fix(ci): repair docker build and consolidate CI/release workflows

The pnpm-fetch layer added in #6296 broke the release build: pnpm 11.10.0
applies patchedDependencies during `pnpm fetch`, before node_modules exists,
crashing with ENOENT. Install directly from the full context with the store
cache mounted instead.

Also audit and consolidate the workflows:
- standardize action majors (cache@v6, upload-artifact@v7, github-script@v9)
- provision Node from mise.toml via jdx/mise-action; drop .nvmrc
- rename deployment-docker-image.yml -> deployment-release.yml, reuse the
  shared setup action, and scope GITHUB_TOKEN permissions per job
- extract the duplicated beta/weekly release logic into a reusable
  deployment-release-pr.yml called by thin triggers

.github/workflows/ci.yml

@@ -317,7 +317,7 @@ jobs:
 
       - name: Delete GHCR package version
         if: '!env.ACT'
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const packageName = "homarr-test";

.github/workflows/deployment-beta-release.yml

@@ -14,91 +14,18 @@ permissions:
   pull-requests: write
 
 jobs:
-  create-and-merge-pr:
-    runs-on: ubuntu-latest
-    timeout-minutes: 2
-    steps:
-      - name: Discord notification
-        if: ${{ github.event.inputs.send-notifications }}
-        env:
-          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
-        uses: Ilshidur/action-discord@0.4.0
-        with:
-          args: "Beta release has been triggered: [run ${{ github.run_number }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})"
-      - name: Checkout repository
-        uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-      - name: Get Next Version
-        id: semver
-        uses: ietf-tools/semver-action@v1
-        with:
-          token: ${{ github.token }}
-          branch: next
-      - name: Create pull request
-        id: create-pull-request
-        run: 'gh pr create --title "chore(release): release ${{ steps.semver.outputs.next }}-beta" --body "Detected change to be ``${{ steps.semver.outputs.bump }}``<br/>Bump version from ``${{ steps.semver.outputs.current }}`` to ``${{ steps.semver.outputs.next }}-beta``" --base beta --head next --label automerge'
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-      - name: Discord notification
-        if: ${{ github.event.inputs.send-notifications }}
-        env:
-          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
-        uses: Ilshidur/action-discord@0.4.0
-        with:
-          args: "Created a release PR ${{ steps.create-pull-request.outputs.url }} for version ${{ steps.semver.outputs.next }}-beta (new behaviour: ${{ steps.semver.outputs.bump }})"
-      - name: Obtain token
-        id: obtainApprovalToken
-        uses: actions/create-github-app-token@v3
-        with:
-          private-key: ${{ secrets.RENOVATE_APPROVE_PRIVATE_KEY }}
-          client-id: ${{ secrets.RENOVATE_APPROVE_APP_ID }}
-          permission-pull-requests: write
-      - name: Approve PR
-        env:
-          GITHUB_TOKEN: ${{ steps.obtainApprovalToken.outputs.token }}
-        run: |
-          gh pr review --approve --body "Automatically approved by GitHub Action"
-      - name: Obtain token
-        id: obtainMergeToken
-        uses: actions/create-github-app-token@v3
-        with:
-          private-key: ${{ secrets.RENOVATE_MERGE_PRIVATE_KEY }}
-          client-id: ${{ secrets.RENOVATE_MERGE_APP_ID }}
-          permission-contents: write # write to beta branch (due to merge)
-          permission-pull-requests: write # merge pull request
-      - id: automerge
-        if: ${{ steps.semver.outputs.bump != 'major' }}
-        name: automerge
-        uses: "pascalgn/automerge-action@v0.16.4"
-        env:
-          GITHUB_TOKEN: ${{ steps.obtainMergeToken.outputs.token }}
-          MERGE_METHOD: merge # we prefer merge commits for merging to beta
-          MERGE_COMMIT_MESSAGE: "chore(release): release ${{ steps.semver.outputs.next }}-beta"
-          MERGE_DELETE_BRANCH: false # never set to true!
-          PULL_REQUEST: "${{ steps.create-pull-request.outputs.pr_number }}"
-          MERGE_RETRIES: 20 # 20 retries * MERGE_RETRY_SLEEP until step fails
-          MERGE_RETRY_SLEEP: 10000 # 10 seconds * MERGE_RETRIES until step fails
-          MERGE_REQUIRED_APPROVALS: 0 # do not require approvals
-
-      - name: Merged Discord notification
-        if: ${{ steps.automerge.outputs.mergeResult == 'merged' && github.event.inputs.send-notifications }}
-        env:
-          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
-        uses: Ilshidur/action-discord@0.4.0
-        with:
-          args: "Merged PR ${{ steps.create-pull-request.outputs.url }} for release ${{ steps.semver.outputs.next }}-beta"
-      - name: Major Bump Discord notification
-        if: ${{ steps.semver.outputs.bump == 'major' && github.event.inputs.send-notifications }}
-        env:
-          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
-        uses: Ilshidur/action-discord@0.4.0
-        with:
-          args: "The release PR must be manually merged because the next version is a major version: ${{ steps.create-pull-request.outputs.url }} for release ${{ steps.semver.outputs.next }}-beta"
-      - name: Discord Fail Notification
-        if: failure() && github.event.inputs.send-notifications
-        env:
-          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
-        uses: Ilshidur/action-discord@0.4.0
-        with:
-          args: "The beta release workflow [run ${{ github.run_number }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) has failed"
+  release:
+    # Permissions must be set on the calling job: a reusable workflow receives
+    # the default GITHUB_TOKEN permissions unless the caller job grants them here.
+    permissions:
+      contents: write
+      pull-requests: write
+    uses: ./.github/workflows/deployment-release-pr.yml
+    secrets: inherit
+    with:
+      release-label: "Beta release"
+      version-suffix: "-beta"
+      semver-branch: next
+      head: next
+      base: beta
+      send-notifications: ${{ github.event.inputs.send-notifications == 'true' }}

