Pandore/homarr
Public Access
1
0 Fork 0
Code Actions Activity

docs: refresh v2 release readiness evidence

Browse Source
This commit is contained in:
ajnart committed 2026-09-06 12:31:37 +02:00
1 parent 992681dab4
commit 6740d78c01
1 file changed
+203 -66
Download Patch File Download Diff File Expand all files Collapse all files
docs/V2_RELEASE_CHECKLIST.md
+203 -66
View File
@@ -1,6 +1,6 @@
# Homarr v2 GA release checklist
Last audited: 2026-09-06 (Europe/Berlin)
Last audited: 2026-09-06 12:30 CEST (Europe/Berlin)
This is the working go/no-go checklist for the full Homarr v2 release. Do not mark an item complete from an old
preview, PR run, or verbal confirmation. Add the final SHA, run URL, screenshot, issue, or written risk acceptance next
@@ -42,7 +42,7 @@ These facts are time-sensitive and must be refreshed at the start of the release
- [x] `release/v2` has 562 commits not in `dev`; `dev` has 54 commits not in `release/v2`.
- [x] The merge base is `2513e8454f240caa315b68dd6738b79838eeeecc` from 2026-08-13.
- [x] The `dev...release/v2` change spans 2,473 files, 243,111 insertions and 59,966 deletions.
- [x] A clean `git merge-tree --write-tree origin/dev origin/release/v2` rehearsal reports 11 content conflicts.
- [x] A clean `git merge-tree --write-tree origin/dev origin/release/v2` rehearsal reports 42 unique conflict paths.
- [x] The exact `release/v2` SHA has successful Fast gate, Container and E2E, CodeQL, Workshop validation and
amd64/arm64 preview publication checks.
- [x] The latest `dev` deployment workflow at `da32acb4f0ba9d8fa8e9667f56a54f85ca497865` is successful. An earlier
@@ -54,6 +54,21 @@ These facts are time-sensitive and must be refreshed at the start of the release
- [x] PR [#6760](https://github.com/homarr-labs/homarr/pull/6760) merged the streamlined v2 documentation and
passed its hosted checks.
- [x] GitHub currently reports zero open CodeQL alerts and zero open secret-scanning alerts.
- [x] All 65 open pull requests were inventoried: 36 target `dev`, 21 target `release/v2`, seven are internal stack
layers and one targets `main`. Every one is classified below as review/merge, port, defer, superseded or cleanup.
- [x] Audit-created readiness PRs #6770 through #6788 are non-draft, have clean merge state and have no failing or
pending hosted checks. None has a human approval yet, and this evidence must be repeated after each rebase/merge
wave.
- [x] Repository Actions secret names include `DISCORD_WEBHOOK` and `DISCORD_WEBHOOK_AUTOMATIC_RELEASE`; values were
not read. Their last name-level updates were 2024-02-03 and 2023-12-20, so delivery must still be tested.
- [x] The `github-pages` environment has a deployment branch policy. The existing `prod` environment has no
protection rules or reviewers and is not referenced by the production release workflow.
- [x] The public v2 preview is reachable, redirects to the login page, accepts the advertised `demo` account and
displays `Version 2.0.0` on `/manage/about`.
- [x] A read-only Chromium smoke of the public preview loaded the populated dashboard without application console
errors, completed an authenticated reload to network-idle in 3.2 seconds, opened the Date and time advanced view
through its keyboard control, rendered three world clocks, and rendered populated Media Releases data. This does
not replace final-candidate or real-provider testing.
- [ ] GitHub Dependabot currently reports 168 open repository-wide alerts: 5 critical, 64 high, 82 medium and 17 low.
These are based on the repository's default-branch dependency view and must be reconciled with the candidate-specific
`pnpm audit` results.
@@ -81,44 +96,129 @@ These are fixes, not completed release gates. Merge them into `release/v2`, carr
normalization advisories; 131 focused auth/proxy tests and affected typechecks pass.
