fix(auth): patch critical Auth.js vulnerabilities

Each visible chart row was hardcoded to a fixed pixel height (110px in
advanced mode, 56px-capped in compact) regardless of the widget's actual
tile size - resizing the tile taller left the extra height unused, and
some visible charts required scrolling to reach.

Divide the available height evenly across rows using CSS Grid's
grid-auto-rows: 1fr (the Stack fills the tile via a definite pixel
height, the SimpleGrid grows into it via flex and divides its rows
evenly) rather than computing a per-chart pixel height in JS. Confirmed
via live inspection of a deployed board that Mantine's h prop is not
safe for this: its rem() converter strips a "px" suffix from any string
before checking whether it's a parseable number, so even a literal pixel
*string* passed through h= gets rescaled by rem() * var(--mantine-scale)
exactly like a raw number would - style.height is the only way to set
an exact, un-rescaled pixel value.

.agents/skills/codebase-context/SKILL.md

@@ -0,0 +1,40 @@
+---
+name: codebase-context
+description: Navigate Homarr's monorepo architecture and reuse shared packages. Use when locating code, choosing a package boundary, understanding runtime services, tRPC, databases, widgets, integrations, cron jobs, Custom Widgets, Workshop, or checking @homarr/common before creating a utility.
+---
+
+# Homarr Codebase Context
+
+Orient from the current checkout before editing. Treat package manifests, exports, and source as authoritative when they differ from this snapshot.
+
+## Workflow
+
+1. Confirm the branch and inspect the nearest `package.json`, existing sibling modules, and package exports.
+2. Search `@homarr/common` before creating a general-purpose helper. Read [references/common.md](references/common.md) for every public entrypoint and export.
+3. Read [references/architecture.md](references/architecture.md) when the task crosses packages, runtimes, routing, data, widgets, integrations, cron jobs, Custom Widgets, or Workshop.
+4. Keep the change in the deepest package that owns the behavior. Reuse public entrypoints rather than deep-importing implementation files.
+5. Re-run targeted searches before documenting counts, consumers, or dependency edges; these change faster than the architectural seams.
+
+## Current toolchain
+
+- Use Node `24.18.0` from `mise.toml` and pnpm `11.15.1` from `package.json`.
+- Use pnpm workspaces with Turborepo. Workspace packages use the `@homarr/` scope and catalog-managed dependencies.
+- Use Next.js App Router, TypeScript, tRPC, Drizzle, Mantine v9, Tabler icons, Jotai, TanStack Query, next-intl, Vitest, and Playwright.
+- Use oxlint and oxfmt. Mantine is the application UI system; Tailwind is limited to the docs app.
+- `pnpm dev` starts only `@homarr/nextjs`. Start a standalone runtime explicitly when the task needs it.
+
+## High-value seams
+
+- Server/RSC tRPC: `@homarr/api/server`
+- Client tRPC hooks: `@homarr/api/client`
+- Main router: `packages/api/src/root.ts`
+- MCP eager router: `packages/api/src/mcp.ts`
+- Database schemas: `packages/db/schema/{sqlite,mysql,postgresql}.ts`
+- Widget registry: `packages/widgets/src/registry.ts`
+- Widget loading manifest: `packages/widgets/src/manifest.ts`
+- Integration definitions: `packages/definitions/src/integration.ts`
+- Integration factory: `packages/integrations/src/base/creator.ts`
+- Cron jobs: `packages/cron-jobs/src/jobs/`
+- App routes: `apps/nextjs/src/app/[locale]/`
+
+When a code change affects users, invoke `documentation-sync`. When exposing tRPC through MCP, invoke `mcp-integration`.

.agents/skills/codebase-context/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Homarr Codebase Context"
+  short_description: "Navigate Homarr architecture and shared APIs"
+  default_prompt: "Use $codebase-context to locate the right Homarr package and reuse existing shared APIs."

.agents/skills/codebase-context/references/architecture.md

@@ -0,0 +1,110 @@
+# Homarr architecture
+
+## Contents
+
+- [Applications and runtimes](#applications-and-runtimes)
+- [Package map](#package-map)
+- [Dependency direction](#dependency-direction)
+- [Core patterns](#core-patterns)
+- [Commands and conventions](#commands-and-conventions)
+
+## Applications and runtimes
+
+| Path             | Role                                                                                     |
+| ---------------- | ---------------------------------------------------------------------------------------- |
+| `apps/nextjs`    | Main Next.js application and HTTP APIs on port 3000                                      |
+| `apps/docs`      | Docusaurus documentation site on port 3003                                               |
+| `apps/tasks`     | Cron-job initialization and scheduling runtime; it does not expose the old port-3002 API |
+| `apps/websocket` | tRPC WebSocket subscriptions on port 3001                                                |
+| `apps/workshop`  | Go/PocketBase Workshop service and provider integration                                  |
+
+`pnpm dev` runs only `@homarr/nextjs`. Use `pnpm --filter @homarr/tasks dev`, `pnpm --filter @homarr/websocket dev`, or `pnpm dev:docs` when a task needs those runtimes.
+
+In production, `apps/nextjs/src/instrumentation-node.ts` starts the tasks and WebSocket runtimes inside the Node process. Nginx listens on port 7575, proxies `/websockets` to port 3001, and sends other traffic to port 3000. Redis can run internally or externally.
+
+## Package map
+
+### Foundation and domain
+
+- `core`: environment validation, database and Redis factories, logging, infrastructure.
+- `definitions`: domain enums, integration definitions, widget kinds, permissions.
+- `common`: shared utilities with environment-specific entrypoints. Search it before adding helpers.
+- `validation`: shared Zod schemas.
+- `server-settings`: typed server-setting keys and access.
+
+### Data, identity, and transport
+
+- `db`: Drizzle schemas, queries, migrations, and three database drivers.
+- `auth`: Auth.js/NextAuth configuration, sessions, providers, and API keys.
+- `api`: tRPC routers, contexts, MCP metadata extraction, OpenAPI, and client/server entrypoints.
+- `redis`: Redis clients, pub/sub channels, and caches.
+- `cron-jobs-core`, `cron-jobs`, `cron-job-status`: scheduling primitives, job implementations, and status transport.
+
+### Backends and external systems
+
+- `integrations`: typed clients for external applications.
+- `request-handler`: shared server request flows.
+- `docker`, `ping`, `image-proxy`, `icons`, `analytics`: bounded infrastructure capabilities.
+- `custom-widgets`: Custom JSX v2 schema, validation, runtime, and security contracts.
+- `workshop`: TypeScript Workshop client, backend contracts, and schemas used by Homarr.
+
+### UI and composed features
+
+- `ui`: shared Mantine components, theme, and hooks. Search here before creating a primitive.
+- `form`, `forms-collection`: Zod-backed form setup and reusable forms.
+- `modals`, `modals-collection`: modal primitives and feature modals.
+- `boards`: board state, edit mode, and cache coordination.
+- `settings`, `spotlight`, `notifications`, `onboarding`: cross-feature UI flows.
+- `widgets`: widget definitions, dynamic component loaders, and shared widget UI.
+- `translation`: next-intl configuration and locale catalogs.
+- `cli`: Node operations CLI. `tools/homarr-dev` is the separate Go developer CLI.
+
+## Dependency direction
+
+Prefer these directions; verify the exact dependency in package manifests before changing a boundary.
+
+1. Put infrastructure in `core` and stable domain names in `definitions`.
+2. Put reusable, dependency-light helpers in `common`; use its public environment-specific entrypoints.
+3. Build persistence in `db`, identity in `auth`, transport in `redis`, and external clients in `integrations`.
+4. Compose server behavior in `api`, `cron-jobs`, and request-handler packages.
+5. Build primitives in `ui`, `form`, and `modals`; compose product surfaces in widgets and collection packages.
+6. Keep app entrypoints in `apps/*` thin. Avoid moving reusable behavior into `apps/nextjs` when a package already owns it.
+
+## Core patterns
+
+### tRPC and MCP
+
+`packages/api/src/root.ts` lazily composes the application router. Server components use `@homarr/api/server`; client components use `@homarr/api/client`. MCP extraction requires the eager router in `packages/api/src/mcp.ts`, so MCP-enabled subrouters must be imported and registered there directly. Use the `mcp-integration` skill for exposure and security rules.
+
+### Databases
+
+Drizzle schemas live in parallel files under `packages/db/schema/`. `DB_DRIVER` selects `better-sqlite3`, `mysql2`, or `node-postgres`; migrations live in matching directories under `packages/db/migrations/`. Apply schema behavior consistently across all supported drivers unless the task is explicitly driver-specific.
+
+### Widgets
+
+`packages/widgets/src/registry.ts` owns the explicit widget-module and component-loader registries. `packages/widgets/src/manifest.ts` caches those loaders and exposes definitions, components, and combined resources. Widget modules use `createWidgetDefinition` and typed option builders. Data commonly comes from tRPC queries or Redis-backed cron results. Use existing shared widget components before creating local variants.
+
+### Integrations
+
+`packages/definitions/src/integration.ts` owns `integrationDefs` and `IntegrationKind`. `packages/integrations/src/base/creator.ts` owns `createIntegrationAsync`; concrete integrations implement the shared base contract. Keep credentials and permission checks on server-owned paths.
+
+### Cron jobs
+
+Jobs live in `packages/cron-jobs/src/jobs/` and use `createCronJob`. `apps/tasks` initializes and starts the job group. Job results and status can flow through Redis and tRPC; the retired port-3002 management-API model is no longer part of the architecture.
+
+### Routing and localization
+
+User routes live below `apps/nextjs/src/app/[locale]/`; the locale segment does not add a URL prefix. Route groups organize home and board surfaces. Administrative routes live under `manage`, Custom Widget configuration has a token route, and Workshop has a management surface.
+
+### Custom Widgets and Workshop
+
+`packages/custom-widgets` owns the Custom JSX v2 contract. `packages/workshop` is the Homarr-side client/contract package; `apps/workshop` is the separate Go/PocketBase service. Use the `homarr-custom-widget` skill for authoring and security constraints.
+
+## Commands and conventions
+
+- Read current scripts from the root or package `package.json`; avoid caching commands that do not exist.
+- Use `pnpm dev` for Next.js, `pnpm dev:docs` for docs, and `pnpm dev:cli -- <args>` for the Go developer CLI.
+- Use `pnpm docker:dev:up` for the Redis development dependency.
+- Use package-filtered typechecks or focused tests for the touched behavior.
+- Use `~/*` only inside the Next.js app. Use public `@homarr/*` entrypoints across package boundaries.
+- Keep Mantine application styles separate from the Tailwind-based docs app.

.agents/skills/codebase-context/references/common.md

@@ -0,0 +1,86 @@
+# `@homarr/common` public API
+
+## Contents
+
+- [Reuse workflow](#reuse-workflow)
+- [Entrypoints](#entrypoints)
+- [Root exports](#root-exports)
+- [Types exports](#types-exports)
+- [Server exports](#server-exports)
+- [Client and environment exports](#client-and-environment-exports)
+
+## Reuse workflow
+
+Before writing a utility, search both the public name and the behavior:
+
+```bash
+rg -n "export (const|function|class|type|interface)|export \*" packages/common
+rg -n "@homarr/common" apps packages
+```
+
+Import only from an exported package entrypoint. Do not deep-import `@homarr/common/src/*`. Check `packages/common/package.json` and the source again when adding or renaming an export; this inventory describes the current repository tree.
+
+## Entrypoints
+
+| Import                  | Source                       | Environment                                                                         |
+| ----------------------- | ---------------------------- | ----------------------------------------------------------------------------------- |
+| `@homarr/common`        | `index.ts` -> `src/index.ts` | Shared root; includes React hooks and some Next/Mantine-aware helpers               |
+| `@homarr/common/types`  | `src/types.ts`               | Type-only utilities                                                                 |
+| `@homarr/common/server` | `src/server.ts`              | Node/server-only security, encryption, request, error, and bounded-response helpers |
+| `@homarr/common/client` | `src/client.ts`              | Client-facing Next server action export                                             |
+| `@homarr/common/env`    | `env.ts`                     | Validated package environment                                                       |
+
+## Root exports
+
+| Area              | Public exports                                                                                                                                       | Purpose                                                         |
+| ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------- |
+| Objects           | `objectKeys`, `objectEntries`, `hashObjectBase64`                                                                                                    | Typed key/entry iteration and stable query-key hashing          |
+| Strings           | `capitalize`, `isNullOrWhitespace`, `bestMatch`, `normalizeImageName`, `getImageMatchRank`                                                           | Text normalization and matching                                 |
+| Cookies           | `parseCookies`, `setClientCookie`                                                                                                                    | Cookie parsing and browser cookie serialization                 |
+| Arrays            | `splitToNChunks`, `splitToChunksWithNItems`                                                                                                          | Split by number of groups or maximum group size                 |
+| Dates             | `formatDuration`, `toValidDate`, `isDateWithin`                                                                                                      | Duration formatting, safe date coercion, relative-window checks |
+| Timing            | `Stopwatch`                                                                                                                                          | Elapsed-time measurement and formatting                         |
+| React hooks       | `useTimeAgo`, `useIntegrationConnected`                                                                                                              | Relative time and integration freshness state                   |
+| URLs              | `removeTrailingSlash`, `extractBaseUrlFromHeaders`, `getPortFromUrl`, `isAbsoluteUrl`, `SAFE_NEW_TAB_REL`, `getSafeApplicationUrl`, `getSafeAppHref` | URL normalization, safe navigation, ports, and new-tab policy   |
+| Numbers and bytes | `formatNumber`, `randomInt`, `formatBytes`, `formatBytesPair`, `formatByteRate`, `metricToImperial`, `imperialToMetric`                              | Compact numbers, byte displays, rates, and unit conversion      |
+| Legacy bytes      | `humanFileSize`                                                                                                                                      | Deprecated; use the `formatBytes*` helpers in new code          |
+| Byte types        | `ByteUnitSystem`, `FormatBytesOptions`                                                                                                               | Options for byte formatting                                     |
+| Errors            | `extractErrorMessage`, `FlattenError`                                                                                                                | Unknown-error messages and flattenable domain errors            |
+| Theme             | `getMantineColor`                                                                                                                                    | Resolve a Mantine color and shade                               |
+| Functions         | `isFunction`                                                                                                                                         | Unknown-value function guard                                    |
+| Grid              | `GridAlgorithmItem`, `generateResponsiveGridFor`                                                                                                     | Responsive nested-section grid placement                        |
+| IDs               | `createId`                                                                                                                                           | CUID2 ID creation                                               |
+
+The root deliberately does not re-export `types`, `server`, `client`, or `env`; use their named entrypoints.
+
+## Types exports
+
+`@homarr/common/types` exports:
+
+- `MaybePromise<T>`
+- `AtLeastOneOf<T>`
+- `Modify<T, R>`
+- `RemoveReadonly<T>`
+- `MaybeArray<T>`
+- `Inverse<T>`
+- `inferSearchParamsFromSchema<TSchema>`
+
+## Server exports
+
+`@homarr/common/server` exports:
+
+- Security: `generateSecureRandomToken`.
+- Encryption: `encryptSecret`, `decryptSecret`, `decryptSecretWithKey`, `createKeyedFingerprint`, `verifyKeyedFingerprint`.
+- Requests: `userAgent`, `DeviceType`, `ipAddressFromHeaders`.
+- Bounded bodies: `readBoundedJsonResponseAsync`.
+- Parse errors: `ParseError`, `ParseErrorHandler`, `ZodParseErrorHandler`, `JsonParseErrorHandler`.
+- HTTP handlers: `HttpErrorHandler`, `FetchHttpErrorHandler`, `matchErrorCode`, `OFetchHttpErrorHandler`, `AxiosHttpErrorHandler`, `TsdavHttpErrorHandler`, `OctokitHttpErrorHandler`.
+- HTTP errors: `RequestError`, `ResponseError`, `requestErrorMap`.
+- HTTP error types: `AnyRequestError`, `AnyRequestErrorInput`, `RequestErrorInput`, `RequestErrorType`, `RequestErrorReason`, `AnyRequestErrorReason`, `RequestErrorCode`.
+
+`NodeFetchHttpErrorHandler` exists as an implementation file but is not exported by the public server entrypoint. Add an intentional public export before using it across packages.
+
+## Client and environment exports
+
+- `@homarr/common/client` exports `revalidatePathActionAsync`, a Next server action for page revalidation.
+- `@homarr/common/env` exports `env` with validated `NODE_ENV`, `SECRET_ENCRYPTION_KEY`, and `NO_EXTERNAL_CONNECTION` values.

.agents/skills/documentation-sync/SKILL.md

@@ -0,0 +1,51 @@
+---
+name: documentation-sync
+description: Keep Homarr's Docusaurus documentation aligned with user-facing code. Use when adding or changing integrations, widgets, APIs, environment variables, CLI commands, authentication, permissions, cron jobs, settings, or UI behavior that users must understand.
+---
+
+# Documentation Sync
+
+Update `apps/docs/` in the same change as user-facing behavior. Inspect adjacent pages and the docs types before copying a pattern; the source and docs evolve together.
+
+## Map the change
+
+| Code change                         | Documentation target                                                 |
+| ----------------------------------- | -------------------------------------------------------------------- |
+| New integration                     | `apps/docs/docs/integrations/<slug>/index.mdx` and `index.ts`        |
+| New widget                          | `apps/docs/docs/widgets/<slug>/index.mdx` and `index.ts`             |
+| Changed public or management API    | `apps/docs/docs/management/api/index.mdx`                            |
+| New or changed environment variable | Relevant page under `apps/docs/docs/advanced/` or installation docs  |
+| New or changed CLI command          | `apps/docs/docs/advanced/command-line/`                              |
+| Authentication/provider change      | Relevant SSO or authentication page under `apps/docs/docs/advanced/` |
+| UI or workflow change               | Relevant getting-started, management, widget, or integration page    |
+| Cron-job behavior                   | `apps/docs/docs/management/tasks.mdx`                                |
+| Permission behavior                 | `apps/docs/docs/management/users.mdx` and the affected feature page  |
+| Custom Widget or Workshop behavior  | Relevant Custom Widget, Assistant, or Workshop documentation         |
+
+If no existing row fits, search by the user-visible term and update the page where a user would look for the behavior:
+
+```bash
+rg -n "<term>" apps/docs/docs apps/docs/src
+```
+
+## Follow existing typed patterns
+
+For an integration:
+
+- Add or update `apps/docs/docs/integrations/<slug>/index.ts` with the local `IntegrationDefinition` pattern.
+- Add or update `index.mdx` with the established `IntegrationHeader`, `IntegrationCapabilites`, and `IntegrationSecrets` components as applicable.
+- Reuse metadata from `@homarr/definitions` when the docs app already exposes it.
+
+For a widget:
+
+- Add or update `apps/docs/docs/widgets/<slug>/index.ts` with the local `WidgetDefinition` pattern.
+- Add or update `index.mdx` with the established `WidgetHeader`, `WidgetConfig`, and `AddingWidget` components as applicable.
+- Document options, required integrations, permissions, empty states, and changed behavior that affect setup or use.
+
+## Completion criteria
+
+1. Describe the shipped behavior, not an implementation plan.
+2. Keep names, defaults, paths, screenshots, links, and prerequisites consistent with code.
+3. Update every affected page and remove superseded guidance.
+4. Run the narrowest useful docs validation. Use `pnpm turbo build --filter=@homarr/docs` when links, MDX, generated definitions, or navigation can fail; otherwise run the docs package formatter on touched files.
+5. Treat broken links and anchors as failures; Docusaurus checks them strictly.

.agents/skills/documentation-sync/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Homarr Documentation Sync"
+  short_description: "Keep user-facing docs aligned with code"
+  default_prompt: "Use $documentation-sync to map this Homarr code change to the required documentation updates."

.agents/skills/homarr-custom-widget/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: homarr-custom-widget
+description: Author, validate, preview, test, install, or configure API-backed Homarr Custom JSX v2 widgets.
+---
+
+# Homarr Custom Widget
+
+Author one widget or a coordinated set of widgets. Load only needed release-matched context. Run lifecycle tools alone; independent reads may run together. For a set, research once and finish each widget's validation, evidence, and persistence before the next.
+
+1. Read primary API documentation. Use web search when documentation is not supplied or may have changed.
+2. Create credential-free definitions with keyed `sources`, `requests`, optional `options`, and safe JSX `template`.
+3. While drafting, use `customWidget_validateTemplate` for focused JSX diagnostics without resending the manifest.
+4. Send the definition once to `customWidget_previewCreate` and test its queries/actions. For a JSX-only fix, validate, call `customWidget_previewReviseTemplate` with its session, and retest; it inherits the manifest and resets evidence. Create a preview only for source/request/option changes.
+5. Configure deployment-specific source URLs and credentials through Homarr; never repeat plaintext.
+6. Persist each exact final tested preview with `customWidget_createFromPreview`. Do not resend a large definition through `customWidget_create` when a preview session is available.
+
+Treat a supplied sample or successful preview response as the binding contract. Render every core requested field, guard optional arrays and nested values before indexing, and do not silently drop returned items. Humanize numeric enums with indexed literal label arrays, omit absent numeric values instead of inventing zero, and label timestamp timezones. Give recoverable load errors and empty states a clear refresh or retry path.
+
+Use `{option:name}` or `$option` for saved options. Use `{param:name}` or `$param` for values supplied by `SubFetch`, `ActionButton`, or `ToggleSwitch`. Load queries cannot use invocation parameters. Render load queries from `data` and `status` with `RefreshButton`; reserve `SubFetch` for manual parameterized queries. Templates read `data`, `status`, `options`, and temporary `inputs`.
+
+For a bound control that depends on another input, declare its default and set `resetKey` to that scalar dependency. For example, `<Pagination bind="page" defaultValue={1} resetKey={inputs.search} />` restores page 1 when a search changes without fetching by itself.
+
+`SubFetch` with `trigger="manual"` renders its own load button. Pass a card or image through `triggerContent` with `triggerAriaLabel` when that content should launch the request. Its callback is `(result, meta)`; callback names must not shadow the reserved roots `data`, `status`, `options`, or `inputs`. Never author `onClick` or a fetch callback. Use `Icon` or `TablerIcon` with a `name`; never invent an `IconFoo` component.
+
+Plan capabilities. Use one `customWidget_findComponents` search per job. Batch selected non-obvious binding or interaction documentation with `customWidget_getComponents`; reserve `customWidget_getComponent` for one unknown-prop repair. Failed validation reopens discovery; otherwise search only for a missing capability. The full catalog is for broad exploration; load at most one example. Context never limits composition. Prefer clear hierarchy, responsive grids, divided lists, and aligned actions over nested row cards.
+
+Do not simplify a useful workflow merely because the template is interpreted. Freely compose any supported installed components with multiple sources, requests, options, `choicesFrom`, bound filters, charts, responsive detail areas, manual queries, and safe actions when they improve the user's job. Complexity must remain purposeful rather than decorative.
+
+Polish with a divided list or responsive media grid. Make one metric/action asymmetrically primary; keep headers compact, identity/state clear, metadata quiet, and one badge. At base artwork fills its row and caps above xs; never combine full-width media and nowrap.
+
+Make initial states actionable and wrap variable labels/values on narrow tiles. Do not use an unlabeled decorative icon as an empty state.
+
+Do not use imports, hooks, refs, raw HTML, raw event callbacks, browser requests, arbitrary functions, eval, bigint, npm packages, authored statement blocks, IIFEs, or recursion. Do not pretend MCP tools exist in an offline chat session.
+
+For a community widget, use `customWidget_workshopSearch`, `customWidget_workshopGet`, then `customWidget_workshopInstall`; configure its source securely. Preview configuration expires, so create before persisting configuration.
+
+Reference routing:
+
+- Load `schema` once before a new manifest; otherwise only for concrete request or option ambiguity.
+- Load `runtime` for bound inputs, manual queries, actions, or other interaction.
+- Load `security` once for any authenticated source or mutation, or to resolve a URL or interpreter limitation.
+
+Repository installations expose these as files under `references/`. MCP clients can call `customWidget_getReference` or read `homarr://custom-widgets/references/{name}` instead of loading every reference.