.github/workflows/deployment-release-pr.yml

@@ -0,0 +1,155 @@
+name: "[Deployment] Release PR (reusable)"
+
+# Reusable workflow that opens a release PR from `head` into `base`, auto-approves
+# it and (for non-major bumps) merges it. Used by the beta and weekly release
+# workflows, which differ only in branch, version suffix and notification wording.
+
+on:
+  workflow_call:
+    inputs:
+      release-label:
+        description: 'Human label used in notifications, e.g. "Beta release"'
+        required: true
+        type: string
+      title-prefix:
+        description: 'Text inserted before "release" in the PR title/commit, e.g. "automatic "'
+        required: false
+        default: ""
+        type: string
+      version-suffix:
+        description: 'Suffix appended to the computed version, e.g. "-beta"'
+        required: false
+        default: ""
+        type: string
+      body-prefix:
+        description: "Extra HTML prepended to the PR body"
+        required: false
+        default: ""
+        type: string
+      semver-branch:
+        description: "Branch used to compute the next version"
+        required: true
+        type: string
+      head:
+        description: "PR head branch"
+        required: true
+        type: string
+      base:
+        description: "PR base branch"
+        required: true
+        type: string
+      send-notifications:
+        description: "Whether to send Discord notifications"
+        required: false
+        default: true
+        type: boolean
+
+jobs:
+  create-and-merge-pr:
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Discord notification
+        if: inputs.send-notifications
+        env:
+          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
+        uses: Ilshidur/action-discord@0.4.0
+        with:
+          args: "${{ inputs.release-label }} has been triggered: [run ${{ github.run_number }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})"
+
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Get Next Version
+        id: semver
+        uses: ietf-tools/semver-action@v1
+        with:
+          token: ${{ github.token }}
+          branch: ${{ inputs.semver-branch }}
+
+      - name: Create pull request
+        id: create-pull-request
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: "${{ steps.semver.outputs.next }}${{ inputs.version-suffix }}"
+        run: >-
+          gh pr create
+          --title "chore(release): ${{ inputs.title-prefix }}release ${VERSION}"
+          --body "${{ inputs.body-prefix }}Detected change to be \`${{ steps.semver.outputs.bump }}\`<br/>Bump version from \`${{ steps.semver.outputs.current }}\` to \`${VERSION}\`"
+          --base ${{ inputs.base }}
+          --head ${{ inputs.head }}
+          --label automerge
+
+      - name: Discord notification
+        if: inputs.send-notifications
+        env:
+          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
+        uses: Ilshidur/action-discord@0.4.0
+        with:
+          args: "Created a release PR ${{ steps.create-pull-request.outputs.url }} for version ${{ steps.semver.outputs.next }}${{ inputs.version-suffix }} (new behaviour: ${{ steps.semver.outputs.bump }})"
+
+      - name: Obtain token
+        id: obtainApprovalToken
+        uses: actions/create-github-app-token@v3
+        with:
+          private-key: ${{ secrets.RENOVATE_APPROVE_PRIVATE_KEY }}
+          client-id: ${{ secrets.RENOVATE_APPROVE_APP_ID }}
+          permission-pull-requests: write
+
+      - name: Approve PR
+        env:
+          GITHUB_TOKEN: ${{ steps.obtainApprovalToken.outputs.token }}
+        run: |
+          gh pr review --approve --body "Automatically approved by GitHub Action"
+
+      - name: Obtain token
+        id: obtainMergeToken
+        uses: actions/create-github-app-token@v3
+        with:
+          private-key: ${{ secrets.RENOVATE_MERGE_PRIVATE_KEY }}
+          client-id: ${{ secrets.RENOVATE_MERGE_APP_ID }}
+          permission-contents: write # write to the base branch (due to merge)
+          permission-pull-requests: write # merge pull request
+
+      - id: automerge
+        if: ${{ steps.semver.outputs.bump != 'major' }}
+        name: automerge
+        uses: "pascalgn/automerge-action@v0.16.4"
+        env:
+          GITHUB_TOKEN: ${{ steps.obtainMergeToken.outputs.token }}
+          MERGE_METHOD: merge # we prefer merge commits for release branches
+          MERGE_COMMIT_MESSAGE: "chore(release): ${{ inputs.title-prefix }}release ${{ steps.semver.outputs.next }}${{ inputs.version-suffix }}"
+          MERGE_DELETE_BRANCH: false # never set to true!
+          PULL_REQUEST: "${{ steps.create-pull-request.outputs.pr_number }}"
+          MERGE_RETRIES: 20 # 20 retries * MERGE_RETRY_SLEEP until step fails
+          MERGE_RETRY_SLEEP: 10000 # 10 seconds * MERGE_RETRIES until step fails
+          MERGE_REQUIRED_APPROVALS: 0 # do not require approvals
+
+      - name: Merged Discord notification
+        if: ${{ steps.automerge.outputs.mergeResult == 'merged' && inputs.send-notifications }}
+        env:
+          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
+        uses: Ilshidur/action-discord@0.4.0
+        with:
+          args: "Merged PR ${{ steps.create-pull-request.outputs.url }} for release ${{ steps.semver.outputs.next }}${{ inputs.version-suffix }}"
+
+      - name: Major Bump Discord notification
+        if: ${{ steps.semver.outputs.bump == 'major' && inputs.send-notifications }}
+        env:
+          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
+        uses: Ilshidur/action-discord@0.4.0
+        with:
+          args: "The release PR must be manually merged because the next version is a major version: ${{ steps.create-pull-request.outputs.url }} for release ${{ steps.semver.outputs.next }}${{ inputs.version-suffix }}"
+
+      - name: Discord Fail Notification
+        if: failure() && inputs.send-notifications
+        env:
+          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
+        uses: Ilshidur/action-discord@0.4.0
+        with:
+          args: "The ${{ inputs.release-label }} workflow [run ${{ github.run_number }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) has failed"

