026.08-ga.12

Release notes — v2026.08-ga.12

Release date: 2026-08-13

A corporate-proxy + upgrade-hardening bugfix release, folding the fixes surfaced
by the first customer box that runs behind a TLS-intercepting corporate web proxy.
No new modules; no breaking changes; safe patch upgrade from v2026.08-ga.11.

Highlights

• Corporate TLS-intercept proxy support hardened. On a box whose only egress
  is a re-signing corporate proxy, services now stay healthy and internal
  service-to-service calls correctly bypass the proxy (previously some were routed
  through it and failed). Applies to every module, not just the ones enabled today.
• Dify plugin marketplace works behind a corporate proxy. A small chaining
  sidecar routes Dify's marketplace downloads through the corporate proxy while
  keeping the SSRF isolation intact (internal AI tools stay direct; other internal
  targets stay blocked). Your proxy must allow marketplace.dify.ai.
• More reliable offline / air-gap upgrades. Offline --package upgrades now
  stamp the deployed version/commit correctly, so rzfz status no longer reports a
  false "release tag has moved on origin".
• Config portal + per-user agents work behind the proxy. The portal fetches its
  version manifest over the right channel (public boxes use the public mirror), and
  runtime-provisioned agent containers inherit the proxy settings + corporate CA.
• Safety. GPUStack now refuses to start against an incompatible database schema
  (prevents a data-corruption footgun); rzfz setup no longer clears your enabled
  modules when changing an unrelated setting.

Upgrade notes

• Standard upgrade: razzfazz-upgrade.sh --target v2026.08-ga.12 (or offline
  rzfz upgrade --package <pkg>). Patch-level; no data migration required.
• On corporate-proxy boxes the upgrade auto-regenerates the proxy overlay — the
  broader internal-bypass list and the new Dify marketplace chaining sidecar are
  applied without a manual rzfz setup --corporate-proxy re-run. For Dify plugin
  installs, allowlist marketplace.dify.ai on the corporate proxy.
• No breaking changes; no removed settings.

New modules / features

• None. This is a bugfix / hardening patch.

Bug fixes

• Healthchecks that probe localhost no longer report a false "unhealthy" on a box
  whose Docker daemon inherits a corporate proxy (cognee, matrix, tika).
• The internal-bypass list now covers every potential internal service name (not
  just the active-profile ones) and the host gateway, so internal calls and the
  config portal's container reads work under a proxy.
• GPUStack embedded worker registers reliably behind a proxy (advertises a loopback
  address for its self-check); a schema-line guard prevents starting an incompatible
  GPUStack version against an existing database.
• Config portal version-manifest fetch is channel-aware (public mirror on public
  boxes); the cognee UI uses a same-origin API base so it works on any domain.
• rzfz setup preserves the enabled module set; offline-package upgrades record the
  correct version so status reporting is accurate.
• The model registry no longer shows a spurious "unhealthy" (its image ships without
  a shell, so the container healthcheck was disabled in favour of out-of-band checks).
• PostgreSQL memory ceiling raised (mem_limit 2g→6g) so shared_buffers has headroom
  for backend work_mem under load — prevents the container being cgroup-OOM-killed on
  busy boxes — plus a longer stop_grace_period (60s) so a host reboot shuts the database
  down cleanly (no WAL recovery on next boot). Takes effect on the postgres container's
  next recreate during the upgrade.

Security

• The security-relevant surface changed in this release — the reverse-proxy
  configuration, the corporate-proxy egress overlay and its CA-trust handling, and the
  new Dify plugin-marketplace egress-chaining sidecar — was reviewed before release.
  The sidecar preserves the outbound deny-list that blocks internal (RFC1918) targets,
  so plugin-catalog traffic reaches the internet through the corporate proxy without
  opening an SSRF path to internal services. No new high- or critical-severity findings
  were introduced versus the previous release. A full security assessment for this
  version is available from your razzfazz.ai support contact.

Known issues

• Behind a corporate proxy, the proxy must allow marketplace.dify.ai for Dify
  plugin installs (customer-side proxy policy, not a stack setting).

Migration manifest

See config/migrations/env-changes.json → version 2026.08-ga.12.

v2026.08-ga.11

Release Notes — v2026.08-ga.11

Released: 2026-08-06
Type: security hotfix on v2026.08-ga.10 — four clean drop-in image bumps, no config/schema changes.
Upgrade path: standard rzfz upgrade (online / offline --package / proxied) from any 2026.08 patch.

Security fixes

• Gitea 1.27.0 → 1.27.1 — fixes CVE-2026-59774 (CVSS 9.8), an unauthenticated arbitrary file read via the Org-Mode #+INCLUDE renderer. An in-the-wild cryptominer campaign was reported against exactly the 1.27.0-rootless image. Highest-priority fix.
• Synapse (Matrix) v1.156.0 → v1.158.0 — picks up security release 1.157.2 (6 High + 3 Moderate advisories). Verified safe for this stack: we use classic oidc_providers (Authentik as OP), not MSC3861, so the 1.157 MSC3861 removal doesn't apply. Paired with Element Web v1.12.23 → v1.12.25.
• LightRAG v1.5.4 → v1.5.5 — closes ~8 advisories, including an auth-independent Stored-XSS (GHSA-xpjq-3w4w-w5wr), a DoS (GHSA-3wg5), an IPv6-SSRF, and CVE-2026-61808. No embedding/schema change → no re-index.

Upgrade behavior

• Gitea + LightRAG are .env-pinned (GITEA_VERSION, LIGHTRAG_VERSION); a change_default migration bumps them so existing boxes actually receive the fix. Synapse + Element Web are hardcoded in compose and bump on git pull. requires_pull (new images), no rebuild.
• Re-verify Authentik SSO for Gitea (2FA/end-session tightening in 1.27.1) after upgrade.

Also included — hermes-agent (rebuilt from source)

• hermes-agent v2026.7.1 → v2026.8.3 — security roll-up: gateway credential-isolation, shared-gateway DoS, ReDoS (#76083), JWKS hardening (#75437), and a world-readable token leak (#60199, BWS_ACCESS_TOKEN). The image is rebuilt from source (git clone NousResearch/hermes-agent@v2026.8.3); users re-provision from My Agents post-upgrade. Option-B boot re-validation PASSED on the reference box before the tag: image builds, container runs with 0 restarts, s6 supervises (PID 1), the built-in dashboard and its loopback proxy both answer HTTP 200, /ready returns true, and config.yaml carries the injected model api_key + GPUStack base_url (no interactive hermes setup needed).