.agents/skills/homarr-custom-widget/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Homarr Custom Widget"
+  short_description: "Build and deploy safe Custom JSX widgets"
+  default_prompt: "Use $homarr-custom-widget to author, validate, preview, and configure a safe Custom JSX v2 widget."

.agents/skills/homarr-custom-widget/references/runtime.md

@@ -0,0 +1,37 @@
+# Runtime
+
+Templates read `data.requestId`, `status.requestId`, `options.name`, and temporary `inputs.name`. Status is `{ loading, ok, status, statusText, error }`. Render load queries directly from `data` and `status` with `RefreshButton`; never wrap them in `SubFetch`.
+
+`bind="search"` creates an in-memory input. It is never persisted. Supply invocation values only through `params`, for example:
+
+```jsx
+<TextInput bind="search" label="Search" />
+<Pagination bind="page" resetKey={inputs.search} defaultValue={1} total={5} />
+<SubFetch requestId="search" trigger="manual" params={{ query: inputs.search }}>
+  {(result) => <Stack>{(result.results ?? []).map(item => <Text key={item.id}>{item.name}</Text>)}</Stack>}
+</SubFetch>
+```
+
+Manual queries require `trigger: "manual"` on request and `SubFetch`; otherwise they run automatically. `triggerContent` with `triggerAriaLabel` makes custom content the launcher. `SubFetch` owns loading/error/retry; its child receives success plus `{ ok, status, statusText, loading: false }`. Never author `onClick` or fetch callbacks.
+
+`SubFetch`, `ActionButton`, and `ToggleSwitch` need literal `requestId`; validation rejects missing/computed IDs.
+
+Inside a successful manual result, `<RefreshButton requestId="search" label="Run again" />` reruns the same parameters.
+
+When a manual SubFetch request ID, parameters, or effective definition changes, Homarr immediately hides its prior result and returns to the trigger. It cannot fetch the new parameters until the user triggers it again.
+
+The `SubFetch` callback receives the entire JSON response exactly as previewed. If the response is `{ "results": [...] }`, render and map `result.results`; never map the envelope itself. Trace every rendered field from the preview response before persistence.
+
+Format timestamps with safe static helpers; never use `new Date`. Never invent a formatter component. Use `Date.toLocaleString(value, "en-US", "UTC")` plus a visible `UTC` label. Also available: `Date.toISOString`, `Date.toLocaleDateString`, and `Date.toLocaleTimeString`.
+
+For compact numeric enums, index a literal label array with a fallback:
+
+```jsx
+<Text>{["Unknown", "Pending", "Ready"][(item.status ?? 1) - 1] ?? "Unknown"}</Text>
+```
+
+Every stateful control must use `bind`, and its `inputs.<name>` value must feed a supported request/helper when it is meant to change remote data. For dependent pagination, declare `defaultValue={1}` and use `resetKey={inputs.search}` to restore page 1 when the query changes. If a control cannot affect the workflow through a binding, option, or runtime helper, render concise context instead of a dead control.
+
+Callback parameters must not shadow the reserved roots `data`, `status`, `options`, or `inputs`. Use `<Icon name="refresh" />` or `<TablerIcon name="refresh" />`; never invent components such as `<IconFoo />`.
+
+Use expression callbacks for supported collections and trusted slots. No callback blocks, IIFEs, authored recursion, or raw events. Regex is limited to safe string operations.

.agents/skills/homarr-custom-widget/references/schema.md

@@ -0,0 +1,49 @@
+# Schema
+
+```ts
+interface HomarrCustomWidgetV2 {
+  $schema: "homarr-custom-widget-v2";
+  name: string;
+  description?: string;
+  iconUrl?: string;
+  sources: Record<string, CustomWidgetSource>;
+  requests: Record<string, CustomWidgetRequest>;
+  options?: Record<string, CustomWidgetOption>;
+  template: string;
+}
+```
+
+The object key `default` is the required source ID; `default` is not a property on a source. Source properties are `name?`, `baseUrl`, `networkScope`, and `auth?`:
+
+```json
+{
+  "sources": {
+    "default": {
+      "name": "Service",
+      "baseUrl": "http://service.local:5055/api/v1",
+      "networkScope": "private",
+      "auth": { "type": "apiKeyHeader", "name": "X-Api-Key" }
+    }
+  },
+  "requests": {
+    "summary": { "path": "/summary" },
+    "search": { "trigger": "manual", "path": "/search", "query": { "q": { "$param": "query" } } },
+    "create": {
+      "kind": "action",
+      "method": "POST",
+      "path": "/items",
+      "body": { "id": { "$param": "id" } },
+      "confirmation": "Create this item?",
+      "invalidates": ["search"]
+    }
+  }
+}
+```
+
+Auth is `none`, `bearer`, `basic`, `{ "type": "apiKeyHeader", "name": "X-Api-Key" }`, or `{ "type": "apiKeyQuery", "name": "api_key" }`. A request defaults to source `default`, kind `query`, method `GET`, trigger `load`, inherited auth, and view permission. Set `trigger: "manual"` for a parameterized query. An action defaults to manual and modify permission. DELETE uses full permission and confirmation. Do not use `load: false`.
+
+Use stable real URLs for public APIs and clear suggested URLs for self-hosted services. Homarr collects the installer's server URL, network scope, and credentials as source setup; credentials remain outside the manifest.
+
+Paths use `{option:name}` and `{param:name}`; query/body references use `{ "$option": "name" }` and `{ "$param": "name" }`. Constants stay primitive (`take: 10`); `$param` is only for manual helpers, never load queries. Names and types are inferred.
+
+Every option has `label`, `control`, and `default`. Optional fields are `description`, `choices`, `choicesFrom`, `min`, `max`, `step`, `advanced`, and `group`.

.agents/skills/homarr-custom-widget/references/security.md

@@ -0,0 +1,7 @@
+# Security
+
+All requests use Homarr's protected server executor. Source origin, network scope, DNS, redirects, SSRF, rate limits, permissions, size limits, timeouts, and encrypted credential injection remain enforced.
+
+The JSX interpreter blocks imports, hooks, refs, raw event callbacks, browser requests, eval, arbitrary functions, prototype access, unsafe URLs, global CSS escape, arbitrary portals, bigint, statement blocks, IIFEs, and recursion. Regex literals must be bounded and reject backreferences, lookbehind, nested quantifiers, excessive length, and unsupported flags.
+
+Credentials are stored separately and never exported or returned to an agent. A published self-hosted source URL is only a suggestion: installers must confirm or replace private and loopback URLs for their own Homarr deployment. Source origins cannot be controlled through widget options.

.agents/skills/mcp-integration/SKILL.md

@@ -0,0 +1,98 @@
+---
+name: mcp-integration
+description: Expose Homarr tRPC procedures safely through MCP. Use when adding or changing tRPC procedures under packages/api, adding MCP metadata, registering an eager MCP router, shaping tool inputs and descriptions, or reviewing MCP authorization, sensitive data, and destructive actions.
+---
+
+# MCP Integration
+
+Expose a procedure only when an AI client should call it. Preserve the procedure's existing authorization and add MCP-specific safeguards for sensitive or destructive behavior.
+
+## Assess exposure
+
+Prefer:
+
+- Data queries: list, search, get, health, stats, and summaries.
+- User-requested actions with explicit permission checks and bounded inputs.
+- Serializable results that do not reveal credentials or internal-only state.
+
+Skip subscriptions, session/onboarding internals, file streams, blobs, credential values, and procedures whose authorization or audit behavior is unclear. Ask for a security review when a mutation is destructive, tenant boundaries are ambiguous, or returned data is sensitive.
+
+## Add metadata
+
+Place `.meta()` before `.input()` and `.query()` or `.mutation()`:
+
+```typescript
+getAll: protectedProcedure
+  .meta({
+    mcp: {
+      enabled: true,
+      description: "List resources the current user can access, including stable IDs used by resource_get",
+    },
+  })
+  .input(z.object({ limit: z.number().int().min(1).max(100).default(50) }))
+  .query(async ({ ctx, input }) => {
+    // Preserve normal procedure authorization.
+  });
+```
+
+No-input procedures can omit `.input()`; the MCP extractor accepts an empty object for them.
+
+For mutations, state the effect and required permission in the description:
+
+```typescript
+remove: permissionRequiredProcedure
+  .meta({
+    mcp: {
+      enabled: true,
+      description: "Delete one resource by ID. Requires full access; get the ID from resource_all",
+    },
+  })
+  .input(z.object({ id: z.string() }))
+  .mutation(async ({ ctx, input }) => {
+    // Perform the permission-scoped action.
+  });
+```
+
+## Write discoverable descriptions
+
+Include every item that applies:
+
+- What the tool returns or changes.
+- Supported integrations or services.
+- Required IDs and the tool that returns them.
+- Permission requirements and the meaning of permission fields.
+- Important bounds, confirmation semantics, or irreversible effects.
+
+Use precise domain language. A description such as `Get calendar events` is insufficient because it omits supported services, required IDs, and result scope.
+
+## Shape inputs for clients
+
+- Use a top-level `z.object({...})` for parameterized tools.
+- Bound strings, arrays, numeric ranges, pagination, and payload sizes.
+- Use defaults where a safe, unsurprising value exists.
+- Prefer explicit fields over a top-level union or discriminated union.
+- Keep identifiers stable and describe how to obtain them.
+- Keep secrets out of inputs unless the procedure is explicitly a credential-configuration flow with server-owned encryption and non-return guarantees.
+
+## Register the eager router
+
+The application router in `packages/api/src/root.ts` is lazy. MCP tool extraction is synchronous, so add an eager import and registration in `packages/api/src/mcp.ts`:
+
+```typescript
+import { resourceRouter } from "./router/resource";
+
+export const mcpRouter = createTRPCRouter({
+  resource: resourceRouter,
+});
+```
+
+Register the smallest router that owns the enabled procedures. If a parent router uses `lazy()`, import the needed subrouter directly. Metadata on a procedure is not enough; a procedure absent from `mcpRouter` is not exposed.
+
+## Validate the tool surface
+
+1. Confirm the procedure still enforces its ordinary auth and permission boundary.
+2. Confirm `packages/api/src/mcp.ts` eagerly includes the procedure.
+3. Confirm the generated tool name, description, and JSON schema are unambiguous.
+4. Run the focused API MCP spec when the tool list or extraction changes: `pnpm test packages/api/src/test/mcp.spec.ts`.
+5. Run the focused route spec when protocol or transport behavior changes: `pnpm test apps/nextjs/src/app/api/mcp/[transport]/route.spec.ts`.
+6. If manually probing `/api/mcp/<transport>`, use a scoped API key and avoid printing credentials or secret-bearing results.

.agents/skills/mcp-integration/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Homarr MCP Integration"
+  short_description: "Expose tRPC procedures safely through MCP"
+  default_prompt: "Use $mcp-integration to expose this Homarr tRPC procedure as a safe, discoverable MCP tool."

.claude/skills

@@ -0,0 +1 @@
+../.agents/skills

.deepsource.toml

@@ -1,11 +0,0 @@
-version = 1
-
-[[analyzers]]
-name = "javascript"
-
-  [analyzers.meta]
-  plugins = ["react"]
-  environment = ["nodejs"]
-
-[[transformers]]
-name = "prettier"

.dockerignore

@@ -5,7 +5,21 @@ node_modules
 npm-debug.log
 README.md
 .next
+.turbo
+.pnpm-store
+**/.pnpm-store
+coverage
+**/coverage
+**/.docusaurus
+**/build
 .git
+.github
 dev
 .build
-e2e
+e2e
+apps/docs/*
+!apps/docs/package.json
+apps/nextjs/.next
+.env
+.env.*
+!.env.example

.env.example

@@ -30,11 +30,62 @@ DB_URL='FULL_PATH_TO_YOUR_SQLITE_DB_FILE'
 # DB_PASSWORD='password'
 # DB_NAME='name-of-database'
 
-# The below path can be used to store trusted certificates during development, it is not required and can be left empty.
+# The following is an example on how to use the node-postgres driver:
+# DB_DRIVER='node-postgres'
+# DB_URL='postgres://user:password@host:port/database'
+
+# The below path can be used to store trusted certificates, it is not required and can be left empty.
+# If it is empty, it will default to `/appdata/trusted-certificates` in production.
 # If it is used, please use the full path to the directory where the certificates are stored.
 # LOCAL_CERTIFICATE_PATH='FULL_PATH_TO_CERTIFICATES'
 
 TURBO_TELEMETRY_DISABLED=1
 
+# Turborepo remote cache (optional, for faster CI/local builds)
+# Uncomment and fill in to enable remote caching locally.
+# CI uses GitHub secrets for these values automatically.
+# TURBO_API=https://your-cache-worker.workers.dev
+# TURBO_TEAM=team_your_team
+# TURBO_TOKEN=your-turbo-token
+# TURBO_REMOTE_CACHE_SIGNATURE_KEY=your-signature-key
+
+# Comma-separated paths to Docker-compatible Unix sockets.
+# Useful for connecting to multiple runtimes (Docker + Podman) simultaneously.
+# When unset and no TCP hosts configured, defaults to /var/run/docker.sock.
+# Example: DOCKER_SOCKET_PATHS=/var/run/docker.sock,/run/user/1000/podman/podman.sock
+# DOCKER_SOCKET_PATHS=
+
 # Enable kubernetes tool
-# ENABLE_KUBERNETES=true
+# ENABLE_KUBERNETES=true
+
+# Enable mock integration
+UNSAFE_ENABLE_MOCK_INTEGRATION=true
+
+# Public URL contract. Values must be absolute HTTP(S) URLs without credentials,
+# query strings, or fragments. Trailing slashes are normalized at startup.
+HOMARR_WEBSITE_URL=https://homarr.dev
+# PocketBase API used by Homarr and by the standalone documentation site.
+# Defaults to HOMARR_WEBSITE_URL.
+# WORKSHOP_API_URL=https://homarr.dev
+# Public Workshop website used by links in Homarr, Custom Widgets, onboarding,
+# and assistant context. Defaults to HOMARR_WEBSITE_URL/workshop.
+# WORKSHOP_WEB_URL=https://homarr.dev/workshop
+
+# Documentation and PocketBase deployment settings.
+# WORKSHOP_PUBLIC_ORIGIN=https://homarr.dev
+# PB_ALLOWED_ORIGINS=*
+
+# Local Workshop stack:
+# HOMARR_WEBSITE_URL=http://127.0.0.1:3003
+# WORKSHOP_API_URL=http://127.0.0.1:8090
+# WORKSHOP_WEB_URL=http://127.0.0.1:3003/workshop
+# WORKSHOP_PUBLIC_ORIGIN=http://127.0.0.1:3003
+# Optional: GITHUB_CLIENT_ID=
+# Optional: GITHUB_CLIENT_SECRET=
+
+# Enable demo mode (seeds a demo user "demo"/"demo", a sample board and a mock integration)
+# DEMO_MODE=true
+
+# Whether demo mode is read-only. Defaults to true (the public demo blocks all mutations).
+# Set to false for writable preview deployments so the demo user can modify the dashboard.
+# DEMO_READ_ONLY=false

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -31,6 +31,84 @@ body:
       label: Version
       description: What version of Homarr are you running?
       options:
+        # The below comment is used to insert a new version with on-release.yml
+        #NEXT_VERSION#
+        - 1.76.2
+        - 1.76.1
+        - 1.76.0
+        - 1.75.0
+        - 1.74.0
+        - 1.73.0
+        - 1.72.0
+        - 1.71.0
+        - 1.70.0
+        - 1.69.2
+        - 1.69.0
+        - 1.68.0
+        - 1.67.0
+        - 1.66.1
+        - 1.66.0
+        - 1.65.0
+        - 1.64.0
+        - 1.62.0
+        - 1.61.0
+        - 1.60.1-beta.1
+        - 1.60.0
+        - 1.59.3
+        - 1.59.2
+        - 1.59.1
+        - 1.59.0
+        - 1.58.1
+        - 1.58.0
+        - 1.57.1
+        - 1.57.0
+        - 1.56.1
+        - 1.56.0
+        - 1.55.0
+        - 1.54.0
+        - 1.53.0
+        - 1.52.0
+        - 1.51.0
+        - 1.50.1
+        - 1.50.0
+        - 1.49.1
+        - 1.49.0
+        - 1.48.0
+        - 1.47.0
+        - 1.46.0
+        - 1.45.3
+        - 1.45.2
+        - 1.45.1
+        - 1.45.0
+        - 1.44.0
+        - 1.43.1
+        - 1.43.0
+        - 1.42.1
+        - 1.42.0
+        - 1.41.0
+        - 1.40.0
+        - 1.39.0
+        - 1.38.0
+        - 1.37.0
+        - 1.36.1
+        - 1.36.0
+        - 1.35.1
+        - 1.35.0
+        - 1.34.0
+        - 1.33.0
+        - 1.32.0
+        - 1.31.0
+        - 1.30.1
+        - 1.30.0
+        - 1.29.0
+        - 1.28.1
+        - 1.28.0
+        - 1.27.0
+        - 1.26.0
+        - 1.25.0
+        - 1.24.0
+        - 1.23.0
+        - 1.22.0
         - 1.21.0
         - 1.20.0
         - 1.19.1

.github/ISSUE_TEMPLATE/integration.yml

@@ -25,16 +25,16 @@ body:
       label: Public API available?
       description: Is there a public API available, that we can consume in Homarr?
       options:
-        - Yes, available on a website
-        - Yes, available in the application itself
-        - No
+        - "Yes, available on a website"
+        - "Yes, available in the application itself"
+        - "No"
     validations:
       required: true
   - type: dropdown
     attributes:
       label: Are you willing to contribute this yourself?
       options:
-      - Yes
-      - No
+        - "Yes"
+        - "No"
     validations:
       required: true

.github/ISSUE_TEMPLATE/widget.yml

@@ -24,7 +24,7 @@ body:
     attributes:
       label: Are you willing to contribute this yourself?
       options:
-        - Yes
-        - No
+        - "Yes"
+        - "No"
     validations:
       required: true

.github/act/.gitignore

@@ -0,0 +1,2 @@
+.secrets
+!.secrets.example

.github/act/.secrets.example

@@ -0,0 +1,4 @@
+TURBO_API=
+TURBO_TEAM=
+TURBO_TOKEN=
+TURBO_REMOTE_CACHE_SIGNATURE_KEY=

.github/act/README.md

@@ -0,0 +1,36 @@
+# Running CI locally
+
+Install [Act](https://nektosact.com/installation/index.html) and ensure Docker is running, then use:
+
+```bash
+pnpm ci:act:fast
+pnpm ci:act:docker
+pnpm ci:act:all
+pnpm ci:act:cleanup
+```
+
+`fast` runs the quality gate. `docker` and `all` run the gate followed by the single container build, E2E suite, and memory regression test. `cleanup` validates the manual cleanup path without calling GitHub. The wrapper supports regular clones and Git worktrees, including non-default Docker contexts. Linux dependencies are kept in Docker volumes instead of overwriting host `node_modules`. The first run downloads the Act runner and Playwright browser dependencies.
+
+Remote caching is optional locally. Copy `.github/act/.secrets.example` to `.github/act/.secrets`, populate it with rotated credentials, and run with:
+
+```bash
+ACT_SECRET_FILE=.github/act/.secrets pnpm ci:act:all
+```
+
+Act never publishes or deletes GHCR images. The secret file is ignored by Git.
+
+## PR preview images
+
+Successful non-draft pull requests from this repository publish an amd64 image:
+
+```bash
+docker pull ghcr.io/homarr-labs/homarr-test:pr-<number>
+```
+
+The tag is replaced when the pull request is updated and deleted when it closes. Production Homarr images remain the supported multi-architecture releases. The `homarr-test` package must be configured as public in GHCR for unauthenticated testers.
+
+## Dokploy preview cache
+
+Keep `needs-demo` as the Dokploy preview label. Under the application's **Preview Build-time Secrets**, configure `TURBO_API`, `TURBO_TEAM`, `TURBO_TOKEN`, and `TURBO_REMOTE_CACHE_SIGNATURE_KEY`. Dokploy passes these to the Dockerfile as BuildKit secrets. Do not configure the token or signature key as Docker build arguments.
+
+Rotate any credentials that have appeared in chat, logs, or committed configuration before enabling the cache.