.github/workflows/deployment-release.yml

@@ -15,9 +15,9 @@ on:
         default: true
         description: Send notifications
 
+# Least-privilege default; each job widens only what it needs.
 permissions:
-  contents: write # Required to update package.json version
-  packages: write # Required for pushing to GHCR
+  contents: read
 
 env:
   SKIP_ENV_VALIDATION: true
@@ -34,6 +34,8 @@ jobs:
     name: Create tag and release
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    permissions:
+      contents: write # commit package.json/changelog, push tags, update dev/next
     env:
       SKIP_RELEASE: ${{ github.event_name == 'workflow_dispatch' || github.ref_name == 'dev' || github.ref_name == 'next' }}
     outputs:
@@ -61,19 +63,9 @@ jobs:
         if: env.SKIP_RELEASE == 'false'
         with:
           persist-credentials: false
-      - uses: pnpm/action-setup@v6
+      - name: Setup
         if: env.SKIP_RELEASE == 'false'
-      - uses: actions/setup-node@v6
-        if: env.SKIP_RELEASE == 'false'
-        with:
-          node-version: 24.18.0
-          package-manager-cache: false
-      - run: npm i -g pnpm
-        if: env.SKIP_RELEASE == 'false'
-      - name: Install dependencies
-        if: env.SKIP_RELEASE == 'false'
-        run: |
-          pnpm install
+        uses: ./tooling/github/setup
       - name: Run Semantic Release
         if: env.SKIP_RELEASE == 'false'
         env:
@@ -116,6 +108,9 @@ jobs:
     needs: release
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    permissions:
+      contents: read # checkout the repository
+      packages: write # push image by digest to GHCR
     outputs:
       digest: ${{ steps.build.outputs.digest }}
     steps:
@@ -160,6 +155,9 @@ jobs:
     needs: release
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 20
+    permissions:
+      contents: read # checkout the repository
+      packages: write # push image by digest to GHCR
     outputs:
       digest: ${{ steps.build.outputs.digest }}
     steps:
@@ -204,6 +202,8 @@ jobs:
     needs: [release, build-amd64]
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    permissions:
+      contents: write # upload build artifacts as release assets
     steps:
       - name: Extract amd64
         if: needs.release.outputs.skipped == 'false'
@@ -220,6 +220,8 @@ jobs:
     needs: [release, build-arm64]
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 5
+    permissions:
+      contents: write # upload build artifacts as release assets
     steps:
       - name: Extract arm64
         if: needs.release.outputs.skipped == 'false'
@@ -235,6 +237,9 @@ jobs:
     needs: [release, build-amd64, build-arm64, extract-asset-amd64, extract-asset-arm64]
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    permissions:
+      contents: write # mark GitHub release as published (undraft)
+      packages: write # create multi-arch image tags in GHCR
     env:
       NEXT_VERSION: ${{ needs.release.outputs.version }}
       DEPLOY_LATEST: ${{ github.ref_name == 'main' }}

.github/workflows/deployment-weekly-release.yml

@@ -17,91 +17,20 @@ permissions:
   pull-requests: write
 
 jobs:
-  create-and-merge-pr:
-    runs-on: ubuntu-latest
-    timeout-minutes: 2
-    steps:
-      - name: Discord notification
-        if: ${{ github.event.inputs.send-notifications }}
-        env:
-          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
-        uses: Ilshidur/action-discord@0.4.0
-        with:
-          args: "Automatic release has been triggered: [run ${{ github.run_number }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})"
-      - name: Checkout repository
-        uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-      - name: Get Next Version
-        id: semver
-        uses: ietf-tools/semver-action@v1
-        with:
-          token: ${{ github.token }}
-          branch: dev
-      - name: Create pull request
-        id: create-pull-request
-        run: 'gh pr create --title "chore(release): automatic release ${{ steps.semver.outputs.next }}" --body "**This is an automatic release**.<br/>Manual action may be required for major bumps.<br/>Detected change to be ``${{ steps.semver.outputs.bump }}``<br/>Bump version from ``${{ steps.semver.outputs.current }}`` to ``${{ steps.semver.outputs.next }}``" --base main --head dev --label automerge'
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-      - name: Discord notification
-        if: ${{ github.event.inputs.send-notifications }}
-        env:
-          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
-        uses: Ilshidur/action-discord@0.4.0
-        with:
-          args: "Created a release PR ${{ steps.create-pull-request.outputs.url }} for version ${{ steps.semver.outputs.next }} (new behaviour: ${{ steps.semver.outputs.bump }})"
-      - name: Obtain token
-        id: obtainApprovalToken
-        uses: actions/create-github-app-token@v3
-        with:
-          private-key: ${{ secrets.RENOVATE_APPROVE_PRIVATE_KEY }}
-          client-id: ${{ secrets.RENOVATE_APPROVE_APP_ID }}
-          permission-pull-requests: write
-      - name: Approve PR
-        env:
-          GITHUB_TOKEN: ${{ steps.obtainApprovalToken.outputs.token }}
-        run: |
-          gh pr review --approve --body "Automatically approved by GitHub Action"
-      - name: Obtain token
-        id: obtainMergeToken
-        uses: actions/create-github-app-token@v3
-        with:
-          private-key: ${{ secrets.RENOVATE_MERGE_PRIVATE_KEY }}
-          client-id: ${{ secrets.RENOVATE_MERGE_APP_ID }}
-          permission-contents: write # write to main branch (due to merge)
-          permission-pull-requests: write # merge pull request
-      - id: automerge
-        if: ${{ steps.semver.outputs.bump != 'major' }}
-        name: automerge
-        uses: "pascalgn/automerge-action@v0.16.4"
-        env:
-          GITHUB_TOKEN: ${{ steps.obtainMergeToken.outputs.token }}
-          MERGE_METHOD: merge # we prefer merge commits for merging to main
-          MERGE_COMMIT_MESSAGE: "chore(release): automatic release ${{ steps.semver.outputs.next }}"
-          MERGE_DELETE_BRANCH: false # never set to true!
-          PULL_REQUEST: "${{ steps.create-pull-request.outputs.pr_number }}"
-          MERGE_RETRIES: 20 # 20 retries * MERGE_RETRY_SLEEP until step fails
-          MERGE_RETRY_SLEEP: 10000 # 10 seconds * MERGE_RETRIES until step fails
-          MERGE_REQUIRED_APPROVALS: 0 # do not require approvals
-
-      - name: Merged Discord notification
-        if: ${{ steps.automerge.outputs.mergeResult == 'merged' && github.event.inputs.send-notifications }}
-        env:
-          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
-        uses: Ilshidur/action-discord@0.4.0
-        with:
-          args: "Merged PR ${{ steps.create-pull-request.outputs.url }} for release ${{ steps.semver.outputs.next }}"
-      - name: Major Bump Discord notification
-        if: ${{ steps.semver.outputs.bump == 'major' && github.event.inputs.send-notifications }}
-        env:
-          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
-        uses: Ilshidur/action-discord@0.4.0
-        with:
-          args: "The release PR must be manually merged because the next version is a major version: ${{ steps.create-pull-request.outputs.url }} for release ${{ steps.semver.outputs.next }}"
-      - name: Discord Fail Notification
-        if: failure() && github.event.inputs.send-notifications
-        env:
-          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
-        uses: Ilshidur/action-discord@0.4.0
-        with:
-          args: "The automatic release workflow [run ${{ github.run_number }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) has failed"
+  release:
+    # Permissions must be set on the calling job: a reusable workflow receives
+    # the default GITHUB_TOKEN permissions unless the caller job grants them here.
+    permissions:
+      contents: write
+      pull-requests: write
+    uses: ./.github/workflows/deployment-release-pr.yml
+    secrets: inherit
+    with:
+      release-label: "Automatic release"
+      title-prefix: "automatic "
+      body-prefix: "**This is an automatic release**.<br/>Manual action may be required for major bumps.<br/>"
+      semver-branch: dev
+      head: dev
+      base: main
+      # Scheduled runs have no inputs, so notifications stay off unless manually dispatched.
+      send-notifications: ${{ github.event.inputs.send-notifications == 'true' }}

