refactor: pass isFetching as prop to WidgetCacheAge to avoid duplicate useIsFetching

Co-authored-by: Thomas <thomas@ajnart.fr>

.env.example

@@ -59,4 +59,11 @@ TURBO_TELEMETRY_DISABLED=1
 # ENABLE_KUBERNETES=true
 
 # Enable mock integration
-UNSAFE_ENABLE_MOCK_INTEGRATION=true
+UNSAFE_ENABLE_MOCK_INTEGRATION=true
+
+# Enable demo mode (seeds a demo user "demo"/"demo", a sample board and a mock integration)
+# DEMO_MODE=true
+
+# Whether demo mode is read-only. Defaults to true (the public demo blocks all mutations).
+# Set to false for writable preview deployments so the demo user can modify the dashboard.
+# DEMO_READ_ONLY=false

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -33,6 +33,7 @@ body:
       options:
         # The below comment is used to insert a new version with on-release.yml
         #NEXT_VERSION#
+        - 1.69.2
         - 1.69.0
         - 1.68.0
         - 1.67.0

.github/actions/prebuilt-debian/action.yaml

@@ -11,7 +11,7 @@ outputs:
 runs:
   using: "composite"
   steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
       with:
         persist-credentials: false
     - name: Set up Docker Buildx

.github/workflows/automatic-approval.yml

@@ -17,7 +17,7 @@ jobs:
     if: github.actor_id == 158783068 || github.actor_id == 190541745 || github.actor_id == 210161987 || github.actor_id == 175486441
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Obtain token
         id: obtainToken
         uses: actions/create-github-app-token@v3

.github/workflows/code-quality.yml

@@ -25,13 +25,13 @@ env:
 
 jobs:
   lint-format-autofix:
-    if: github.event_name == 'pull_request'
+    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.id == github.repository_id
     runs-on: ubuntu-latest
     timeout-minutes: 5
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           ref: ${{ github.head_ref }}
@@ -60,7 +60,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -78,7 +78,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -92,7 +92,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -106,7 +106,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Setup
         uses: ./tooling/github/setup
@@ -124,7 +124,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Setup
         uses: ./tooling/github/setup
       - name: Set up Docker Buildx
@@ -153,7 +153,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Setup
@@ -163,65 +163,3 @@ jobs:
         run: cp .env.example .env
       - name: Build
         run: pnpm turbo build --affected
-
-  memory-regression:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v6
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-      - name: Build Docker image
-        uses: docker/build-push-action@v7
-        with:
-          platforms: linux/amd64
-          context: .
-          push: false
-          load: true
-          tags: homarr-memory-test
-          network: host
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-        env:
-          SKIP_ENV_VALIDATION: true
-      - name: Start container and measure memory
-        run: |
-          docker run -d --name homarr-mem-test -p 17575:7575 homarr-memory-test
-          # Wait for container to be healthy (up to 60s)
-          healthy=false
-          for i in $(seq 1 30); do
-            if curl -sf http://localhost:17575/api/health 2>/dev/null; then
-              echo "Container healthy after $((i * 2))s"
-              healthy=true
-              break
-            fi
-            sleep 2
-          done
-          if [ "$healthy" != "true" ]; then
-            echo "ERROR: Container never became healthy"
-            docker logs homarr-mem-test --tail 50
-            exit 1
-          fi
-          # Warm up: hit the dashboard page a few times
-          for i in $(seq 1 5); do
-            curl -sf http://localhost:17575/ > /dev/null 2>&1 || true
-            sleep 2
-          done
-          # Measure RSS after warmup
-          MEM_KB=$(docker stats --no-stream --format '{{.MemUsage}}' homarr-mem-test | sed 's| /.*||')
-          echo "Raw memory: $MEM_KB"
-          # Convert to numeric MB (handles GiB and MiB suffixes)
-          MEM_NUM=$(echo "$MEM_KB" | awk '{
-            if ($0 ~ /GiB/) { gsub(/GiB/,""); print $1 * 1024 }
-            else if ($0 ~ /MiB/) { gsub(/MiB/,""); print $1 }
-            else if ($0 ~ /KiB/) { gsub(/KiB/,""); print $1 / 1024 }
-            else { print $1 / 1048576 }
-          }')
-          echo "Memory usage: ${MEM_NUM} MB"
-          MAX_MB=700
-          if awk "BEGIN {exit !($MEM_NUM > $MAX_MB)}"; then
-            echo "ERROR: Memory usage ${MEM_NUM} MB exceeds ${MAX_MB} MB threshold"
-            docker logs homarr-mem-test --tail 50
-            exit 1
-          fi
-          echo "Memory check passed: ${MEM_NUM} MB <= ${MAX_MB} MB"

.github/workflows/crowdin-schedule-download.yml

@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Obtain token
         id: obtainToken

.github/workflows/crowdin-upload.yml

@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Upload Crowdin translations
         uses: crowdin/github-action@v2

.github/workflows/deployment-beta-release.yml

@@ -26,7 +26,7 @@ jobs:
         with:
           args: "Beta release has been triggered: [run ${{ github.run_number }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})"
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Get Next Version

.github/workflows/deployment-docker-image.yml

@@ -57,7 +57,7 @@ jobs:
           client-id: ${{ secrets.RENOVATE_MERGE_APP_ID }}
           permission-contents: write # required to commit package.json & changelog changes, merge them to dev / next and publish the release
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         if: env.SKIP_RELEASE == 'false'
         with:
           persist-credentials: false
@@ -119,7 +119,7 @@ jobs:
     outputs:
       digest: ${{ steps.build.outputs.digest }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ needs.release.outputs.git_ref }}
 
@@ -158,7 +158,7 @@ jobs:
     outputs:
       digest: ${{ steps.build.outputs.digest }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ needs.release.outputs.git_ref }}
 

.github/workflows/deployment-docs.yml

@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Setup
         uses: ./tooling/github/setup
       - name: Build docs

.github/workflows/deployment-weekly-release.yml

@@ -29,7 +29,7 @@ jobs:
         with:
           args: "Automatic release has been triggered: [run ${{ github.run_number }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})"
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Get Next Version