- [ ] [#6776](https://github.com/homarr-labs/homarr/pull/6776) — patch the critical `protobufjs` path while staying on
compatible 7.x; 24 Docker tests and affected typechecks pass.
- [x] A temporary combined audit of `origin/release/v2` plus #6775 and #6776 reports zero critical production
advisories. The remaining result is 58 high, 54 moderate and 10 low advisories, so the full risk triage remains open.
- [ ] [#6777](https://github.com/homarr-labs/homarr/pull/6777) — replace the SQLite database placeholder with a
safe ignored local path, remove copy-pastable weak secrets and delete the obsolete source-install
`CRON_JOB_API_KEY` instruction. It also makes SSO key/credential replacement explicit and removes obsolete
`BASE_URL` / `NEXTAUTH_URL` entries. The production docs build and hosted Fast gate, amd64/arm64 preview builds,
container/E2E tests and multi-platform preview publication all pass.
- [ ] [#6778](https://github.com/homarr-labs/homarr/pull/6778) — port the focused database-restore re-login and error
reporting fix from #6624 without unrelated branch drift.
- [ ] [#6779](https://github.com/homarr-labs/homarr/pull/6779) — make MCP OAuth discovery, resource validation,
authentication challenges and login redirects honor the public origin and supported MCP route aliases. Sixteen
route tests, Next.js typecheck/build, docs build and production-server route smokes pass.
- [ ] [#6780](https://github.com/homarr-labs/homarr/pull/6780) — enforce `NO_EXTERNAL_CONNECTION` before weather
location search makes an outbound request and show the disabled state. Fifteen focused tests and affected
typechecks pass.
- [ ] [#6781](https://github.com/homarr-labs/homarr/pull/6781) — use Unraid's byte-based memory metrics and clamp
inconsistent values instead of using layout metadata.
- [ ] [#6782](https://github.com/homarr-labs/homarr/pull/6782) — report Docker container CPU as a 0–100 percent share
of the whole machine while retaining one-shot/Podman fallback behavior. Twenty focused tests pass.
- [ ] [#6783](https://github.com/homarr-labs/homarr/pull/6783) — sync the committed Helm page to live chart 8.28.2 /
app v1.76.2. Regenerate it again from the v2 chart after that chart is published.
- [ ] [#6784](https://github.com/homarr-labs/homarr/pull/6784) — give the Downloads name column a stable default width
without changing user-resizable persisted state.
- [ ] [#6785](https://github.com/homarr-labs/homarr/pull/6785) — support nested OIDC group/name claim paths while
preserving v2's provider and verified-email linking safeguards. Twenty-three focused Auth tests pass.
- [ ] [#6786](https://github.com/homarr-labs/homarr/pull/6786) — preserve reverse-proxy subpaths in Nextcloud CalDAV
discovery. Five focused Nextcloud tests pass.
- [ ] [#6787](https://github.com/homarr-labs/homarr/pull/6787) — use valid UniFi HTTPS default ports, preserve explicit
ports and avoid hiding authentication failures. Six focused tests pass.
- [ ] [#6788](https://github.com/homarr-labs/homarr/pull/6788) — patch every published, fixable high-severity
production dependency path found by the audit with exact catalog versions and range-scoped overrides. All
workspace typechecks, the production docs build and 18 focused backup/ZIP tests pass. Its hosted Fast gate,
amd64/arm64 preview builds, container/E2E tests and multi-platform preview publication all pass.
- [x] A temporary combined audit of `origin/release/v2` plus #6775, #6776 and #6788 reports 0 critical, 2 high, 20
moderate and 9 low production advisories. Both remaining high findings are Docusaurus build-time paths to
`image-size@2.0.2`; the registry still reports 2.0.2 as latest while both advisories require `>=2.0.3`.
- [x] That exact temporary combined graph also passes all 38 Turbo typecheck tasks and the Docusaurus production build.