Security scan (SBOM + CVE diff vs v2026.08-ga.10)

• Mode-B diff review: clean — all bumps are forward and consistent across every version-pin layer; the manifest checksum matches; Synapse's classic-oidc_providers posture was verified (no MSC3861), so skipping the 1.157.x MSC3861 changes is safe.
• Per-image SBOM + Grype CVE diff for the changed images ships under sbom/. Accepted residual: LightRAG v1.5.5 rebased onto a heavier Debian base (criticals 6→20, highs 58→119 vs v1.5.4). Of the 14 new criticals, 13 belong to the newly-bundled gosu binary's old Go stdlib (/usr/sbin/gosu, Go 1.19.8) — gosu only performs setuid+exec, so the Go-toolchain / html/template / net/http CVEs attributed to it are not reachable; the 14th is a Debian libsqlite3-0 OS-package CVE with no attacker-fed path. These are orthogonal to — and outweighed by — the reachable LightRAG advisories this bump closes (auth-independent Stored-XSS, IPv6-SSRF, DoS). LightRAG is an opt-in, non-default profile behind Caddy + Authentik. The residual clears on a routine base-image refresh; tracked for the next cycle.

v2026.08-ga.10

Release Notes — v2026.08-ga.10

Released: 2026-08-05
Type: security + configuration hotfix on v2026.08-ga.9 (no image-version bumps except the cryptography pin)
Upgrade path: standard rzfz upgrade (online, offline --package, or proxied) from any 2026.08 patch or from v2026.07-ga.10.

Fixes

1. SSO login on fresh installs (OIDC grant_types)

Authentik 2026.5.5 made grant_types a required field on OAuth2/OIDC providers; the four native-OIDC provider blueprints (Open WebUI, Gitea, Synapse/Matrix, Vaultwarden) did not set it, so a provider created fresh under 2026.5.5 got an empty list and every SSO authorize was rejected as invalid_request — breaking "Log in with SSO" for those apps on new installs.
All four blueprints now set grant_types: [authorization_code, refresh_token], and INIT_VERSION is bumped (3.4 → 3.5) so the fix re-applies on upgrade.
Boxes upgraded from an earlier release with a long-lived Authentik database were not affected (their providers kept the populated defaults); this bug only bit fresh installs / reset databases.

2. cryptography security update (Dependabot)

The cryptography pin in modules/mcp-manager moves 46.* → 50.*, clearing three advisories: PKCS#7 EnvelopedData Bleichenbacher oracle (High), duplicate self-signed-intermediate exponential path-building (High), and wildcard-DNS permittedSubtrees escape (Moderate).

3. Example secret scrub

The Dify example SECRET_KEY in modules/dify/.env.example (an upstream placeholder shaped like an API key) is replaced with a plain placeholder; it was never a live credential (installs generate their own on init).

4. Public-channel upgrade reliability

rzfz upgrade --update on public/customer boxes no longer fails with "Checksum mismatch!" — the published versions.json.sha256 is regenerated to match its manifest, and the release publisher now creates the GitHub tag + Release for every cut so --target upgrades resolve.
The versions.json header (channel, published) and VERSIONS.md are refreshed to the shipped version set (including Vaultwarden 1.37.1), and the manifest path is corrected to config/manifests/.

Action required

• Coding agents / personal-agent PID limit: to pick up the persisted 2048-PID cap (#221), re-provision the agent from My Agents, or use the agent Settings Update / Reinstall button. A plain container restart does not apply it (the limit is set at container-create time). (This corrects the ga.9 note that said "or restart them".)
• Nothing else — existing SSO sessions and data are untouched.

Verification

• Upgrade suite: 19/19 pass (ga.9 → ga.10).
• Fresh-install: the four OIDC providers come up with grant_types populated; SSO reaches the login flow.

v2026.08-ga.9 — 2026.08 cycle

2026.08-ga.9 — latest 2026.08 patch. Intermediate patches (ga.6–ga.8) are consolidated into the cycle notes below; the public repo ships one curated export per cycle head.

Release Notes — 2026.08

Cycle status: GA — latest v2026.08-ga.9 (2026-08-03); v2026.08-ga.8 (2026-08-03); v2026.08-ga.7 (2026-08-02);
v2026.08-ga.6 (2026-08-02); v2026.08-ga.5 (2026-08-01); v2026.08-ga.4 (2026-07-30);
v2026.08-ga.3 (2026-07-29); v2026.08-ga.1 (2026-07-28); v2026.08-ga (2026-07-27).
(ga.2 was folded into ga.3, never shipped separately.) Shipped after a gated rc1→rc5
rollout validated on the 0.91 reference box.

See WHATS_NEW.md for the cycle themes and changelog.md for the change list.
Per-tag notes: releases/2026.08-ga.9/, releases/2026.08-ga.8/, releases/2026.08-ga.7/, releases/2026.08-ga.6/, releases/2026.08-ga.5/, releases/2026.08-ga.4/, releases/2026.08-ga.3/, releases/2026.08-ga.1/, releases/2026.08-ga/.

Patch — v2026.08-ga.9 (2026-08-03)

Reliability / disk-safety patch on ga.8; four fixes, no image-version bumps,
requires_build=true (agent-manager + start-portal rebuilds). The coding-agent
PID limit is now persisted (#221): the 2048 cap was defined in the catalog but had
no column in the agent_types table, so it was dropped on the DB round-trip and every
(re)provision reverted to the 512 default — busy coding sessions hit "Resource
temporarily unavailable"; a pids_limit column + migration v9 + upsert plumbing make
it stick. The per-user agent backup can no longer fill the host disk (#139):
pre-backup.sh guards each agent-volume tar with a disk-usage ceiling, a per-volume
size cap, a hard ulimit -f output cap, sparse-aware tar, and partial-tar cleanup —
after a live coding-agent workspace ballooned a 2.5 GB volume into a 636 GB tar and
filled a production disk. The observability ClickHouse store now applies retention
reliably and cannot fill the disk (#193/#139): the OTEL exporter bakes the TTL at
table-create (the old init-time ALTER raced table creation and never took effect, so
the store grew unbounded), with ttl_only_drop_parts, a prompt TTL-merge cadence, a
keep_free_space_bytes disk backstop, and a 30 → 7-day default retention. The Start
Portal admin "Manage shortcuts" control renders as a button (#185) instead of a bare
link. After upgrade, re-provision coding agents from My Agents to pick up the
persisted PID cap. Mode-B security review clean.

Patch — v2026.08-ga.8 (2026-08-03)

Single image bump on ga.7: Vaultwarden 1.36.0 → 1.37.1, restoring compatibility with
Bitwarden 2026.7.0+ clients. Bitwarden's 2026.7.x browser-extension and desktop apps
changed their WASM SDK cipher-deserialization in a way that is incompatible with
Vaultwarden ≤1.36.0 — the client logs in but shows an empty vault (autofill unusable),
while the web vault and older 2026.6.1 clients keep working. Vaultwarden 1.37.0 is "required
for support with clients version 2026.7.0+" (upstream); 1.37.1 is the current patch. Not an
encryption / key-rotation issue and no data migration — the upgrade recreates vaultwarden
and runs its own schema migration (verified clean on 0.91 + prod, 3,472 ciphers intact,
prod 2026.7.x extension shows the vault again). requires_pull=true; no .env, schema, or
breaking changes. Mode-B review clean.