.github/workflows/docs-algolia-recrawl.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Setup
         uses: ./tooling/github/setup

.github/workflows/docs-update-contributors.yml

@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: dev
 

.github/workflows/docs-update-openapi.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: dev
 

.github/workflows/on-pr-prebuilt-debian-validate.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Validate prebuilt dependencies for amd64
         id: validate-amd64
         uses: ./.github/actions/prebuilt-debian
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Validate prebuilt dependencies for arm64
         id: validate-arm64
         uses: ./.github/actions/prebuilt-debian

.github/workflows/on-pr-renovate-validate.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 2
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - run: |
           npx --yes --package renovate -- \
               renovate-config-validator --strict .github/renovate.json5

.github/workflows/on-release.yml

@@ -52,7 +52,7 @@ jobs:
           permission-contents: write # required to commit to branch
           permission-pull-requests: write # required to create pr & enable automerge
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           token: ${{ steps.obtainToken.outputs.token }}
           ref: dev

.github/workflows/update-contributors.yml

@@ -29,7 +29,7 @@ jobs:
           permission-pull-requests: write # required to create pr & enable automerge
 
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         env:
           GITHUB_TOKEN: ${{ steps.obtainToken.outputs.token }}
 

.github/workflows/update-integration-list.yml

@@ -28,7 +28,7 @@ jobs:
           permission-contents: write # required to commit to branch
           permission-pull-requests: write # required to create pr & enable automerge
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         env:
           GITHUB_TOKEN: ${{ steps.obtainToken.outputs.token }}
       - name: Setup

CHANGELOG.md

@@ -1,3 +1,9 @@
+## [1.69.2](https://github.com/homarr-labs/homarr/compare/v1.69.1...v1.69.2) (2026-07-06)
+
+### Bug Fixes
+
+* **layout:** raise AppShellHeader z-index above Indicator dots ([687edb9](https://github.com/homarr-labs/homarr/commit/687edb9226307cb83986097abb24fe7f672e1778)), closes [#6194](https://github.com/homarr-labs/homarr/issues/6194)
+
 ## [1.69.1](https://github.com/homarr-labs/homarr/compare/v1.69.0...v1.69.1) (2026-07-04)
 
 ### Bug Fixes

apps/docs/docs/integrations/immich/index.mdx

@@ -39,13 +39,26 @@ import { immichServerStatsWidget } from '../../widgets/immich-server-stats';
     'Scroll down to "API Keys"', 
     'Click "New API Key"', 
     'Enter a name, e.g. "Homarr"', 
-    (<span>
-      Select the following permissions:{" "}
-      <code>album.read</code>,{" "}
-      <code>user.read</code>,{" "}
-      <code>server.statistics</code>,{" "}
-      <code>asset.download</code>
-    </span>), 
+(
+
+  <span>
+
+    Select the following permissions:{" "}
+    <code>album.statistics</code>,{" "}
+    <code>album.read</code>,{" "}
+    <code>album.create</code>,{" "}
+    <code>user.read</code>,{" "}
+    <code>user.update</code>,{" "}
+    <code>asset.read</code>,{" "}
+    <code>asset.download</code>,{" "}
+    <code>asset.statistics</code>,{" "}
+    <code>server.statistics</code>,{" "}
+    <code>server.about</code>.
+    <br />
+    Additional permissions may be required depending on your Immich version. If you encounter authorization errors, grant any missing permissions requested by the server.
+  </span>
+
+),
     'Create the integration in Homarr and copy the API key to there'
     ]
-}]} />
+}]} />

apps/docs/docsearch.config.js

@@ -1,18 +1,25 @@
 // Algolia DocSearch crawler for homarr.dev
 // Crawler ID: cd77a285-2756-4557-bf21-ee703748df15
-// DocSearch-managed crawlers: paste this in the Algolia crawler editor or send to DocSearch support.
-// Template: https://docsearch.algolia.com/docs/templates/#docusaurus-v3-template
-// Markdown indexing: https://www.algolia.com/doc/guides/algolia-ai/askai/guides/markdown-indexing
+// Paste this in the Algolia crawler editor.
 
 new Crawler({
   appId: "N69WSPZTID",
   apiKey: "YOUR_CRAWLER_ADMIN_API_KEY",
-  rateLimit: 8,
-  maxDepth: 10,
+  indexPrefix: "",
+  rateLimit: 32,
+  maxDepth: 4,
   startUrls: ["https://homarr.dev/"],
   sitemaps: ["https://homarr.dev/sitemap.xml"],
   ignoreCanonicalTo: true,
   discoveryPatterns: ["https://homarr.dev/**"],
+  exclusionPatterns: [
+    "https://homarr.dev/docs/tags/**",
+    "https://homarr.dev/blog/tags/**",
+    "https://homarr.dev/blog/authors/**",
+    "https://homarr.dev/blog/archive/**",
+    "https://homarr.dev/search/**",
+    "https://homarr.dev/docs/category/**",
+  ],
   actions: [
     {
       indexName: "Docusaurus",
@@ -105,7 +112,6 @@ new Crawler({
       advancedSyntax: true,
       attributeCriteriaComputedByMinProximity: true,
       removeWordsIfNoResults: "allOptional",
-      separatorsToIndex: "_",
     },
     markdown: {
       attributesForFaceting: ["lang", "language", "version", "docusaurus_tag"],
@@ -119,4 +125,10 @@ new Crawler({
       advancedSyntax: false,
     },
   },
+  apiKey: "YOUR_CRAWLER_ADMIN_API_KEY",
+  schedule: "on saturday",
+  renderJavaScript: false,
+  maxUrls: null,
+  cache: { enabled: false },
+  safetyChecks: { beforeIndexPublishing: { maxLostRecordsPercentage: 99 } },
 });