.github/workflows/update-contributors.yml

@@ -15,9 +15,6 @@ jobs:
   update-contributors:
     runs-on: ubuntu-latest
     timeout-minutes: 2
-    strategy:
-      matrix:
-        node-version: [22]
     steps:
       - name: Obtain token
         id: obtainToken
@@ -33,13 +30,11 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ steps.obtainToken.outputs.token }}
 
-      - uses: pnpm/action-setup@v6
-      - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v6
-        with:
-          node-version: ${{ matrix.node-version }}
-          cache: "pnpm"
+      - name: Install Node with mise
+        uses: jdx/mise-action@v4
 
+      # This script only uses Node built-ins (fs/promises), so no dependency
+      # install is needed.
       - name: Run update script
         run: node ./scripts/update-contributors.mjs
 

.nvmrc

@@ -1 +0,0 @@
-24.18.0

Dockerfile

@@ -7,26 +7,16 @@ WORKDIR /app
 RUN apk add --no-cache libc6-compat curl bash && apk update
 
 RUN corepack enable pnpm
-COPY pnpm-lock.yaml pnpm-workspace.yaml package.json ./
-COPY patches ./patches
-# Workaround for pnpm/pnpm#5268: pnpm fetch crashes when patchedDependencies
-# are configured with nodeLinker: hoisted. The applyPatchToDir function tries
-# to chdir into node_modules/<pkg> which doesn't exist during fetch (only the
-# content-addressable store is populated). By temporarily switching to the
-# isolated linker, patches apply inside the virtual store (node_modules/.pnpm/...)
-# which IS created by pnpm fetch. The original hoisted linker is restored
-# before the install step so the final node_modules layout stays flat.
+
+# NOTE: We intentionally do NOT use `pnpm fetch` here. pnpm 11.10.0 applies
+# `patchedDependencies` patches during the fetch phase, before packages are
+# unpacked into node_modules, which crashes with ENOENT (chdir into a
+# not-yet-existing node_modules path). Installing directly from the full
+# context with the store cache mounted keeps builds fast without that break.
+COPY . .
 RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store \
     pnpm config set store-dir /pnpm/store && \
-    sed -i 's/nodeLinker: hoisted/nodeLinker: isolated/' pnpm-workspace.yaml && \
-    pnpm fetch && \
-    sed -i 's/nodeLinker: isolated/nodeLinker: hoisted/' pnpm-workspace.yaml
-
-COPY . .
-# Follow the pnpm fetch pattern from https://pnpm.io/cli/fetch
-# --frozen-lockfile is omitted as recommended by the pnpm fetch docs
-RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store \
-    pnpm install --recursive
+    pnpm install --recursive --frozen-lockfile
 
 ARG SKIP_ENV_VALIDATION='true'
 ARG CI='true'

apps/nextjs/src/app/[locale]/_client-providers/trpc.tsx

@@ -29,7 +29,6 @@ import {
   queryCacheDefaultGcTimeMs,
   queryCacheDefaultRefetchIntervalMs,
   queryCacheDefaultStaleTimeMs,
-  widgetRefetchIntervalOverrides,
 } from "@homarr/api/query-cache";
 import { createHeadersCallbackForSource, getTrpcUrl } from "@homarr/api/shared";
 import { env } from "@homarr/common/env";
@@ -91,9 +90,6 @@ export function TRPCReactProvider(props: PropsWithChildren) {
       },
     });
     client.setQueryDefaults([["widget"]], { refetchInterval: queryCacheDefaultRefetchIntervalMs });
-    for (const [path, interval] of Object.entries(widgetRefetchIntervalOverrides)) {
-      client.setQueryDefaults([path.split(".")], { refetchInterval: interval });
-    }
     return client;
   });
 

packages/api/src/query-cache.ts

@@ -7,44 +7,6 @@ export const queryCacheMaxValueBytes = 1024 * 1024;
 export const queryCacheStoragePrefix = "homarr-widget-query";
 export const queryCacheBuster = "v2-superjson";
 