Patch — v2026.08-ga.7 (2026-08-02)

Two offline/robustness fixes on ga.6; no image or version-pin change. Air-gapped
document extraction no longer hangs: the offline overlay generator was giving
HF_HUB_OFFLINE to openwebui + gpustack but not to docling, so on a sealed box
docling's per-conversion HuggingFace revision-check SYN-hung behind the egress firewall
and stalled every doc→JSON extraction before any model ran; docling is now in the offline
flag list (its models are pre-cached, so it uses them directly) (#184). The Dify
webhook-trigger URL no longer shows a literal ${MAIN_DOMAIN} placeholder: TRIGGER_URL
resolves via single-level https://dify.${MAIN_DOMAIN} instead of the nested
${DIFY_DOMAIN:-dify.${MAIN_DOMAIN}}, which a recreated dify-api could leave unresolved.
requires_build=false; the upgrade regenerates the offline overlay (offline boxes) and
recreates docling + dify-api. No .env, schema, or breaking changes. Mode-A review clean.

Patch — v2026.08-ga.6 (2026-08-02)

Single-fix patch on ga.5. Air-gapped AMD boxes no longer get a stuck GPUStack
worker after an offline-package upgrade. The legacy GPUStack image (llm-legacy
profile, AMD Strix Halo) now bakes the fastfetch helper into the image and writes
versions.json with GPUStack v0.7.1's builtin version strings, so the worker's
prepare_tools() skips every download instead of re-fetching fastfetch +
gguf-parser on start. Previously an online box downloaded those two tools once and
kept them in the container, but the ga.5 offline-package container-recreate wiped that
state — and with WAN blocked by the offline egress firewall the worker could not
re-fetch them, so it stuck at not_ready with no models (#127). The download-skip
check compares only the version string, so the CVE-fixed gguf-parser binary is
retained (no CVE regression). requires_build=true (rebuilds the gpustack-legacy
image); no .env, schema, or breaking changes; only the llm-legacy (AMD) profile is
affected. Mode-A security review clean.

Patch — v2026.08-ga.5 (2026-08-01)

Multi-fix patch on ga.4, grouped around Vaultwarden + offline hardening. The Bitwarden
desktop "SSO only" login no longer hangs on an endless spinner — Caddy stopped injecting
X-Frame-Options onto Vaultwarden's SSO/2FA connector (which the desktop client frames);
Vaultwarden keeps its own CSP frame-ancestors clickjacking protection (#225).
Vaultwarden now stores its data in the shared PostgreSQL instead of a stray SQLite file,
so the vault is part of the standard Postgres backup path; existing installs are migrated
once, automatically and idempotently, on upgrade (verified row-count parity, SQLite kept as
rollback, fail-clear so a vault is never left empty) (#226). Offline boxes can now be sealed
by the kernel: harden-offline-host.sh --egress-firewall drops all non-LAN egress for both
host and containers via nftables (reboot-persisted, --undo reverses) — closing the gap that
offline mode alone only gates application egress, not the network (#184). Sandboxed coding
agents are lifted from the 512-PID hardening default to 2048 so heavy agentic sessions
(MCP servers + multiple agent processes) stop hitting Resource temporarily unavailable
(#221). Also fixes the shipped Shortcuts admin: it is now reachable from a "Manage
shortcuts" link in the Start Portal and a Shortcuts item in the Config Portal nav (was
URL-only), renders on a readable panel (was on the background image), and gains a group-list
filter (#185; an Open WebUI model picker is still to come). requires_build rebuilds the
agent-manager + start-portal images and recreates Caddy + Vaultwarden; no new active .env
keys, no breaking changes. Mode-A security review clean.
Known issue (upstream, not the box): Bitwarden desktop 2026.7.0 shows an empty vault
after login — use desktop 2026.6.1 until upstream fixes it.

Patch — v2026.08-ga.4 (2026-07-30)

Single-fix patch on ga.3. Personal agents: the "Open" button / coding-tools web-terminal
port now goes green only once the agent is actually reachable — not the instant its
container starts (#220). The readiness probe (/api/ready) used a bare TCP connect that
succeeds as soon as the container binds its port, but agent runtimes
(gunicorn/uvicorn/vite/moltis/openhands) listen early and only serve HTTP 10–60s later —
so the button flipped to green while clicking it still returned the reverse-proxy's
"Agent starting… container is not ready yet" (502) on every session. The probe now issues
a real httpx.get on the container root: any HTTP response = ready, a transport error
(connect refused / timeout / reset) = not-ready. requires_build rebuilds the agent-manager
image on upgrade; existing agents/instances are untouched (no re-provision). No version
bumps, no schema or .env changes. Mode-B security review clean.

Patch — v2026.08-ga.3 (2026-07-29)

Public distribution moved off Codeberg to GitHub (github.com/rzfz-ai/rzfz-ai-service-stack
— repo, wiki, and Releases): Codeberg's 2026-07 Terms of Use (§7) now prohibit projects
that mostly consist of generative-AI-written code, so the community/customer channel was
moved. Public/customer boxes auto-repoint origin Codeberg→GitHub on this upgrade
(anonymous pulls; offline-package boxes are unaffected); the public remote is centralized
with an optional fallback, and init recognizes the GitHub origin (legacy Codeberg still
accepted during the transition). A hardening bonus genericized bare private example IPs
(including an operator infrastructure address) in the Mac-gateway sample configs to
documentation (TEST-NET) IPs. This release also folds in everything staged as ga.2:

Four fixes found running ga.1 on production, plus one personal-agent feature. No
version bumps, no new modules, no schema or .env changes — a code-only rebuild of
the Start Portal, Configuration Portal, and Agent Manager images. Start Portal
logout now fully signs you out — it clears the forward-auth proxy session instead
of only the Authentik core session, fixing a broken half-logged-in state. The Config
Portal Release-Notes /
"What's new" dialog scrolls again (the mouse wheel now scrolls the dialog, not the
page behind it — the real fix was a background scroll-lock, plus per-version
stylesheet cache-busting; #216 follow-up); changing an agent type's memory limit no
longer returns a 500 (all JSON columns are serialized on save); and "Clone from
Gitea" states that the token needs both read:user and read:repository instead of
a bare 403. New: personal agen...

v2026.08-ga.5 — 2026.08 cycle

Release Notes — 2026.08

Cycle status: GA — latest v2026.08-ga.5 (2026-08-01); v2026.08-ga.4 (2026-07-30);
v2026.08-ga.3 (2026-07-29); v2026.08-ga.1 (2026-07-28); v2026.08-ga (2026-07-27). (ga.2
was folded into ga.3, never shipped separately.) Shipped after a gated rc1→rc5 rollout
validated on the 0.91 reference box.