apps/docs/docusaurus.config.ts

@@ -8,7 +8,7 @@ const config: Config = {
   tagline: "A simple yet powerful dashboard for your server.",
   url: "https://homarr.dev",
   baseUrl: "/",
-  trailingSlash: true,
+  trailingSlash: undefined,
   favicon: "img/logo.png",
   organizationName: "homarr-labs",
   projectName: "homarr",
@@ -79,8 +79,27 @@ const config: Config = {
         sitemap: {
           changefreq: "weekly",
           priority: 0.5,
-          ignorePatterns: ["/tags/**"],
+          ignorePatterns: ["/tags/**", "/docs/category/**"],
           filename: "sitemap.xml",
+          createSitemapItems: async ({ routes, siteConfig, defaultCreateSitemapItems }) => {
+            const items = await defaultCreateSitemapItems({ routes, siteConfig });
+            return items.map((item) => {
+              const path = new URL(item.url).pathname;
+              if (path === "/" || path === "") {
+                return { ...item, priority: 1.0, changefreq: "weekly" };
+              }
+              if (path.startsWith("/docs/")) {
+                return { ...item, priority: 0.7, changefreq: "monthly" };
+              }
+              if (path.startsWith("/blog/")) {
+                return { ...item, priority: 0.3, changefreq: "never" };
+              }
+              if (path.startsWith("/about-us")) {
+                return { ...item, priority: 0.4, changefreq: "yearly" };
+              }
+              return item;
+            });
+          },
         },
       } satisfies Preset.Options,
     ],

apps/docs/package.json

@@ -32,7 +32,7 @@
     "@scalar/api-reference-react": "catalog:",
     "@signalwire/docusaurus-plugin-llms-txt": "^1.2.2",
     "@tabler/icons-react": "catalog:",
-    "@tailwindcss/postcss": "^4.3.1",
+    "@tailwindcss/postcss": "^4.3.2",
     "clsx": "catalog:",
     "dayjs": "catalog:",
     "docusaurus-plugin-image-zoom": "^3.0.1",
@@ -43,8 +43,8 @@
     "random-word-slugs": "^0.1.7",
     "react": "catalog:",
     "react-dom": "catalog:",
-    "swiper": "^12.2.0",
-    "tailwindcss": "^4.3.1"
+    "swiper": "^14.0.1",
+    "tailwindcss": "^4.3.2"
   },
   "devDependencies": {
     "@docusaurus/module-type-aliases": "^3.10.1",

apps/docs/src/css/custom.css

@@ -1,8 +1,7 @@
+@import url("https://api.fontshare.com/v2/css?f[]=work-sans@2,1&display=swap");
 @import "tailwindcss/theme" layer(theme);
 @import "tailwindcss/utilities" layer(utilities);
 
-@import url(https://api.fontshare.com/v2/css?f[]=work-sans@2,1&display=swap);
-
 @custom-variant dark (&:where([data-theme="dark"], [data-theme="dark"] *));
 
 @theme {

apps/docs/tsconfig.json

@@ -1,9 +1,6 @@
 {
-  "extends": "@docusaurus/tsconfig",
   "compilerOptions": {
-    "ignoreDeprecations": "6.0",
-    "baseUrl": ".",
-    "target": "es5",
+    "target": "ES2022",
     "lib": ["dom", "dom.iterable", "esnext"],
     "allowJs": true,
     "skipLibCheck": true,
@@ -12,10 +9,14 @@
     "noEmit": true,
     "esModuleInterop": true,
     "module": "esnext",
+    "moduleResolution": "bundler",
     "resolveJsonModule": true,
     "isolatedModules": true,
     "jsx": "preserve",
     "incremental": true,
+    "paths": {
+      "@site/*": ["./*"]
+    },
   },
   "include": [
     "**/*.ts",

apps/nextjs/next.config.ts

@@ -5,21 +5,9 @@ import "@homarr/common/env";
 import "@homarr/core/infrastructure/logs/env";
 import "@homarr/docker/env";
 
-import { readFileSync } from "fs";
-
 import type { NextConfig } from "next";
 import createNextIntlPlugin from "next-intl/plugin";
 
-const homarrVersion = (() => {
-  for (const candidate of ["../../package.json", "./package.json"]) {
-    try {
-      const pkg = JSON.parse(readFileSync(candidate, "utf-8"));
-      if (pkg.name === "homarr") return pkg.version as string;
-    } catch {}
-  }
-  return "unknown";
-})();
-
 // Package path does not work... so we need to use relative path
 const withNextIntl = createNextIntlPlugin({
   requestConfig: "../../packages/translation/src/request.ts",
@@ -27,7 +15,7 @@ const withNextIntl = createNextIntlPlugin({
 
 const nextConfig: NextConfig = {
   env: {
-    HOMARR_VERSION: homarrVersion,
+    HOMARR_VERSION: process.env.HOMARR_VERSION ?? "unknown",
   },
   output: "standalone",
   reactStrictMode: true,
@@ -43,9 +31,19 @@ const nextConfig: NextConfig = {
   experimental: {
     optimizePackageImports: ["@mantine/core", "@mantine/hooks", "@tabler/icons-react"],
     turbopackFileSystemCacheForDev: true,
-    preloadEntriesOnStart: false,
     webpackMemoryOptimizations: true,
   },
+  turbopack: {
+    // ponytail: known Turbopack NFT warning from path.join(process.cwd(), …) in
+    // src/app/api/backup/{route,shared}.ts. No working placement in 16.2.x
+    // (see vercel/next.js#95125). Suppress until upstream fix lands.
+    ignoreIssue: [
+      {
+        path: "**/*",
+        title: "Encountered unexpected file in NFT list",
+      },
+    ],
+  },
   transpilePackages: ["@homarr/ui", "@homarr/notifications", "@homarr/modals", "@homarr/spotlight", "@homarr/widgets"],
   images: {
     localPatterns: [

apps/nextjs/package.json

@@ -4,7 +4,7 @@
   "private": true,
   "type": "module",
   "scripts": {
-    "build": "pnpm with-env next build",
+    "build": "HOMARR_VERSION=$(node -p \"require('../../package.json').version\") pnpm with-env next build",
     "clean": "git clean -xdf .next .turbo node_modules",
     "dev": "pnpm with-env next dev",
     "format": "oxfmt .",

apps/nextjs/src/app/[locale]/boards/(content)/_creator.tsx

@@ -123,9 +123,9 @@ async function QueryCacheHydration({ userId, boardId }: { userId: string; boardI
     const serialized = await getQueryCacheAsync(userId, boardId);
     if (!serialized) return null;
 