- [x] The five repository-wide critical Dependabot alerts were reconciled: three runtime Auth.js alerts are addressed
by #6775, `protobufjs` is addressed by #6776, and the remaining `handlebars` alert is development-scoped and is not
present in the candidate's production audit.
### Recommended review and merge order
- [ ] Merge #6769 early so the team works from this checklist; continue updating its evidence in the release tracking
issue if the file itself is frozen.
- [ ] Review the release-control and production-default fixes first: #6770, #6771, #6772, #6773, #6774 and #6777.
- [ ] Merge the lockfile security chain in this order: #6775, rebase/re-audit #6776, then rebase/re-audit #6788. Do not
resolve their shared lockfile conflicts by choosing one side wholesale.
- [ ] Review the backup, public-origin, privacy, authentication and integration correctness fixes next: #6778, #6779,
#6780, #6785, #6786 and #6787.
- [ ] Review the isolated display/metric fixes next: #6781, #6782 and #6784.
- [ ] Review #6783 against the chart actually available to GA users; regenerate it after the v2 chart is published.
- [ ] Decide #6765 explicitly before freeze. It is not ready to merge on the current evidence.
- [ ] After every merge wave, update the remaining PRs from the new `release/v2` head and rerun affected checks. Their
current green results are based on the same pre-integration release SHA and are not final-candidate evidence.
### Current merge conflicts
- [ ] `.gitignore`
- [ ] `.agents/skills/codebase-context/SKILL.md`
- [ ] `.agents/skills/datatable-migration/SKILL.md`
- [ ] `.agents/skills/documentation-sync/SKILL.md`
- [ ] `.agents/skills/mcp-integration/SKILL.md`
- [ ] `.mcp.json`
- [ ] `AGENTS.md`
- [ ] `apps/docs/docs/getting-started/installation/helm.md`
- [ ] `apps/docs/docs/management/certificates/index.mdx`
- [ ] `apps/docs/docs/widgets/app/index.mdx`
- [ ] `apps/docs/docs/widgets/bookmarks/index.mdx`
- [ ] `apps/docs/docs/widgets/smart-home-entity-state/index.mdx`
- [ ] `apps/docs/docs/widgets/smart-home-execute-automation/index.mdx`
- [ ] `apps/nextjs/src/app/api/mcp/[transport]/route.ts`
- [ ] `apps/nextjs/src/components/board/items/widget-context-menu.tsx`
- [ ] `apps/nextjs/src/components/board/sections/gridstack/use-gridstack.ts`
- [ ] `e2e/onboarding.spec.ts`
- [ ] `package.json`
- [ ] `packages/api/src/router/widgets/smart-home.ts`
- [ ] `packages/integrations/src/truenas/test/truenas-integration.spec.ts`
- [ ] `packages/translation/src/lang/ca.json`
- [ ] `packages/translation/src/lang/cs.json`
- [ ] `packages/translation/src/lang/de-CH.json`
- [ ] `packages/translation/src/lang/el.json`
- [ ] `packages/translation/src/lang/en-gb.json`
- [ ] `packages/translation/src/lang/es.json`
- [ ] `packages/translation/src/lang/et.json`
- [ ] `packages/translation/src/lang/fr.json`
- [ ] `packages/translation/src/lang/hr.json`
- [ ] `packages/translation/src/lang/hu.json`
- [ ] `packages/translation/src/lang/lt.json`
- [ ] `packages/translation/src/lang/lv.json`
- [ ] `packages/translation/src/lang/no.json`
- [ ] `packages/translation/src/lang/pt-br.json`
- [ ] `packages/translation/src/lang/pt.json`
- [ ] `packages/translation/src/lang/ro.json`
- [ ] `packages/translation/src/lang/ru.json`
- [ ] `packages/translation/src/lang/sl.json`
- [ ] `packages/translation/src/lang/sv.json`
- [ ] `packages/translation/src/lang/uk.json`
- [ ] `packages/translation/src/lang/vi.json`
- [ ] `packages/widgets/src/health-monitoring/component.tsx`
- [ ] `packages/widgets/src/system-disks/component.tsx`
## Current hard blockers
- [ ] **BLOCKER — integrate histories:** reconcile all 54 `dev`-only commits and resolve the 11 current merge
- [ ] **BLOCKER — integrate histories:** reconcile all 54 `dev`-only commits and resolve the 42 current merge
conflicts without dropping either branch's behavior.