-export const widgetRefetchIntervalOverrides: Record<string, number> = {
-  "widget.healthMonitoring": 5_000,
-  "widget.dnsHole": 5_000,
-  "widget.downloads": 5_000,
-  "widget.mediaServer": 5_000,
-  "widget.tracearr": 5_000,
-  "widget.firewall.getFirewallCpuStatus": 5_000,
-  "widget.firewall.getFirewallMemoryStatus": 15_000,
-  "widget.firewall.getFirewallInterfacesStatus": 30_000,
-  "widget.firewall.getFirewallVersionStatus": 3_600_000,
-  "widget.anchorNotes": 15_000,
-  "widget.coolify": 30_000,
-  "widget.umami.getActiveVisitors": 30_000,
-  "widget.umami": 300_000,
-  "widget.calendar": 60_000,
-  "widget.mediaRequests": 60_000,
-  "widget.smartHome": 60_000,
-  "widget.ups": 60_000,
-  "widget.uptimeKuma": 60_000,
-  "widget.weather": 60_000,
-  "widget.timetable": 60_000,
-  "widget.indexerManager": 300_000,
-  "widget.mediaRelease": 300_000,
-  "widget.mediaTranscoding": 300_000,
-  "widget.networkController": 300_000,
-  "widget.notifications": 300_000,
-  "widget.rssFeed": 300_000,
-  "widget.stockPrice": 300_000,
-  "widget.minecraft": 300_000,
-  "widget.vpn": 300_000,
-  "widget.archiveTeamWarrior": 300_000,
-  "widget.audiobookshelf": 600_000,
-  "widget.navidrome": 600_000,
-  "widget.speedtestTracker": 600_000,
-  "widget.immich": 900_000,
-  "widget.paperlessNgx": 900_000,
-};
-
 let activeQueryCacheBoardId: string | null = null;
 
 export const setActiveQueryCacheBoardId = (boardId: string | null) => {

packages/request-handler/src/anchor-notes.ts

@@ -12,7 +12,6 @@ export const anchorNotesListRequestHandler = createIntegrationRequestHandler<
     const instance = await createIntegrationAsync(integration);
     return instance.listNotesAsync(input);
   },
-  cacheTtlMs: 15_000,
 });
 
 export const anchorNoteRequestHandler = createIntegrationRequestHandler<AnchorNote, "anchor", { noteId: string }>({
@@ -20,5 +19,4 @@ export const anchorNoteRequestHandler = createIntegrationRequestHandler<AnchorNo
     const instance = await createIntegrationAsync(integration);
     return instance.getNoteAsync(input.noteId);
   },
-  cacheTtlMs: 15_000,
 });

packages/request-handler/src/archive-team-warrior.ts

@@ -13,5 +13,4 @@ export const archiveTeamWarriorRequestHandler = createIntegrationRequestHandler<
     const integrationInstance = await createIntegrationAsync(integration);
     return await integrationInstance.getStatusAsync();
   },
-  cacheTtlMs: 300_000,
 });

packages/request-handler/src/audiobookshelf.ts

@@ -12,5 +12,4 @@ export const audiobookshelfRequestHandler = createIntegrationRequestHandler<
     const integrationInstance = await createIntegrationAsync(integration);
     return await integrationInstance.getDashboardDataAsync();
   },
-  cacheTtlMs: 600_000,
 });

packages/request-handler/src/calendar.ts

@@ -23,5 +23,4 @@ export const calendarMonthRequestHandler = createIntegrationRequestHandler<
       input.showUnmonitored,
     );
   },
-  cacheTtlMs: 60_000,
 });

packages/request-handler/src/coolify.ts

@@ -12,5 +12,4 @@ export const coolifyRequestHandler = createIntegrationRequestHandler<
     const integrationInstance = await createIntegrationAsync(integration);
     return await integrationInstance.getInstanceInfoAsync();
   },
-  cacheTtlMs: 30_000,
 });

packages/request-handler/src/dns-hole.ts

@@ -13,5 +13,4 @@ export const dnsHoleRequestHandler = createIntegrationRequestHandler<
     const integrationInstance = await createIntegrationAsync(integration);
     return await integrationInstance.getSummaryAsync();
   },
-  cacheTtlMs: 5_000,
 });

packages/request-handler/src/docker.ts

@@ -177,7 +177,6 @@ export const dockerContainersRequestHandler = createWidgetRequestHandler({
     }
     return await getContainersWithStatsAsync();
   },
-  cacheTtlMs: 20_000,
 });
 
 const extractImage = (container: ContainerInfo) => extractContainerImageName(container.Image);

packages/request-handler/src/downloads.ts

@@ -13,5 +13,4 @@ export const downloadClientRequestHandler = createIntegrationRequestHandler<
     const integrationInstance = await createIntegrationAsync(integration);
     return await integrationInstance.getClientJobsAndStatusAsync(input);
   },
-  cacheTtlMs: 5_000,
 });

packages/request-handler/src/duckduckgo-bangs.ts

@@ -69,5 +69,4 @@ export const duckDuckGoBangsRequestHandler = createRequestHandler({
 
     return normalized;
   },
-  cacheTtlMs: 86_400_000,
 });

packages/request-handler/src/firewall.ts

@@ -18,7 +18,6 @@ export const firewallCpuRequestHandler = createIntegrationRequestHandler<
     const integrationInstance = await createIntegrationAsync(integration);
     return integrationInstance.getFirewallCpuAsync();
   },
-  cacheTtlMs: 5_000,
 });
 
 export const firewallMemoryRequestHandler = createIntegrationRequestHandler<
@@ -30,7 +29,6 @@ export const firewallMemoryRequestHandler = createIntegrationRequestHandler<
     const integrationInstance = await createIntegrationAsync(integration);
     return await integrationInstance.getFirewallMemoryAsync();
   },
-  cacheTtlMs: 15_000,
 });
 