-    const persisted = superjson.parse<PersistedClient>(serialized);
-    if (persisted.buster !== queryCacheBuster) return null;
-    if (!persisted?.clientState?.queries?.length) return null;
+    const persisted = superjson.parse<PersistedClient | undefined>(serialized);
+    if (!persisted || persisted.buster !== queryCacheBuster) return null;
+    if (!persisted.clientState?.queries?.length) return null;
 
     return <HydrationBoundary state={persisted.clientState} />;
   } catch (error) {

apps/nextjs/src/app/[locale]/boards/(content)/_header-actions.tsx

@@ -45,7 +45,9 @@ export const BoardContentHeaderActions = () => {
   const [isEditMode] = useEditMode();
   const board = useRequiredBoard();
   const { hasChangeAccess } = useBoardPermissions(board);
-  const { data: demoMode, isLoading } = clientApi.info.isDemoMode.useQuery();
+  // Fall back to read-only if the query has no data (e.g. errored) so we never expose
+  // edit/save/settings UI that would then fail server-side.
+  const { data: demoReadOnly = true, isLoading } = clientApi.info.isDemoReadOnly.useQuery();
 
   if (!hasChangeAccess || isLoading) {
     return <SelectBoardsMenu />;
@@ -55,9 +57,9 @@ export const BoardContentHeaderActions = () => {
     <>
       {isEditMode && <AddMenu />}
 
-      <EditModeMenu demoMode={demoMode ?? false} />
+      <EditModeMenu demoReadOnly={demoReadOnly} />
 
-      {!demoMode && (
+      {!demoReadOnly && (
         <OnboardingTour.Target id="board-settings">
           <HeaderButton href={`/boards/${board.name}/settings`}>
             <IconSettings stroke={1.5} />
@@ -158,7 +160,7 @@ const AddMenu = () => {
   );
 };
 
-const EditModeMenu = ({ demoMode }: { demoMode: boolean }) => {
+const EditModeMenu = ({ demoReadOnly }: { demoReadOnly: boolean }) => {
   const [isEditMode, { open, close }] = useEditMode();
   const board = useRequiredBoard();
   const utils = clientApi.useUtils();
@@ -188,11 +190,11 @@ const EditModeMenu = ({ demoMode }: { demoMode: boolean }) => {
 
   const toggle = useCallback(() => {
     if (isEditMode) {
-      if (demoMode) return discardDemoChanges();
+      if (demoReadOnly) return discardDemoChanges();
       return saveBoard(board);
     }
     open();
-  }, [board, isEditMode, demoMode, saveBoard, open, discardDemoChanges]);
+  }, [board, isEditMode, demoReadOnly, saveBoard, open, discardDemoChanges]);
 
   useHotkeys([[hotkeys.toggleBoardEdit, toggle]]);
   usePreventLeaveWithDirty(isEditMode);

apps/nextjs/src/app/api/backup/shared.ts

@@ -1,11 +1,13 @@
 import fs from "fs";
 import path from "path";
 
-const migrationsFolderCandidates = [
-  path.join(process.cwd(), "db/migrations/sqlite"),
-  path.join(process.cwd(), "packages/db/migrations/sqlite"),
-  path.resolve(process.cwd(), "../../db/migrations/sqlite"),
-  "/app/db/migrations/sqlite",
-];
-
-export const findMigrationsFolder = () => migrationsFolderCandidates.find((candidate) => fs.existsSync(candidate));
+export const findMigrationsFolder = () => {
+  const cwd = process.cwd();
+  const migrationsFolderCandidates = [
+    path.join(cwd, "db/migrations/sqlite"),
+    path.join(cwd, "packages/db/migrations/sqlite"),
+    path.resolve(cwd, "../../db/migrations/sqlite"),
+    "/app/db/migrations/sqlite",
+  ];
+  return migrationsFolderCandidates.find((candidate) => fs.existsSync(candidate));
+};

apps/nextjs/src/components/board/items/widget-context-menu.tsx

@@ -2,10 +2,10 @@
 
 import type { MutableRefObject, ReactNode } from "react";
 import { useCallback, useEffect, useMemo, useState } from "react";
-import { Group, Menu, Switch, Text } from "@mantine/core";
+import { Group, Loader, Menu, Switch, Text } from "@mantine/core";
 import { IconCopy, IconLayoutKanban, IconRefresh, IconSettings, IconTrash } from "@tabler/icons-react";
 import type { QueryClient } from "@tanstack/react-query";
-import { useQueryClient } from "@tanstack/react-query";
+import { useIsFetching, useQueryClient } from "@tanstack/react-query";
 
 import { clientApi } from "@homarr/api/client";
 import { useSession } from "@homarr/auth/client";
@@ -50,8 +50,9 @@ export const WidgetContextMenu = ({ item, widgetStateRef, children }: WidgetCont
   const queryClient = useQueryClient();
 
   const widgetQueryKey = useMemo(() => [["widget", item.kind]], [item.kind]);
+  const isWidgetFetching = useIsFetching({ queryKey: widgetQueryKey }) > 0;
   const handleRefetch = useCallback(() => {
-    void queryClient.invalidateQueries({ queryKey: widgetQueryKey });
+    void queryClient.refetchQueries({ queryKey: widgetQueryKey, type: "all" });
   }, [queryClient, widgetQueryKey]);
 
   const options = useMemo(
@@ -223,11 +224,15 @@ export const WidgetContextMenu = ({ item, widgetStateRef, children }: WidgetCont
 