- [ ] **BLOCKER — production dependency audit:** the baseline `mise exec -- pnpm audit --prod --audit-level high`
reported 141 findings: 4 critical, 65 high, 62 moderate and 10 low. PRs #6775 and #6776 address every critical
candidate-specific finding; merge both and repeat the full audit/risk triage on the combined final candidate.
reported 141 findings: 4 critical, 65 high, 62 moderate and 10 low. The isolated combined graph with #6775,
#6776 and #6788 has 0 critical, 2 high, 20 moderate and 9 low. Merge the two critical fixes first, rebase #6788,
repeat the audit on that exact lockfile, and explicitly accept or wait for a published `image-size` fix.
- [ ] **BLOCKER — direct authentication advisories:** merge and review #6775, then revalidate every authentication
provider on the combined candidate. The isolated PR removes the critical `next-auth` and `@auth/core` findings.
- [ ] **BLOCKER — weekly promotion automation:** merge #6770 and prove its success, failure and no-release paths in
controlled workflow runs. It turns the observed no-version-bump failure into a successful no-op.
- [ ] **BLOCKER — scheduled notifications:** merge #6770 and prove scheduled start, success, major and failure notices
in a non-public Discord channel.
- [ ] **BLOCKER — MCP public origin:** merge #6779 and repeat discovery/login/401 challenges through the actual
production reverse proxy and subpath before publishing MCP as GA-ready.
- [ ] **BLOCKER — documentation release:** merge #6770, which removes the false handoff to the archived
`homarr-labs/documentation` repository. Confirm the authoritative monorepo GitHub Pages workflow deploys `apps/docs`
when the v2 docs reach `dev`, then verify the public site and Algolia recrawl.
- [ ] **BLOCKER — branch rules:** the strong `v2 release` ruleset targets the legacy `refs/heads/v2`, not
`refs/heads/release/v2`. The active release branch does not receive those required checks.
- [ ] **BLOCKER — production deployment guard:** the release workflow publishes after a `main` push without a
protected production environment, while `main` currently requires no status checks. Decide and test the exact
human approval/check boundary before the release window.
- [ ] **BLOCKER — final upgrade rehearsal:** perform backup, migration, restore and rollback rehearsals from real
`v1.76.2` installations for SQLite, MySQL and PostgreSQL.
- [ ] **BLOCKER — upgrade guide:** review and merge #6774, then verify the canonical guide against all three real
@@ -186,63 +286,81 @@ defer once the release is frozen.
- [ ] [#6765 llama.cpp integration and widget](https://github.com/homarr-labs/homarr/pull/6765) — currently targets
`release/v2`, is unstable, has no approval, lacks full CI on its newest head, and has requested responsive/advanced
mode work. Finish it completely or defer it before integration.
- [ ] [#6624 backup restore re-login](https://github.com/homarr-labs/homarr/pull/6624) — verify whether the final v2
candidate already contains the intended redirect and user warning. Port the minimal fix if not; do not merge its
unrelated branch drift wholesale.
- [ ] [#6631 MCP OAuth base URL](https://github.com/homarr-labs/homarr/pull/6631) — security and reverse-proxy
relevance; include/port or document why it is safe to defer.
- [ ] [#6662 board access-control form](https://github.com/homarr-labs/homarr/pull/6662) — permission correctness;
include/port or explicitly defer.
- [ ] [#6674 weather and `NO_EXTERNAL_CONNECTION`](https://github.com/homarr-labs/homarr/pull/6674) — offline/privacy
contract; include/port or explicitly defer.