.github/actions/extract-build-artifact/action.yaml

@@ -0,0 +1,64 @@
+name: Extract Build Artifact
+description: Extracts artifacts from an existing Docker image to be used for from source installation
+inputs:
+  digest:
+    description: Digest of Docker image to use
+    required: true
+  architecture:
+    description: Name of architecture, will be used to build artifact content (amd64 or arm64)
+    required: true
+  release-tag:
+    description: Tag of the release to which the artifact will be attached
+    required: true
+  repository:
+    description: Repository to which the release belongs, e.g. owner/repo
+    required: true
+  token:
+    description: GitHub token with permissions to upload release assets
+    required: true
+runs:
+  using: "composite"
+  steps:
+    - name: Prebuilt debian dependencies
+      uses: ./.github/actions/prebuilt-debian
+      id: prebuilt-debian
+      with:
+        architecture: ${{ inputs.architecture }}
+    - name: Start docker container for ${{ inputs.architecture }}
+      run: |
+        docker run --name homarr \
+          -e "SECRET_ENCRYPTION_KEY=0000000000000000000000000000000000000000000000000000000000000000" \
+          --detach --rm ${{ inputs.digest }}
+      shell: bash
+    - name: Prepare extraction
+      run: |
+        docker exec homarr cp /etc/nginx/templates/nginx.conf /app && \
+        mkdir -p ${{ runner.temp }}/extraction/${{ inputs.architecture }}
+      shell: bash
+    - name: Extract source from ${{ inputs.architecture }} container (alpine)
+      run: |
+        docker exec homarr tar -czf extraction-alpine.tar.gz -C /app . && \
+        docker cp homarr:/app/extraction-alpine.tar.gz ${{ runner.temp }}/extraction/${{ inputs.architecture }}/build-alpine-${{ inputs.architecture }}.tar.gz && \
+        docker exec homarr rm /app/extraction-alpine.tar.gz
+      shell: bash
+    - name: Extract source from ${{ inputs.architecture }} container (debian)
+      run: |
+        docker cp ${{ steps.prebuilt-debian.outputs.path }}/. homarr:/app/build && \
+        docker cp ${{ steps.prebuilt-debian.outputs.path }}/. homarr:/app/node_modules/better-sqlite3/build/Release && \
+        docker exec homarr tar -czf extraction-debian.tar.gz -C /app . && \
+        docker cp homarr:/app/extraction-debian.tar.gz ${{ runner.temp }}/extraction/${{ inputs.architecture }}/build-debian-${{ inputs.architecture }}.tar.gz
+      shell: bash
+    - name: Stop ${{ inputs.architecture }} container
+      if: always()
+      run: docker container remove --force --volumes homarr
+      shell: bash
+    - name: Add build archive to release (alpine)
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+      run: gh release upload --repo ${{ inputs.repository }} ${{ inputs.release-tag }} ${{ runner.temp }}/extraction/${{ inputs.architecture }}/build-alpine-${{ inputs.architecture }}.tar.gz --clobber
+      shell: bash
+    - name: Add build archive to release (debian)
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+      run: gh release upload --repo ${{ inputs.repository }} ${{ inputs.release-tag }} ${{ runner.temp }}/extraction/${{ inputs.architecture }}/build-debian-${{ inputs.architecture }}.tar.gz --clobber
+      shell: bash

.github/actions/prebuilt-debian/action.yaml

@@ -0,0 +1,39 @@
+name: Prebuilt dependencies for debian
+description: Provides prebuilt dependencies for debian based docker images
+inputs:
+  architecture:
+    description: Name of architecture, will be used to build docker image (e.g. amd64, arm64)
+    required: true
+outputs:
+  path:
+    description: Path to extracted prebuilt dependencies
+    value: ${{ runner.temp }}/prebuilts
+runs:
+  using: "composite"
+  steps:
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v4
+
+    - name: Build docker image for ${{ inputs.architecture }}
+      id: build
+      uses: docker/build-push-action@v7
+      with:
+        push: false
+        load: true
+        context: ./deployments/prebuilt-debian
+        platforms: linux/${{ inputs.architecture }}
+        tags: prebuilt-debian
+    - name: Start docker container for ${{ inputs.architecture }}
+      run: |
+        docker run --name prebuilt-debian \
+          --detach --rm prebuilt-debian
+      shell: bash
+    - name: Extract prebuilt dependencies from ${{ inputs.architecture }} container
+      run: |
+        mkdir -p ${{ runner.temp }}/prebuilts && \
+        docker cp prebuilt-debian:/app/node_modules/better-sqlite3/build/Release/better_sqlite3.node ${{ runner.temp }}/prebuilts/better_sqlite3.node
+      shell: bash
+    - name: Stop ${{ inputs.architecture }} container
+      if: always()
+      run: docker container remove --force --volumes prebuilt-debian
+      shell: bash

.github/pull_request_template.md

@@ -6,8 +6,16 @@
 
 **Thank you for your contribution. Please ensure that your pull request meets the following pull request:**
 
-- [ ] Builds without warnings or errors (``pnpm build``, autofix with ``pnpm format:fix``)
-- [ ] Pull request targets ``dev`` branch
+- [ ] Builds without warnings or errors (`pnpm build`, autofix with `pnpm format:fix`)
+- [ ] Pull request targets `dev` branch
 - [ ] Commits follow the [conventional commits guideline](https://www.conventionalcommits.org/en/v1.0.0/)
-- [ ] No shorthand variable names are used (eg. ``x``, ``y``, ``i`` or any abbrevation)
+- [ ] No shorthand variable names are used (eg. `x`, `y`, `i` or any abbrevation)
+- [ ] Documentation is up to date. Create a pull request [here](https://github.com/homarr-labs/documentation/).
+- [ ] When using AI; No temp files are checked in, the code style follows the rest of the project
 
+**When contributing a new integration or widget:**
+
+- [ ] I confirmed manually that the integration or widget is working with a real system and performed basic smoke
+      tests (e.g. what happens if it is offline)
+- [ ] Optional but recommended: I confirm that I am willing to be added to the `CODEOWNERS` of this feature and will
+      provide support and maintain the integration (e.g. in case of breaking or failure)

.github/renovate.json5

@@ -1,19 +1,53 @@
 {
   $schema: "https://docs.renovatebot.com/renovate-schema.json",
-  extends: ["config:recommended"],
+  extends: ["config:recommended", ":dependencyDashboardApproval"],
   packageRules: [
     {
-      matchPackagePatterns: ["^@homarr/"],
+      matchPackageNames: ["^@homarr/"],
+      enabled: false,
+    },
+    // Reenable once https://github.com/privatenumber/tsx/issues/737 is fixed
+    {
+      matchPackageNames: ["tsx"],
+      enabled: false,
+    },
+    // Reenable once bug with undici v8 is fixed (https://github.com/homarr-labs/homarr/issues/5467)
+    {
+      matchPackageNames: ["undici"],
+      matchNewValue: "8.*",
       enabled: false,
     },
     {
       matchUpdateTypes: ["minor", "patch", "pin", "digest"],
       automerge: true,
     },
+    {
+      // disallow automerge for allowBuilds dependencies (native builds need manual verification)
+      matchPackageNames: [
+        "@tree-sitter-grammars/tree-sitter-yaml",
+        "bcrypt",
+        "better-sqlite3",
+        "cpu-features",
+        "esbuild",
+        "sharp",
+        "ssh2",
+        "tree-sitter",
+        "tree-sitter-json",
+      ],
+      automerge: false,
+    },
   ],
+  // Updates lockfile for prebuilt-debian after if package.json is updated, otherwise only root lockfile is updated
+  postUpgradeTasks: {
+    commands: ["cd deployments/prebuilt-debian && pnpm install --ignore-workspace --lockfile-only"],
+    fileFilters: ["deployments/prebuilt-debian/pnpm-lock.yaml"],
+    executionMode: "update",
+  },
   updateInternalDeps: true,
   rangeStrategy: "bump",
   automerge: false,
-  baseBranches: ["dev"],
-  dependencyDashboard: false,
+  baseBranchPatterns: ["dev"],
+  dependencyDashboard: true,
+  // prevent special characters in branch names (otherwise git errors occur on windows)
+  branchNameStrict: true,
 }

.github/workflows/autofix.yml

@@ -0,0 +1,35 @@
+name: Formatting
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+    branches: ["**"]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  format:
+    name: Check formatting
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup
+        uses: ./tooling/github/setup
+
+      - name: Check changed files
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: |
+          git diff --name-only --diff-filter=ACMR -z "origin/${BASE_REF}...HEAD" -- \
+            '*.css' '*.js' '*.json' '*.jsonc' '*.jsx' '*.md' '*.mdx' '*.scss' '*.ts' '*.tsx' '*.yaml' '*.yml' \
+            | xargs -0 -r pnpm exec oxfmt --check --

.github/workflows/automatic-approval.yml

@@ -1,25 +0,0 @@
-name: "[Dependency Updates] Auto Approve"
-on:
-  pull_request:
-    types: [opened, synchronize]
-
-jobs:
-  approve-automatic-prs:
-    runs-on: ubuntu-latest
-    if: github.actor_id == 158783068 || github.actor_id == 190541745 || github.actor_id == 210161987 # Id of renovate bot and crowdin bot see https://api.github.com/users/homarr-renovate%5Bbot%5D and https://api.github.com/users/homarr-crowdin%5Bbot%5D and https://api.github.com/users/homarr-update-contributors%5Bbot%5D
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-      - name: Obtain token
-        id: obtainToken
-        uses: tibdex/github-app-token@v2
-        with:
-          private_key: ${{ secrets.RENOVATE_APPROVE_PRIVATE_KEY }}
-          app_id: ${{ secrets.RENOVATE_APPROVE_APP_ID }}
-      - name: Install GitHub CLI
-        run: sudo apt-get install -y gh
-      - name: Approve automatic PRs
-        env:
-          GITHUB_TOKEN: ${{ steps.obtainToken.outputs.token }}
-        run: |
-          gh pr review ${{github.event.pull_request.number}} --approve --body "Automatically approved by GitHub Action"

.github/workflows/bot-auto-merge-reconcile.yml

@@ -0,0 +1,43 @@
+name: "[Bots] Reconcile Auto-merge"
+
+on:
+  schedule:
+    - cron: "*/30 * * * *"
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  reconcile:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Obtain token
+        id: obtainToken
+        uses: actions/create-github-app-token@v3
+        with:
+          private-key: ${{ secrets.RENOVATE_APPROVE_PRIVATE_KEY }}
+          client-id: ${{ secrets.RENOVATE_APPROVE_APP_ID }}
+          permission-pull-requests: write # required to enable auto-merge
+
+      - name: Install GitHub CLI
+        run: sudo apt-get install -y gh
+
+      - name: Re-enable auto-merge for prepared bot PRs
+        env:
+          GITHUB_TOKEN: ${{ steps.obtainToken.outputs.token }}
+        run: |
+          # 158783068: homarr-renovate[bot]
+          # 190541745: homarr-crowdin[bot]
+          # 210161987: homarr-update-contributors[bot]
+          # 175441: homarr-releases[bot]
+          gh pr list --repo "${{ github.repository }}" --base dev --state open --limit 100 \
+            --json number,author,reviewDecision,mergeStateStatus,autoMergeRequest \
+            --jq '.[] | select(.author.login as $login | ["app/homarr-renovate", "app/homarr-crowdin", "app/homarr-update-contributors", "app/homarr-releases"] | index($login)) | select(.reviewDecision == "APPROVED") | select(.mergeStateStatus == "CLEAN") | select(.autoMergeRequest == null) | .number' \
+          | while read -r pr; do
+              echo "Re-enabling auto-merge on PR #$pr"
+              gh pr merge "$pr" --auto --squash
+            done

.github/workflows/bot-pr-automerge.yml

@@ -0,0 +1,47 @@
+name: "[Bots] Approve and Auto-merge"
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+permissions: {}
+
+jobs:
+  approve-and-automerge:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    # 158783068: homarr-renovate[bot]
+    # 190541745: homarr-crowdin[bot]
+    # 210161987: homarr-update-contributors[bot]
+    # 175441: homarr-releases[bot]
+    # Extracted from https://api.github.com/users/<username>
+    if: |
+      (github.actor_id == 158783068 || github.actor_id == 190541745 || github.actor_id == 210161987 || github.actor_id == 175441) &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.base.ref == 'dev'
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Obtain token
+        id: obtainToken
+        uses: actions/create-github-app-token@v3
+        with:
+          private-key: ${{ secrets.RENOVATE_APPROVE_PRIVATE_KEY }}
+          client-id: ${{ secrets.RENOVATE_APPROVE_APP_ID }}
+          permission-pull-requests: write # required to approve a pull request and enable auto-merge
+
+      - name: Install GitHub CLI
+        run: sudo apt-get install -y gh
+
+      - name: Approve and enable auto-merge
+        env:
+          GITHUB_TOKEN: ${{ steps.obtainToken.outputs.token }}
+        run: |
+          PR_NUMBER="${{ github.event.pull_request.number }}"
+          if [ "$(gh pr view "$PR_NUMBER" --json reviewDecision --jq .reviewDecision)" != "APPROVED" ]; then
+            gh pr review "$PR_NUMBER" --approve --body "Automatically approved by Homarr bot policy"
+          fi
+          if [ "$(gh pr view "$PR_NUMBER" --json autoMergeRequest --jq '.autoMergeRequest != null')" != "true" ]; then
+            gh pr merge "$PR_NUMBER" --auto --squash
+          fi

.github/workflows/ci.yml

@@ -0,0 +1,454 @@
+name: CI
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    branches: ["**"]
+  pull_request_target:
+    types: [closed]
+    branches: ["**"]
+  push:
+    branches: [main, dev, beta, next, v2, release/v2]
+  merge_group:
+  workflow_dispatch:
+    inputs:
+      operation:
+        description: Operation to run
+        required: true
+        default: validate
+        type: choice
+        options:
+          - validate
+          - publish
+          - cleanup
+      pr_number:
+        description: PR number for publish or cleanup
+        required: false
+        type: number
+      ref:
+        description: Git ref to validate or publish
+        required: false
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  # Every event for a PR shares one group so a close event cancels stale image
+  # publication and a newer synchronize run cannot be overwritten by an older run.
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || inputs.pr_number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || github.event_name == 'pull_request_target' || github.event_name == 'workflow_dispatch' || github.ref != 'refs/heads/main' }}
+
+env:
+  FORCE_COLOR: 3
+  SKIP_ENV_VALIDATION: true
+  TURBO_TELEMETRY_DISABLED: 1
+  REGISTRY: ghcr.io
+  PREVIEW_IMAGE: ghcr.io/homarr-labs/homarr-test
+
+jobs:
+  fast-gate:
+    name: Fast gate
+    if: github.event_name != 'pull_request_target' && (github.event_name != 'workflow_dispatch' || inputs.operation != 'cleanup')
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    env:
+      TURBO_API: ${{ secrets.TURBO_API }}
+      TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
+      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+      TURBO_REMOTE_CACHE_SIGNATURE_KEY: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
+      TURBO_SCM_BASE: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha || github.event.before || 'HEAD~1' }}
+      TURBO_SCM_HEAD: ${{ github.sha }}
+      TURBO_PLATFORM: linux/amd64
+    steps:
+      - uses: actions/checkout@v7
+        if: "!env.ACT"
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }}
+
+      - name: Validate manual inputs
+        if: github.event_name == 'workflow_dispatch' && inputs.operation == 'publish'
+        env:
+          PR_NUMBER: ${{ inputs.pr_number }}
+          BUILD_REF: ${{ inputs.ref }}
+        run: |
+          test -n "$PR_NUMBER" || { echo "pr_number is required for publish"; exit 1; }
+          test -n "$BUILD_REF" || { echo "ref is required for publish"; exit 1; }
+
+      - name: Setup
+        uses: ./tooling/github/setup
+
+      - name: Copy environment defaults
+        run: cp .env.example .env
+
+      - name: Lint, typecheck, and build affected workspaces
+        run: pnpm turbo run lint typecheck build --affected --continue=dependencies-successful --concurrency=2
+
+      - name: Validate workspace configuration
+        run: pnpm lint:ws
+
+      - name: Validate Custom Widget architecture
+        run: pnpm check:custom-widgets
+
+      - name: Validate checked-in OpenAPI schema
+        run: pnpm check:openapi
+
+      - name: Validate Custom Widget bundle budget
+        run: |
+          pnpm --filter nextjs build
+          pnpm check:custom-widget-bundle
+
+      - name: Run unit tests
+        run: pnpm test
+
+  container:
+    name: Container and E2E
+    needs: [fast-gate, preview-amd64]
+    if: |
+      !cancelled() && needs.fast-gate.result == 'success' &&
+      (
+        github.event_name == 'merge_group' ||
+        (github.event_name == 'push' && github.ref == 'refs/heads/release/v2') ||
+        (github.event_name == 'pull_request' && github.event.pull_request.draft == false) ||
+        (github.event_name == 'workflow_dispatch' && (inputs.operation == 'validate' || inputs.operation == 'publish'))
+      )
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      packages: read
+    steps:
+      - uses: actions/checkout@v7
+        if: "!env.ACT"
+        with:
+          persist-credentials: false
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }}
+
+      - name: Setup
+        uses: ./tooling/github/setup
+
+      - name: Set up Docker Buildx
+        if: "!env.ACT"
+        uses: docker/setup-buildx-action@v4
+
+      - name: Reuse amd64 preview image
+        if: needs.preview-amd64.outputs.digest != '' && !env.ACT
+        env:
+          DIGEST: ${{ needs.preview-amd64.outputs.digest }}
+        run: |
+          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+          docker pull "${PREVIEW_IMAGE}@${DIGEST}"
+          docker tag "${PREVIEW_IMAGE}@${DIGEST}" homarr-ci
+          docker tag "${PREVIEW_IMAGE}@${DIGEST}" homarr-e2e
+
+      - name: Build container once
+        if: needs.preview-amd64.outputs.digest == '' && !env.ACT
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          network: host
+          platforms: linux/amd64
+          load: true
+          push: false
+          tags: |
+            homarr-ci
+            homarr-e2e
+          labels: |
+            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.ref.name=pr-${{ github.event.pull_request.number || inputs.pr_number || 'none' }}
+          cache-from: type=gha,scope=homarr-e2e
+          cache-to: type=gha,scope=homarr-e2e,mode=max
+          secrets: |
+            TURBO_API=${{ secrets.TURBO_API }}
+            TURBO_TEAM=${{ secrets.TURBO_TEAM }}
+            TURBO_TOKEN=${{ secrets.TURBO_TOKEN }}
+            TURBO_REMOTE_CACHE_SIGNATURE_KEY=${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
+
+      - name: Build container once with Act
+        if: env.ACT
+        env:
+          TURBO_API: ${{ secrets.TURBO_API }}
+          TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
+          TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+          TURBO_REMOTE_CACHE_SIGNATURE_KEY: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
+        run: |
+          secret_args=()
+          for secret in TURBO_API TURBO_TEAM TURBO_TOKEN TURBO_REMOTE_CACHE_SIGNATURE_KEY; do
+            if [ -n "${!secret:-}" ]; then
+              secret_args+=(--secret "id=${secret},env=${secret}")
+            fi
+          done
+          DOCKER_BUILDKIT=1 docker build --platform linux/amd64 \
+            --tag homarr-ci --tag homarr-e2e "${secret_args[@]}" .
+
+      - name: Cache Playwright browsers
+        if: "!env.ACT"
+        id: playwright-cache
+        uses: actions/cache@v6
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
+
+      - name: Install Playwright Chromium
+        if: steps.playwright-cache.outputs.cache-hit != 'true' || env.ACT
+        run: pnpm exec playwright install --with-deps chromium
+
+      - name: Install Playwright system deps
+        if: steps.playwright-cache.outputs.cache-hit == 'true'
+        run: pnpm exec playwright install-deps chromium
+
+      - name: Run E2E tests
+        env:
+          NODE_ENV: development
+          CI: "true"
+        run: pnpm exec vitest e2e --retry 1 --maxWorkers 4
+
+      - name: Upload E2E artifacts
+        if: failure() && !env.ACT
+        uses: actions/upload-artifact@v7
+        with:
+          name: playwright-report
+          path: e2e/test-results/
+          retention-days: 7
+
+  preview-amd64:
+    name: Build amd64 preview image
+    needs: fast-gate
+    if: |
+      (
+        (github.event_name == 'pull_request' && github.event.pull_request.draft == false && github.event.pull_request.head.repo.full_name == github.repository) ||
+        (github.event_name == 'push' && github.ref == 'refs/heads/release/v2') ||
+        (github.event_name == 'workflow_dispatch' && inputs.operation == 'publish')
+      )
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      packages: write
+    outputs:
+      digest: ${{ steps.preview-build.outputs.digest }}
+    steps:
+      - uses: actions/checkout@v7
+        if: "!env.ACT"
+        with:
+          persist-credentials: false
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }}
+
+      - name: Log in to GHCR
+        if: "!env.ACT"
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        if: "!env.ACT"
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build and push amd64 preview image by digest
+        id: preview-build
+        if: "!env.ACT"
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          network: host
+          platforms: linux/amd64
+          outputs: type=image,"name=${{ env.PREVIEW_IMAGE }}",push-by-digest=true,name-canonical=true,push=true
+          cache-from: type=gha,scope=homarr-linux-amd64
+          cache-to: type=gha,scope=homarr-linux-amd64,mode=max
+          secrets: |
+            TURBO_API=${{ secrets.TURBO_API }}
+            TURBO_TEAM=${{ secrets.TURBO_TEAM }}
+            TURBO_TOKEN=${{ secrets.TURBO_TOKEN }}
+            TURBO_REMOTE_CACHE_SIGNATURE_KEY=${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
+
+  preview-arm64:
+    name: Build arm64 preview image
+    needs: fast-gate
+    if: |
+      (
+        (github.event_name == 'pull_request' && github.event.pull_request.draft == false && github.event.pull_request.head.repo.full_name == github.repository) ||
+        (github.event_name == 'push' && github.ref == 'refs/heads/release/v2') ||
+        (github.event_name == 'workflow_dispatch' && inputs.operation == 'publish')
+      )
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      packages: write
+    outputs:
+      digest: ${{ steps.preview-build.outputs.digest }}
+    steps:
+      - uses: actions/checkout@v7
+        if: "!env.ACT"
+        with:
+          persist-credentials: false
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }}
+
+      - name: Log in to GHCR
+        if: "!env.ACT"
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        if: "!env.ACT"
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build and push arm64 preview image by digest
+        id: preview-build
+        if: "!env.ACT"
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          network: host
+          platforms: linux/arm64
+          outputs: type=image,"name=${{ env.PREVIEW_IMAGE }}",push-by-digest=true,name-canonical=true,push=true
+          cache-from: type=gha,scope=homarr-linux-arm64
+          cache-to: type=gha,scope=homarr-linux-arm64,mode=max
+          secrets: |
+            TURBO_API=${{ secrets.TURBO_API }}
+            TURBO_TEAM=${{ secrets.TURBO_TEAM }}
+            TURBO_TOKEN=${{ secrets.TURBO_TOKEN }}
+            TURBO_REMOTE_CACHE_SIGNATURE_KEY=${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
+
+  publish-preview:
+    name: Publish multi-platform preview image
+    needs: [container, preview-amd64, preview-arm64]
+    if: |
+      !cancelled() &&
+      needs.container.result == 'success' &&
+      needs.preview-amd64.result == 'success' &&
+      needs.preview-arm64.result == 'success' &&
+      (
+        (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) ||
+        (github.event_name == 'push' && github.ref == 'refs/heads/release/v2') ||
+        (github.event_name == 'workflow_dispatch' && inputs.operation == 'publish')
+      )
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      packages: write
+      pull-requests: read
+    env:
+      PREVIEW_TAG: ${{ github.event_name == 'push' && 'v2' || format('pr-{0}', github.event.pull_request.number || inputs.pr_number) }}
+    steps:
+      - name: Log in to GHCR
+        if: "!env.ACT"
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        if: "!env.ACT"
+        uses: docker/setup-buildx-action@v4
+
+      - name: Verify PR head before publication
+        if: github.event_name == 'pull_request'
+        uses: actions/github-script@v8
+        env:
+          EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        with:
+          script: |
+            const { data: pull } = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.payload.pull_request.number,
+            });
+            if (pull.state !== "open") {
+              core.setFailed(`PR #${pull.number} is ${pull.state}; refusing to publish its preview.`);
+              return;
+            }
+            if (pull.head.sha !== process.env.EXPECTED_HEAD_SHA) {
+              core.setFailed(`PR #${pull.number} moved from ${process.env.EXPECTED_HEAD_SHA} to ${pull.head.sha}.`);
+            }
+
+      - name: Publish preview manifest
+        if: "!env.ACT"
+        env:
+          AMD64_DIGEST: ${{ needs.preview-amd64.outputs.digest }}
+          ARM64_DIGEST: ${{ needs.preview-arm64.outputs.digest }}
+        run: |
+          tags=(-t "${PREVIEW_IMAGE}:${PREVIEW_TAG}")
+          docker buildx imagetools create "${tags[@]}" \
+            "${PREVIEW_IMAGE}@${AMD64_DIGEST}" \
+            "${PREVIEW_IMAGE}@${ARM64_DIGEST}"
+
+      - name: Verify preview manifest platforms
+        if: "!env.ACT"
+        run: |
+          tags=("${PREVIEW_TAG}")
+          for tag in "${tags[@]}"; do
+            image="${PREVIEW_IMAGE}:${tag}"
+            manifest="$(docker buildx imagetools inspect "$image" --raw)"
+            for architecture in amd64 arm64; do
+              jq --exit-status --arg architecture "$architecture" \
+                'any(.manifests[]; .platform.os == "linux" and .platform.architecture == $architecture)' \
+                <<<"$manifest" >/dev/null
+            done
+            docker buildx imagetools inspect "$image"
+          done
+
+  cleanup:
+    name: Clean up preview image
+    if: github.event_name == 'pull_request_target' || (github.event_name == 'workflow_dispatch' && inputs.operation == 'cleanup')
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      packages: write
+    env:
+      IMAGE_TAG: pr-${{ github.event.pull_request.number || inputs.pr_number }}
+    steps:
+      - name: Validate cleanup input
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          PR_NUMBER: ${{ inputs.pr_number }}
+        run: test -n "$PR_NUMBER" || { echo "pr_number is required for cleanup"; exit 1; }
+
+      - name: Delete GHCR package version
+        if: "!env.ACT"
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const packageName = "homarr-test";
+            const org = context.repo.owner;
+            const tag = process.env.IMAGE_TAG;
+            const versions = await github.paginate(
+              github.rest.packages.getAllPackageVersionsForPackageOwnedByOrg,
+              { package_type: "container", package_name: packageName, org, per_page: 100 },
+            );
+            const target = versions.find((version) =>
+              version.metadata?.container?.tags?.includes(tag),
+            );
+            if (!target) {
+              core.info(`No package version found with tag "${tag}"`);
+              return;
+            }
+            const targetTags = target.metadata?.container?.tags ?? [];
+            const extraTags = targetTags.filter((targetTag) => targetTag !== tag);
+            if (extraTags.length > 0) {
+              core.warning(
+                `Package version ${target.id} also carries tag(s) ${extraTags.map((targetTag) => `"${targetTag}"`).join(", ")}; refusing cleanup.`,
+              );
+              return;
+            }
+            await github.rest.packages.deletePackageVersionForOrg({
+              package_type: "container",
+              package_name: packageName,
+              org,
+              package_version_id: target.id,
+            });
+            core.info(`Deleted package version ${target.id} (${tag})`);
+
+      - name: Show Act cleanup result
+        if: env.ACT
+        run: echo "Act validated cleanup for ${IMAGE_TAG}; external GHCR writes are disabled locally."