         <>
           {(toggleOptions.length > 0 || visibleWidgetActions.length > 0 || isEditMode) && <Menu.Divider />}
-          <Menu.Item closeMenuOnClick leftSection={<IconRefresh size={16} />} onClick={handleRefetch}>
+          <Menu.Item
+            leftSection={isWidgetFetching ? <Loader size={16} /> : <IconRefresh size={16} />}
+            onClick={handleRefetch}
+            disabled={isWidgetFetching}
+          >
             <Group justify="space-between" wrap="nowrap">
               {tMenu("refresh")}
               <Text size="xs" c="dimmed">
-                <WidgetCacheAge queryClient={queryClient} queryKey={widgetQueryKey} />
+                <WidgetCacheAge queryClient={queryClient} queryKey={widgetQueryKey} isFetching={isWidgetFetching} />
               </Text>
             </Group>
           </Menu.Item>
@@ -265,13 +270,24 @@ export const WidgetContextMenu = ({ item, widgetStateRef, children }: WidgetCont
   );
 };
 
-const WidgetCacheAge = ({ queryClient, queryKey }: { queryClient: QueryClient; queryKey: unknown[] }) => {
+const WidgetCacheAge = ({
+  queryClient,
+  queryKey,
+  isFetching,
+}: {
+  queryClient: QueryClient;
+  queryKey: unknown[];
+  isFetching: boolean;
+}) => {
+  // 1s tick for "just now" → "1s ago" label transition; isFetching prop handles refetch reactivity
   const [, setTick] = useState(0);
   useEffect(() => {
     const id = setInterval(() => setTick((n) => n + 1), 1000);
     return () => clearInterval(id);
   }, []);
 
+  if (isFetching) return <Loader size={12} />;
+
   const timestamps = queryClient
     .getQueryCache()
     .findAll({ queryKey })

apps/nextjs/src/components/layout/header.tsx

@@ -18,7 +18,7 @@ interface Props {
 
 export const MainHeader = ({ logo, actions, hasNavigation = true }: Props) => {
   return (
-    <AppShellHeader maw="100vw" style={{ overflowX: "hidden" }}>
+    <AppShellHeader maw="100vw" zIndex={201} style={{ overflowX: "hidden" }}>
       <Group h="100%" gap="xl" px="md" justify="apart" wrap="nowrap">
         <Group h="100%" align="center" style={{ flex: 1 }} wrap="nowrap">
           {hasNavigation && <ClientBurger />}

deployments/prebuilt-debian/package.json

@@ -2,7 +2,7 @@
   "name": "homarr-prebuilt-debian",
   "private": true,
   "dependencies": {
-    "better-sqlite3": "^12.10.0"
+    "better-sqlite3": "^12.11.1"
   },
   "engines": {
     "node": ">=24.18.0",

deployments/prebuilt-debian/pnpm-lock.yaml

@@ -9,16 +9,16 @@ importers:
   .:
     dependencies:
       better-sqlite3:
-        specifier: ^12.10.0
-        version: 12.10.0
+        specifier: ^12.11.1
+        version: 12.11.1
 
 packages:
 
   base64-js@1.5.1:
     resolution: {integrity: sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==}
 
-  better-sqlite3@12.10.0:
-    resolution: {integrity: sha512-CyzaZRQKyHkB2ZInfTTl2nvT33EbDpjkLEbE8/Zck3Ll6O0qqvuGdrJ45HgtH+HykRg88ITY3AdreBGN70aBSQ==}
+  better-sqlite3@12.11.1:
+    resolution: {integrity: sha512-dq9AtApgg5PGFtBzPFSBl3HZQjHok5gaQCM6zh2Yk0aSmDCs1CbnVI8/HgASQkNKsWFpseIO9beg5xxpYhbIfA==}
     engines: {node: 20.x || 22.x || 23.x || 24.x || 25.x || 26.x}
 
   bindings@1.5.0:
@@ -148,7 +148,7 @@ snapshots:
 
   base64-js@1.5.1: {}
 
-  better-sqlite3@12.10.0:
+  better-sqlite3@12.11.1:
     dependencies:
       bindings: 1.5.0
       prebuild-install: 7.1.3

package.json

@@ -1,6 +1,6 @@
 {
   "name": "homarr",
-  "version": "1.69.1",
+  "version": "1.69.2",
   "private": true,
   "scripts": {
     "build": "cross-env CI=true turbo build",
@@ -43,6 +43,7 @@
     "@semantic-release/release-notes-generator": "catalog:",
     "@testcontainers/redis": "catalog:",
     "@turbo/gen": "catalog:",
+
     "@vitejs/plugin-react": "catalog:",
     "@vitest/coverage-v8": "catalog:",
     "@vitest/ui": "catalog:",

packages/api/src/env.ts

@@ -6,9 +6,11 @@ export const env = createEnv({
   server: {
     KUBERNETES_SERVICE_ACCOUNT_NAME: z.string().optional(),
     DEMO_MODE: createBooleanSchema(false),
+    DEMO_READ_ONLY: createBooleanSchema(true),
   },
   runtimeEnv: {
     KUBERNETES_SERVICE_ACCOUNT_NAME: process.env.KUBERNETES_SERVICE_ACCOUNT_NAME,
     DEMO_MODE: process.env.DEMO_MODE,
+    DEMO_READ_ONLY: process.env.DEMO_READ_ONLY,
   },
 });

packages/api/src/router/info.ts

@@ -1,7 +1,7 @@
 import z from "zod/v4";
 
 import packageJson from "../../../../package.json";
-import { createTRPCRouter, isDemoMode, publicProcedure, protectedProcedure } from "../trpc";
+import { createTRPCRouter, isDemoMode, isDemoReadOnly, publicProcedure, protectedProcedure } from "../trpc";
 
 export const infoRouter = createTRPCRouter({
   getInfo: protectedProcedure
@@ -20,4 +20,5 @@ export const infoRouter = createTRPCRouter({
       };
     }),
   isDemoMode: publicProcedure.query(() => isDemoMode),
+  isDemoReadOnly: publicProcedure.query(() => isDemoReadOnly),
 });

packages/api/src/trpc.ts

@@ -95,8 +95,12 @@ export const createTRPCRouter = t.router;
 
 export const isDemoMode = env.DEMO_MODE;
 