- [ ] [#6749 Unraid memory utilization](https://github.com/homarr-labs/homarr/pull/6749) — validate against the v2
system widgets and include/port or defer.
- [ ] [#6250 container CPU utilization](https://github.com/homarr-labs/homarr/pull/6250) — recently updated and
potentially user-visible for v2 Docker widgets; include/port or defer.
- [ ] [#6733 Helm documentation](https://github.com/homarr-labs/homarr/pull/6733) — reconcile with the v2 Helm
conflict and current chart; do not ship competing instructions.
- [ ] [#6601 broad dependency update](https://github.com/homarr-labs/homarr/pull/6601) — do not merge wholesale just
to clear advisories; create a focused security upgrade if this PR is too broad or stale.
- [x] **PORT ONLY** [#6624 backup restore re-login](https://github.com/homarr-labs/homarr/pull/6624) — focused v2
port opened as #6778; do not merge unrelated branch drift.
- [x] **PORT ONLY** [#6631 MCP OAuth base URL](https://github.com/homarr-labs/homarr/pull/6631) — expanded and
production-smoked current-v2 port opened as #6779.
- [x] **SUPERSEDED** [#6662 board access-control form](https://github.com/homarr-labs/homarr/pull/6662) — current
`release/v2` already renders the access/danger forms outside the unified outer form; no duplicate port required.
- [x] **PORT ONLY** [#6674 weather and `NO_EXTERNAL_CONNECTION`](https://github.com/homarr-labs/homarr/pull/6674) —
focused current-v2 privacy/offline port opened as #6780.
- [x] **PORT ONLY** [#6749 Unraid memory utilization](https://github.com/homarr-labs/homarr/pull/6749) — focused
current-v2 metric fix opened as #6781.
- [x] **PORT ONLY** [#6250 container CPU utilization](https://github.com/homarr-labs/homarr/pull/6250) — focused
current-v2 normalization fix opened as #6782.
- [x] **PORT ONLY** [#6733 Helm documentation](https://github.com/homarr-labs/homarr/pull/6733) — current chart
metadata port opened as #6783; regenerate again after publishing the v2 chart.
- [x] **DEFER WHOLESALE** [#6601 broad dependency update](https://github.com/homarr-labs/homarr/pull/6601) — its
6,000-line lock/dependency churn is not a safe release patch. Use #6775, #6776 and #6788 for the focused
candidate-specific security work.
### Feature/UI candidates to include or defer explicitly
- [ ] #6657 OMV volume selection
- [ ] #6645 Beszel GPU metrics
- [ ] #6621 Downloads column width
- [ ] #6603 isolated pnpm linker/phantom dependencies
- [ ] #6572 Hermes Agent integration
- [ ] #6562 favicon detection
- [ ] #6561 Komodo integration
- [ ] #6546 REST dashboard automation
- [ ] #6537 dashboard memory work
- [ ] #6518 Sportarr integration
- [ ] #6517 UGOS integration
- [ ] #6515 SABnzbd archived-history options
- [ ] #6458 API add-item section targeting
- [ ] #6393 board keyboard shortcuts
- [ ] #6295 Nextcloud subpath fix
- [ ] #6294 nested OIDC claims
- [ ] #6210 UniFi default ports
- [ ] #6148 path-only app URLs
- [x] **DEFER** #6657 OMV volume selection — feature work, not a GA blocker.
- [x] **DEFER** #6645 Beszel GPU metrics — feature work, not a GA blocker.
- [x] **PORT ONLY** #6621 Downloads column width — minimal current-v2 fix opened as #6784; supersedes #6122.
- [x] **DEFER** #6603 isolated pnpm linker/phantom dependencies — broad package-manager/workspace refactor.
- [x] **DEFER** #6572 Hermes Agent integration — large new integration and widget.
- [x] **DEFER** #6562 favicon detection — new network-facing app-form behavior.
- [x] **DEFER** #6561 Komodo integration — large new integration.