See WHATS_NEW.md for the cycle themes and changelog.md for the change list.
Per-tag notes: releases/2026.08-ga.5/, releases/2026.08-ga.4/, releases/2026.08-ga.3/, releases/2026.08-ga.1/, releases/2026.08-ga/.

Patch — v2026.08-ga.5 (2026-08-01)

Multi-fix patch on ga.4, grouped around Vaultwarden + offline hardening. The Bitwarden
desktop "SSO only" login no longer hangs on an endless spinner — Caddy stopped injecting
X-Frame-Options onto Vaultwarden's SSO/2FA connector (which the desktop client frames);
Vaultwarden keeps its own CSP frame-ancestors clickjacking protection (#225).
Vaultwarden now stores its data in the shared PostgreSQL instead of a stray SQLite file,
so the vault is part of the standard Postgres backup path; existing installs are migrated
once, automatically and idempotently, on upgrade (verified row-count parity, SQLite kept as
rollback, fail-clear so a vault is never left empty) (#226). Offline boxes can now be sealed
by the kernel: harden-offline-host.sh --egress-firewall drops all non-LAN egress for both
host and containers via nftables (reboot-persisted, --undo reverses) — closing the gap that
offline mode alone only gates application egress, not the network (#184). Sandboxed coding
agents are lifted from the 512-PID hardening default to 2048 so heavy agentic sessions
(MCP servers + multiple agent processes) stop hitting Resource temporarily unavailable
(#221). Also fixes the shipped Shortcuts admin: it is now reachable from a "Manage
shortcuts" link in the Start Portal and a Shortcuts item in the Config Portal nav (was
URL-only), renders on a readable panel (was on the background image), and gains a group-list
filter (#185; an Open WebUI model picker is still to come). requires_build rebuilds the
agent-manager + start-portal images and recreates Caddy + Vaultwarden; no new active .env
keys, no breaking changes. Mode-A security review clean.
Known issue (upstream, not the box): Bitwarden desktop 2026.7.0 shows an empty vault
after login — use desktop 2026.6.1 until upstream fixes it.

Patch — v2026.08-ga.4 (2026-07-30)

Single-fix patch on ga.3. Personal agents: the "Open" button / coding-tools web-terminal
port now goes green only once the agent is actually reachable — not the instant its
container starts (#220). The readiness probe (/api/ready) used a bare TCP connect that
succeeds as soon as the container binds its port, but agent runtimes
(gunicorn/uvicorn/vite/moltis/openhands) listen early and only serve HTTP 10–60s later —
so the button flipped to green while clicking it still returned the reverse-proxy's
"Agent starting… container is not ready yet" (502) on every session. The probe now issues
a real httpx.get on the container root: any HTTP response = ready, a transport error
(connect refused / timeout / reset) = not-ready. requires_build rebuilds the agent-manager
image on upgrade; existing agents/instances are untouched (no re-provision). No version
bumps, no schema or .env changes. Mode-B security review clean.

Patch — v2026.08-ga.3 (2026-07-29)

Public distribution moved off Codeberg to GitHub (github.com/rzfz-ai/rzfz-ai-service-stack
— repo, wiki, and Releases): Codeberg's 2026-07 Terms of Use (§7) now prohibit projects
that mostly consist of generative-AI-written code, so the community/customer channel was
moved. Public/customer boxes auto-repoint origin Codeberg→GitHub on this upgrade
(anonymous pulls; offline-package boxes are unaffected); the public remote is centralized
with an optional fallback, and init recognizes the GitHub origin (legacy Codeberg still
accepted during the transition). A hardening bonus genericized bare private example IPs
(including an operator infrastructure address) in the Mac-gateway sample configs to
documentation (TEST-NET) IPs. This release also folds in everything staged as ga.2:

Four fixes found running ga.1 on production, plus one personal-agent feature. No
version bumps, no new modules, no schema or .env changes — a code-only rebuild of
the Start Portal, Configuration Portal, and Agent Manager images. Start Portal
logout now fully signs you out — it clears the forward-auth proxy session instead
of only the Authentik core session, fixing a broken half-logged-in state. The Config
Portal Release-Notes /
"What's new" dialog scrolls again (the mouse wheel now scrolls the dialog, not the
page behind it — the real fix was a background scroll-lock, plus per-version
stylesheet cache-busting; #216 follow-up); changing an agent type's memory limit no
longer returns a 500 (all JSON columns are serialized on save); and "Clone from
Gitea" states that the token needs both read:user and read:repository instead of
a bare 403. New: personal agents gain a Restart button and a Settings-page
Update / Reinstall control (#219), both non-destructive (chats/skills/files/config
preserved). Mode-B security review clean.

Patch — v2026.08-ga.1 (2026-07-28)

Seven targeted fixes on the GA; no version bumps, no new modules, one new
(non-secret) .env key (USER_DEFINED_APT_PACKAGES, migration-tracked,
requires_build). Coding agents no longer die from PID exhaustion (#215); Dify
model-provider icons render again (#160); the Config Portal "What's new" dialog
scrolls on WebKit and the Network-Policy matrix headers are readable (#216/#217);
the coding-agent clone dialog takes a username and handles tokens correctly
(#213 — with its anti-exfil allowlist hardened to gate the username channel per
the release security review). Under the hood: a USER_DEFINED_APT_PACKAGES build
knob bakes system libs into per-user agent images (#212) and an init-suite
skip-pre-check (#214, test-only). Agent images are rebuilt on upgrade — re-provision
from My Agents after rzfz post-install --refresh.

Cross-cutting themes

1. Offline / air-gapped operation (#184) — the flagship.
2. Apple-silicon Mac LLM gateway (#168/#169).
3. Enterprise documentation portal (#162/#163).
4. Customer-box delivery reliability (#171/#173/#159).
5. Stack-wide LLM observability (#193/#197).
6. Platform currency + security sweep (Dify/Authentik/Gitea/ClickHouse/Cognee/Onyx + base images; Valkey 9.1.1 RCE fix).

GA hardening (rc4 → rc5)

Before the GA the full genuinely-open defect list was cleared and re-verified
end-to-end on 0.91: Vaultwarden SSO first login (#211 — deterministic
email_verified that also reaches upgraded boxes), domain-change SSO re-template
(#183), clean-install SSO host (#70), TLS-internal CA drift warning (#55), upgrade
*_VERSION reconcile (#177), Config-Portal orphan guard (#176), per-user agent
slug drift (#192), SearXNG verify false-negative (#201), plus the offline-upgrade
images/ leftover (#209) and non-blocking help-cache warm (#210).