+// The public "real demo" (demo + mock integrations) stays read-only, while preview
+// deployments run with DEMO_MODE + DEMO_READ_ONLY=false to allow mutations.
+export const isDemoReadOnly = env.DEMO_MODE && env.DEMO_READ_ONLY;
+
 const enforceDemoModeReadOnly = t.middleware(({ ctx, next, type }) => {
-  if (env.DEMO_MODE && type === "mutation") {
+  if (isDemoReadOnly && type === "mutation") {
     throw new TRPCError({
       code: "FORBIDDEN",
       message: "Mutations are disabled in demo mode",
@@ -105,7 +109,7 @@ const enforceDemoModeReadOnly = t.middleware(({ ctx, next, type }) => {
   return next({ ctx });
 });
 
-const baseProcedure = env.DEMO_MODE ? t.procedure.use(enforceDemoModeReadOnly) : t.procedure;
+const baseProcedure = isDemoReadOnly ? t.procedure.use(enforceDemoModeReadOnly) : t.procedure;
 
 /**
  * Public (unauthed) procedure

packages/common/src/cookie.ts

@@ -6,5 +6,5 @@ export function parseCookies(cookieString: string) {
 }
 
 export function setClientCookie(name: string, value: string, options: SerializeOptions = {}) {
-  document.cookie = stringifySetCookie(name, value, options);
+  document.cookie = stringifySetCookie({ name, value, ...options });
 }

packages/common/src/errors/http/handlers/axios-http-error-handler.ts

@@ -25,7 +25,7 @@ export class AxiosHttpErrorHandler extends HttpErrorHandler {
 
     return new RequestError(requestErrorInput, {
       cause: error,
-    });
+    }) as AnyRequestError;
   }
   handleResponseError(error: unknown): ResponseError | undefined {
     if (!(error instanceof AxiosError)) return undefined;

packages/common/src/errors/http/handlers/fetch-http-error-handler.ts

@@ -20,7 +20,7 @@ export class FetchHttpErrorHandler extends HttpErrorHandler {
     const result = matchErrorCode(error.cause.code);
     if (!result) return undefined;
 
-    return new RequestError(result, { cause: error });
+    return new RequestError(result, { cause: error }) as AnyRequestError;
   }
 
   /**
@@ -59,7 +59,7 @@ export const matchErrorCode = (code: string): AnyRequestErrorInput | undefined =
       type: key,
       reason: found[0] as RequestErrorReason<typeof key>,
       code: code as RequestErrorCode,
-    };
+    } as AnyRequestErrorInput;
   }
 
   return undefined;

packages/common/src/errors/http/handlers/node-fetch-http-error-handler.ts

@@ -30,7 +30,7 @@ export class NodeFetchHttpErrorHandler extends HttpErrorHandler {
 
     return new RequestError(requestErrorInput, {
       cause: error,
-    });
+    }) as AnyRequestError;
   }
 
   /**

packages/db/migrations/mysql/0042_add_widget_secret.sql

@@ -0,0 +1,9 @@
+CREATE TABLE `widget_secret` (
+	`item_id` varchar(64) NOT NULL,
+	`kind` varchar(64) NOT NULL,
+	`value` text NOT NULL,
+	`updated_at` timestamp NOT NULL,
+	CONSTRAINT `widget_secret_item_id_kind_pk` PRIMARY KEY(`item_id`,`kind`)
+);
+--> statement-breakpoint
+ALTER TABLE `widget_secret` ADD CONSTRAINT `widget_secret_item_id_item_id_fk` FOREIGN KEY (`item_id`) REFERENCES `item`(`id`) ON DELETE cascade ON UPDATE no action;

packages/db/migrations/mysql/meta/_journal.json

@@ -295,6 +295,13 @@
       "when": 1780764500000,
       "tag": "0041_merge_custom_widget_url",
       "breakpoints": true
+    },
+    {
+      "idx": 42,
+      "version": "5",
+      "when": 1783176100870,
+      "tag": "0042_add_widget_secret",
+      "breakpoints": true
     }
   ]
 }

packages/db/migrations/postgresql/0008_add_widget_secret.sql

@@ -0,0 +1,9 @@
+CREATE TABLE "widget_secret" (
+	"item_id" varchar(64) NOT NULL,
+	"kind" varchar(64) NOT NULL,
+	"value" text NOT NULL,
+	"updated_at" timestamp NOT NULL,
+	CONSTRAINT "widget_secret_item_id_kind_pk" PRIMARY KEY("item_id","kind")
+);
+--> statement-breakpoint
+ALTER TABLE "widget_secret" ADD CONSTRAINT "widget_secret_item_id_item_id_fk" FOREIGN KEY ("item_id") REFERENCES "public"."item"("id") ON DELETE cascade ON UPDATE no action;

packages/db/migrations/postgresql/meta/_journal.json

@@ -57,6 +57,13 @@
       "when": 1780764500000,
       "tag": "0007_merge_custom_widget_url",
       "breakpoints": true
+    },
+    {
+      "idx": 8,
+      "version": "7",
+      "when": 1783176100870,
+      "tag": "0008_add_widget_secret",
+      "breakpoints": true
     }
   ]
 }

packages/db/migrations/sqlite/0040_add_widget_secret.sql

@@ -0,0 +1,8 @@
+CREATE TABLE `widget_secret` (
+	`item_id` text NOT NULL,
+	`kind` text NOT NULL,
+	`value` text NOT NULL,
+	`updated_at` integer NOT NULL,
+	PRIMARY KEY(`item_id`, `kind`),
+	FOREIGN KEY (`item_id`) REFERENCES `item`(`id`) ON UPDATE no action ON DELETE cascade
+);

packages/db/migrations/sqlite/meta/_journal.json

@@ -281,6 +281,13 @@
       "when": 1780764500000,
       "tag": "0039_merge_custom_widget_url",
       "breakpoints": true
+    },
+    {
+      "idx": 40,
+      "version": "6",
+      "when": 1783176100870,
+      "tag": "0040_add_widget_secret",
+      "breakpoints": true
     }
   ]
 }