- [x] **DEFER** #6546 REST dashboard automation — large API expansion; release separately after threat-model review.
- [x] **DEFER** #6537 dashboard memory work — very large conflicting performance branch; benchmark separately.
- [x] **DEFER** #6518 Sportarr integration — new integration.
- [x] **DEFER** #6517 UGOS integration — conflicting new integration.
- [x] **DEFER** #6515 SABnzbd archived-history options — changes requested remain.
- [x] **DEFER** #6458 API add-item section targeting — changes requested remain.
- [x] **DEFER** #6393 board keyboard shortcuts — conflicting feature work.
- [x] **PORT ONLY** #6295 Nextcloud subpath fix — current-v2 port opened as #6786.
- [x] **PORT ONLY** #6294 nested OIDC claims — current-v2 port opened as #6785 while preserving newer auth guards.
- [x] **PORT ONLY** #6210 UniFi default ports — cleaned current-v2 port opened as #6787.
- [x] **SUPERSEDED** #6148 path-only app URLs — current v2 already accepts safe same-origin paths and blocks unsafe
schemes through `getSafeAppHref`; #5595 is also superseded.
### Remaining open `dev` candidates
- [x] **DEFER** #6214 disabled users, #6140 Dawarich, #6144 FileFlows, #6145 Pushover, #4957 Incus and #4549
automatic layout — drafts, conflicting branches or new-feature scope.
- [x] **CLOSE/SUPERSEDED** #6132 dependency group — stale/conflicting dependency churn; use candidate-specific
advisory fixes.
- [ ] Confirm the release owner accepts every recommended `DEFER` classification above before feature freeze.
### Stack and stale-PR cleanup
- [ ] Close or reframe #6545 after the real promotion PR exists.
- [ ] Close internal stack PRs #6569, #6555, #6503, #6502, #6482, #6450 and #6356 after confirming their commits
are present in `release/v2`.
- [ ] Resolve/close #6549, whose head and base are both `dev`.
- [ ] Close superseded duplicate PRs such as the older Downloads-width and path-only URL variants.
- [x] **CLOSE** classification recorded for #6549: its head and base are both `dev`, and its history includes
acknowledged unrelated media changes despite approval.
- [ ] Close #6549 after preserving any unique issue/history references.
- [x] **CLOSE/SUPERSEDED** classifications recorded for #6122, #6148, #5595, #6621, #6624, #6631, #6674, #6749,
#6250, #6294, #6295, #6210 and #6733 after their current-v2 replacement or source-equivalent behavior is merged.
- [ ] Close those source/duplicate PRs only after the replacement PRs land and their history is linked.
- [ ] Move all accepted deferred work to a `v2.0.x` or `v2.1` milestone.
- [ ] Confirm no open PR still targets `release/v2` when the candidate is frozen.
### Documentation and announcement branches
- [x] PR #6760 is merged into `release/v2`.
- [ ] Rebase `origin/feat/homarr-v2-release-blog` onto current `release/v2`; it is currently two commits behind and
nine ahead.
- [ ] Review and merge the Homarr 2.0 blog, screenshots/GIFs, and GitHub/Reddit/Discord announcement variants from
that branch.
- [ ] Confirm no release-research scratch material is published unintentionally.
- [ ] Do not merge `origin/feat/homarr-v2-release-blog` wholesale. It remains two commits behind and nine ahead, but
changes 199 files, combines the article with a broad documentation rewrite, deletes many current screenshots and
includes `apps/docs/.release-research/` scratch material.
- [ ] Split a focused release-material branch containing only the reviewed Homarr 2.0 blog, required media and
GitHub/Reddit/Discord announcement variants; rebase that branch after the product/docs freeze.
- [ ] Remove private release-research files from the publishable diff.
- [ ] Replace announcement links to internal stack PR #6545 with the real promotion/release URL.
- [ ] Replace GA announcement calls to the preview/beta thread with the production release, upgrade guide and support
destinations; keep a beta link only if it serves a deliberate archival purpose.