.github/workflows/code-quality.yml

@@ -1,110 +0,0 @@
-name: "[Quality] Code Analysis"
-
-on:
-  pull_request:
-    branches: ["*"]
-  push:
-    branches: ["main"]
-  merge_group:
-
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}"
-  cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
-
-# You can leverage Vercel Remote Caching with Turbo to speed up your builds
-# @link https://turborepo.org/docs/core-concepts/remote-caching#remote-caching-on-vercel-builds
-env:
-  FORCE_COLOR: 3
-  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
-  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
-
-jobs:
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup
-        uses: ./tooling/github/setup
-
-      - name: Copy env
-        shell: bash
-        run: cp .env.example .env
-
-      - name: Lint
-        run: pnpm lint && pnpm lint:ws
-
-  format:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup
-        uses: ./tooling/github/setup
-
-      - name: Format
-        run: pnpm format
-
-  typecheck:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup
-        uses: ./tooling/github/setup
-
-      - name: Typecheck
-        run: turbo typecheck
-
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup
-        uses: ./tooling/github/setup
-
-      - name: Test
-        run: pnpm test
-
-      - name: "Report Coverage"
-        # Set if: always() to also generate the report if tests are failing
-        # Only works if you set `reportOnFailure: true` in your vite config as specified above
-        if: always()
-        uses: davelosert/vitest-coverage-report-action@v2
-
-  e2e:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v4
-      - name: Setup
-        uses: ./tooling/github/setup
-      - name: Build docker image
-        id: build-docker-image
-        uses: docker/build-push-action@v6
-        with:
-          platforms: linux/amd64
-          context: .
-          push: false
-          tags: homarr-e2e
-          network: host
-        env:
-          SKIP_ENV_VALIDATION: true
-      - name: Install playwright browsers
-        run: pnpm exec playwright install chromium
-      - name: Run E2E Tests
-        shell: bash
-        run: pnpm test:e2e
-
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Setup
-        uses: ./tooling/github/setup
-      - name: Copy env
-        shell: bash
-        run: cp .env.example .env
-      - name: Build
-        run: pnpm build

.github/workflows/conventions-semantic-commits.yml

@@ -1,14 +0,0 @@
-# https://github.com/webiny/action-conventional-commits?tab=readme-ov-file
-name: "[Conventions] Semantic Commits"
-
-on:
-  pull_request:
-    branches: [ dev ]
-
-jobs:
-  build:
-    name: Conventional Commits
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: webiny/action-conventional-commits@v1.3.0

.github/workflows/conventions-semantic-pull-requests.yml

@@ -13,7 +13,8 @@ permissions:
 jobs:
   validate-pull-request-title:
     runs-on: ubuntu-latest
+    timeout-minutes: 1
     steps:
-      - uses: amannn/action-semantic-pull-request@v5
+      - uses: amannn/action-semantic-pull-request@v6
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/crowdin-schedule-download.yml

@@ -5,20 +5,26 @@ on:
   schedule:
     - cron: "0 0 * * *" # every day at midnight
 
+permissions:
+  contents: write # required to push changes
+
 jobs:
   download-crowdin-translations:
+    timeout-minutes: 5
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Obtain token
         id: obtainToken
-        uses: tibdex/github-app-token@v2
+        uses: actions/create-github-app-token@v3
         with:
-          private_key: ${{ secrets.CROWDIN_APP_PRIVATE_KEY }}
-          app_id: ${{ secrets.CROWDIN_APP_ID }}
+          private-key: ${{ secrets.CROWDIN_APP_PRIVATE_KEY }}
+          client-id: ${{ secrets.CROWDIN_APP_ID }}
+          permission-contents: write # required to commit to crowdin branch
+          permission-pull-requests: write # required to create pull request
 
       - name: Download Crowdin translations
         id: crowdin-download

.github/workflows/crowdin-upload.yml

@@ -1,4 +1,6 @@
 name: "[Crowdin] Upload translations"
+permissions:
+  contents: read
 
 on:
   workflow_dispatch:
@@ -12,10 +14,11 @@ jobs:
     # Don't run this action if the downloaded translations are being pushed
     if: "!contains(github.event.head_commit.message, 'chore(lang)')"
     runs-on: ubuntu-latest
+    timeout-minutes: 5
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Upload Crowdin translations
         uses: crowdin/github-action@v2

.github/workflows/deployment-beta-release.yml

@@ -0,0 +1,104 @@
+name: "[Deployment] Beta Release"
+
+on:
+  workflow_dispatch:
+    inputs:
+      send-notifications:
+        type: boolean
+        required: false
+        default: true
+        description: Send notifications
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  create-and-merge-pr:
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    steps:
+      - name: Discord notification
+        if: ${{ github.event.inputs.send-notifications }}
+        env:
+          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
+        uses: Ilshidur/action-discord@0.4.0
+        with:
+          args: "Beta release has been triggered: [run ${{ github.run_number }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})"
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: Get Next Version
+        id: semver
+        uses: ietf-tools/semver-action@v1
+        with:
+          token: ${{ github.token }}
+          branch: next
+      - name: Create pull request
+        id: create-pull-request
+        run: 'gh pr create --title "chore(release): release ${{ steps.semver.outputs.next }}-beta" --body "Detected change to be ``${{ steps.semver.outputs.bump }}``<br/>Bump version from ``${{ steps.semver.outputs.current }}`` to ``${{ steps.semver.outputs.next }}-beta``" --base beta --head next --label automerge'
+        env:
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+      - name: Discord notification
+        if: ${{ github.event.inputs.send-notifications }}
+        env:
+          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
+        uses: Ilshidur/action-discord@0.4.0
+        with:
+          args: "Created a release PR ${{ steps.create-pull-request.outputs.url }} for version ${{ steps.semver.outputs.next }}-beta (new behaviour: ${{ steps.semver.outputs.bump }})"
+      - name: Obtain token
+        id: obtainApprovalToken
+        uses: actions/create-github-app-token@v3
+        with:
+          private-key: ${{ secrets.RENOVATE_APPROVE_PRIVATE_KEY }}
+          client-id: ${{ secrets.RENOVATE_APPROVE_APP_ID }}
+          permission-pull-requests: write
+      - name: Approve PR
+        env:
+          GITHUB_TOKEN: ${{ steps.obtainApprovalToken.outputs.token }}
+        run: |
+          gh pr review --approve --body "Automatically approved by GitHub Action"
+      - name: Obtain token
+        id: obtainMergeToken
+        uses: actions/create-github-app-token@v3
+        with:
+          private-key: ${{ secrets.RENOVATE_MERGE_PRIVATE_KEY }}
+          client-id: ${{ secrets.RENOVATE_MERGE_APP_ID }}
+          permission-contents: write # write to beta branch (due to merge)
+          permission-pull-requests: write # merge pull request
+      - id: automerge
+        if: ${{ steps.semver.outputs.bump != 'major' }}
+        name: automerge
+        uses: "pascalgn/automerge-action@v0.16.4"
+        env:
+          GITHUB_TOKEN: ${{ steps.obtainMergeToken.outputs.token }}
+          MERGE_METHOD: merge # we prefer merge commits for merging to beta
+          MERGE_COMMIT_MESSAGE: "chore(release): release ${{ steps.semver.outputs.next }}-beta"
+          MERGE_DELETE_BRANCH: false # never set to true!
+          PULL_REQUEST: "${{ steps.create-pull-request.outputs.pr_number }}"
+          MERGE_RETRIES: 20 # 20 retries * MERGE_RETRY_SLEEP until step fails
+          MERGE_RETRY_SLEEP: 10000 # 10 seconds * MERGE_RETRIES until step fails
+          MERGE_REQUIRED_APPROVALS: 0 # do not require approvals
+
+      - name: Merged Discord notification
+        if: ${{ steps.automerge.outputs.mergeResult == 'merged' && github.event.inputs.send-notifications }}
+        env:
+          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
+        uses: Ilshidur/action-discord@0.4.0
+        with:
+          args: "Merged PR ${{ steps.create-pull-request.outputs.url }} for release ${{ steps.semver.outputs.next }}-beta"
+      - name: Major Bump Discord notification
+        if: ${{ steps.semver.outputs.bump == 'major' && github.event.inputs.send-notifications }}
+        env:
+          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
+        uses: Ilshidur/action-discord@0.4.0
+        with:
+          args: "The release PR must be manually merged because the next version is a major version: ${{ steps.create-pull-request.outputs.url }} for release ${{ steps.semver.outputs.next }}-beta"
+      - name: Discord Fail Notification
+        if: failure() && github.event.inputs.send-notifications
+        env:
+          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
+        uses: Ilshidur/action-discord@0.4.0
+        with:
+          args: "The beta release workflow [run ${{ github.run_number }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) has failed"

.github/workflows/deployment-docker-image.yml

@@ -5,6 +5,7 @@ on:
     branches:
       - main
       - beta
+      - next
       - dev
   workflow_dispatch:
     inputs:
@@ -12,7 +13,7 @@ on:
         type: boolean
         required: false
         default: true
-        description: Send notifications
+        description: Send notifications when redeploying an existing release
 
 permissions:
   contents: write # Required to update package.json version
@@ -32,14 +33,15 @@ jobs:
   release:
     name: Create tag and release
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     env:
-      SKIP_RELEASE: ${{ github.event_name == 'workflow_dispatch' || github.ref_name == 'dev' }}
+      SKIP_RELEASE: ${{ github.event_name == 'workflow_dispatch' || github.ref_name == 'dev' || github.ref_name == 'next' }}
     outputs:
       version: ${{ steps.read-semver.outputs.version || steps.version-fallback.outputs.version }}
-      git_ref: ${{ steps.read-git-ref.outputs.ref || github.ref }}
-
+      git_ref: ${{ steps.read-git-ref.outputs.ref || steps.read-semver.outputs.version || github.ref }}
+      skipped: ${{ env.SKIP_RELEASE }}
     steps:
-      - run: echo "Skipping release for workflow_dispatch event"
+      - run: echo "Manual dispatch redeploys the latest existing release without creating a new one"
         if: env.SKIP_RELEASE == 'true'
         # The below generated version fallback represents a normalized branch name, for example "feature/branch-name" -> "feature-branch-name"
       - run: echo "version="$(echo ${{github.ref_name}} | sed 's/[^a-zA-Z0-9\-]/-/g') >> "$GITHUB_OUTPUT"
@@ -49,24 +51,47 @@ jobs:
       - name: Obtain token
         if: env.SKIP_RELEASE == 'false'
         id: obtainToken
-        uses: tibdex/github-app-token@v2
+        uses: actions/create-github-app-token@v3
         with:
-          private_key: ${{ secrets.RENOVATE_MERGE_PRIVATE_KEY }}
-          app_id: ${{ secrets.RENOVATE_MERGE_APP_ID }}
-      - uses: actions/checkout@v4
-        if: env.SKIP_RELEASE == 'false'
+          private-key: ${{ secrets.RENOVATE_MERGE_PRIVATE_KEY }}
+          client-id: ${{ secrets.RENOVATE_MERGE_APP_ID }}
+          permission-contents: write # required to commit package.json & changelog changes, merge them to dev / next and publish the release
+
+      - uses: actions/checkout@v7
+        if: env.SKIP_RELEASE == 'false' || github.ref_name == 'main' || github.ref_name == 'beta'
         with:
+          fetch-depth: 0
           persist-credentials: false
-      - uses: actions/setup-node@v4
+      - uses: pnpm/action-setup@v6
+        if: env.SKIP_RELEASE == 'false'
+      - uses: actions/setup-node@v6
         if: env.SKIP_RELEASE == 'false'
         with:
-          node-version: 22
-      - run: npm i -g pnpm
-        if: env.SKIP_RELEASE == 'false'
-      - name: Install dependencies
+          node-version: 24.18.0
+          package-manager-cache: false
+      - name: Verify major release intent
         if: env.SKIP_RELEASE == 'false'
         run: |
-          pnpm install
+          latest_tag="$(git describe --tags --abbrev=0)"
+          latest_major="${latest_tag#v}"
+          latest_major="${latest_major%%.*}"
+          package_version="$(jq --raw-output '.version' package.json)"
+          package_major="${package_version%%.*}"
+
+          if (( package_major <= latest_major )); then
+            exit 0
+          fi
+
+          if git log --format='%s%n%b' "${latest_tag}..HEAD" \
+            | grep --extended-regexp --quiet '(^[[:alnum:]-]+(\([^)]*\))?!:)|(^BREAKING[ -]CHANGE:)'; then
+            exit 0
+          fi
+
+          echo "::error::package.json declares ${package_version}, but commits since ${latest_tag} contain no breaking-change signal. Use a conventional ! commit or BREAKING CHANGE footer so Semantic Release creates the intended major version."
+          exit 1
+      - name: Install dependencies
+        if: env.SKIP_RELEASE == 'false'
+        run: pnpm install --frozen-lockfile
       - name: Run Semantic Release
         if: env.SKIP_RELEASE == 'false'
         env:
@@ -89,109 +114,171 @@ jobs:
         id: read-git-ref
         run: |
           echo "ref=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
-      - name: Update dev branch
+      - name: Update dev / next branch
         if: env.SKIP_RELEASE == 'false'
         continue-on-error: true # Prevent pipeline from failing when merge fails
         env:
           GITHUB_TOKEN: ${{ steps.obtainToken.outputs.token }}
+          UPSTREAM_BRANCH: ${{ github.ref_name == 'main' && 'dev' || 'next' }}
         run: |
           git config user.name "Releases Homarr"
           git config user.email "175486441+homarr-releases[bot]@users.noreply.github.com"
           git remote set-url origin https://x-access-token:${{ steps.obtainToken.outputs.token }}@github.com/${{ github.repository }}.git
-          git fetch origin dev
-          git checkout dev
-          git pull origin dev
+          git fetch origin ${{ env.UPSTREAM_BRANCH }}
+          git checkout ${{ env.UPSTREAM_BRANCH }}
+          git pull origin ${{ env.UPSTREAM_BRANCH }}
           git rebase ${{ github.ref_name }}
-          git push origin dev
+          git push origin ${{ env.UPSTREAM_BRANCH }}
   build-amd64:
     name: Build docker image for amd64
     needs: release
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     outputs:
       digest: ${{ steps.build.outputs.digest }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ needs.release.outputs.git_ref }}
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: "${{ env.GHCR_REPO }}"
 
       - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Build and push by digest
         id: build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           network: host
           platforms: linux/amd64
           labels: ${{ steps.meta.outputs.labels }}
           outputs: type=image,"name=${{ env.GHCR_REPO }}",push-by-digest=true,name-canonical=true,push=true
+          secrets: |
+            TURBO_API=${{ secrets.TURBO_API }}
+            TURBO_TEAM=${{ secrets.TURBO_TEAM }}
+            TURBO_TOKEN=${{ secrets.TURBO_TOKEN }}
+            TURBO_REMOTE_CACHE_SIGNATURE_KEY=${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
         env:
           SKIP_ENV_VALIDATION: true
-
   build-arm64:
     name: Build docker image for arm64
     needs: release
     runs-on: ubuntu-24.04-arm
+    timeout-minutes: 20
     outputs:
       digest: ${{ steps.build.outputs.digest }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ needs.release.outputs.git_ref }}
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: "${{ env.GHCR_REPO }}"
 
       - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Build and push by digest
         id: build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           network: host
           platforms: linux/arm64
           labels: ${{ steps.meta.outputs.labels }}
           outputs: type=image,"name=${{ env.GHCR_REPO }}",push-by-digest=true,name-canonical=true,push=true
+          secrets: |
+            TURBO_API=${{ secrets.TURBO_API }}
+            TURBO_TEAM=${{ secrets.TURBO_TEAM }}
+            TURBO_TOKEN=${{ secrets.TURBO_TOKEN }}
+            TURBO_REMOTE_CACHE_SIGNATURE_KEY=${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
         env:
           SKIP_ENV_VALIDATION: true
+  extract-asset-amd64:
+    name: Extract amd64 asset from docker image
+    needs: [release, build-amd64]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v7
+        if: needs.release.outputs.skipped == 'false'
+        with:
+          ref: ${{ needs.release.outputs.git_ref }}
+          persist-credentials: false
+      - name: Extract amd64
+        if: needs.release.outputs.skipped == 'false'
+        uses: ./.github/actions/extract-build-artifact
+        with:
+          digest: "${{ env.GHCR_REPO }}@${{ needs.build-amd64.outputs.digest }}"
+          architecture: amd64
+          release-tag: ${{ needs.release.outputs.version }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+          repository: ${{ github.repository }}
 
+  extract-asset-arm64:
+    name: Extract arm64 asset from docker image
+    needs: [release, build-arm64]
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v7
+        if: needs.release.outputs.skipped == 'false'
+        with:
+          ref: ${{ needs.release.outputs.git_ref }}
+          persist-credentials: false
+      - name: Extract arm64
+        if: needs.release.outputs.skipped == 'false'
+        uses: ./.github/actions/extract-build-artifact
+        with:
+          digest: "${{ env.GHCR_REPO }}@${{ needs.build-arm64.outputs.digest }}"
+          architecture: arm64
+          release-tag: ${{ needs.release.outputs.version }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+          repository: ${{ github.repository }}
   publish:
     name: Complete deployment and notify
-    needs: [release, build-amd64, build-arm64]
+    needs: [release, build-amd64, build-arm64, extract-asset-amd64, extract-asset-arm64]
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     env:
       NEXT_VERSION: ${{ needs.release.outputs.version }}
       DEPLOY_LATEST: ${{ github.ref_name == 'main' }}
       DEPLOY_BETA: ${{ github.ref_name == 'beta' }}
     steps:
+      - name: Obtain token
+        if: needs.release.outputs.skipped == 'false'
+        id: obtainToken
+        uses: actions/create-github-app-token@v3
+        with:
+          private-key: ${{ secrets.RENOVATE_MERGE_PRIVATE_KEY }}
+          client-id: ${{ secrets.RENOVATE_MERGE_APP_ID }}
+          permission-contents: write # required to publish the release
+
       - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -217,9 +304,17 @@ jobs:
             ${{ env.GHCR_REPO }}@${{ needs.build-amd64.outputs.digest }} \
             ${{ env.GHCR_REPO }}@${{ needs.build-arm64.outputs.digest }}
 
+      - name: Publish release
+        if: needs.release.outputs.skipped == 'false'
+        env:
+          GITHUB_TOKEN: ${{ steps.obtainToken.outputs.token }}
+        run: |
+          gh release edit --repo ${{ github.repository }} ${{ needs.release.outputs.version }} --draft=false
+
       - name: Discord notification
+        if: github.event_name != 'workflow_dispatch' || inputs['send-notifications']
         env:
           DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
-        uses: Ilshidur/action-discord@master
+        uses: Ilshidur/action-discord@0.4.0
         with:
           args: "Successfully deployed images for branch **${{ github.ref_name }}**. Tagged as **${{env.NEXT_VERSION}}**."