Upgrade path

Standard rzfz upgrade from v2026.07-ga.10 (online or offline --package).
Pre-2026.07 boxes cross via the reorg-aware bootstrap. All cycle .env/image
changes apply automatically via the migration manifest (rc1→ga blocks); the
Authentik blueprint re-apply rides an INIT_VERSION bump (no image rebuild).

v2026.07-ga.10 — 2026.07 cycle

Release Notes — 2026.07 cycle

Status: General Availability · Latest: v2026.07-ga.10 (2026-07-19) ·
GA: v2026.07-ga (2026-07-06) · Prior cycle: 2026.06-ga.7

The 2026.07 cycle reached General Availability as v2026.07-ga, consolidating
two release candidates (rc1, rc2). It is the largest cycle since the platform's
first GA: the product is renamed and rebranded to the rzfz.ai Stack, published
under an open-core licensing model, delivered to customers through a public
Codeberg mirror, reorganised behind a single rzfz command, and given a
per-user coding-agent and Model-Context-Protocol (MCP) workspace platform. Dify
moves to 1.15.0. Per-tag detail lives in releases/2026.07-rc1/,
releases/2026.07-rc2/, releases/2026.07-ga/, and releases/2026.07-ga.1/.

Upgrade paths validated for GA (test box): the standard next-cycle path plus,
critically, the pre-reorg big-bang crossing. Because 2026.07 reorganises the
repository, any box on a pre-reorg release — 2026.04-ga.x, 2026.05-ga.x, and
2026.06-ga.x — must upgrade into 2026.07 through the reorg-aware bootstrap
razzfazz-upgrade-from-2026.04-GA.x.sh (operator decision B; #113/#128), not the
plain upgrade. The GA gate caught and fixed the final upgrade-path and provisioning
defects before ship — the pre-reorg bootstrap seeding, a rzfz upgrade --check
abort on absent optional keys, and a per-user image-builder no-op.

v2026.07-ga.1 (2026-07-07) — day-1 functional-readiness patch. The GA
acceptance suite validated install, health and SSO but not real user journeys;
hands-on functional testing of the GA box surfaced a cluster of day-1 defects, all
fixed in ga.1: Open WebUI listed zero models, the default chat model returned an
empty answer, several custom-build modules would not enable on a restricted-egress
box, some Help-Center mirrors were incomplete, and a few Configuration-Portal panels
errored — and rzfz upgrade did not carry the day-1 provisioning fixes forward.
ga.1 makes both a fresh install and an upgrade reach the same working, chat-ready
state (upgrade now auto-runs the day-1 --refresh self-heal and deploys any missing
default models), and adds a Day-1 user-journey test tier (tests/day1/) that
deploys a model, logs in, chats and clicks each module UI on a live box — now a
release gate alongside install / health / SSO. Within the cycle ga.1 is the ordinary
rzfz upgrade and adds no new .env keys. (day-1 Issues A–J; #147, #148)

Patch history (ga.2 → ga.9). ga.2 (2026-07-08) fixed the built-in module
documentation, restored the default chat model's reasoning, and hardened the public
Codeberg export. ga.3 (2026-07-09) fixed an OIDC/SSO login regression on Let's
Encrypt boxes — the OIDC trust bundle is now a superset of public + Caddy-internal +
operator CAs, so login verifies across every TLS mode (#152). ga.4 (2026-07-10)
reconciled three production hotfixes into source: upgrades no longer abort when a
single container was already unhealthy (#153), per-service database table ownership
is repaired automatically so migrations don't crash with "must be owner" (#154), and
onyx-vespa gets 8 GB of headroom (#154); it is also the first release whose public
Codeberg upgrade path (RAZZFAZZ_CHANNEL=public, anonymous curated-mirror pull) was
validated end-to-end on the reference box before the tag. ga.5 (2026-07-10) is the
one defect that public-path validation caught: on a RAZZFAZZ_CHANNEL=public box an
upgrade could crash the Configuration Portal because the curated public .gitignore
dropped the governance checksum DB (so git stash --include-untracked stashed it
away and Docker recreated its mount as a directory); the curated ignore list now
matches the internal one, and internal/fleet boxes were never affected (#156). ga.6
(2026-07-10) completes that fix: because the upgrade's stash runs from the source
box's .gitignore, a box already on an older affected export still crashed on the
transition, so restart_stack now coerces the checksum DB back to a regular file
before recreating containers — the upgrade self-heals the Config Portal from any
earlier build (verified on the reference box). ga.7 (2026-07-11) hardens the upgrade
driver after the prod rollout exposed three ways it could stumble: a divergent old
git tag aborting the fetch, the pre-upgrade backup silently skipping when rzfz
isn't on PATH, and the pre-upgrade auto-stash accumulating (#158). ga.8 (2026-07-11)
is a critical fix: automated and upgrade backups were failing silently on any
box with a live database (offen raced the write-ahead log and wrote no file), now
fixed by briefly quiescing PostgreSQL during the archive — with the restore path
unchanged (#157). ga.9 (2026-07-11) is a public-delivery polish: the Configuration
Portal's Release Notes / What's New panels were blank on Codeberg installs because the
public export culled releases/ wholesale, so the export now ships the consolidated
cycle docs the Config UI reads — the combined GA + patch view — while the internal
per-tag directories (SBOM, security assessments, test results) stay excluded (#159).
Customer/public boxes should target ga.9 — it's the first export whose in-product
release notes populate. All eight patches are the ordinary within-cycle rzfz upgrade
with no new .env keys.

Cross-cutting themes

1. Open-core licensing + public Codeberg delivery (rc1, finalised at ga) —
   the stack is published under a clear three-way model: a free Community tier
   (Apache-2.0), a source-available tier (Business Source License 1.1) governed by
   the rzfz.ai Subscription with free private/evaluation use and a rolling
   Change Date (2029-07-08 for this release), and bundled upstream components under
   their own licences. New root LICENSE / LICENSE-APACHE / LICENSE-BSL /
   NOTICE / THIRD-PARTY-NOTICES.md, a plain-language docs/LICENSING.md, and a
   stack.yaml-driven per-component map rendered live at license.<domain>.
   Customer boxes set RAZZFAZZ_CHANNEL=public and pull from the public Codeberg
   mirror (the upgrade pre-flight redirects origin there automatically); a
   hardened export ships only the customer-needed surface and a Community Wiki is
   published alongside. (#26, #101, #105, #27, #28, #123, #124, #127)
2. The rzfz unified CLI + repository reorganisation (rc1) — every
   management script is consolidated behind a single rzfz command, and the
   repository is reorganised into modules/, core/, cli/, and config/. The
   setup.<domain> web wizard is retired: first-run is rzfz init, dangerous
   operations are rzfz setup, and RAG-model selection and TLS-certificate upload
   move into the Configuration Portal. The COMPOSE_FILE LLM-overlay path is
   migrated automatically on upgrade. The whole product is rebranded razzfazz.ai →
   rzfz.ai. (#26, #34, #22, #35)
3. Box-local Enterprise overlay + delivery channel (ga) — the Help Center
   serves the open community documentation by default and runtime-mounts a gated
   Enterprise documentation overlay when one is present; the USB build and
   rzfz package deliver that overlay into overlay/enterprise/ so an entitled
   box carries the extended material without it being published to the public
   mirror. The RAZZFAZZ_CHANNEL (internal → the SEQIS Gitea, public → the public mirror)
   model draws the line between the two channels. (#125, #126, #129)
4. Coding-agent split + per-user MCP & shared company memory (rc1) — the
   personal coding agents become per-type sandboxed containers (opencode, Codex,
   and a user-defined slot), each isolated, with a first-party Hermes v0.18
   dashboard, a live web-app port preview, and three-layer agent-memory governance.
   Each user gets their own MCP proxies with an encrypted credential vault and a
   two-tier Cognee "memory" (a private per-user brain and an admin-managed shared
   company brain) wired into the agents — all under one unified MCP & Agent
   Manager. A central password broker fans a new password out to Authentik, Dify
   and Cognee in one step. (#84, #36, #88, #61, #54)
5. Dify 1.15 + true SSO + version currency (rc1) — Dify is de-vendored (the
   custom web frontend builds from a clean upstream clone) and bumped 1.14.2 →
   1.15.0, with 24 database migrations and the plugin-auto-upgrade backfill wired
   to run automatically. True SSO adds group-to-role mapping for the four
   natively-integrated apps (Open WebUI, Gitea, Dify, Cognee), auto-seeds their
   native OIDC credentials, and drops the redundant double login. A CVE/currency
   sweep moves Open WebUI, Gitea, SearXNG, Crawl4AI, ClickHouse, LightRAG,
   Cognee (1.2.2) and the legacy gpustack:vulkan base to current, patched
   releases. (#26, #107, #33, #18, #20, #79)