 export const firewallInterfacesRequestHandler = createIntegrationRequestHandler<
@@ -42,7 +40,6 @@ export const firewallInterfacesRequestHandler = createIntegrationRequestHandler<
     const integrationInstance = await createIntegrationAsync(integration);
     return await integrationInstance.getFirewallInterfacesAsync();
   },
-  cacheTtlMs: 30_000,
 });
 
 export const firewallVersionRequestHandler = createIntegrationRequestHandler<
@@ -54,5 +51,4 @@ export const firewallVersionRequestHandler = createIntegrationRequestHandler<
     const integrationInstance = await createIntegrationAsync(integration);
     return await integrationInstance.getFirewallVersionAsync();
   },
-  cacheTtlMs: 3_600_000,
 });

packages/request-handler/src/health-monitoring.ts

@@ -13,7 +13,6 @@ export const systemInfoRequestHandler = createIntegrationRequestHandler<
     const integrationInstance = await createIntegrationAsync(integration);
     return await integrationInstance.getSystemInfoAsync();
   },
-  cacheTtlMs: 5_000,
 });
 
 export const clusterInfoRequestHandler = createIntegrationRequestHandler<
@@ -25,5 +24,4 @@ export const clusterInfoRequestHandler = createIntegrationRequestHandler<
     const integrationInstance = await createIntegrationAsync(integration);
     return await integrationInstance.getClusterInfoAsync();
   },
-  cacheTtlMs: 5_000,
 });

packages/request-handler/src/immich.ts

@@ -13,7 +13,6 @@ export const immichStatsRequestHandler = createIntegrationRequestHandler<
     const integrationInstance = await createIntegrationAsync(integration);
     return await integrationInstance.getServerStatsAsync();
   },
-  cacheTtlMs: 900_000,
 });
 
 export const immichAlbumsRequestHandler = createIntegrationRequestHandler<
@@ -29,7 +28,6 @@ export const immichAlbumsRequestHandler = createIntegrationRequestHandler<
     const integrationInstance = await createIntegrationAsync(integration);
     return await integrationInstance.getAlbumsAsync();
   },
-  cacheTtlMs: 900_000,
 });
 
 export const immichAlbumRequestHandler = createIntegrationRequestHandler<
@@ -41,5 +39,4 @@ export const immichAlbumRequestHandler = createIntegrationRequestHandler<
     const integrationInstance = await createIntegrationAsync(integration);
     return await integrationInstance.getAlbumAsync(input.albumId);
   },
-  cacheTtlMs: 900_000,
 });

packages/request-handler/src/indexer-manager.ts

@@ -13,5 +13,4 @@ export const indexerManagerRequestHandler = createIntegrationRequestHandler<
     const integrationInstance = await createIntegrationAsync(integration);
     return await integrationInstance.getIndexersAsync();
   },
-  cacheTtlMs: 300_000,
 });

packages/request-handler/src/lib/widget-request-handler.ts

@@ -2,7 +2,6 @@ import { createRequestHandler } from "./request-handler";
 
 interface Options<TData, TInput extends Record<string, unknown>> {
   requestAsync: (input: TInput) => Promise<TData>;
-  cacheTtlMs?: number;
 }
 
 export const createWidgetRequestHandler = <TData, TInput extends Record<string, unknown>>(
@@ -11,6 +10,5 @@ export const createWidgetRequestHandler = <TData, TInput extends Record<string,
   handler: (widgetOptions: TInput) =>
     createRequestHandler<TData, TInput>({
       requestAsync: options.requestAsync,
-      cacheTtlMs: options.cacheTtlMs,
     }).handler(widgetOptions),
 });

packages/request-handler/src/media-release.ts

@@ -13,5 +13,4 @@ export const mediaReleaseRequestHandler = createIntegrationRequestHandler<
     const integrationInstance = await createIntegrationAsync(integration);
     return await integrationInstance.getMediaReleasesAsync();
   },
-  cacheTtlMs: 300_000,
 });

packages/request-handler/src/media-request-stats.ts

@@ -16,5 +16,4 @@ export const mediaRequestStatsRequestHandler = createIntegrationRequestHandler<
       users: await integrationInstance.getUsersAsync(),
     };
   },
-  cacheTtlMs: 60_000,
 });

packages/request-handler/src/media-server.ts

@@ -15,5 +15,4 @@ export const mediaServerRequestHandler = createIntegrationRequestHandler<
     const integrationInstance = await createIntegrationAsync(integration);
     return await integrationInstance.getCurrentSessionsAsync({ showOnlyPlaying: input.showOnlyPlaying });
   },
-  cacheTtlMs: 5_000,
 });

packages/request-handler/src/media-transcoding.ts

@@ -17,7 +17,6 @@ export const mediaTranscodingRequestHandler = createIntegrationRequestHandler<
       statistics: await integrationInstance.getStatisticsAsync(),
     };
   },
-  cacheTtlMs: 300_000,
 });
 
 export interface MediaTranscoding {

packages/request-handler/src/minecraft-server-status.ts

@@ -14,7 +14,6 @@ export const minecraftServerStatusRequestHandler = createWidgetRequestHandler({
     );
     return responseSchema.parse(await response.json());
   },
-  cacheTtlMs: 300_000,
 });
 
 const responseSchema = z

packages/request-handler/src/navidrome.ts

@@ -12,5 +12,4 @@ export const navidromeRequestHandler = createIntegrationRequestHandler<
     const integrationInstance = await createIntegrationAsync(integration);
     return await integrationInstance.getDashboardDataAsync();
   },
-  cacheTtlMs: 600_000,
 });

packages/request-handler/src/network-controller.ts

@@ -13,5 +13,4 @@ export const networkControllerRequestHandler = createIntegrationRequestHandler<
     const integrationInstance = await createIntegrationAsync(integration);
     return await integrationInstance.getNetworkSummaryAsync();
   },
-  cacheTtlMs: 300_000,
 });