.github/workflows/deployment-docs.yml

@@ -0,0 +1,56 @@
+name: "[Deployment] Documentation"
+
+on:
+  push:
+    branches: ["dev"]
+    paths:
+      - "apps/docs/**"
+      - "packages/definitions/src/docs/**"
+      - ".github/workflows/deployment-docs.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: "pages"
+  cancel-in-progress: false
+
+env:
+  SKIP_ENV_VALIDATION: true
+  TURBO_API: ${{ secrets.TURBO_API }}
+  TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_REMOTE_CACHE_SIGNATURE_KEY: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+      - name: Setup
+        uses: ./tooling/github/setup
+      - name: Build docs
+        run: pnpm turbo build --filter=@homarr/docs
+        env:
+          CI: "true"
+      - name: Setup Pages
+        uses: actions/configure-pages@v6
+      - name: Upload pages artifact
+        uses: actions/upload-pages-artifact@v5
+        with:
+          path: "apps/docs/build"
+
+  deploy:
+    runs-on: ubuntu-latest
+    needs: build
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v5

.github/workflows/deployment-weekly-release.yml

@@ -3,6 +3,7 @@ name: "[Deployment] Automatic Weekly Release"
 on:
   schedule:
     - cron: "0 19 * * 5" # https://crontab.guru/#0_19_*_*_5
+      timezone: Europe/Zurich
   workflow_dispatch:
     inputs:
       send-notifications:
@@ -18,16 +19,17 @@ permissions:
 jobs:
   create-and-merge-pr:
     runs-on: ubuntu-latest
+    timeout-minutes: 2
     steps:
       - name: Discord notification
-        if: ${{ github.events.inputs.send-notifications }}
+        if: ${{ github.event.inputs.send-notifications }}
         env:
           DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
-        uses: Ilshidur/action-discord@master
+        uses: Ilshidur/action-discord@0.4.0
         with:
           args: "Automatic release has been triggered: [run ${{ github.run_number }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})"
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Get Next Version
@@ -37,22 +39,24 @@ jobs:
           token: ${{ github.token }}
           branch: dev
       - name: Create pull request
+        id: create-pull-request
         run: 'gh pr create --title "chore(release): automatic release ${{ steps.semver.outputs.next }}" --body "**This is an automatic release**.<br/>Manual action may be required for major bumps.<br/>Detected change to be ``${{ steps.semver.outputs.bump }}``<br/>Bump version from ``${{ steps.semver.outputs.current }}`` to ``${{ steps.semver.outputs.next }}``" --base main --head dev --label automerge'
         env:
           GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
       - name: Discord notification
-        if: ${{ github.events.inputs.send-notifications }}
+        if: ${{ github.event.inputs.send-notifications }}
         env:
           DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
-        uses: Ilshidur/action-discord@master
+        uses: Ilshidur/action-discord@0.4.0
         with:
           args: "Created a release PR ${{ steps.create-pull-request.outputs.url }} for version ${{ steps.semver.outputs.next }} (new behaviour: ${{ steps.semver.outputs.bump }})"
       - name: Obtain token
         id: obtainApprovalToken
-        uses: tibdex/github-app-token@v2
+        uses: actions/create-github-app-token@v3
         with:
-          private_key: ${{ secrets.RENOVATE_APPROVE_PRIVATE_KEY }}
-          app_id: ${{ secrets.RENOVATE_APPROVE_APP_ID }}
+          private-key: ${{ secrets.RENOVATE_APPROVE_PRIVATE_KEY }}
+          client-id: ${{ secrets.RENOVATE_APPROVE_APP_ID }}
+          permission-pull-requests: write
       - name: Approve PR
         env:
           GITHUB_TOKEN: ${{ steps.obtainApprovalToken.outputs.token }}
@@ -60,17 +64,19 @@ jobs:
           gh pr review --approve --body "Automatically approved by GitHub Action"
       - name: Obtain token
         id: obtainMergeToken
-        uses: tibdex/github-app-token@v2
+        uses: actions/create-github-app-token@v3
         with:
-          private_key: ${{ secrets.RENOVATE_MERGE_PRIVATE_KEY }}
-          app_id: ${{ secrets.RENOVATE_MERGE_APP_ID }}
+          private-key: ${{ secrets.RENOVATE_MERGE_PRIVATE_KEY }}
+          client-id: ${{ secrets.RENOVATE_MERGE_APP_ID }}
+          permission-contents: write # write to main branch (due to merge)
+          permission-pull-requests: write # merge pull request
       - id: automerge
         if: ${{ steps.semver.outputs.bump != 'major' }}
         name: automerge
         uses: "pascalgn/automerge-action@v0.16.4"
         env:
           GITHUB_TOKEN: ${{ steps.obtainMergeToken.outputs.token }}
-          MERGE_METHOD: merge # we prefer merge commits for merging to master
+          MERGE_METHOD: merge # we prefer merge commits for merging to main
           MERGE_COMMIT_MESSAGE: "chore(release): automatic release ${{ steps.semver.outputs.next }}"
           MERGE_DELETE_BRANCH: false # never set to true!
           PULL_REQUEST: "${{ steps.create-pull-request.outputs.pr_number }}"
@@ -79,23 +85,23 @@ jobs:
           MERGE_REQUIRED_APPROVALS: 0 # do not require approvals
 
       - name: Merged Discord notification
-        if: ${{ steps.automerge.outputs.mergeResult == 'merged' && github.events.inputs.send-notifications }}
+        if: ${{ steps.automerge.outputs.mergeResult == 'merged' && github.event.inputs.send-notifications }}
         env:
           DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
-        uses: Ilshidur/action-discord@master
+        uses: Ilshidur/action-discord@0.4.0
         with:
           args: "Merged PR ${{ steps.create-pull-request.outputs.url }} for release ${{ steps.semver.outputs.next }}"
       - name: Major Bump Discord notification
-        if: ${{ steps.semver.outputs.bump == 'major' && github.events.inputs.send-notifications }}
+        if: ${{ steps.semver.outputs.bump == 'major' && github.event.inputs.send-notifications }}
         env:
           DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
-        uses: Ilshidur/action-discord@master
+        uses: Ilshidur/action-discord@0.4.0
         with:
           args: "The release PR must be manually merged because the next version is a major version: ${{ steps.create-pull-request.outputs.url }} for release ${{ steps.semver.outputs.next }}"
       - name: Discord Fail Notification
-        if: failure() && github.events.inputs.send-notifications
+        if: failure() && github.event.inputs.send-notifications
         env:
           DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
-        uses: Ilshidur/action-discord@master
+        uses: Ilshidur/action-discord@0.4.0
         with:
           args: "The automatic release workflow [run ${{ github.run_number }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) has failed"

.github/workflows/docs-algolia-recrawl.yml

@@ -0,0 +1,58 @@
+name: "[Docs] Algolia Recrawl"
+
+on:
+  workflow_run:
+    workflows: ["[Deployment] Documentation"]
+    types: [completed]
+    branches: [dev]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  recrawl:
+    if: >-
+      ${{
+        (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'pull_request')
+        || github.event_name == 'workflow_dispatch'
+      }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Setup
+        uses: ./tooling/github/setup
+
+      - name: Check Algolia crawler secrets
+        run: |
+          missing=0
+          for secret in ALGOLIA_CRAWLER_ID ALGOLIA_CRAWLER_USER_ID ALGOLIA_CRAWLER_API_KEY; do
+            if [ -z "${!secret}" ]; then
+              echo "::warning::Missing repository secret: $secret"
+              missing=1
+            fi
+          done
+          if [ "$missing" -eq 1 ]; then
+            echo "Add crawler secrets to enable automatic recrawls."
+            exit 1
+          fi
+        env:
+          ALGOLIA_CRAWLER_ID: ${{ secrets.ALGOLIA_CRAWLER_ID }}
+          ALGOLIA_CRAWLER_USER_ID: ${{ secrets.ALGOLIA_CRAWLER_USER_ID }}
+          ALGOLIA_CRAWLER_API_KEY: ${{ secrets.ALGOLIA_CRAWLER_API_KEY }}
+
+      - name: Wait for GitHub Pages to serve the new deployment
+        run: sleep 60
+
+      - name: Trigger Algolia DocSearch recrawl
+        uses: cssnr/algolia-crawler-action@v2
+        with:
+          crawler_id: ${{ secrets.ALGOLIA_CRAWLER_ID }}
+          crawler_user_id: ${{ secrets.ALGOLIA_CRAWLER_USER_ID }}
+          crawler_api_key: ${{ secrets.ALGOLIA_CRAWLER_API_KEY }}
+
+      - name: Verify search index
+        working-directory: apps/docs
+        run: pnpm verify:search

.github/workflows/docs-update-contributors.yml

@@ -0,0 +1,39 @@
+name: "[Docs] Update Contributors"
+
+on:
+  schedule:
+    - cron: "0 12 * * FRI"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+env:
+  GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+  HOMARR_CROWDIN_TOKEN: "${{ secrets.HOMARR_CROWDIN_TOKEN }}"
+  HOMARR_LABS_CROWDIN_TOKEN: "${{ secrets.HOMARR_LABS_CROWDIN_TOKEN }}"
+  SKIP_ENV_VALIDATION: true
+
+jobs:
+  dump:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: dev
+
+      - name: Setup
+        uses: ./tooling/github/setup
+
+      - name: Dump contributors
+        working-directory: apps/docs
+        run: pnpm api-dump-contributors
+
+      - name: Commit updated contributors
+        uses: EndBug/add-and-commit@v10
+        with:
+          add: "apps/docs/static"
+          default_author: github_actor
+          message: "chore(docs): update contributors"
+          push: true

.github/workflows/docs-update-openapi.yml

@@ -0,0 +1,66 @@
+name: "[Docs] Update OpenAPI Spec"
+
+on:
+  schedule:
+    - cron: "0 0 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+env:
+  SKIP_ENV_VALIDATION: true
+
+jobs:
+  update-spec:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: dev
+
+      - name: Setup
+        uses: ./tooling/github/setup
+
+      - name: Copy env
+        run: cp .env.example .env
+
+      - name: Start dev server
+        run: pnpm --filter @homarr/nextjs dev &
+        env:
+          TURBO_TELEMETRY_DISABLED: 1
+          DISABLE_TELEMETRY: 1
+
+      - name: Wait for server and fetch spec
+        run: |
+          set -euo pipefail
+          for i in $(seq 1 30); do
+            if curl -fsS http://localhost:3000/api/openapi -o /tmp/openapi.json 2>/dev/null; then
+              echo "Server is up, spec fetched"
+              break
+            fi
+            echo "Waiting for server... ($i/30)"
+            sleep 3
+          done
+
+          if [ ! -f /tmp/openapi.json ]; then
+            echo "::error::Server failed to start within timeout"
+            exit 1
+          fi
+
+          jq -e '.openapi and .paths' /tmp/openapi.json > /dev/null || {
+            echo "::error::Fetched file is not a valid OpenAPI spec"
+            exit 1
+          }
+
+          cp /tmp/openapi.json apps/docs/static/api/open-api-schema.json
+          echo "OpenAPI spec updated ($(jq '.paths | length' /tmp/openapi.json) paths)"
+
+      - name: Commit updated spec
+        uses: EndBug/add-and-commit@v10
+        with:
+          add: "apps/docs/static/api/"
+          default_author: github_actor
+          message: "chore(docs): update OpenAPI spec"
+          push: true

.github/workflows/on-pr-prebuilt-debian-validate.yml

@@ -0,0 +1,45 @@
+name: "[Deployments] Validate prebuilt debian dependencies"
+
+permissions:
+  contents: read
+
+on:
+  pull_request:
+    branches: ["**"]
+    paths: [".github/actions/prebuilt-debian/**", "deployments/prebuilt-debian/**"]
+
+jobs:
+  prebuilt-debian-validate-amd64:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v7
+      - name: Validate prebuilt dependencies for amd64
+        id: validate-amd64
+        uses: ./.github/actions/prebuilt-debian
+        with:
+          architecture: amd64
+
+      - name: Check extracted files for amd64
+        run: |
+          if [ ! -f "${{ steps.validate-amd64.outputs.path }}/better_sqlite3.node" ]; then
+            echo "better_sqlite3.node not found for amd64!"
+            exit 1
+          fi
+  prebuilt-debian-validate-arm64:
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v7
+      - name: Validate prebuilt dependencies for arm64
+        id: validate-arm64
+        uses: ./.github/actions/prebuilt-debian
+        with:
+          architecture: arm64
+
+      - name: Check extracted files for arm64
+        run: |
+          if [ ! -f "${{ steps.validate-arm64.outputs.path }}/better_sqlite3.node" ]; then
+            echo "better_sqlite3.node not found for arm64!"
+            exit 1
+          fi

.github/workflows/on-pr-renovate-validate.yml

@@ -0,0 +1,19 @@
+name: "[Renovate] Validate configuration"
+
+permissions:
+  contents: read
+
+on:
+  pull_request:
+    branches: ["**"]
+    paths: [".github/renovate.json5"]
+
+jobs:
+  renovate-validate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    steps:
+      - uses: actions/checkout@v7
+      - run: |
+          npx --yes --package renovate -- \
+              renovate-config-validator --strict .github/renovate.json5

.github/workflows/on-release.yml

@@ -0,0 +1,87 @@
+permissions: {}
+
+on:
+  release:
+    types: [released]
+
+jobs:
+  trigger-docs-release:
+    name: Trigger Documentation Release
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    steps:
+      - name: Obtain token
+        id: obtainToken
+        uses: actions/create-github-app-token@v3
+        with:
+          private-key: ${{ secrets.HOMARR_DOCS_RELEASE_APP_PRIVATE_KEY }}
+          client-id: ${{ vars.HOMARR_DOCS_RELEASE_APP_ID }}
+          owner: homarr-labs
+          repositories: |
+            documentation
+          permission-contents: write # required to dispatch repository workflow
+      - name: Trigger documentation release
+        env:
+          GITHUB_TOKEN: ${{ steps.obtainToken.outputs.token }}
+          SOURCE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          curl -X POST \
+            -H "Authorization: token $GITHUB_TOKEN" \
+            -H "Accept: application/vnd.github+json" \
+            https://api.github.com/repos/homarr-labs/documentation/dispatches \
+            -d @- <<EOF
+          {
+            "event_type": "trigger-release",
+            "client_payload": {
+              "tag": "${SOURCE_TAG}"
+            }
+          }
+          EOF
+
+  update-bug-report-template:
+    name: Update Bug Report Template
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Obtain token
+        id: obtainToken
+        uses: actions/create-github-app-token@v3
+        with:
+          private-key: ${{ secrets.RENOVATE_MERGE_PRIVATE_KEY }}
+          client-id: ${{ secrets.RENOVATE_MERGE_APP_ID }}
+          permission-contents: write # required to commit to branch
+          permission-pull-requests: write # required to create pr & enable automerge
+      - name: Checkout code
+        uses: actions/checkout@v7
+        with:
+          token: ${{ steps.obtainToken.outputs.token }}
+          ref: dev
+      - name: Setup
+        uses: ./tooling/github/setup
+      - run: pnpm run scripts:update-bug-report-template
+        env:
+          NEXT_VERSION: ${{ github.event.release.tag_name }}
+
+      - name: Create Pull Request
+        id: create-pull-request
+        uses: peter-evans/create-pull-request@v8
+        with:
+          add-paths: .github/ISSUE_TEMPLATE/bug_report.yml
+          commit-message: "chore: update bug report template"
+          author: Releases Homarr <175486441+homarr-releases[bot]@users.noreply.github.com>
+          token: ${{ steps.obtainToken.outputs.token }}
+          branch: update-bug-report-template
+          base: dev
+          title: "chore: update bug report template"
+          delete-branch: true
+          body: |
+            This PR automatically updates the bug report template of Homarr in the .github/ISSUE_TEMPLATE/bug_report.yml
+
+      - name: Install GitHub CLI
+        run: sudo apt-get install -y gh
+
+      - name: Enable auto-merge
+        env:
+          GITHUB_TOKEN: ${{ steps.obtainToken.outputs.token }}
+        run: |
+          gh pr merge ${{steps.create-pull-request.outputs.pull-request-number}} --auto --squash

.github/workflows/skip-renovate-stability-days.yml

@@ -0,0 +1,36 @@
+permissions:
+  statuses: write
+  contents: read
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+
+jobs:
+  skip-stability-days:
+    if: ${{ !startsWith(github.head_ref, 'renovate/') && github.event.pull_request.head.repo.full_name == github.repository }}
+    name: Skip Stability Days
+    runs-on: ubuntu-latest
+    timeout-minutes: 1
+    steps:
+      - name: Add status check
+        env:
+          GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
+        run: |
+          for attempt in 1 2 3 4 5; do
+            if gh api \
+              --method POST \
+              -H "Accept: application/vnd.github+json" \
+              -H "X-GitHub-Api-Version: 2022-11-28" \
+              /repos/${{github.repository}}/statuses/${{github.event.pull_request.head.sha}} \
+              -f 'state=success' \
+              -f 'target_url=https://docs.renovatebot.com/configuration-options#minimumreleaseage' \
+              -f 'description=Skipped for non renovate branches' \
+              -f 'context=renovate/stability-days' \
+              --silent; then
+              exit 0
+            fi
+            echo "status POST failed (attempt $attempt/5), retrying in 5s"
+            sleep 5
+          done
+          exit 1

.github/workflows/update-contributors.yml

@@ -10,31 +10,32 @@ env:
   CROWDIN_TOKEN: "${{ secrets.CROWDIN_UPDATE_CONTRIBUTORS_TOKEN }}"
 
 permissions:
-  contents: write
-
+  contents: read
 jobs:
   update-contributors:
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        node-version: [22]
+    timeout-minutes: 2
     steps:
       - name: Obtain token
         id: obtainToken
-        uses: tibdex/github-app-token@v2
+        uses: actions/create-github-app-token@v3
         with:
-          private_key: ${{ secrets.HOMARR_UPDATE_CONTRIBUTORS_PRIVATE_KEY }}
-          app_id: ${{ vars.HOMARR_UPDATE_CONTRIBUTORS_APP_ID }}
+          private-key: ${{ secrets.HOMARR_UPDATE_CONTRIBUTORS_PRIVATE_KEY }}
+          client-id: ${{ vars.HOMARR_UPDATE_CONTRIBUTORS_APP_ID }}
+          permission-contents: write # required to commit to branch
+          permission-pull-requests: write # required to create pr & enable automerge
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         env:
           GITHUB_TOKEN: ${{ steps.obtainToken.outputs.token }}
 
-      - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
+      - uses: pnpm/action-setup@v6
+      - name: Use Node.js
+        uses: actions/setup-node@v6
         with:
-          node-version: ${{ matrix.node-version }}
+          node-version: 24.18.0
+          cache: "pnpm"
 
       - name: Run update script
         run: node ./scripts/update-contributors.mjs
@@ -50,7 +51,7 @@ jobs:
 
       - name: Create Pull Request
         id: create-pull-request
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@v8
         with:
           token: ${{ steps.obtainToken.outputs.token }}
           branch: update-contributors

.github/workflows/update-integration-list.yml

@@ -0,0 +1,65 @@
+name: Update integration list
+
+on:
+  workflow_dispatch: {}
+  push:
+    paths:
+      - packages/definitions/src/integration.ts
+    branches:
+      - dev
+
+permissions:
+  pull-requests: write
+
+jobs:
+  update-readme:
+    concurrency:
+      group: update-integration
+      cancel-in-progress: false
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Obtain token
+        id: obtainToken
+        uses: actions/create-github-app-token@v3
+        with:
+          private-key: ${{ secrets.HOMARR_UPDATE_CONTRIBUTORS_PRIVATE_KEY }}
+          client-id: ${{ vars.HOMARR_UPDATE_CONTRIBUTORS_APP_ID }}
+          permission-contents: write # required to commit to branch
+          permission-pull-requests: write # required to create pr & enable automerge
+      - name: Checkout code
+        uses: actions/checkout@v7
+        env:
+          GITHUB_TOKEN: ${{ steps.obtainToken.outputs.token }}
+      - name: Setup
+        uses: ./tooling/github/setup
+      - run: pnpm run scripts:update-readme-integrations
+      - name: Commit changes
+        env:
+          GITHUB_TOKEN: ${{ steps.obtainToken.outputs.token }}
+        run: |
+          git config --global user.email "210161987+homarr-update-contributors[bot]@users.noreply.github.com"
+          git config --global user.name "Homarr Update Contributors"
+          git add .
+          git commit -m "chore: update integrations list readme"
+
+      - name: Create Pull Request
+        id: create-pull-request
+        uses: peter-evans/create-pull-request@v8
+        with:
+          token: ${{ steps.obtainToken.outputs.token }}
+          branch: update-integrations-readme
+          base: dev
+          title: "chore: update integrations list readme"
+          delete-branch: true
+          body: |
+            This PR automatically updates the list of integrations of Homarr in the README.md
+
+      - name: Install GitHub CLI
+        run: sudo apt-get install -y gh
+
+      - name: Enable auto-merge
+        env:
+          GITHUB_TOKEN: ${{ steps.obtainToken.outputs.token }}
+        run: |
+          gh pr merge ${{steps.create-pull-request.outputs.pull-request-number}} --auto --squash

.github/workflows/workshop.yml

@@ -0,0 +1,146 @@
+name: Workshop
+
+on:
+  pull_request:
+  push:
+    branches: [dev, v2, release/v2, main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ (github.ref_name == 'v2' || github.ref_name == 'release/v2') && 'v2-preview' || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24.18.0
+      - uses: pnpm/action-setup@v6
+        with:
+          run_install: false
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm --filter @homarr/workshop typecheck
+      - run: pnpm --filter @homarr/docs typecheck
+      - run: docker compose --env-file apps/workshop/.env.staging.example -f apps/workshop/docker-compose.staging.yml config --quiet
+      - run: pnpm test:workshop
+      - run: pnpm test:workshop-image
+
+  publish-amd64:
+    if: github.event_name == 'push' && (github.ref_name == 'v2' || github.ref_name == 'release/v2' || github.ref_name == 'main')
+    needs: validate
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      packages: write
+    outputs:
+      digest: ${{ steps.build.outputs.digest }}
+    steps:
+      - uses: actions/checkout@v7
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/build-push-action@v7
+        id: build
+        with:
+          context: .
+          file: apps/workshop/Dockerfile
+          target: production
+          platforms: linux/amd64
+          outputs: type=image,"name=ghcr.io/homarr-labs/workshop",push-by-digest=true,name-canonical=true,push=true
+          cache-from: type=gha,scope=workshop-linux-amd64
+          cache-to: type=gha,scope=workshop-linux-amd64,mode=max
+
+  publish-arm64:
+    if: github.event_name == 'push' && (github.ref_name == 'v2' || github.ref_name == 'release/v2' || github.ref_name == 'main')
+    needs: validate
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      packages: write
+    outputs:
+      digest: ${{ steps.build.outputs.digest }}
+    steps:
+      - uses: actions/checkout@v7
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/build-push-action@v7
+        id: build
+        with:
+          context: .
+          file: apps/workshop/Dockerfile
+          target: production
+          platforms: linux/arm64
+          outputs: type=image,"name=ghcr.io/homarr-labs/workshop",push-by-digest=true,name-canonical=true,push=true
+          cache-from: type=gha,scope=workshop-linux-arm64
+          cache-to: type=gha,scope=workshop-linux-arm64,mode=max
+
+  publish:
+    if: github.event_name == 'push' && (github.ref_name == 'v2' || github.ref_name == 'release/v2' || github.ref_name == 'main')
+    needs: [publish-amd64, publish-arm64]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      packages: write
+    env:
+      WORKSHOP_IMAGE: ghcr.io/homarr-labs/workshop
+    steps:
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Verify branch head before publication
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const branchName = context.ref.replace("refs/heads/", "");
+            const { data: branch } = await github.rest.repos.getBranch({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              branch: branchName,
+            });
+            if (branch.commit.sha !== context.sha) {
+              core.setFailed(`Branch ${branchName} moved from ${context.sha} to ${branch.commit.sha}.`);
+            }
+      - name: Publish multi-platform image
+        env:
+          AMD64_DIGEST: ${{ needs.publish-amd64.outputs.digest }}
+          ARM64_DIGEST: ${{ needs.publish-arm64.outputs.digest }}
+        run: |
+          tags=(-t "${WORKSHOP_IMAGE}:sha-${GITHUB_SHA}")
+          if [[ "${GITHUB_REF_NAME}" == "v2" || "${GITHUB_REF_NAME}" == "release/v2" ]]; then
+            tags+=(-t "${WORKSHOP_IMAGE}:v2")
+          fi
+          if [[ "${GITHUB_REF_NAME}" == "main" ]]; then
+            tags+=(-t "${WORKSHOP_IMAGE}:latest")
+          fi
+          docker buildx imagetools create "${tags[@]}" \
+            "${WORKSHOP_IMAGE}@${AMD64_DIGEST}" \
+            "${WORKSHOP_IMAGE}@${ARM64_DIGEST}"
+      - name: Verify multi-platform image
+        run: |
+          image="${WORKSHOP_IMAGE}:sha-${GITHUB_SHA}"
+          manifest="$(docker buildx imagetools inspect "$image" --raw)"
+          for architecture in amd64 arm64; do
+            jq --exit-status --arg architecture "$architecture" \
+              'any(.manifests[]; .platform.os == "linux" and .platform.architecture == $architecture)' \
+              <<<"$manifest" >/dev/null
+          done
+          docker buildx imagetools inspect "$image"