- [ ] Update the blog path/date if the final publication date differs from `2026/09/03`.
## 4. Security and privacy gate
@@ -252,11 +370,16 @@ defer once the release is frozen.
- [ ] Merge #6775's patched `next-auth` release and validate failure-open, email normalization and session behavior on
the final candidate.
- [ ] Merge #6776's patched `protobufjs` 7.x resolution and rerun the audit on the final candidate.
- [ ] Merge #6788 after #6775 and #6776, resolve/review the resulting lockfile once, and repeat its typecheck, docs,
container and production-audit evidence on the rebased head.
- [ ] Resolve the repository-wide development-scoped `handlebars` alert separately or record why it does not block
production; it is not present in the candidate's production dependency audit.
- [ ] Triage high findings including `undici`, `adm-zip`, `fast-xml-parser`, `axios`, `hono`, `postcss`,
`serialize-javascript`, `image-size`, `fast-uri`, `js-yaml`, `brace-expansion`, `find-my-way`, `immutable`, `svgo`,
`shell-quote`, `@xmldom/xmldom`, `protobufjs` and `handlebars`.
- [x] #6788 patches the audited high findings for `undici`, `adm-zip`, `fast-xml-parser`, `axios`, `postcss`,
`serialize-javascript`, `fast-uri`, `js-yaml`, `brace-expansion`, `find-my-way`, `immutable`, `svgo`, `shell-quote`,
`@xmldom/xmldom` and their affected paths; #6776 patches `protobufjs`.
- [ ] Record a time-bounded risk decision for the two `image-size` highs. They are limited to Docusaurus MDX image
processing during the docs build, but no patched package is currently published. Upgrade immediately when
`image-size>=2.0.3` becomes available, or hold GA if the security owner does not accept that build-time exposure.
- [ ] For every accepted advisory, record package path, runtime reachability, mitigating controls, owner and target
patch release.
- [ ] Confirm CodeQL has no open alert on the final SHA.
@@ -411,12 +534,20 @@ preferences/branding to SQLite, MySQL and PostgreSQL, plus the custom section/gu
Track every report from [issue #6600](https://github.com/homarr-labs/homarr/issues/6600) with a reproducer and fix,
or a linked issue and explicit defer decision.
- [ ] Dense Beszel/widget text scaling — correlate with #6616 and retest 13/23/24-column layouts.
- [ ] Incorrect v1.74 update indicator in the v2 preview — verify final image reports v2.0.0 and no false update.
- [ ] Full-page widget refresh reported as roughly 5 seconds in v1 versus 72 seconds in v2 — reproduce and profile.
- [ ] Date/time widget missing world clocks — reproduce and close or fix.
- [ ] Media Releases widget reported non-functional — reproduce with supported providers and close or fix.
- [ ] Compact bookmarks reported as not compact — #6747 is present; visually retest all supported sizes.
- [ ] Dense Beszel/widget text scaling — current `release/v2` contains merged #6616; still retest the reported
13/23/24-column layouts on the final candidate.
- [ ] Incorrect v1.74 update indicator — the current public preview displays `Version 2.0.0`; still verify the final
immutable image and update checker report the production tag without a false update.
- [ ] Full-page widget refresh reported as roughly 5 seconds in v1 versus 72 seconds in v2 — the 2026-09-06 public
demo smoke completed an authenticated network-idle reload in 3.2 seconds with no application console errors.
Repeat with a large real-provider dashboard and profile server/browser memory before closing.
- [x] Date/time widget missing world clocks — reproduced as fixed on the current public preview: keyboard activation
opened advanced view with New York, Paris and Tokyo clocks. Retest the final candidate after freeze.
- [ ] Media Releases widget reported non-functional — current public demo advanced view renders seven populated mock
releases. Repeat with every supported real provider before closing the report.
- [ ] Compact bookmarks reported as not compact — current `release/v2` contains merged #6747; visually retest all
supported sizes and mobile layouts.