Release candidates (rc1 → rc2 → ga)

• rc1 (2026-07-04) — consolidated the entire cycle's development into one cut
  (the crossing applies all cycle env deltas at once): the open-core licensing
  reorganisation, the coding-agent split + unified MCP & Agent Manager, Dify 1.15,
  true SSO, the rzfz CLI + repository reorganisation, the rebrand, and the
  public-delivery mechanism. A box crossing from 2026.06-ga.7 receives 52
  auto-applied env deltas (2 breaking, both auto-migrated).
• rc2 (2026-07-05) — rc1 plus three fixes: the Onyx v4 clean install
  (onyx_user CREATEROLE; #111), the pre-reorg big-bang upgrade bootstrap seed
  (#113), and the finalised licensing naming — the rzfz.ai Subscription (tier)
  and the rzfz.ai Stack (product) (#110). No new .env keys over rc1.
• ga (2026-07-06) — rc2 plus the box-local Enterprise documentation overlay
  and its USB/rzfz package delivery (#125/#126/#129), the Community Wiki publish
  and export hardening (#123/#124/#127), and the final fixes: the pre-reorg big-bang
  bootstrap made the single supported crossing for every 2026.04/05/06-...

v2026.06-ga.6 — 2026.06 cycle

Release Notes — 2026.06 cycle

Status: General Availability · Release: v2026.06-ga (2026-06-14) ·
Latest patch: v2026.06-ga.6 (2026-06-21) · Prior cycle: 2026.05-ga.7

The 2026.06 cycle reached General Availability as v2026.06-ga, consolidating
four release candidates, and has since received six maintenance patches
(ga.1 – ga.6). Per-tag detail lives in releases/2026.06-rc1/ …
releases/2026.06-rc4/, releases/2026.06-ga/, and releases/2026.06-ga.1/ …
releases/2026.06-ga.6/.

Upgrade paths validated for GA (test box, both directions): 2026.05-ga.7 →
2026.06-ga (standard) and 2026.04-ga → 2026.06-ga (big-bang bootstrap). The GA
gate caught + fixed three upgrade-path defects before ship — a clean-install
volume race, the big-bang bootstrap's shared-library seeding, and an OpenWebUI
schema-migration that crash-looped on a direct upgrade from the oldest baseline
(now reconciled automatically).

Cross-cutting themes

1. Upgrade observability & self-healing (rc1) — a structured per-run upgrade
   journal with an automatic diagnose-gate, plus auto-remediation of the top
   recurring field failures (outpost bindings, stale Authentik sessions, init
   tools on restricted networks). Upgrades are now diagnosable and self-correcting
   instead of failing silently.
2. Credential management (rc2) — a tool to set any app admin password
   (razzfazz-set-admin-password.sh) and a class-enforced infrastructure-secret
   rotation tool with a danger matrix (razzfazz-rotate-secret.sh +
   docs/secret-rotation-danger-matrix.md). Secrets are classified SAFE /
   COORDINATED / DATA-LOSS / DO-NOT-ROTATE and the tooling enforces the class.
3. Clock-jump survival (rc2) — chrony makestep so a virtualized-clock skew
   can't expire the internal TLS leaf and take down every gated UI.
4. Concurrency & resource correctness (rc2) — docling RQ engine (UI works
   with multiple workers), Onyx connection-pool caps, authentik-server memory bump.
5. Backup control (rc1+rc2) — LightRAG AGE-orphan backup-completeness fix
   (rc1) and an optional Dify-plugin-data exclusion setting (rc2).
6. One default model + grounded RAG (rc3) — qwen3.6 becomes the single
   default for every role (chat/general/coding/vision) at 1M context, the optional
   models are pre-downloaded then stopped (0 replicas), and the reranker/chunking/
   query defaults that make document Q&A find the right facts ship as product
   defaults.
7. Version-currency sweep (rc4) — nine third-party images and two custom
   agent images moved to current releases ahead of GA; no open CVE forced any, all
   targets verified and all custom builds re-compiled.

Patch releases (ga.1 → ga.6)

After GA the cycle received six maintenance patches, all upgrade-path and
reliability focused — no third-party image versions changed across the patch
line:

• ga.1 (2026-06-15, docs-only) — release-notes / documentation refresh.

• ga.2 (2026-06-18) — upgrade-path self-healing: empty per-service secrets
  are regenerated on upgrade, and several reliability fixes for direct upgrades
  from older baselines.

• ga.3 (2026-06-20) — further upgrade hardening and a knowledge/RAG quality
  improvement:

  • The upgrade now self-heals empty per-service database users, fixing a
    crash-loop on the document-management and enterprise-search modules after an
    upgrade.
  • The upgrade no longer aborts when a container has written root-owned files
    into the stack directory.
  • qwen3-embedding becomes the fleet-standard embedding model (≈2560-dim,
    32K context) for the knowledge-graph, RAG, agent and chat document-RAG paths,
    replacing the previous model whose 2048-token limit could not embed full-size
    document chunks.
  • A new USB-appliance installer performs an unattended operating-system
    install and prepares the stack for first boot.
  • The status tool no longer mis-reports the stable CPU LLM profile as a legacy
    profile.
  • The customer security documentation now emits the full machine-checkable
    NIS2 and ISO 27001 control-mapping tables.