packages/definitions/src/docs/homarr-docs-sitemap.ts

@@ -60,8 +60,8 @@ export type HomarrDocumentationPath =
   | "/docs/tags/connections"
   | "/docs/tags/custom-widgets"
   | "/docs/tags/customization"
-  | "/docs/tags/data-sources"
   | "/docs/tags/data"
+  | "/docs/tags/data-sources"
   | "/docs/tags/database"
   | "/docs/tags/developer"
   | "/docs/tags/development"
@@ -99,8 +99,8 @@ export type HomarrDocumentationPath =
   | "/docs/tags/redis"
   | "/docs/tags/responsive"
   | "/docs/tags/roles"
-  | "/docs/tags/search-engines"
   | "/docs/tags/search"
+  | "/docs/tags/search-engines"
   | "/docs/tags/secrets"
   | "/docs/tags/security"
   | "/docs/tags/self-signed"
@@ -132,15 +132,6 @@ export type HomarrDocumentationPath =
   | "/docs/advanced/running-as-different-user"
   | "/docs/advanced/single-sign-on"
   | "/docs/advanced/styling"
-  | "/docs/category/advanced"
-  | "/docs/category/community"
-  | "/docs/category/developer-guides"
-  | "/docs/category/getting-started"
-  | "/docs/category/installation-1"
-  | "/docs/category/installation"
-  | "/docs/category/integrations"
-  | "/docs/category/management"
-  | "/docs/category/widgets"
   | "/docs/community/donate"
   | "/docs/community/faq"
   | "/docs/community/get-in-touch"

packages/forms-collection/src/new-app/_form.tsx

@@ -72,7 +72,14 @@ export const AppForm = ({
     }
 
     form.initialize(toFormValues(initialValues));
-  }, [initialValuesKey, form, initialValues]);
+    // `form` is a new object every render (Mantine useForm returns a fresh literal),
+    // so it must not be a dep here — it would re-run every render and, since
+    // form.initialize() always calls clearErrors() (new {} object) internally,
+    // trigger an infinite update loop. initialValuesKey (a primitive string)
+    // already captures the only case this effect exists for: re-initializing
+    // when initialValues actually changes (e.g. navigating between edit pages).
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [initialValuesKey]);
 
   // Debounce the name value with 200ms delay
   const [debouncedName] = useDebouncedValue(form.values.name, 200);

packages/integrations/src/gluetun/gluetun-types.ts

@@ -46,7 +46,7 @@ const gluetunServerSelectionSchema = z.object({
   isps: z.array(z.string()).nullable(),
   names: z.array(z.string()).nullable(),
   numbers: z.array(z.number()).nullable(),
-  hostnames: z.array(z.string()),
+  hostnames: z.array(z.string()).nullable(),
   owned_only: z.boolean(),
   free_only: z.boolean(),
   premium_only: z.boolean(),
@@ -65,7 +65,7 @@ const gluetunPortForwardingSchema = z.object({
   status_file_path: z.string(),
   up_command: z.string(),
   down_command: z.string(),
-  listening_port: z.number(),
+  listening_port: z.union([z.number(), z.array(z.number())]),
   username: z.string(),
   password: z.string(),
 });
@@ -98,7 +98,7 @@ const gluetunOpenvpnSettingsSchema = z.object({
 const gluetunWireguardSettingsSchema = z.object({
   private_key: z.string(),
   pre_shared_key: z.string(),
-  addresses: z.array(z.string()),
+  addresses: z.array(z.string()).nullable(),
   allowed_ips: z.array(z.string()),
   interface: z.string(),
   persistent_keep_alive_interval: z.number(),

packages/integrations/src/gluetun/test/gluetun-integration.spec.ts

@@ -124,6 +124,126 @@ const VPN_SETTINGS_PAYLOAD = {
   },
 };
 