packages/request-handler/src/notifications.ts

@@ -13,5 +13,4 @@ export const notificationsRequestHandler = createIntegrationRequestHandler<
     const integrationInstance = await createIntegrationAsync(integration);
     return await integrationInstance.getNotificationsAsync();
   },
-  cacheTtlMs: 300_000,
 });

packages/request-handler/src/paperless-ngx.ts

@@ -12,5 +12,4 @@ export const paperlessNgxStatsRequestHandler = createIntegrationRequestHandler<
     const integrationInstance = await createIntegrationAsync(integration);
     return await integrationInstance.getStatsAsync();
   },
-  cacheTtlMs: 900_000,
 });

packages/request-handler/src/rss-feeds.ts

@@ -28,7 +28,6 @@ export const rssFeedsRequestHandler = createWidgetRequestHandler({
       entries: result.entries?.map((entry) => ({ ...entry, feedUrl: input.url })).slice(0, input.count) ?? [],
     };
   },
-  cacheTtlMs: 300_000,
 });
 
 const attemptGetImageFromEntry = (feedUrl: string, entry: object) => {

packages/request-handler/src/smart-home-entity-state.ts

@@ -18,5 +18,4 @@ export const smartHomeEntityStateRequestHandler = createIntegrationRequestHandle
 
     return result.data.state;
   },
-  cacheTtlMs: 60_000,
 });

packages/request-handler/src/speedtest-tracker.ts

@@ -12,5 +12,4 @@ export const speedtestTrackerRequestHandler = createIntegrationRequestHandler<
     const integrationInstance = await createIntegrationAsync(integration);
     return await integrationInstance.getDashboardDataAsync();
   },
-  cacheTtlMs: 600_000,
 });

packages/request-handler/src/stock-price.ts

@@ -39,7 +39,6 @@ export const fetchStockPriceHandler = createWidgetRequestHandler({
       shortName: firstResult.meta.shortName,
     };
   },
-  cacheTtlMs: 300_000,
 });
 
 const dataSchema = z

packages/request-handler/src/tracearr.ts

@@ -12,5 +12,4 @@ export const tracearrRequestHandler = createIntegrationRequestHandler<
     const integrationInstance = await createIntegrationAsync(integration);
     return await integrationInstance.getDashboardDataAsync();
   },
-  cacheTtlMs: 5_000,
 });

packages/request-handler/src/umami.ts

@@ -12,7 +12,6 @@ export const umamiRequestHandler = createIntegrationRequestHandler<
     const integrationInstance = await createIntegrationAsync(integration);
     return await integrationInstance.getVisitorStatsAsync(input.websiteId, input.timeFrame, input.eventName);
   },
-  cacheTtlMs: 300_000,
 });
 
 export const umamiEventNamesRequestHandler = createIntegrationRequestHandler<string[], "umami", { websiteId: string }>({
@@ -20,7 +19,6 @@ export const umamiEventNamesRequestHandler = createIntegrationRequestHandler<str
     const integrationInstance = await createIntegrationAsync(integration);
     return await integrationInstance.getEventNamesAsync(input.websiteId);
   },
-  cacheTtlMs: 300_000,
 });
 
 export const umamiTopPagesRequestHandler = createIntegrationRequestHandler<
@@ -32,7 +30,6 @@ export const umamiTopPagesRequestHandler = createIntegrationRequestHandler<
     const integrationInstance = await createIntegrationAsync(integration);
     return await integrationInstance.getTopPagesAsync(input.websiteId, input.timeFrame, input.limit);
   },
-  cacheTtlMs: 300_000,
 });
 
 export const umamiTopReferrersRequestHandler = createIntegrationRequestHandler<
@@ -44,7 +41,6 @@ export const umamiTopReferrersRequestHandler = createIntegrationRequestHandler<
     const integrationInstance = await createIntegrationAsync(integration);
     return await integrationInstance.getTopReferrersAsync(input.websiteId, input.timeFrame, input.limit);
   },
-  cacheTtlMs: 300_000,
 });
 
 export const umamiMultiEventRequestHandler = createIntegrationRequestHandler<
@@ -56,7 +52,6 @@ export const umamiMultiEventRequestHandler = createIntegrationRequestHandler<
     const integrationInstance = await createIntegrationAsync(integration);
     return await integrationInstance.getMultiEventTimeSeriesAsync(input.websiteId, input.timeFrame, input.eventNames);
   },
-  cacheTtlMs: 300_000,
 });
 
 export const umamiActiveVisitorsRequestHandler = createIntegrationRequestHandler<
@@ -68,5 +63,4 @@ export const umamiActiveVisitorsRequestHandler = createIntegrationRequestHandler
     const integrationInstance = await createIntegrationAsync(integration);
     return await integrationInstance.getActiveVisitorsAsync(input.websiteId);
   },
-  cacheTtlMs: 30_000,
 });

packages/request-handler/src/ups.ts

@@ -13,5 +13,4 @@ export const upsSummariesRequestHandler = createIntegrationRequestHandler<
     const integrationInstance = await createIntegrationAsync(integration);
     return await integrationInstance.getUpsSummariesAsync();
   },
-  cacheTtlMs: 60_000,
 });

packages/request-handler/src/uptime-kuma.ts

@@ -12,5 +12,4 @@ export const uptimeKumaRequestHandler = createIntegrationRequestHandler<
     const integrationInstance = await createIntegrationAsync(integration);
     return await integrationInstance.getDashboardDataAsync();
   },
-  cacheTtlMs: 60_000,
 });

packages/request-handler/src/vpn.ts

@@ -25,5 +25,4 @@ export const vpnSummaryHandler = createIntegrationRequestHandler<
       return null;
     }
   },
-  cacheTtlMs: 300_000,
 });

packages/request-handler/src/weather.ts

@@ -31,7 +31,6 @@ export const weatherRequestHandler = createWidgetRequestHandler({
       }),
     } satisfies Weather;
   },
-  cacheTtlMs: 60_000,
 });
 
 const atLocationOutput = z.object({

packages/widgets/src/docker/component.tsx

@@ -184,8 +184,12 @@ export default function DockerWidget({ options, width, isEditMode }: WidgetCompo
   const t = useScopedI18n("docker");
   const isTiny = width <= 256;
 