• ga.4 (2026-06-20) — upgrade-path hotfix for older installations:

  • The ga.3 database-login self-heal is now conditional — it switches a
    service to its dedicated database login only after verifying that login
    works, and otherwise preserves the working shared administrator login. This
    fixes a regression where ga.3 could take Authentik, Open WebUI and Dify
    offline on older boxes that share a single database administrator account.
  • Recommended over ga.3 for the upgrade path; host-script only, no image or
    setting changes.

• ga.5 (2026-06-21) — customer-handover + repo-hygiene release:

  • Fresh installs now set the backup-encryption passphrase correctly (a bug left
    it empty → the backup service refused); password rotation handles the empty case.
  • New razzfazz-security-check.sh — a self-service posture + CVE check the
    customer can run any time (also run per-box post-install).
  • Factory reset now returns the box to delivery state (the sticker password).
  • The day-1 handover checklist is rewritten to be fully actionable on a single
    box (rotate all admin accounts, no-spare-host restore drill, signup-closed
    verification, firewall expected output, recovery model).
  • No third-party image version changes; full Mode-A security assessment included.

• ga.6 (2026-06-21) — clean-install hardening + document-extraction enablement:

  • Fresh AMD/Strix-Halo installs load models again (host Vulkan userspace installed
    by init); gpustack-legacy v0.7.1 Vulkan builds reproducibly from source, and a
    build-gate verifies the runner actually runs.
  • Dify PDF→JSON path completed: qwen3.6 + qwen3-embedding defaults, gpustack plugin
    0.0.15 with thinking-param passthrough, the internal-AI-tools SSRF allow-list made
    standard, and per-app concurrency backpressure so a workflow can't overrun the LLM.
  • OpenWebUI document/RAG + web search settings now persist (written via the OWUI API);
    Config Portal module toggles and Authentik login branding fixed on clean installs.
  • harden-host gained a live-stack guard (it had torn down a running stack); a clean
    ga.6 install and a reboot-survival test both passed on a Strix-Halo box.
  • No third-party image version changes; full Mode-A security assessment included.

Module versions

rc1 ran the comprehensive security/CVE sweep (ClickHouse 24.8.14.39, Crawl4AI
0.8.9, Dify 1.14.2, Gitea 1.26.2, Authentik 2026.2.4, Valkey 9.1.0). rc2/rc3
changed no images. rc4 is a freshness sweep (no open CVE forced any): gotenberg
8.34.0, openlit 1.22.0, searxng 2026.6.13, Synapse v1.154.0, element-web v1.12.21,
infisical v0.161.0, vespa 8.703.17, tika 3.3.1.0, docling-serve-cpu v1.23.0; plus
custom agent builds coding-tools (gsd-pi 3.0.0 / opencode 1.17.5) and paperclip
v2026.609.0. Held to post-GA: Authentik 2026.5.x, onyx v4, OpenHands 1.8.0,
hermes-agent v2026.6.5, GPUStack 2.2.0. See releases/2026.06-rc4/changelog.md.

Security posture

• rc1 shipped the ClickHouse + Crawl4AI CVE remediations and the Authentik
  2026.2.4 SAML-signature-wrapping patch.
• rc2 adds no new exposed surface: the new tools are operator-run CLI scripts, the
  new env key is a backup toggle.
• ga.3 full Mode-A compliance audit (NIS2 / ISO 27001 / OWASP LLM Top 10):
  performed against a clean reference install. No active-compromise indicators;
  external and internal active scans returned zero matched findings; no reachable
  Critical/High. The patch line ships no new container versions, so the CVE
  posture equals the GA-assessed baseline (residual volume is upstream "won't-fix"
  operating-system base-layer advisories, not live exposure). Full report:
  your razzfazz.ai support contact.
• ga.5 full Mode-A audit: clean reference install; 0 active-scan findings;
  0 new Critical, 3 new High (upstream-DB drift on unchanged images). Report:
  your razzfazz.ai support contact.

Validated at GA and across the patch line

• Full clean-install suite (19/20 scenarios; the one miss is a known slow-CPU
  build-timing artefact, not a defect) and the standard upgrade path
  (previous-GA → 2026.06-ga.3) on the test box.
• Both customer-facing security artifacts refreshed: the as-built security
  architecture document and the audit-grade assessment report.

---

Issued by razzfazz.ai GmbH - Member of SEQIS Group.

v2026.05-ga.7 — 2026.05 cycle

Release notes — v2026.05

Cycle window: 2026-04-23 → 2026-05-25 (cycle extended by the v2026.05-ga.5 feature + infrastructure patch).
GA tag: v2026.05-ga — released 2026-05-08.
Latest patch: v2026.05-ga.7 — released 2026-06-01.
Patch line: v2026.05-ga.1 (2026-05-13) — Caddy network-alias refactor, LLM-config single-source, agent-provisioning follow-up source fixes, patched llama.cpp build for Strix Halo, OpenWebUI 0.9.4 → 0.9.5, gotenberg 8.31 → 8.32. v2026.05-ga.2 (2026-05-13) — Dify password-reset usability fixes. v2026.05-ga.3 (2026-05-13) — single-YAML LLM config rollout + per-user agent state in backups + cycle-closing security-review + handover doc rewrite. v2026.05-ga.4 (2026-05-17) — security-driven patch: Authentik CRITICAL XSS + GHSA-5wcc forward-auth bypass + PostgreSQL CVE coverage + broad upstream sweep of 18 third-party images + ClickHouse observability OOM hotfix. v2026.05-ga.5 (2026-05-25) — stack-wide MCP registry (Cognee memory across OWUI/Dify/Moltis/Hermes/OpenCode + OpenHands emitter), automated 24.04→26.04 LTS host-migration tooling, ~15 field-bug fixes, shared-lib consolidation, security bumps (Caddy 2.11.3, Dify 1.14.2, Gitea 1.26.2). v2026.05-ga.6 (2026-05-29) — Google + Microsoft Entra ID concurrent SSO login, scoped default-closed Dify→document-tools SSRF allow-list, Configuration Portal module/version-management hardening, post-install Authentik outpost reconcile. v2026.05-ga.7 (2026-06-01) — backup & restore disaster-recovery fix: the backup pre-hook silently stopped running on the offen v2 backup engine (backups were missing the database dump, encrypted .env, and agent state); re-wired via the archive-pre label, fixed restore to recreate services with the restored secrets and preserve absolute symlinks, plus a new backup-restore DR test scenario. Take a fresh backup after upgrading — pre-ga.7 backups are not restorable.