.gitignore

@@ -2,6 +2,7 @@
 
 # dependencies
 node_modules
+.pnpm-store/
 .pnp
 .pnp.js
 .idea/
@@ -15,6 +16,7 @@ out/
 next-env.d.ts
 
 # artifacts
+.ai-evaluations/
 packages/db/migrations/*/migrate.cjs
 
 # nitro
@@ -23,6 +25,8 @@ packages/db/migrations/*/migrate.cjs
 
 # production
 build
+tools/homarr-dev/homarr
+tools/homarr-dev/homarr-dev
 
 # misc
 .DS_Store
@@ -66,5 +70,27 @@ e2e/shared/tmp
 #personal backgrounds
 apps/nextjs/public/images/background.png
 
-# next-intl
-en.d.json.ts
+
+
+# personal agent config
+.opencode
+.agents/*
+!.agents/skills/
+skills-lock.json
+
+# docusaurus
+apps/docs/.docusaurus
+apps/docs/build
+.pnpm-store
+benchmark-results
+
+# local performance investigation (never ship benchmark data or restored backups)
+.widget-performance/
+.bench/
+homarr-backup*.zip
+*.sqlite-wal
+*.sqlite-shm
+/scripts/benchmarks/
+
+# PR description screenshots belong on the pull request, not in the repository
+.screenshots/

.mcp.json

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "mantine": {
+      "command": "npx",
+      "args": ["-y", "@mantine/mcp-server@9.6.0"]
+    }
+  }
+}

.mise.toml

@@ -0,0 +1,2 @@
+[tools]
+node = "24.18.0"

.npmrc

@@ -1,5 +1,2 @@
-# Expo doesn't play nice with pnpm by default. 
-# The symbolic links of pnpm break the rules of Expo monorepos.
-# @link https://docs.expo.dev/guides/monorepos/#common-issues
-node-linker=hoisted
-strict-peer-dependencies=false
+# pnpm v11: non-auth settings moved to pnpm-workspace.yaml
+# Keep this file for any future registry/auth configuration

.nvmrc

@@ -1 +1 @@
-22.16.0
+24.18.0

.oxfmtrc.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "./node_modules/oxfmt/configuration_schema.json",
+  "printWidth": 120,
+  "endOfLine": "lf",
+  "sortPackageJson": true,
+  "ignorePatterns": [
+    "**/*.cjs",
+    "**/lang/**",
+    "static-data/**",
+    "CHANGELOG.md",
+    "apps/docs/.docusaurus/**",
+    "apps/docs/build/**",
+    "apps/docs/blog/**",
+    "packages/custom-widgets/src/core/component-catalog.generated.json",
+    "apps/docs/static/custom-widgets/component-catalog-v1.json"
+  ]
+}

.oxlintrc.json

@@ -0,0 +1,65 @@
+{
+  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "plugins": ["eslint", "typescript", "unicorn", "oxc", "react", "import", "jsx-a11y"],
+  "categories": {
+    "correctness": "error",
+    "suspicious": "warn",
+    "pedantic": "off",
+    "perf": "off",
+    "style": "off",
+    "restriction": "off",
+    "nursery": "off"
+  },
+  "rules": {
+    "eslint/no-unused-vars": ["error", { "argsIgnorePattern": "^_", "varsIgnorePattern": "^_" }],
+    "typescript/consistent-type-imports": ["warn", { "prefer": "type-imports", "fixStyle": "separate-type-imports" }],
+    "typescript/no-non-null-assertion": "error",
+    "import/consistent-type-specifier-style": ["error", "prefer-top-level"],
+    "unicorn/no-new-array": "warn",
+    "unicorn/no-useless-spread": "warn",
+    "unicorn/no-useless-length-check": "warn",
+    "unicorn/no-useless-fallback-in-spread": "warn",
+    "jsx-a11y/prefer-tag-over-role": "warn",
+    "oxc/const-comparisons": "warn",
+    "react-hooks/exhaustive-deps": "warn",
+    "react/no-children-prop": "warn",
+    "jsx-a11y/no-autofocus": "warn",
+    "jsx-a11y/img-redundant-alt": "warn",
+    "react/react-in-jsx-scope": "off"
+  },
+  "options": {
+    "reportUnusedDisableDirectives": "off"
+  },
+  "overrides": [
+    {
+      "files": ["apps/nextjs/src/**/*.ts", "apps/nextjs/src/**/*.tsx"],
+      "excludeFiles": ["**/*.spec.ts", "**/*.spec.tsx"],
+      "rules": {
+        "eslint/no-restricted-imports": [
+          "error",
+          {
+            "paths": [
+              {
+                "name": "@homarr/widgets",
+                "allowTypeImports": true,
+                "message": "Import a narrow @homarr/widgets export to preserve widget lazy loading."
+              }
+            ]
+          }
+        ]
+      }
+    }
+  ],
+  "ignorePatterns": [
+    "**/*.config.js",
+    "**/*.config.mjs",
+    "**/*.cjs",
+    "**/lang/*.d.json.ts",
+    ".next/**",
+    "apps/docs/.docusaurus/**",
+    "apps/docs/build/**"
+  ],
+  "settings": {
+    "react": { "version": "19" }
+  }
+}

.releaserc.json

@@ -44,6 +44,7 @@
       {
         "successComment": false,
         "failComment": false,
+        "draftRelease": true,
         "releaseBodyTemplate": "<%= _.truncate(nextRelease.notes, { 'length': 124000, 'omission': '' }) %>"
       }
     ]

.run/db_migration_postgresql_generate.run copy.xml

@@ -0,0 +1,13 @@
+<component name="ProjectRunConfigurationManager">
+  <configuration default="false" name="db:migration:postgresql:generate" type="js.build_tools.npm">
+    <package-json value="$PROJECT_DIR$/package.json" />
+    <command value="run" />
+    <scripts>
+      <script value="db:migration:postgresql:generate" />
+    </scripts>
+    <node-interpreter value="project" />
+    <package-manager value="pnpm" />
+    <envs />
+    <method v="2" />
+  </configuration>
+</component>

.vscode/extensions.json

@@ -1,7 +1,7 @@
 {
   "recommendations": [
     "dbaeumer.vscode-eslint",
-    "esbenp.prettier-vscode",
+    "oxc.oxc-vscode",
     "yoavbls.pretty-ts-errors",
     "million.million-lint",
     "lokalise.i18n-ally"

.vscode/i18n-ally-custom-framework.yml

@@ -31,6 +31,5 @@ scopeRangeRegex: "(?:const|let|var)\\s+t\\s*=\\s*(?:await\\s+)?(?:getScopedI18n|
 # refactorTemplates:
 #  - i18n.get("$1")
 
-
 # If set to true, only enables this custom framework (will disable all built-in frameworks)
-monopoly: true
+monopoly: true

.vscode/launch.json

@@ -15,9 +15,7 @@
       "request": "launch",
       "command": "pnpm docker:dev",
       "cwd": "${workspaceFolder}",
-      "skipFiles": [
-        "<node_internals>/**"
-      ]
+      "skipFiles": ["<node_internals>/**"]
     },
     {
       "name": "lint fix",
@@ -25,9 +23,7 @@
       "request": "launch",
       "command": "pnpm lint:fix",
       "cwd": "${workspaceFolder}",
-      "skipFiles": [
-        "<node_internals>/**"
-      ]
+      "skipFiles": ["<node_internals>/**"]
     },
     {
       "name": "format fix",
@@ -35,9 +31,7 @@
       "request": "launch",
       "command": "pnpm format:fix",
       "cwd": "${workspaceFolder}",
-      "skipFiles": [
-        "<node_internals>/**"
-      ]
+      "skipFiles": ["<node_internals>/**"]
     },
     {
       "name": "db push",
@@ -69,9 +63,7 @@
       "request": "launch",
       "command": "pnpm test",
       "cwd": "${workspaceFolder}",
-      "skipFiles": [
-        "<node_internals>/**"
-      ]
+      "skipFiles": ["<node_internals>/**"]
     },
     {
       "name": "test ui",
@@ -79,9 +71,7 @@
       "request": "launch",
       "command": "pnpm test:ui",
       "cwd": "${workspaceFolder}",
-      "skipFiles": [
-        "<node_internals>/**"
-      ]
+      "skipFiles": ["<node_internals>/**"]
     }
   ]
 }

.vscode/settings.json

@@ -1,13 +1,6 @@
 {
-  "eslint.workingDirectories": [
-    {
-      "mode": "auto"
-    }
-  ],
-  "eslint.experimental.useFlatConfig": true,
-  "typescript.tsdk": "node_modules\\typescript\\lib",
+  "js/ts.tsdk.path": "node_modules\\typescript\\lib",
   "js/ts.implicitProjectConfig.experimentalDecorators": true,
-  "prettier.configPath": "./tooling/prettier/index.mjs",
   "cSpell.words": [
     "ajnart",
     "cqmin",
@@ -34,11 +27,7 @@
   ],
   "i18n-ally.dirStructure": "auto",
   "i18n-ally.displayLanguage": "en",
-  "i18n-ally.enabledFrameworks": [
-    "custom"
-  ],
-  "i18n-ally.localesPaths": [
-    "packages/translation/src/lang",
-  ],
-  "i18n-ally.keystyle": "nested",
+  "i18n-ally.enabledFrameworks": ["custom"],
+  "i18n-ally.localesPaths": ["packages/translation/src/lang"],
+  "i18n-ally.keystyle": "nested"
 }

AGENTS.md

@@ -0,0 +1,104 @@
+# Homarr Agent Rules
+
+## Repository Structure
+
+```
+homarr/
+├── apps/
+│   ├── nextjs/          # Main Next.js application (port 3000)
+│   ├── docs/            # Docusaurus 3 documentation site (@homarr/docs)
+│   ├── tasks/           # Cron-job initialization and scheduling runtime
+│   ├── websocket/       # Standalone tRPC WebSocket server (port 3001)
+│   └── workshop/        # Go/PocketBase Workshop service
+├── packages/
+│   ├── api/             # tRPC appRouter, procedures, OpenAPI
+│   ├── auth/            # NextAuth config, providers, session, API keys
+│   ├── db/              # Drizzle schema (3 DB drivers), migrations, queries
+│   ├── core/            # Env validation, DB/Redis driver factories, logging
+│   ├── definitions/     # Domain enums: WidgetKind, IntegrationKind, permissions
+│   ├── widgets/         # Dashboard widget definitions and components
+│   ├── integrations/    # Integration classes (HTTP clients to external apps)
+│   ├── redis/           # Redis pub/sub channels, caching abstractions
+│   ├── translation/     # next-intl setup, locale configs, lang JSON files
+│   ├── ui/              # Shared Mantine components, theme, hooks
+│   ├── validation/      # Shared zod schemas for API/forms
+│   ├── common/          # Shared utilities, IDs, errors
+│   ├── cron-jobs/       # Cron job implementations
+│   ├── cron-jobs-core/  # Cron scheduling primitives
+│   ├── cron-job-status/ # Cron status via Redis
+│   ├── boards/          # Board context, edit mode, cache updater
+│   ├── modals/          # Modal primitives on Mantine
+│   ├── modals-collection/ # Feature modals (apps, boards, docker, etc.)
+│   ├── form/            # useZodForm (Mantine + zod resolver)
+│   ├── forms-collection/# Reusable form UIs (new app, icon picker, upload)
+│   ├── spotlight/       # Command palette / search with multiple modes
+│   ├── request-handler/ # Server request handlers (feeds, integrations)
+│   ├── notifications/   # Mantine notifications wrapper
+│   ├── docker/          # Dockerode-based Docker access
+│   ├── icons/           # Icon DB/repo integration
+│   ├── image-proxy/     # Image proxy + caching
+│   ├── ping/            # Reachability / ping utilities
+│   ├── analytics/       # Server-side analytics (Umami)
+│   ├── server-settings/ # Server setting keys/types
+│   ├── settings/        # User-facing settings UI context
+│   ├── custom-widgets/  # Custom JSX v2 schema, validation, and runtime
+│   ├── onboarding/      # Onboarding studio and setup flow
+│   ├── workshop/        # Homarr-side Workshop client and contracts
+│   └── cli/             # Node CLI for ops (brocli)
+├── tooling/
+│   ├── typescript/      # Base tsconfig
+│   └── github/          # CI setup action
+├── tools/
+│   └── homarr-dev/      # Go CLI for local and PR Docker images
+├── development/         # Dev docker-compose (Redis, MySQL, PostgreSQL)
+├── e2e/                 # E2E test specs
+└── Dockerfile           # Multi-stage production build
+```
+
+## Documentation Sync
+
+The documentation site lives at `apps/docs/` (Docusaurus 3, `@homarr/docs`).
+
+When modifying user-facing code, you MUST also update the corresponding documentation:
+
+- New integration → `apps/docs/docs/integrations/<slug>/index.mdx` + `index.ts`
+- New widget → `apps/docs/docs/widgets/<slug>/index.mdx` + `index.ts`
+- Changed API → `apps/docs/docs/management/api/index.mdx`
+- New/changed env vars → `apps/docs/docs/advanced/`
+- New CLI commands → `apps/docs/docs/advanced/command-line/`
+- Auth changes → `apps/docs/docs/advanced/` SSO pages
+- New cron job → `apps/docs/docs/management/tasks.mdx`
+
+## Monorepo Commands
+
+- `pnpm dev` — Next.js app only
+- `pnpm dev:cli -- dev` — run the developer CLI without installing a global binary
+- `pnpm db:seed` — seed default database data explicitly
+- `pnpm docker:dev:up` — start the Redis development service in the background
+- `pnpm dev:docs` — Docusaurus docs site only
+- `pnpm turbo build` — build all packages
+- `pnpm turbo build --filter=@homarr/docs` — build docs only
+- `pnpm turbo typecheck` — typecheck all packages
+- `pnpm lint` / `pnpm format` — oxlint / oxfmt
+
+## Code Style
+
+- Lint: oxlint (not ESLint)
+- Format: oxfmt (not Prettier)
+- UI: Mantine (not Tailwind) — Tailwind is only used in docs app
+- Mantine: use the project-scoped MCP server in `.mcp.json` for current v9 APIs, and check `packages/ui/` before creating a new primitive.
+- Icons: @tabler/icons-react
+- Docs app can import from `@homarr/definitions` for shared types
+- Run `pnpm dev:cli -- dev` to browse local `homarr:*` images and remote PR images.
+- Run `pnpm dev:cli -- build <name>` from a Homarr checkout to build `homarr:<name>` with rebuild provenance.
+- Run `pnpm dev:cli -- build --pr <number>` to build a PR locally from a temporary checkout.
+- Run Go checks from `tools/homarr-dev` with `go test ./...` and `go vet ./...`.
+
+## Agent Skills
+
+Portable skills live in `.agents/skills/`. Read the relevant `SKILL.md` before working in that domain; detailed references are loaded only when needed. Claude-compatible discovery is provided through `.claude/skills`.
+
+- `codebase-context` — architecture, package boundaries, and shared utilities
+- `documentation-sync` — required user-facing documentation updates
+- `mcp-integration` — safe tRPC-to-MCP exposure
+- `homarr-custom-widget` — safe Custom JSX v2 authoring

CODEOWNERS

@@ -1 +1,234 @@
+# ── CODEOWNERS ───────────────────────────────────────
 * @homarr-labs/maintainers
+
+# Specific features / integrations
+# These owners come from the PR that introduced each integration implementation.
+# Specific rules override the global fallback because CODEOWNERS uses the last
+# matching pattern; do not include @homarr-labs/maintainers here unless they
+# should also be requested for that integration.
+
+# AdGuard Home - introduced in https://github.com/homarr-labs/homarr/pull/929 by @hillaliy
+apps/docs/docs/integrations/adguard-home @hillaliy
+packages/integrations/src/adguard-home @hillaliy
+
+# Anchor - introduced in https://github.com/homarr-labs/homarr/pull/5040 by @ohmzi
+apps/docs/docs/integrations/anchor @ohmzi
+packages/integrations/src/anchor @ohmzi
+
+# ArchiveTeam Warrior - introduced in https://github.com/homarr-labs/homarr/pull/5784 by @darbyjack
+apps/docs/docs/integrations/archive-team-warrior @darbyjack
+packages/integrations/src/archive-team-warrior @darbyjack
+
+# Bazarr - introduced in https://github.com/homarr-labs/homarr/pull/6156 by @Ayush7614
+apps/docs/docs/integrations/bazarr @Ayush7614
+apps/docs/docs/widgets/bazarr @Ayush7614
+packages/api/src/router/widgets/bazarr.ts @Ayush7614
+packages/integrations/src/bazarr @Ayush7614
+packages/request-handler/src/bazarr.ts @Ayush7614
+packages/widgets/src/bazarr @Ayush7614
+
+# Audiobookshelf - introduced in https://github.com/homarr-labs/homarr/pull/5910 by @ajnart
+apps/docs/docs/integrations/audiobookshelf @ajnart
+packages/integrations/src/audiobookshelf @ajnart
+
+# Beszel - introduced in https://github.com/homarr-labs/homarr/pull/5900 by @ajnart
+apps/docs/docs/integrations/beszel @ajnart
+packages/integrations/src/beszel @ajnart
+
+# Codeberg - introduced in https://github.com/homarr-labs/homarr/pull/3253 by @Aandree5
+apps/docs/docs/integrations/codeberg @Aandree5
+packages/integrations/src/codeberg @Aandree5
+
+# Coolify - introduced in https://github.com/homarr-labs/homarr/pull/4789 by @Rhiz3K
+apps/docs/docs/integrations/coolify @Rhiz3K
+packages/integrations/src/coolify @Rhiz3K
+
+# Dash. - introduced in https://github.com/homarr-labs/homarr/pull/1541 by @manuel-rw
+apps/docs/docs/integrations/dash-dot @manuel-rw
+packages/integrations/src/dashdot @manuel-rw
+
+# Docker Hub - introduced in https://github.com/homarr-labs/homarr/pull/3253 by @Aandree5
+apps/docs/docs/integrations/docker-hub @Aandree5
+packages/integrations/src/docker-hub @Aandree5
+
+# Emby - introduced in https://github.com/homarr-labs/homarr/pull/2466 by @Meierschlumpf
+apps/docs/docs/integrations/emby @Meierschlumpf
+packages/integrations/src/emby @Meierschlumpf
+
+# GitHub - introduced in https://github.com/homarr-labs/homarr/pull/3253 by @Aandree5
+apps/docs/docs/integrations/github @Aandree5
+packages/integrations/src/github @Aandree5
+
+# GitHub Container Registry - introduced in https://github.com/homarr-labs/homarr/pull/3727 by @Aandree5
+apps/docs/docs/integrations/github-containerregistry @Aandree5
+packages/integrations/src/github-container-registry @Aandree5
+
+# GitLab - introduced in https://github.com/homarr-labs/homarr/pull/3253 by @Aandree5
+apps/docs/docs/integrations/gitlab @Aandree5
+packages/integrations/src/gitlab @Aandree5
+
+# Glances - introduced in https://github.com/homarr-labs/homarr/pull/5102 by @manuel-rw
+apps/docs/docs/integrations/glances @manuel-rw
+packages/integrations/src/glances @manuel-rw
+
+# Gluetun - introduced in https://github.com/homarr-labs/homarr/pull/5812 by @Lok3sh-kumar
+apps/docs/docs/integrations/gluetun @Lok3sh-kumar
+packages/integrations/src/gluetun @Lok3sh-kumar
+
+# Gotify - introduced in https://github.com/homarr-labs/homarr/pull/5847 by @Nerdy-Technician
+apps/docs/docs/integrations/gotify @Nerdy-Technician
+packages/integrations/src/gotify @Nerdy-Technician
+
+# Home Assistant - introduced in https://github.com/homarr-labs/homarr/pull/578 by @manuel-rw
+apps/docs/docs/integrations/home-assistant @manuel-rw
+packages/integrations/src/homeassistant @manuel-rw
+
+# ICal - introduced in https://github.com/homarr-labs/homarr/pull/3980 by @NicolasNewman
+apps/docs/docs/integrations/ical @NicolasNewman
+packages/integrations/src/ical @NicolasNewman
+
+# Immich - introduced in https://github.com/homarr-labs/homarr/pull/5165 by @manuel-rw
+apps/docs/docs/integrations/immich @manuel-rw
+packages/integrations/src/immich @manuel-rw
+
+# Jellyfin - introduced in https://github.com/homarr-labs/homarr/pull/672 by @manuel-rw
+apps/docs/docs/integrations/jellyfin @manuel-rw
+packages/integrations/src/jellyfin @manuel-rw
+
+# Jellyseerr - introduced in https://github.com/homarr-labs/homarr/pull/774 by @manuel-rw
+apps/docs/docs/integrations/jellyseerr @manuel-rw
+packages/integrations/src/jellyseerr @manuel-rw
+
+# LinuxServer.io - introduced in https://github.com/homarr-labs/homarr/pull/3607 by @Aandree5
+apps/docs/docs/integrations/linux-server-io @Aandree5
+packages/integrations/src/linuxserverio @Aandree5
+
+# Navidrome - introduced in https://github.com/homarr-labs/homarr/pull/5910 by @ajnart
+apps/docs/docs/integrations/navidrome @ajnart
+packages/integrations/src/navidrome @ajnart
+
+# Nextcloud - introduced in https://github.com/homarr-labs/homarr/pull/2501 by @manuel-rw
+apps/docs/docs/integrations/nextcloud @manuel-rw
+packages/integrations/src/nextcloud @manuel-rw
+
+# npm - introduced in https://github.com/homarr-labs/homarr/pull/3253 by @Aandree5
+apps/docs/docs/integrations/npm @Aandree5
+packages/integrations/src/npm @Aandree5
+
+# ntfy - introduced in https://github.com/homarr-labs/homarr/pull/2900 by @itzTheMeow
+apps/docs/docs/integrations/ntfy @ajnart @manuel-rw
+packages/integrations/src/ntfy @ajnart @manuel-rw
+
+# OpenMediaVault - introduced in https://github.com/homarr-labs/homarr/pull/1142 by @hillaliy
+apps/docs/docs/integrations/open-media-vault @hillaliy
+packages/integrations/src/openmediavault @hillaliy
+
+# OPNsense - introduced in https://github.com/homarr-labs/homarr/pull/3424 by @Oupsman
+apps/docs/docs/integrations/opnsense @Oupsman
+packages/integrations/src/opnsense @Oupsman
+
+# Overseerr - introduced in https://github.com/homarr-labs/homarr/pull/774 by @manuel-rw
+apps/docs/docs/integrations/overseerr @manuel-rw
+packages/integrations/src/overseerr @manuel-rw
+
+# Paperless-ngx - introduced in https://github.com/homarr-labs/homarr/pull/5910 by @ajnart
+apps/docs/docs/integrations/paperless-ngx @ajnart
+packages/integrations/src/paperless-ngx @ajnart
+
+# PatchMon - introduced in https://github.com/homarr-labs/homarr/pull/6119 by @mrjoshuap
+apps/docs/docs/integrations/patchmon @mrjoshuap
+packages/integrations/src/patchmon @mrjoshuap
+packages/widgets/src/patchmon @mrjoshuap
+packages/api/src/router/widgets/patchmon.ts @mrjoshuap
+packages/request-handler/src/patchmon.ts @mrjoshuap
+
+# PeaNUT - introduced in https://github.com/homarr-labs/homarr/pull/5862 by @afonsojramos
+apps/docs/docs/integrations/peanut @afonsojramos
+packages/integrations/src/peanut @afonsojramos
+
+# Pi-hole - introduced in https://github.com/homarr-labs/homarr/pull/521 by @Meierschlumpf
+apps/docs/docs/integrations/pi-hole @Meierschlumpf
+packages/integrations/src/pi-hole @Meierschlumpf
+
+# Plex - introduced in https://github.com/homarr-labs/homarr/pull/1342 by @hillaliy
+apps/docs/docs/integrations/plex @hillaliy
+packages/integrations/src/plex @hillaliy
+
+# Prowlarr - introduced in https://github.com/homarr-labs/homarr/pull/965 by @hillaliy
+apps/docs/docs/integrations/prowlarr @hillaliy
+packages/integrations/src/prowlarr @hillaliy
+
+# Proxmox - introduced in https://github.com/homarr-labs/homarr/pull/1969 by @Meierschlumpf
+apps/docs/docs/integrations/proxmox @Meierschlumpf
+packages/integrations/src/proxmox @Meierschlumpf
+
+# Quay - introduced in https://github.com/homarr-labs/homarr/pull/3607 by @Aandree5
+apps/docs/docs/integrations/quay @Aandree5
+packages/integrations/src/quay @Aandree5
+
+# search.ch - introduced in https://github.com/homarr-labs/homarr/pull/5180 by @Meierschlumpf
+apps/docs/docs/integrations/search-ch @Meierschlumpf
+packages/integrations/src/search-ch @Meierschlumpf
+
+# Speedtest Tracker - introduced in https://github.com/homarr-labs/homarr/pull/5363 by @kylegrieder
+apps/docs/docs/integrations/speedtest-tracker @kylegrieder
+packages/integrations/src/speedtest-tracker @kylegrieder
+
+# Synology - introduced in https://github.com/homarr-labs/homarr/pull/6121 by @mrjoshuap
+apps/docs/docs/integrations/synology @mrjoshuap
+packages/integrations/src/synology @mrjoshuap
+
+# Technitium DNS - introduced in https://github.com/homarr-labs/homarr/pull/5832 by @lopsch
+apps/docs/docs/integrations/technitium-dns @lopsch
+packages/integrations/src/technitium @lopsch
+
+# Tracearr - introduced in https://github.com/homarr-labs/homarr/pull/5060 by @StrandedTurtle
+apps/docs/docs/integrations/tracearr @StrandedTurtle
+packages/integrations/src/tracearr @StrandedTurtle
+
+# TrueNAS - introduced in https://github.com/homarr-labs/homarr/pull/3745 by @manuel-rw
+apps/docs/docs/integrations/truenas @manuel-rw @afonsojramos
+packages/integrations/src/truenas @manuel-rw @afonsojramos
+
+# Umami - introduced in https://github.com/homarr-labs/homarr/pull/5362 by @febrile42
+apps/docs/docs/integrations/umami @febrile42
+packages/integrations/src/umami @febrile42
+
+# UniFi Controller - introduced in https://github.com/homarr-labs/homarr/pull/2236 by @pitschi
+apps/docs/docs/integrations/unifi-controller @pitschi
+packages/integrations/src/unifi-controller @pitschi
+
+# Unraid - introduced in https://github.com/homarr-labs/homarr/pull/4439 by @manuel-rw
+apps/docs/docs/integrations/unraid @manuel-rw
+packages/integrations/src/unraid @manuel-rw
+
+# Uptime Kuma - introduced in https://github.com/homarr-labs/homarr/pull/5910 by @ajnart
+apps/docs/docs/integrations/uptime-kuma @ajnart
+packages/integrations/src/uptime-kuma @ajnart
+
+# What's Up Docker (WUD) - introduced in https://github.com/homarr-labs/homarr/pull/6523 by @tiimonn
+apps/docs/docs/integrations/whats-up-docker @tiimonn
+apps/docs/docs/widgets/whats-up-docker @tiimonn
+packages/api/src/router/widgets/wud.ts @tiimonn
+packages/integrations/src/wud @tiimonn
+packages/request-handler/src/wud.ts @tiimonn
+packages/widgets/src/wud @tiimonn
+
+# Traefik - by @Nerdy-Technician
+apps/docs/docs/integrations/traefik @Nerdy-Technician
+apps/docs/docs/widgets/traefik @Nerdy-Technician
+packages/api/src/router/widgets/traefik.ts @Nerdy-Technician
+packages/integrations/src/traefik @Nerdy-Technician
+packages/request-handler/src/traefik.ts @Nerdy-Technician
+packages/widgets/src/traefik @Nerdy-Technician
+
+# Exempt Renovate-managed files (no owners)
+package.json
+**/package.json
+package-lock.json
+**/package-lock.json
+pnpm-lock.yaml
+**/pnpm-lock.yaml
+pnpm-workspace.yaml
+Dockerfile
+docker-compose.yml