-  const { data, refetch, isFetching } = clientApi.docker.getContainers.useQuery(undefined, {
-    refetchInterval: 20_000,
+  const {
+    data,
+    refetch,
+    isFetching,
+  } = clientApi.docker.getContainers.useQuery(undefined, {
+    refetchInterval: 30_000,
   });
   const containers = data?.containers ?? [];
   const timestamp = useMemo(() => data?.timestamp ?? new Date(), [data?.timestamp]);
@@ -300,7 +304,9 @@ export default function DockerWidget({ options, width, isEditMode }: WidgetCompo
               {t("table.totalMemory", { memory: formatBytes(totals.memory) })}
             </Text>
 
-            <Tooltip label={t("table.refresh.lastUpdated", { when: relativeTime })}>
+            <Tooltip
+              label={t("table.refresh.lastUpdated", { when: relativeTime })}
+            >
               <ActionIcon
                 size="sm"
                 variant="transparent"

pnpm-workspace.yaml

@@ -18,7 +18,7 @@ catalog:
   "@gitbeaker/rest": ^43.8.0
   "@homarr/gridstack": ^1.12.0
   "@homarr/node-unifi": ^2.6.0
-  "@immich/sdk": ^3.0.2
+  "@immich/sdk": ^3.0.1
   "@jellyfin/sdk": ^0.13.0
   "@kubernetes/client-node": ^1.4.0
   "@modelcontextprotocol/sdk": 1.29.0
@@ -93,11 +93,11 @@ catalog:
   "@types/video.js": ^7.3.58
   "@types/ws": ^8.18.1
   "@types/xml2js": ^0.4.14
-  posthog-js: ^1.399.0
-  posthog-node: ^5.40.0
+  posthog-js: ^1.398.2
+  posthog-node: ^5.39.2
   "@vitejs/plugin-react": ^6.0.3
-  "@vitest/coverage-v8": ^4.1.10
-  "@vitest/ui": ^4.1.10
+  "@vitest/coverage-v8": ^4.1.9
+  "@vitest/ui": ^4.1.9
   "@xterm/addon-canvas": ^0.7.0
   "@xterm/addon-fit": 0.11.0
   "@xterm/xterm": ^6.0.0
@@ -139,20 +139,20 @@ catalog:
   jsonpath-plus: ^10.4.0
   ldapts: 8.1.8
   lodash.clonedeep: ^4.5.0
-  lucide-react: ^1.24.0
+  lucide-react: ^1.23.0
   "mantine-contextmenu": ^9.3.1
   mantine-datatable: ^9.3.1
   mantine-react-table: npm:mantine-react-table-open@9.0.3
   mcp-handler: ^1.1.0
   maria2: ^0.4.1
-  mysql2: 3.22.6
+  mysql2: 3.22.5
   next: 16.2.10
   next-auth: 5.0.0-beta.31
   next-intl: 4.13.1
   node-loader: ^2.1.0
   octokit: ^5.0.5
   oxfmt: ^0.58.0
-  oxlint: ^1.73.0
+  oxlint: ^1.72.0
   pg: ^8.22.0
   postcss-preset-mantine: ^1.18.0
   prismjs: ^1.30.0
@@ -177,13 +177,13 @@ catalog:
   tsdav: ^2.3.0
   tsx: 4.20.4
   turbo: ^2.10.4
-  typescript: "npm:@typescript/typescript6@^6.0.2"
-  vite: ^8.1.4
+  typescript: ^6.0.3
+  vite: ^8.1.2
   undici: 7.28.0
   use-deep-compare-effect: ^1.8.1
   video.js: ^8.23.9
   vite-tsconfig-paths: ^6.1.1
-  vitest: ^4.1.10
+  vitest: ^4.1.9
   winston: 3.19.0
   ws: ^8.21.0
   xml2js: ^0.6.2
@@ -229,7 +229,7 @@ overrides:
   "tar-fs@>=3.0.0 <3.0.9": ">=3.1.3"
   "tar-fs@>=2.0.0 <2.1.3": ">=3.1.3"
   "tmp@<=0.2.3": ">=0.2.7"
-  "vite@>=5.0.0 <=5.4.18": ">=8.1.4"
+  "vite@>=5.0.0 <=5.4.18": ">=8.1.3"
 patchedDependencies:
   "@types/node-unifi": "patches/@types__node-unifi.patch"
   "trpc-to-openapi": "patches/trpc-to-openapi.patch"

tooling/github/setup/action.yml

@@ -4,11 +4,26 @@ description: "Common setup steps for Actions"
 runs:
   using: composite
   steps:
-    - uses: pnpm/action-setup@v6
-    - uses: actions/setup-node@v6
-      with:
-        node-version: 24.18.0
-        cache: "pnpm"
+    # Node (and any other tools) are provisioned from mise.toml, the single
+    # source of truth for tool versions.
+    - name: Install tools with mise
+      uses: jdx/mise-action@v4
 
-    - shell: bash
+    - name: Install pnpm
+      uses: pnpm/action-setup@v6
+
+    - name: Locate pnpm store
+      shell: bash
+      run: echo "PNPM_STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_ENV"
+
+    - name: Cache pnpm store
+      uses: actions/cache@v6
+      with:
+        path: ${{ env.PNPM_STORE_PATH }}
+        key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
+        restore-keys: |
+          pnpm-store-${{ runner.os }}-
+
+    - name: Install dependencies
+      shell: bash
       run: pnpm install --frozen-lockfile