Executive summary

The 2026.05 cycle is the largest 2026.x release to date. The headline change is the personal agents go per-user rework (operators provision Hermes / Moltis / Coding Tools / OpenHands / Paperclip from a "My Agents" Authentik drawer) plus a brand-new razzfazz.ai Start Portal at start.<domain> as the operator's stack-wide tile-based landing page with per-user pinning, drag-and-drop reorder, and custom categories. Authentik jumps two majors (2025.10 → 2026.2.3) entirely from Docker Compose with no operator-side schema steps. Dify lands its 1.14 line (1.13.3 → 1.14.1) with the LiteLLM 1.83 supply-chain fix. The host-side kernel + ROCm freeze is broken — operators can now run modern OEM kernels (6.17+) and ROCm 7.2 — but the GPUStack runtime itself stays on v0.7.1 + custom Vulkan as the recommended STABLE default for AMD and CPU. Upstream GPUStack v2.1.x is added as opt-in EXPERIMENTAL for operators who specifically need its NVIDIA / vLLM / kyuz0 ROCm support; a 12-hour stop/start soak on production AMD Strix Halo hardware showed v2.1.x leaking under sustained load while v0.7.1 stayed flat, which drove the late-cycle decision to keep v0.7.1 as the recommended path.

A new module — Crawl4AI — joins the search profile alongside SearXNG, completing the URL-discovery → content-fetch pipeline for downstream RAG into LightRAG / Cognee / Onyx / Dify. The Management UI gains a stack-wide observability profile (OpenLIT + ClickHouse), a new OpenWebUI ↔ Dify Manifold Pipe lets operators route any chat conversation through a Dify workflow, and Cognee's bare FastAPI page is replaced with the upstream Next.js frontend built locally from source. The Configuration Portal gains a Modules → LLM Runtime panel that flips the runtime between v0.7.1 and v2.1.x in one click — handling profile flip, container teardown, orphan runner pod cleanup, schema reset, API-key rotation, and custom-backend re-registration inline.

The customer upgrade path from 2026.04-ga is a single command: fetch the bootstrap script and run ./razzfazz-upgrade-from-2026.04-GA.x.sh --target v2026.05-ga.4. After GA, four patch tags ship within the same line — v2026.05-ga.1 (Caddy network-alias refactor + LLM single-source-of-truth + agent-provisioning hardening), v2026.05-ga.2 (Dify password-reset usability), v2026.05-ga.3 (single-YAML LLM-config rollout + per-user agent state in backups + cycle-closing security review), and v2026.05-ga.4 (security-driven patch: Authentik 2026.2.3 + GHSA-5wcc forward-auth bypass + PostgreSQL CVE coverage + broad upstream sweep of 18 third-party images + ClickHouse observability OOM hotfix). All four are reachable by a normal razzfazz-upgrade.sh --target <tag> from any ga box. Six of seven post-upgrade audit findings closed by GA — including the late-cycle re-discovery and full closure of F-RC5-1 (gpustack worker ports were still bound on 0.0.0.0 in standalone mode despite earlier patches; the GA cut makes the bind mode-aware in both razzfazz-init.sh and a new migrate_gpustack_bind step in razzfazz-upgrade.sh). The remaining open items (gpustack v2.x bundled-deps CVE inheritance, autoheal Alpine base) are documented as accept-residual / planned-fix and do not block ga.

---

Table of contents

• Cross-cutting changes — the things that span multiple modules across GA and the patch line
• Module-by-module changes — every module, alphabetical within each category
  • Identity & Access
  • AI Workflows & Chat
  • LLM Inference
  • Knowledge & RAG
  • Document Processing
  • Search & Crawl
  • Collaboration & Vault
  • Personal Agents
  • Observability
  • Operations
• Operator UX — Management UI improvements
• Upgrade instructions
• Security
• Known issues at GA
• Patch releases — ga.1 and ga.2 summaries

---

Cross-cutting changes

These touch multiple modules and are best understood at the cycle level. Module-specific detail is in the per-module sections below.

Late-GA maintenance sweep (in-window updates)

The cycle's GA window closed with a maintenance sweep that bundles 16 image bumps + a Gotenberg SSRF flag re-enable + an Authentik edge mitigation + a Dify XSS compensating control + the dify-web 1.11.2 → 1.14.0 monorepo re-vendor + the cognee 1.0.1 → 1.0.9 graph-driver swap + the Hermes-Agent v2026.5.7 ("Tenacity") rebuild. Validated end-to-end on the development and test environments with both fresh-install and bootstrap-upgrade-from-2026.04-ga.6 paths. Five real bugs were caught and fixed in current main during the validation cycle (force-rebuild on commit-move; fail-fast on non-interactive sudo; bootstrap fetch refspec; outpost-attach race; outpost drift). All carried in v2026.05-ga. The post-ga patch line subsequently bumped Cognee 1.0.9 → 1.1.0 and Hermes-Agent v2026.5.7 → v2026.5.16 (full-cycle pins reflected in the per-module sections below).

Authentik edge mitigation for GHSA-qvxx-mfm6-626f

Upstream advisory (GHSA-qvxx-mfm6-626f, CVSS 9.1, Authenticated RCE in Policy/Property Mapping test endpoint) is unpatched on the 2026.2.x line. Authentik shipped patches on 2025.8.6 / 2025.10.4 / 2025.12.4; no 2026.2.x patch published as of GA. RBAC analysis confirmed only akadmin (superuser) holds the relevant view_policy / view_propertymapping perms in our default deployment, so the practical attack surface is operator-credential compromise only. Caddy edge block layered on top:

@ghsa_qvxx path_regexp ghsa ^/api/v3/(policies|propertymappings)/all/[^/]+/test/?$
respond @ghsa_qvxx 403

Lives inside the {$AUTHENTIK_DOMAIN} site block in core/Caddy/Caddyfile. Removable by commenting two lines once 2026.2.3 lands. Operators who legitimately need to invoke the test endpoint from the Authentik admin UI can comment the block temporarily.

Dify echarts XSS — Content-Security-Policy-Report-Only

Upstream advisory (GHSA-qqjx-5h5w-x5vj, echarts DOM XSS) has no upstream patch. Compensating control on dify.<domain>: Content-Security-Policy-Report-Only header with default-src 'self' + permissive script-src for the observation phase (Next.js 16 hydration relies on inline scripts), violation reports POSTed to /csp-report → Caddy respond 204. Operators tune the policy from observed reports and flip the header name from Content-Security-Policy-Report-Only to Content-Security-Policy (enforcing) once the report stream is quiet.

Authentik App library slim-down via blank://blank

The mid-window first attempt at slimming the Authentik App library down to "start + help + licenses only" deleted the per-module authentik_core.application rows and broke forward-auth — Authentik's proxy outpost requires application__isnull=False on every gated host. Reverted same-day. Redo (currently shipped): set meta_launch_url: "blank://blank" on every per-module Application; Authentik's frontend appHasLaunchUrl filter then hides the tile from the user library while the Application + ProxyProvider stay live for the outpost. Documented upstream as the official workaround. The previously per-profile blueprint-state-gating machinery retires — apps now stay always-present; profile gating moves entirely into the start-portal manifest.

dify-web 1.11.2 → 1.14.0 monorepo re-vendor

Upstream restructured web/ into a true pnpm monorepo (web/ + e2e/ + `sdks/nodejs-clien...