- [x] No new beta-thread comments were present after 2026-08-29 when refreshed on 2026-09-06.
- [ ] Review the beta issue again for new comments immediately before freeze.
- [ ] Reply with fix/issue links so testers know each report's disposition.
- [ ] Close or convert the beta thread only after all reports have a disposition.
@@ -446,11 +577,13 @@ or a linked issue and explicit defer decision.
- [ ] Decide whether to restore a root `README.md`. Only `docs/README.md` currently exists.
- [ ] Review and merge #6772; it replaces the seven committed `href="null"` integration links and makes the generator
use canonical integration documentation URLs.
- [ ] Replace `.env.example`'s `DB_URL='FULL_PATH_TO_YOUR_SQLITE_DB_FILE'` with a safe runnable example or clearly
commented unset value.
- [ ] Review and merge #6777; it replaces `.env.example`'s SQLite database placeholder with the runnable
source-development path `./db.sqlite`, documents the separate `/appdata/db/db.sqlite` container default and keeps
other database examples commented.
- [ ] Review and merge #6771; it comments out `UNSAFE_ENABLE_MOCK_INTEGRATION` in `.env.example`.
- [ ] Repeat #6771's disabled/enabled direct URL, API creation and onboarding smoke on the final candidate.
- [ ] Review sample `AUTH_SECRET` and encryption keys so no example can be mistaken for production-safe material.
- [ ] Review and merge #6777's removal of copy-pastable `AUTH_SECRET` and `SECRET_ENCRYPTION_KEY` values; confirm the
final source-install guide requires two different random values.
- [ ] Keep intentional UI input placeholders, test-domain `example.com` values, the Workshop password replacement
example and media-year `TBD`; these are not unfinished product copy.
- [ ] Run another focused scan for TODO, TBD, lorem ipsum, coming soon, `href="null"`, fake URLs, temporary files,
@@ -491,11 +624,13 @@ or a linked issue and explicit defer decision.
- [ ] Require at least one human approval, resolved threads, stale-approval dismissal and no force push/deletion for the
final promotion.
- [ ] Review ruleset bypass actors and limit release bypasses to the necessary bots/owners.
- [ ] Protect a real production deployment environment and bind the irreversible Semantic Release/tag/publish path to
it, or record an explicit alternative control. The current unprotected, unused `prod` environment is not a gate.
- [ ] Merge #6770's removal of the false archived-repository handoff and verify the monorepo `dev` docs deployment is
authoritative.
- [ ] Add an explicit production deployment failure notification.
- [ ] Remove `continue-on-error` from post-release `dev` synchronization, or add a mandatory job that verifies `dev`
contains the Semantic Release commit and fails loudly otherwise.
- [ ] Review and merge #6770's explicit production deployment failure/cancellation notification.
- [ ] Review and merge #6770's mandatory post-release check that verifies `dev` contains the Semantic Release commit
after synchronization; prove the verification fails loudly when synchronization is incomplete.
- [ ] Decide whether the absent `beta` branch is intentional. Remove dead beta logic or create/test a real RC path.
- [ ] Verify a manual dispatch redeploys the latest existing release and cannot create an unintended tag.
@@ -534,7 +669,9 @@ or a linked issue and explicit defer decision.
## 11. Discord and community readiness
- [ ] Confirm `DISCORD_WEBHOOK` and `DISCORD_WEBHOOK_AUTOMATIC_RELEASE` exist and work without exposing their values.
- [x] Confirm the `DISCORD_WEBHOOK` and `DISCORD_WEBHOOK_AUTOMATIC_RELEASE` secret names exist without exposing their
values.
- [ ] Confirm both webhook values still work; their name-level update timestamps are from 2024 and 2023 respectively.
- [ ] Test release notifications in a non-public/test channel.
- [ ] Prepare pre-release notice with date, expected impact, backup requirement and upgrade-guide link.
- [ ] Brief moderators and support maintainers on breaking changes, migrations and rollback.