Dockerfile

@@ -1,27 +1,53 @@
-FROM node:22.16.0-alpine AS base
+# syntax=docker/dockerfile:1.25
+
+FROM node:24.18.0-alpine AS base
 
 FROM base AS builder
-RUN apk add --no-cache libc6-compat
-RUN apk update
-
-# Set working directory
+ARG TARGETPLATFORM
 WORKDIR /app
-RUN apk add --no-cache libc6-compat curl bash
-RUN apk update
+# Native dependencies normally use prebuilds, but the build must remain
+# reproducible when a prebuild download times out and compilation is required.
+RUN apk add --no-cache libc6-compat curl bash python3 make g++
+
+RUN corepack enable pnpm
+COPY .npmrc pnpm-lock.yaml pnpm-workspace.yaml package.json ./
+COPY patches ./patches
+COPY --parents ./apps/*/package.json ./packages/*/package.json ./tooling/*/package.json ./
+# @homarr/definitions generates documentation types during install.
+COPY --parents ./packages/definitions/src ./
+# Workaround for pnpm/pnpm#5268: pnpm fetch crashes when patchedDependencies
+# are configured with nodeLinker: hoisted. The applyPatchToDir function tries
+# to chdir into node_modules/<pkg> which doesn't exist during fetch (only the
+# content-addressable store is populated). By temporarily switching to the
+# isolated linker, patches apply inside the virtual store (node_modules/.pnpm/...)
+# which IS created by pnpm fetch. The original hoisted linker is restored
+# before the install step so the final node_modules layout stays flat.
+RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store,sharing=locked \
+    pnpm config set store-dir /pnpm/store && \
+    sed -i 's/nodeLinker: hoisted/nodeLinker: isolated/' pnpm-workspace.yaml && \
+    pnpm fetch --ignore-scripts && \
+    sed -i 's/nodeLinker: isolated/nodeLinker: hoisted/' pnpm-workspace.yaml
+
+# Install only from the fetched, committed lockfile so local and Docker builds
+# resolve the same dependency graph. Serial lifecycle builds avoid esbuild's
+# atomic binary replacement racing across the hoisted workspace (pnpm/pnpm#8200).
+RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store,sharing=locked \
+    npm_config_nodedir=/usr/local pnpm install --recursive --offline --frozen-lockfile --child-concurrency=1
+
 COPY . .
 
-# Install working version of corepack (See https://github.com/nodejs/corepack/issues/612)
-RUN npm install -g corepack@0.31.0 && corepack --version
-RUN corepack enable pnpm && pnpm install --recursive --frozen-lockfile
-
-# Copy static data as it is not part of the build
-COPY static-data ./static-data
 ARG SKIP_ENV_VALIDATION='true'
 ARG CI='true'
 ARG DISABLE_REDIS_LOGS='true'
-# Install working version of corepack (See https://github.com/nodejs/corepack/issues/612)
-RUN npm install -g corepack@0.31.0 && corepack --version
-RUN corepack enable pnpm && pnpm build
+ARG TARGETPLATFORM
+
+RUN --mount=type=secret,id=TURBO_API,env=TURBO_API \
+    --mount=type=secret,id=TURBO_TEAM,env=TURBO_TEAM \
+    --mount=type=secret,id=TURBO_TOKEN,env=TURBO_TOKEN \
+    --mount=type=secret,id=TURBO_REMOTE_CACHE_SIGNATURE_KEY,env=TURBO_REMOTE_CACHE_SIGNATURE_KEY \
+    --mount=type=cache,id=homarr-next-build-${TARGETPLATFORM},target=/app/apps/nextjs/.next/cache,sharing=locked \
+    TURBO_PLATFORM="${TARGETPLATFORM:-linux/amd64}" \
+    pnpm turbo build --filter=@homarr/nextjs... --filter=@homarr/cli
 
 FROM base AS runner
 WORKDIR /app
@@ -45,9 +71,8 @@ RUN mkdir -p /var/cache/nginx && \
 
 COPY --from=builder /app/apps/nextjs/next.config.ts .
 COPY --from=builder /app/apps/nextjs/package.json .
+COPY --from=builder /app/pnpm-workspace.yaml ./pnpm-workspace.yaml
 
-COPY --from=builder /app/apps/tasks/tasks.cjs ./apps/tasks/tasks.cjs
-COPY --from=builder /app/apps/websocket/wssServer.cjs ./apps/websocket/wssServer.cjs
 COPY --from=builder /app/node_modules/better-sqlite3/build/Release/better_sqlite3.node /app/build/better_sqlite3.node
 
 COPY --from=builder /app/packages/db/migrations ./db/migrations
@@ -58,7 +83,7 @@ COPY --from=builder /app/apps/nextjs/.next/standalone ./
 COPY --from=builder /app/apps/nextjs/.next/static ./apps/nextjs/.next/static
 COPY --from=builder /app/apps/nextjs/public ./apps/nextjs/public
 COPY scripts/run.sh ./run.sh
-COPY --chmod=777 scripts/entrypoint.sh ./entrypoint.sh
+COPY --chmod=755 scripts/entrypoint.sh ./entrypoint.sh
 COPY packages/redis/redis.conf /app/redis.conf
 COPY nginx.conf /etc/nginx/templates/nginx.conf
 
@@ -67,7 +92,9 @@ ENV DB_URL='/appdata/db/db.sqlite'
 ENV DB_DIALECT='sqlite'
 ENV DB_DRIVER='better-sqlite3'
 ENV AUTH_PROVIDERS='credentials'
+ENV REDIS_IS_EXTERNAL='false'
 ENV NODE_ENV='production'
 
+EXPOSE 7575
 ENTRYPOINT [ "/app/entrypoint.sh" ]
 CMD ["sh", "run.sh"]

SECURITY.md

@@ -1,18 +1,18 @@
 # Security Policy
+
 This policy is relevant if you found potential vulnerabilities in an audit.
 We consider something as a vulnerability if it...
+
 1. puts users or user data at risk
 2. enables third parties to gain control or access (e.g. [RATs](https://en.wikipedia.org/wiki/Remote_desktop_software#RAT), [privilege escalation](https://en.wikipedia.org/wiki/Privilege_escalation), ...)
 3. abuses the system in an unintended way (e.g. crypto mining, proxy, ...)
 
 ## Supported Versions
 
-| Version | Supported          |
-| ------- | ------------------ |
-| >1.0.0  | :white_check_mark: |
-| <1.0.0  | :x:                |
+We only fix security issues in the [latest stable version](https://github.com/homarr-labs/homarr/releases/latest). Meaning security issues in prior versions will not be fixed and users have to upgrade to the latest version to receive them.
 
 ## Reporting a Vulnerability
+
 We use [GitHub's system for reporting vulnerabilities](https://docs.github.com/en/enterprise-cloud@latest/code-security/security-advisories/working-with-repository-security-advisories/creating-a-repository-security-advisory).
 Click [**here to report an advisory**](https://github.com/homarr-labs/homarr/security/advisories/new). Our team will get notified and will get back to you within 1-6 business days.
 

apps/docs/.dockerignore

@@ -0,0 +1,6 @@
+Dockerfile
+.dockerignore
+node_modules
+npm-debug.log
+README.md
+.git

apps/docs/.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lf

apps/docs/.gitignore

@@ -0,0 +1,58 @@
+# See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
+.idea/
+
+# dependencies
+/node_modules
+/.pnp
+.pnp.js
+.pnpm-store/
+
+# testing
+/coverage
+
+# next.js
+/.next/
+/out/
+
+# production
+/build
+
+# misc
+.DS_Store
+*.pem
+
+# debug
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# local env files
+.env.local
+.env.development.local
+.env.test.local
+.env.production.local
+
+# vercel
+.vercel
+*.tsbuildinfo
+
+# storybook
+storybook-static
+static/data/configs
+
+# https://yarnpkg.com/getting-started/qa#which-files-should-be-gitignored
+# Yarn v2
+.pnp.*
+.yarn/*
+!.yarn/patches
+!.yarn/plugins
+!.yarn/releases
+!.yarn/sdks
+!.yarn/versions
+
+# docusaurus
+.docusaurus
+
+# CI Stuff
+screenshots
+test-results

apps/docs/.oxlintrc.json

@@ -0,0 +1,30 @@
+{
+  "$schema": "../../node_modules/oxlint/configuration_schema.json",
+  "plugins": ["eslint", "typescript", "unicorn", "oxc", "react", "import", "jsx-a11y"],
+  "categories": {
+    "correctness": "error",
+    "suspicious": "warn",
+    "pedantic": "off",
+    "perf": "off",
+    "style": "off",
+    "restriction": "off",
+    "nursery": "off"
+  },
+  "rules": {
+    "eslint/no-unused-vars": ["warn", { "argsIgnorePattern": "^_", "varsIgnorePattern": "^_" }],
+    "typescript/consistent-type-imports": "off",
+    "typescript/no-non-null-assertion": "warn",
+    "import/consistent-type-specifier-style": "off",
+    "jsx-a11y/alt-text": "warn",
+    "jsx-a11y/control-has-associated-label": "warn",
+    "jsx-a11y/prefer-tag-over-role": "warn",
+    "react/jsx-key": "warn",
+    "react/react-in-jsx-scope": "off",
+    "react-hooks/exhaustive-deps": "warn",
+    "eslint/no-unused-expressions": "warn"
+  },
+  "ignorePatterns": ["**/*.config.js", "**/*.config.mjs", "**/*.cjs", ".docusaurus/**", "build/**"],
+  "settings": {
+    "react": { "version": "19" }
+  }
+}

apps/docs/.vscode/settings.json

@@ -0,0 +1,3 @@
+{
+  "cSpell.words": ["Homarr", "Lidarr", "Nextcloud", "Radarr", "Readarr", "Sonarr"]
+}

apps/docs/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright (c) 2025 Meier Lukas, Thomas Camlong and Homarr Labs
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

apps/docs/README.md

@@ -0,0 +1,112 @@
+# Homarr Documentation (`@homarr/docs`)
+
+The official [homarr.dev](https://homarr.dev) documentation site, built with [Docusaurus 3](https://docusaurus.io/) and living inside the Homarr monorepo.
+
+## Why it's in the monorepo
+
+Having documentation alongside the application code enables:
+
+- **Two-way linking** — the docs app imports from `@homarr/definitions` for type-safe integration/widget metadata, and the main app references doc paths via generated sitemap types
+- **Atomic PRs** — code changes and their documentation updates ship in the same pull request
+- **Shared tooling** — same Node version, pnpm catalog, oxlint/oxfmt, CI pipeline
+- **Build-time validation** — Docusaurus strict mode catches broken links and references at build time
+
+## Development
+
+From the **monorepo root**:
+
+```bash
+# Start the docs dev server (port 3003)
+pnpm dev:docs
+
+# Or from within this directory
+pnpm dev
+
+# Point the docs at a local PocketBase instance
+WORKSHOP_API_URL=http://127.0.0.1:8090 pnpm dev:docs
+```
+
+The standalone docs use `WORKSHOP_API_URL` for PocketBase and `HOMARR_WEBSITE_URL` for the public site origin. The old
+`WORKSHOP_URL` name is a deprecated one-release alias.
+
+## Build
+
+```bash
+# Build docs only
+pnpm turbo build --filter=@homarr/docs
+
+# Build everything (docs + main app + tasks + websocket)
+pnpm build
+```
+
+## Lint & Format
+
+Uses oxlint and oxfmt (same as the rest of the monorepo):
+
+```bash
+pnpm lint        # oxlint
+pnpm format      # oxfmt (check)
+pnpm format:fix    # oxfmt (fix)
+```
+
+## Typecheck
+
+```bash
+pnpm typecheck
+```
+
+## Content Structure
+
+```
+docs/
+├── getting-started/    # Installation guides, glossary, prerequisites
+├── management/         # Boards, apps, users, integrations, settings, tasks, API
+├── integrations/       # 56 integration guides (one folder each)
+├── widgets/            # 43 widget guides (one folder each)
+├── advanced/           # SSO, env vars, proxy, styling, CLI, development
+└── community/          # FAQ, donate, license, translations, get-in-touch
+```
+
+Each integration/widget doc follows a consistent pattern:
+
+- `index.ts` — typed metadata (`IntegrationDefinition` / `WidgetDefinition`)
+- `index.mdx` — content using shared React components (`IntegrationHeader`, `WidgetHeader`, etc.)
+
+## Importing from homarr packages
+
+The docs app has `@homarr/definitions` as a workspace dependency. You can import integration kinds, widget kinds, and other definitions directly:
+
+```typescript
+import { IntegrationKind } from "@homarr/definitions";
+```
+
+This enables type-safe references to homarr domain concepts within documentation code.
+
+## Search (Algolia DocSearch)
+
+Search uses the `Docusaurus` Algolia index (crawler `cd77a285-2756-4557-bf21-ee703748df15`). A separate `markdown` index is built for LLM markdown indexing.
+
+Crawler reference config: [`docsearch.config.js`](docsearch.config.js).
+
+**Verify search health:**
+
+```bash
+pnpm verify:search
+```
+
+## Tech Stack
+
+| Layer          | Technology                                  |
+| -------------- | ------------------------------------------- |
+| Site generator | Docusaurus 3 (`@docusaurus/preset-classic`) |
+| Styling        | Tailwind CSS 4 + Docusaurus Infima          |
+| Icons          | `@tabler/icons-react`                       |
+| Diagrams       | Mermaid (`@docusaurus/theme-mermaid`)       |
+| Search         | Algolia DocSearch                           |
+| Analytics      | PostHog                                     |
+| Charts         | @nivo/line                                  |
+
+## Contributing
+
+When a Homarr change affects user-facing behavior, update the corresponding documentation in this app. See the
+[documentation-sync skill](../../.agents/skills/documentation-sync/SKILL.md) for the code-to-documentation mapping.

apps/docs/blog/2022/06-22-documentation/index.mdx

@@ -0,0 +1,35 @@
+---
+slug: documentation-migration
+title: Migration of Documentation
+authors:
+  - ajnart
+  - manuel-rw
+tags: [documentation, migration]
+---
+
+We are happy to announce that the documentation of Homarr has been migrated to Docusaurus - An opensource documentation tool.
+The documentation has been re-written partly and includes now many animations, guides and additional crucial information.
+
+We are still figuring things out and highly depend on your feedback.
+
+<!-- truncate -->
+
+## Why we migrated
+
+The default GitHub Wiki feature is decent - but very confusing to read.
+Our possibilites for searching the documentation in the Wiki are highly limited.
+Additionally, Users are unable to contribute to the documentation if they have not sufficient permissions.
+
+We could not review any chanegs made to the documentation. This is why we migrated to Docusaurus.
+
+## How you can contribute
+
+The documentation will soon be merged into the master branch of Homarr.
+You'll find a ``doc/`` directory in the root of Homarr.
+We'll obviously not include this in our Docker images.
+In the future, everyone may modify the documentation by creating a pull request.
+After we've reviewed your changes, we'll merge your PR and this documentation will automatically update.
+
+## TL;DR
+
+The documentation on GitHub Wiki will soon disappear. It will be replaced with this Docusaurus-powered website. You'll find much more information here with higher detail and searchability.

apps/docs/blog/2022/08-28-translation/index.mdx

@@ -0,0 +1,20 @@
+---
+slug: translations
+title: Help us make Homarr multilingual
+authors:
+  - ajnart
+  - manuel-rw
+tags: [translations, homarr, update, contributions]
+---
+
+We've been working hard to offer Homarr in many languages. The next update of Homarr will be using [i18next](https://www.i18next.com/) to translate almost any part of your Dashboard.
+
+### We need your help
+![](img/homarr-we-need-you.webp) <br/>
+Yes, we need **YOU**! We want to make Homarr accessible to as many people as possible. Thus, we need to translate all content into many different languages. We need your help for that! [You can help us now to translate Homarr into as many languages as possible](/docs/community/translations).
+
+<!-- truncate -->
+
+### About global translations / translations per user
+
+We are aware that many people would like to configure translations globally or configure language per user. Currently, translations are stored in the Cookies, which will expire after some time (currently, it's set to 30 days). We will implement more granular language settings in future versions of Homarr, since it requires major changes to Homarr. Stay tuned! 😎

apps/docs/blog/2023/01-11-version0.11/index.mdx

@@ -0,0 +1,67 @@
+---
+title: "We present: Homarr 0.11 - the most complex Homarr version yet!"
+authors:
+  - ajnart
+  - manuel-rw
+  - walkx
+  - meierschlumpf
+tags: [homarr, update, breaking changes, version, gridstack, dnd, documentation]
+---
+
+We are *incredibly* proud to serve you Homarr 0.11!
+It contains many breaking changes and huge improvements to your favourite dashboard app:
+
+- Integration of Gridstack for much more complex dashboard configuration and drag and drop
+- Added icon picker with smart search and automatic icons
+- Complete overhaul of the module system
+- Added an edit mode for making changes easier
+- Form validation for better user experience
+- Better security with new built-in credentials system
+- Huge design and usability improvements to older components to Homarr
+- Better handeling of exceptions and unexpected issues
+
+<!-- truncate -->
+
+## Complete implementation of highly customizable drag and drop library "Gridstack"
+
+In 0.11, we have replaced our quite limited drag and drop system with Gridstack.
+Gridstack enables you to create much more complex and advanced dashboards while keeping everything organized.
+
+<video style={{ maxWidth: "min(100%, 600px)", borderRadius: "0.5rem"}} controls preload='auto' autoplay >
+  <source src="https://user-images.githubusercontent.com/30572287/217098893-5880e7de-13d0-42c5-b505-f7921593396f.mp4" type="video/mp4" />
+    <p>
+      To view this video please enable JavaScript, and consider upgrading to a
+      web browser that
+      <a href="https://videojs.com/html5-video-support/" target="_blank">
+        supports HTML5 video
+      </a>
+  </p>
+</video>
+
+We've also introduced more advanced categories this time:
+
+![](../../../docs/getting-started/img/category-menu.webp)
+
+We'll continute to improve this system according to your feedback.
+
+## Modules have been overhauled and renamed to widgets
+
+Widgets are now much snappier and have been completely recoded.
+This fixes some of the bugs a few users have previously experienced and improves overall customization.
+
+![](./img/choose-widget-in-modal.webp)
+
+## Fancy icon picker for speeding up your creation process
+
+We've also added a new fancy icon picker, you can use to get access to any icons much faster.
+We will add more icon sources in the future, as we made this icon picker very modular, and we plan to make local icons accessible via this picker very soon.
+
+![](../../../docs/advanced/customizations/img/icons/icons-picker.gif)
+
+## Design and documentation improvements to homarr.dev
+
+https://homarr.dev has been overhauled with better design, updated documentation, more images and better explanations.
+
+## Download Homarr now!
+
+Homarr is completly free, even for commercial usage!

