docs(apps): clarify ping URL only accepts http/https

Remove URL validation from app href field to support custom URI
schemes like vscode://, microsoft-edge:https://, and myapp://open.
Only javascript: URIs remain blocked for security.

Closes #6520

apps/docs/docs/management/apps/index.mdx

@@ -40,11 +40,14 @@ An optional description that can be shown as tooltip on the app widget.
 
 The URL to the website you want to link to. Clicking on the app widget or bookmark will open this URL.
 
+You can also use custom URI schemes such as `vscode://file/path`, `microsoft-edge:https://example.com`, or `myapp://open` to link to local applications or third-party programs. We trust that you know what you are doing — only `javascript:` URIs are blocked for security reasons.
+
 ### Ping URL
 
 When you want to use another url for the simple status check you can set it here.
 This will allow you to set a different URL for the ping than the URL that is opened when clicking on the app widget.
 It's useful when you want to ping the service internally for example with a custom ip but open the website externally.
+Note that the ping URL only accepts `http://` and `https://` URLs — custom URI schemes are not supported for pings.
 
 ## List of apps
 

packages/api/src/router/app.ts

@@ -173,7 +173,7 @@ export const appRouter = createTRPCRouter({
       mcp: {
         enabled: true,
         description:
-          "Create a new app (bookmark/shortcut to a service). REQUIRED: name (string), iconUrl (icon URL string), href (app URL, http/https or blank). OPTIONAL: description (string or null), pingUrl (URL to check reachability, or empty string)",
+          "Create a new app (bookmark/shortcut to a service). REQUIRED: name (string), iconUrl (icon URL string), href (app URL or custom URI scheme such as vscode://, or blank). OPTIONAL: description (string or null), pingUrl (URL to check reachability, or empty string)",
       },
     })
     .mutation(async ({ ctx, input }) => {

packages/definitions/src/docs/homarr-docs-sitemap.ts

@@ -119,6 +119,7 @@ export type HomarrDocumentationPath =
   | "/docs/tags/variables"
   | "/docs/tags/widgets"
   | "/docs/advanced/command-line"
+  | "/docs/advanced/command-line/development"
   | "/docs/advanced/command-line/fix-usernames"
   | "/docs/advanced/command-line/integrations"
   | "/docs/advanced/command-line/password-recovery"

packages/definitions/src/integration.ts

@@ -442,7 +442,7 @@ export const integrationDefs = {
     name: "Beszel",
     secretKinds: [["username", "password"]],
     iconUrl: "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@master/svg/beszel.svg",
-    category: ["healthMonitoring"],
+    category: ["beszel"],
     documentationUrl: createDocumentationLink("/docs/integrations/beszel"),
     defaultPort: 8090,
   },
@@ -565,6 +565,7 @@ export const integrationCategories = [
   "smartHomeServer",
   "indexerManager",
   "healthMonitoring",
+  "beszel",
   "search",
   "mediaTranscoding",
   "networkController",

packages/old-import/src/widgets/options.ts

@@ -148,6 +148,8 @@ const optionMapping: OptionMapping = {
   },
   mediaServer: {
     showOnlyPlaying: () => undefined,
+    showBitrate: () => undefined,
+    showLocation: () => undefined,
   },
   indexerManager: {
     openIndexerSiteInNewTab: (oldOptions) => oldOptions.openIndexerSiteInNewTab,

packages/validation/src/app.ts

@@ -3,8 +3,7 @@ import { z } from "zod/v4";
 export const appHrefSchema = z
   .string()
   .trim()
-  .url()
+  .refine((val) => !/^javascript:/i.test(val), "JavaScript URIs are not permitted")
-  .regex(/^(?!javascript)[a-zA-Z]*:\/\//i) // javascript: is not allowed, i for case insensitive (so Javascript: is also not allowed)
   .or(z.literal(""))
   .transform((value) => (value.length === 0 ? null : value))
   .nullable();

packages/widgets/src/docker/index.ts

@@ -26,6 +26,7 @@ const columnTranslationKeyMap = {
 export const { definition, componentLoader } = createWidgetDefinition("dockerContainers", {
   icon: IconBrandDocker,
   queryKey: [["docker", "getContainers"]],
+  refetchInterval: 30,
   createOptions() {
     return optionsBuilder.from(
       (factory) => ({

packages/widgets/src/notifications/index.ts

@@ -7,7 +7,6 @@ import { optionsBuilder } from "../options";
 
 export const { componentLoader, definition } = createWidgetDefinition("notifications", {
   icon: IconMessage,
-  refetchInterval: null,
   createOptions() {
     return optionsBuilder.from((factory) => ({
       hideLogos: factory.switch({ defaultValue: false }),

pnpm-workspace.yaml

@@ -37,9 +37,9 @@ catalog:
   "@octokit/auth-app": ^8.2.0
   "@paralleldrive/cuid2": ^3.3.0
   "@playwright/test": ^1.61.1
-  "@semantic-release/changelog": ^6.0.3
+  "@semantic-release/changelog": ^7.0.0
   "@semantic-release/commit-analyzer": ^13.0.1
-  "@semantic-release/git": ^10.0.1
+  "@semantic-release/git": ^11.0.1
   "@semantic-release/github": ^12.0.9
   "@semantic-release/npm": ^13.1.5
   "@semantic-release/release-notes-generator": ^14.1.1