apps/docs/blog/2023/04-16-version0.12-more-widgets/index.mdx

@@ -0,0 +1,75 @@
+---
+title: "We present: Homarr 0.12 - The fastest homarr version ever!"
+authors:
+  - ajnart
+  - manuel-rw
+  - walkx
+  - meierschlumpf
+tags: [homarr, update, breaking changes, version, dnd, documentation]
+---
+
+## Multiple widgets of the same type
+**It's finally here!** You can decorate your dashboard now with as many widgets as you want.
+This applies to all widgets, but in the case of the IFrame widget, it enables you to:
+- Integrate as many websites as you want
+- Integrate monitoring tools like Grafana, Splunk or Elasticsearch
+- Integrate your services (for example Sonarr, Radarr and Overseerr) directly into Homarr
+
+![](https://media.discordapp.net/attachments/988335098493542410/1094665745226539168/update-teaser.png?width=1046&height=666)
+
+## Edit mode password
+We've added a setting to disable editing completely. This will allow you to restrict edit access without password-protection.
+use the `EDIT_MODE_PASSWORD` ENV variable to set a password for edit mode. 
+turn on `DISABLE_EDIT_MODE=TRUE` to disable edit mode on startup.
+
+<!-- truncate -->
+
+## 😎 Blazingly fast
+We've implemented a new caching system, that will cache all data in your browser, meaning that Homarr will load within milliseconds, as if it was *powered by rust and blazingly fast* !!!
+
+## Media request widgets (Overseerr & Jellyseerr)
+We've implemented a new widget, that displays a history of all requests.
+You can't approve from the widget yet, but we plan to add this in the future.
+
+![image](https://user-images.githubusercontent.com/30572287/231829411-f61f03e9-79a0-45fc-9a87-94d69ea3ea84.png)
+
+## Multiple RSS feeds
+You can now consume multiple RSS feeds at the same time:
+
+![image](https://user-images.githubusercontent.com/30572287/231829886-69133a84-3ae7-4fa3-a6d2-c582f4cc9eea.png)
+
+## Tab refresh / close confirmation
+Since some have lost their changes, by refreshing the page in the edit mode. We've added a popup that will ask you to confirm you want to reload the page :
+
+![image](https://user-images.githubusercontent.com/30572287/231823776-9cbb12d4-3cb3-422e-b2e8-f9917bb3f8cc.png)
+
+## Environment variable for default theme
+You can now set the default color scheme using environment variables:
+
+``DEFAULT_COLOR_SCHEME`` = ``[dark, light]``
+
+## Global error catching for widgets
+Previously, widgets were able to crash your entire dashboard and just a blank page would be displayed.
+Now, users will still be able to use their dashboard and an information message will be displayed instead.
+
+## Migration to Mantine V6
+We've migrated Mantine to version 6. This will bring some upstream changes for responsiveness and usability.
+
+## Fix width and height in the calendar
+In 0.11.5 and previous versions, the calendar scaled poorly if the widget was resized.
+Now, the calendar will fill out the entire available space and scale nicely with your dashboard.
+
+![](https://cdn.discordapp.com/attachments/988335098493542410/1095416419816067175/homarr-calendar-scaling.gif)
+
+## Performance improvements
+We now use several methods to improve performance and reduce network requests.
+Homarr will load now within milliseconds and cache data in your browser.
+
+## Docker Socket via TCP
+Previously, it was not possible to mount sockets via TCP (eg. ``tcp://traefik-docker-socket-proxy:2375``).
+Now, you can use the following environment variables to configure this:
+
+- ``DOCKER_HOST``
+- ``DOCKER_PORT``
+
+**Full Changelog**: https://github.com/ajnart/homarr/compare/v0.11.5...v0.12.0

apps/docs/blog/2023/11-10-authentication/index.mdx

@@ -0,0 +1,86 @@
+---
+title: "Authentication in Homarr - 0.14 is here!"
+authors:
+  - ajnart
+  - manuel-rw
+  - tagashi
+  - meierschlumpf
+tags: [homarr, update, breaking changes, version, authentication, notepad, security]
+---
+
+One of the most requested features ever has arrived.
+We worked for months to prepare Homarr for this update and we're happy that we can finally
+provide you a viable solution today.
+
+## Highlights at a glance
+
+- :rocket: Completly overhauled authentication system with user management
+- :sparkles: Improved UI for boards (renamed dashboards to boards).
+- :computer: Server side preferences -> Dark mode and language are not synced accross all your devices
+- :link: Invitation links to easily onboard new users
+- :busts_in_silhouette: Overhauled board management with easy control if anonymous users can view your board
+- :brain:  AI assistant on the documentation to answer your questions: https://homarr.dev/
+- 📝 Overhauled notepad widget with a complex graphical editor that enables easy editing right from your browser.
+- :globe_with_meridians:  Live Translation on Crowdin that enable you to directly translate using images to see what exactly you're translating
+
+<!-- truncate -->
+
+## Breaking changes
+
+- Removed ``PASSWORD`` environment variable
+- Removed ``DISABLE_EDIT_MODE`` environment variable
+- Removed ``EDIT_MODE_PASSWORD`` environment variable
+- Added mounting point ``/data`` for your database
+- Require at least one administrator account on your instance. An onboarding process will automatically set this up.
+- We've added analytics to the documentation and Homarr itself. We use [Umami Analytics](https://umami.is/) which collects anonymous data exclusively and protects your personal data rights. You can disable this using the environment variable ``DISABLE_ANALYTICS``.
+
+## Changes in detail
+
+### Management pages
+![image](https://github.com/ajnart/homarr/assets/30572287/b325eb92-57a6-4b07-a281-f10f7471642e)
+One of the most requested features ever has been ___authentication___. We've completely *removed* the ``PASSWORD``, ``DISABLE_EDIT_MODE`` and ``EDIT_MODE_PASSWORD`` and replaced it by [a secure authentication system](https://next-auth.js.org/) that enables you to manage multiple users easily. We will allow for more detailed permission and user management soon. LDAP and OIDC integrations are currently also in progress and will arrive in a future version.
+
+### New dashboard layout
+![image](https://github.com/ajnart/homarr/assets/30572287/3396da13-816a-434f-a4c1-0efc7f86154c)
+
+We've updated the dashboard user interface slightly to an updated design.
+
+### Server side preferences page
+![image](https://github.com/ajnart/homarr/assets/30572287/2c1f4dbe-7aa7-4c56-aaa3-d6c49e2beeec)
+
+Previously, preferences were stored per dashboard and applied to all users.
+In this release, we moved this page to a separate link and store this on the server.
+This means that regardless what device your on - your preferences will stay the same when you're logged in.
+
+### Invitations for new users
+![image](https://github.com/ajnart/homarr/assets/30572287/a929b345-c014-48fb-aef9-ea2c3c581376)
+
+Tired of creating user accounts by yourself? With the new "invites" feature you can invite new users by simply sending them a link.
+This link is valid only once and must have an expiration date - more info on that in our documentation.
+
+Additionally, you can deny users, that are not logged into an account, to access your board with a simple toggle:
+
+![image](https://github.com/ajnart/homarr/assets/30572287/aa3ff3fb-66fc-4f88-93fb-b2dd819599a8)
+
+### New "boards" page
+Previously, dashboards were managed in an ugly and hard to control popup.
+We've moved this now to the new management pages as well and it's now much easier to control:
+
+![image](https://github.com/ajnart/homarr/assets/30572287/2b24222e-da33-45eb-a54f-89a33a21881d)
+
+
+### Read-only for non-administrators and guests
+Yes, managing access to your dashboard is now much easier!
+Guests and non-administrators cannot edit your dashboard in any way (edit is hidden):
+
+![image](https://github.com/ajnart/homarr/assets/30572287/01c48beb-5453-4626-ac4d-f8d7177e999b)
+
+This is not an definite solution and will be significantly improved in an upcoming update.
+
+-----
+
+We are aware that this update has many breaking changes and may confuse some users.
+For that reason, we updated our documentation and will enhance it further within the next few weeks.
+We've also added this small button at the bottom of the page were you can ask **your questions** to an AI assistant:
+
+![image](https://github.com/ajnart/homarr/assets/30572287/a56f721a-d022-42ad-813a-d85c89462a8c)

apps/docs/blog/2023/12-22-updated-documentation/index.mdx

@@ -0,0 +1,21 @@
+---
+title: "Updated documentation with better organization & design"
+authors:
+  - manuel-rw
+tags: [homarr, documentation, design, docs]
+---
+
+We'd like to let you know that we've updated our documentation and reorganized the pages.
+This means, that some links may no longer be valid - we apologise if this causes any inconvenience for you.
+
+<!-- truncate -->
+
+A few highlights include:
+
+- Updated navigation bar for much easier navigation
+- Improvements to the landing page
+- Completely revamped [about us page.](/about-us)
+- Bug fixes for image zoom
+- Added documentation for management pages and [new CLI tool](/docs/advanced/command-line/password-recovery/)
+
+Please [let us know](/docs/community/get-in-touch) is something is not working as expected.

apps/docs/blog/2024/09-23-version-1.0/index.mdx

@@ -0,0 +1,86 @@
+---
+authors:
+  - manuel-rw
+---
+
+# Homarr 1.0 - complete rewrite of all systems
+We proudly present to you - Homarr ``1.0``.
+We have started work on this new version back in 2023 and have worked tirelessly for months on this brand-new dashboard.
+
+This isn't our usual update. ``1.0`` doesn't use the same code from previous versions, but has been written from the ground up.
+Therefore, this version contains an unusual amount of breaking changes.
+This will be a one time occurrence and version > ``1.0`` will have less breaking changes.
+This time more important than every; **read the breaking changes** list and **create a backup** before updating.
+Some third party installation methods may take multiple days or weeks to update to the new version.
+
+## Changes at a glance
+- **Asynchronous integrations system**: In versions prior to ``1.0``, we fetched data upon each request synchronously.
+This means that the user had to wait for the requests to finish so any data would appear.
+A page reload will trigger another request - and worse, this will happen for every user accessing your dashboard.
+In ``1.0``, we have implemented a new system that gets rid of this system and scales linearly.
+It will fetch data in background, even if you are not on the page.
+- **Permissions system**: You can now use detailed permissions to allow or prohibit users from certain actions.
+For easier management, you can organize users into groups and manage them all at the same time.
+- **Integration testing**: Starting from ``1.0``, we will require you to test the integration before you can use it.
+This guarantees that you've configured your integration correctly and helps you find errors faster.
+- **Re-imagined widgets**: All widgets have been rewritten & improved. They offer much better performance,
+reliability and scalability compared to < ``1.0``.
+- **Improved performance**: We have upgraded the underlying framework of Homarr and take advantage
+of an in-memory message bus and websockets to deliver data near realtime to you.
+
+<!-- truncate -->
+
+## Breaking changes
+:::warning
+
+Please consult the breaking changes list & upgrade guide if you used third-party installation methods.
+
+:::
+
+- Docker Image
+  - Removed support for ``arm/v7`` -> upgrade to newer architectures as an alternative
+  - Renamed image from ``ghcr.io/ajnart/homarr`` to ``ghcr.io/homarr-labs/homarr``. We now use semantic versioning for our release numbers.
+- Environment Variables
+  - New required env variable ``SECRET_ENCRYPTION_KEY`` used for encryption of secrets in the database
+  - Removed ``DISABLE_ANALYTICS``, can now be configured via UI
+  - Renamed ``AUTH_PROVIDER`` to ``AUTH_PROVIDERS``
+  - Renamed ``DATABASE_URL`` to ``DB_URL`` and made it optional conditionally. If ``DB_HOST`` is set, this is optional - otherwise it's required.
+  - Changed ``DOCKER_HOST`` to two new variables for hostnames (``DOCKER_HOSTNAMES``) and ports (``DOCKER_PORTS``). This allows for multiple docker integrations to be configured.
+  - ``AUTH_LOGOUT_REDIRECT_URL`` must now be a valid Url
+  - Increased minimum length of ``AUTH_OIDC_CLIENT_ID`` to 1
+  - Increased minimum length of ``AUTH_OIDC_CLIENT_SECRET`` to 1
+  - Removed ``AUTH_OIDC_TIMEOUT``
+  - Removed ``AUTH_LDAP_ADMIN_GROUP``, ``AUTH_LDAP_OWNER_GROUP``, ``AUTH_OIDC_ADMIN_GROUP`` and ``AUTH_OIDC_OWNER_GROUP`` -> groups are now managed without manual env binding
+  - ``CI`` will now also trigger an env validation skip like ``SKIP_ENV_VALIDATION``
+- Mounts
+  - Removed ``/app/data/configs`` -> JSON configs have been removed in favour of relation databases
+  - Removed ``/app/public/icons`` -> Images can not be uploaded via the [media management](/docs/management/media/) in the UI
+  - Moved ``/data`` to ``/appdata`` and restructured contents (not backwards compatible!) -> Create a backup before migration of the entire directory to copy data to new Homarr
+- Widgets:
+  - Calendar:
+    - Removed option ``Use Sonarr v4 API``
+    - Removed option ``Use Sonarr v5 API``
+    - Removed option ``Font Size``
+    - Removed option ``Hide week days``
+  - Download speed: We have removed this widget in favour of the brand new download widget which will also display this data.
+  - Dash. widget: We have removed this widget in favour of the System Health Widget. It will also display all data and some more than the old widget.
+- Database:
+  - Changed schema of the database to a completely new schema. They are not backwards compatible. Please export the data from old Homarr in the UI and import it in ``1.0``
+  - Removed all usage of JSON files to store data. Import JSON files in Homarr ``1.0`` to import your dashboards.
+  - Removed ``schemaVersion`` from JSON and use the drizzle migrations to keep track of schema versions and take care of migrations.
+- Web Server:
+  - Added an internal Nginx proxy to forward requests to two servers inside the container for technical reasons.
+  This could impact edge cases with iframes, cookies and custom setups.
+- Dependencies
+  - We now depend on [Redis](https://redis.io/) as a real time messaging bus
+- Development (relevant for contributors):
+  - Migrated to [pnpm](https://pnpm.io/)
+  - Migrated to a mono-repository
+  - All source code has been migrated to the [homarr-labs GitHub organization](https://github.com/homarr-labs)
+- Platform specific breaking changes:
+  - TrueNAS
+    - The TrueCharts app chart is permanently deprecated and no longer maintained / supported. Please migrate to Electric Eel or a different Kubernetes platform.
+  - Unraid
+    - The Homarr app must be reinstalled. The existing directories on your disk are not compatible with Homarr 1.0. Export your old data in < `` 1.0`` and install using different file system locations.
+  - Kubernetes
+    - The official Helm chart has moved from https://github.com/oben01/charts to https://github.com/homarr-labs/charts

apps/docs/blog/2024/12-17-open-beta-1.0/index.mdx

@@ -0,0 +1,39 @@
+---
+authors:
+  - meierschlumpf
+---
+
+# Open Beta 1.0
+
+We are proud to announce the open beta of Homarr 1.0. This is a major milestone for us and we are excited to share it with you.
+The open beta allows us to polish the last rough edges and gather feedback from you.
+We are looking forward to your feedback and hope you enjoy the new features.
+Let us know throgh discord or a [github issues](https://github.com/homarr-labs/homarr/issues/new/choose) if you encounter any issues.
+
+<!-- truncate -->
+
+## How to use the beta with docker
+
+To use the beta with docker you can use the following docker-compose.yml configuration:
+
+```yml title="docker-compose.yml"
+#---------------------------------------------------------------------#
+#     Homarr - A simple, yet powerful dashboard for your server.      #
+#---------------------------------------------------------------------#
+services:
+  homarr:
+    container_name: homarr
+    image: ghcr.io/homarr-labs/homarr:beta
+    restart: unless-stopped
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock # Optional, only if you want docker integration
+      - ./homarr/appdata:/appdata
+    environment:
+      - SECRET_ENCRYPTION_KEY=your_64_character_hex_string # <--- can be generated with `openssl rand -hex 32`
+    ports:
+      - '7575:7575'
+```
+
+Then, run `docker compose up -d` in the same directory. This will start the Homarr container in the background.
+Please note that the mounts have changed and it's not backwards compatible with versions before 1.0.0-beta.1.
+You can find a list of all breaking changes [here](/blog/2024/09/23/version-1.0)

apps/docs/blog/2025/01-19-migration-guide-1.0/index.mdx

@@ -0,0 +1,41 @@
+---
+authors:
+  - meierschlumpf
+---
+
+# Migrate from 0.15.10+ to 1.0.0
+
+In this guide, we will show you how to migrate from Homarr 0.15.10+ to 1.0.0.
+If you are still on a version before 0.15.10, please update to 0.15.10 where we introduced the migration export page.
+
+<!-- truncate -->
+
+## Preserve your old installation
+
+Homarr 1.0 is a complete rewrite and cannot reuse the old Docker mounts. Keep the 0.15 installation and its data intact while you build the replacement. The historical `Management` > `Tools` > `Migrate to 1.0` export can still be kept as a record, but current Homarr releases cannot import that ZIP or its secret key.
+
+Plan to recreate your apps, integrations, and boards manually in the new installation. A SQLite database backup can be restored from the onboarding welcome screen only when it was created by a compatible current Homarr release; it is not a conversion path for a 0.15 database.
+
+![Export page](./img/old-homarr-export-data.png)
+
+## Create a parallel installation
+
+We highly recommend to create a parallel installation of Homarr 1.0.0.
+So if something with for example the import does not quite work, the data in the old installation is still available.
+To do this you can follow the appropriate [installation guide](https://homarr.dev/docs/category/installation-1) for your system.
+Please note that if you are using docker you need to specify a diffrent external port for the new installation as the old one had the same port.
+So in your compose file the ports would be `7576:7575` instead of `7575:7575`.
+
+## Import your data
+
+:::warning Legacy guide
+
+The pre-1.0 ZIP importer is no longer included in current Homarr releases. Keep the old installation available until you have manually verified the replacement. Compatible SQLite backups from current releases can still be restored from the onboarding welcome screen.
+
+:::
+
+## Remove the old installation
+
+After you are happy with the new installation and everything is working as expected you can remove the old installation.
+Please make sure to backup the data before you remove the old installation.
+Also once the port 7575 is free again you can change the port mapping of the new installation to `7575:7575` if you want to.

apps/docs/blog/2025/08-02-using-argus/index.mdx

@@ -0,0 +1,67 @@
+---
+authors:
+  - meierschlumpf
+---
+
+# How to use Argus with Homarr
+
+In `v1.32.0` we added the endpoint `/api/info` which returns the current version of Homarr and can therefore be used in Argus to watch for updates.
+This guide will show you how to set up a user with apiKey to access the endpoint without providing admin access through it.
+
+<!-- truncate -->
+
+![Argus](./img/argus.png)
+
+Currently an apiKey has the same permissions as the user who created it, however you can only create an apiKey with admin permissions.
+This means we have to do some extra steps to create a user with only the permissions we need for Argus.
+
+## Create a group
+
+In a first step we have to create a group which will allow us to restrict the permissions of the user we will create later.
+
+1. Go to `Management` > `Users` > `Groups`
+2. Click on `Create group`
+3. Enter a name for the group, e.g. `Argus`
+4. Click on `Create group`
+5. Click on the newly created group to edit it
+6. In the `Permissions` tab, select the admin permission and save the changes
+
+## Create a user
+
+Now we can create a user which will be used by Argus to access the `/api/info` endpoint.
+
+1. Go to `Management` > `Users` > `Manage`
+2. Click on `Create new user`
+3. Enter a username, e.g. `argus`, click next
+4. Enter a password for the user, click next
+5. Add previously created group `Argus` to the user, click next
+6. Click on next to confirm the user creation
+
+## Create an apiKey
+
+Now we want to create therefore we have to log in with the user we just created.
+
+1. Log out of Homarr
+2. Log in with the user we just created
+3. Go to `Management` > `Tools` > `API Keys`
+4. Click on `Create API Key`
+5. Copy the generated API key and save it somewhere, you will not be able to see it again
+6. Logout of Homarr
+
+## Reduce permissions of the user
+
+Now we can reduce the permissions of the user to only allow access to general authenticated, but not permission restricted endpoints.
+
+1. Log in with your admin user
+2. Go to `Management` > `Users` > `Groups`
+3. Click on the `Argus` group
+4. In the `Permissions` tab, remove all permissions
+5. Save the changes
+
+## Configure Argus
+
+Now you can configure Argus to use the user and apiKey we created.
+
+![Argus configuration](./img/argus-configuration.png)
+
+Replace the `<secret>` with the apiKey you created and the deployed version url with the url of your Homarr instance.

apps/docs/blog/authors.yml

@@ -0,0 +1,37 @@
+manuel-rw:
+  name: Manuel
+  page: true
+  url: https://github.com/manuel-rw
+  image_url: https://avatars.githubusercontent.com/u/30572287?v=4
+  socials:
+    github: manuel-rw
+  description: >
+    Junior .NET developer from Switzerland. 🌌 .NET, Next.js, Node.js, Angular
+ajnart:
+  name: Ajnart
+  page: true
+  url: https://github.com/ajnart
+  image_url: https://avatars.githubusercontent.com/u/49837342?v=4
+  socials:
+    github: ajnart
+meierschlumpf:
+  name: Meierschlumpf
+  page: true
+  url: https://github.com/Meierschlumpf
+  image_url: https://avatars.githubusercontent.com/u/63781622?v=4
+  socials:
+    github: Meierschlumpf
+tagashi:
+  name: Tagashi
+  page: true
+  url: https://github.com/tagaishi
+  image_url: https://avatars.githubusercontent.com/u/26098587?v=4
+  socials:
+    github: tagaishi
+walkx:
+  name: Walkx
+  page: true
+  url: https://github.com/walkxcode
+  image_url: https://avatars.githubusercontent.com/u/71191962?v=4
+  socials:
+    github: walkxcode

apps/docs/components.json

@@ -0,0 +1,24 @@
+{
+  "$schema": "https://ui.shadcn.com/schema.json",
+  "style": "base-nova",
+  "rsc": false,
+  "tsx": true,
+  "tailwind": {
+    "config": "",
+    "css": "src/css/custom.css",
+    "baseColor": "mist",
+    "cssVariables": true,
+    "prefix": ""
+  },
+  "aliases": {
+    "components": "@/components",
+    "utils": "@/lib/utils",
+    "ui": "@/components/ui",
+    "lib": "@/lib",
+    "hooks": "@/hooks"
+  },
+  "iconLibrary": "tabler",
+  "rtl": false,
+  "menuColor": "default",
+  "menuAccent": "subtle"
+}

apps/docs/docs/advanced/_category_.json

@@ -0,0 +1,9 @@
+{
+  "label": "Advanced",
+  "collapsed": true,
+  "position": 5,
+  "link": {
+    "type": "generated-index",
+    "title": "Advanced Concepts or features"
+  }
+}