+const ALT_VPN_SETTINGS_PAYLOAD = {
+  type: "openvpn",
+  provider: {
+    name: "custom",
+    server_selection: {
+      vpn: "openvpn",
+      countries: null,
+      categories: null,
+      regions: null,
+      cities: null,
+      isps: null,
+      names: null,
+      numbers: null,
+      hostnames: null,
+      owned_only: false,
+      free_only: false,
+      premium_only: false,
+      stream_only: false,
+      multi_hop_only: false,
+      port_forward_only: false,
+      secure_core_only: false,
+      tor_only: false,
+      openvpn: {
+        config_file_path: "/gluetun/custom.conf",
+        protocol: "tcp",
+        endpoint_ip: "0.0.0.0",
+        custom_port: 0,
+        pia_encryption_preset: "",
+      },
+      wireguard: {
+        endpoint_ip: "0.0.0.0",
+        endpoint_port: 0,
+        public_key: "",
+      },
+    },
+    port_forwarding: {
+      enabled: false,
+      provider: "",
+      status_file_path: "/tmp/gluetun/forwarded_port",
+      up_command: "",
+      down_command: "",
+      listening_port: [0],
+      ports_count: 0,
+      username: "",
+      password: "",
+    },
+  },
+  amneziawg: {
+    wireguard: {
+      private_key: "",
+      pre_shared_key: "",
+      addresses: null,
+      allowed_ips: ["0.0.0.0/0", "::/0"],
+      interface: "tun0",
+      persistent_keep_alive_interval: 0,
+      mtu: 0,
+      implementation: "userspace",
+    },
+    junk_packet_count: 0,
+    junk_packet_min: 0,
+    junk_packet_max: 0,
+    padding_s1: 0,
+    padding_s2: 0,
+    padding_s3: 0,
+    padding_s4: 0,
+    header_h1: "",
+    header_h2: "",
+    header_h3: "",
+    header_h4: "",
+    init_packet_i1: "",
+    init_packet_i2: "",
+    init_packet_i3: "",
+    init_packet_i4: "",
+    init_packet_i5: "",
+  },
+  openvpn: {
+    version: "2.6",
+    user: "",
+    password: "",
+    config_file_path: "/gluetun/custom.conf",
+    ciphers: null,
+    auth: "",
+    cert: "",
+    key: "",
+    encrypted_key: "",
+    key_passphrase: "",
+    pia_encryption_preset: "",
+    mssfix: 0,
+    interface: "tun0",
+    process_user: "nonrootuser",
+    verbosity: 1,
+    flags: null,
+  },
+  wireguard: {
+    private_key: "",
+    pre_shared_key: "",
+    addresses: null,
+    allowed_ips: ["0.0.0.0/0", "::/0"],
+    interface: "tun0",
+    persistent_keep_alive_interval: 0,
+    mtu: 0,
+    implementation: "auto",
+  },
+  pmtud: {
+    icmp_addresses: ["1.1.1.1", "8.8.8.8"],
+    tcp_addresses: [
+      "1.1.1.1:443",
+      "8.8.8.8:443",
+      "1.1.1.1:53",
+      "8.8.8.8:53",
+      "[2606:4700:4700::1111]:53",
+      "[2001:4860:4860::8888]:53",
+      "[2606:4700:4700::1111]:443",
+      "[2001:4860:4860::8888]:443",
+    ],
+  },
+  up_command: "",
+  down_command: "",
+};
+
 const jsonResponse = (body: unknown, init: ResponseInit = { status: 200 }): FetchResponse =>
   new Response(JSON.stringify(body), {
     ...init,
@@ -368,4 +488,54 @@ describe("gluetun schemas", () => {
   test("vpn settings schema rejects a non-string type", () => {
     expect(() => gluetunVpnSettingsSchema.parse({ ...VPN_SETTINGS_PAYLOAD, type: 1 })).toThrow();
   });
+
+  test("vpn settings schema parses the live gluetun-latest custom/OpenVPN payload", () => {
+    const parsed = gluetunVpnSettingsSchema.parse(ALT_VPN_SETTINGS_PAYLOAD);
+    expect(parsed.type).toBe("openvpn");
+    expect(parsed.provider.name).toBe("custom");
+  });
+
+  test("vpn settings schema accepts null server-selection hostnames", () => {
+    const payload = {
+      ...VPN_SETTINGS_PAYLOAD,
+      provider: {
+        ...VPN_SETTINGS_PAYLOAD.provider,
+        server_selection: {
+          ...VPN_SETTINGS_PAYLOAD.provider.server_selection,
+          hostnames: null,
+        },
+      },
+    };
+
+    expect(() => gluetunVpnSettingsSchema.parse(payload)).not.toThrow();
+  });
+
+  test("vpn settings schema accepts listening_port as a number or a list", () => {
+    const asList = {
+      ...VPN_SETTINGS_PAYLOAD,
+      provider: {
+        ...VPN_SETTINGS_PAYLOAD.provider,
+        port_forwarding: {
+          ...VPN_SETTINGS_PAYLOAD.provider.port_forwarding,
+          listening_port: [0],
+        },
+      },
+    };
+
+    // The happy-path fixture already exercises the scalar form (listening_port: 0).
+    expect(() => gluetunVpnSettingsSchema.parse(VPN_SETTINGS_PAYLOAD)).not.toThrow();
+    expect(() => gluetunVpnSettingsSchema.parse(asList)).not.toThrow();
+  });
+
+  test("vpn settings schema accepts null wireguard addresses", () => {
+    const payload = {
+      ...VPN_SETTINGS_PAYLOAD,
+      wireguard: {
+        ...VPN_SETTINGS_PAYLOAD.wireguard,
+        addresses: null,
+      },
+    };
+
+    expect(() => gluetunVpnSettingsSchema.parse(payload)).not.toThrow();
+  });
 });

packages/translation/src/lang/fr.json

@@ -732,8 +732,8 @@
       "displayType": "",
       "jsonPath": "",
       "jsonPathHint": "",
-      "label": "",
-      "unit": "",
+      "label": "Étiquette",
+      "unit": "Unité",
       "mappings": "",
       "tablePath": "",
       "tablePathHint": "",
@@ -755,14 +755,14 @@
       "striped": "",
       "compact": "",
       "maxHeight": "",
-      "color": "",
+      "color": "Couleur",
       "buttonLabel": "",
       "buttonColor": "",
-      "confirmText": "",
+      "confirmText": "Texte de confirmation",
       "confirmTextHint": "",
-      "successMessage": "",
+      "successMessage": "Message de réussite",
       "successMessageHint": "",
-      "enabled": "",
+      "enabled": "Activé",
       "template": {
         "label": "",
         "description": ""
@@ -1017,13 +1017,13 @@
       "timetable": "",
       "photoService": "",
       "documents": "",
-      "notes": "",
-      "mediaMonitoring": "",
-      "speedtest": "",
+      "notes": "Notes",
+      "mediaMonitoring": "Supervision",
+      "speedtest": "Test de débit",
       "analytics": "",
       "vpn": "",
-      "mediaLibrary": "",
-      "uptimeMonitoring": ""
+      "mediaLibrary": "Bibliothèque de médias",
+      "uptimeMonitoring": "Surveillance des disponibilités"
     },
     "testConnection": {
       "action": {
@@ -1298,7 +1298,7 @@
           "newLabel": "Nouvelle clé privée"
         },
         "slug": {
-          "label": "",
+          "label": "Slug de la page de statut",
           "newLabel": ""
         }
       }

packages/translation/src/lang/it.json

@@ -1599,7 +1599,7 @@
     "menu": {
       "label": {
         "settings": "Impostazioni",
-        "refresh": "",
+        "refresh": "Aggiorna",
         "options": "Opzioni",
         "actions": "Azioni"
       }
@@ -1904,7 +1904,7 @@
       "noStation": "Nessuna stazione selezionata",
       "option": {
         "baseUrl": {
-          "label": ""
+          "label": "Url Search.ch"
         },
         "station": {
           "label": "Stazione"
@@ -2791,8 +2791,8 @@
           "description": "Visualizza la data dell'immagine e l'indice corrente nella parte inferiore della presentazione"
         },
         "randomizePhotos": {
-          "label": "",
-          "description": ""
+          "label": "Immagini casuali",
+          "description": "Mostra le foto in ordine casuale invece di iniziare sempre con lo stesso ordine degli album."
         }
       },
       "description": "Presentazione delle immagini nel tuo album Immich",
@@ -3158,7 +3158,7 @@
             "label": "Provider"
           },
           "providerUrl": {
-            "label": ""
+            "label": "URL Provider"
           },
           "identifier": {
             "label": "Identificatore",
@@ -3209,10 +3209,10 @@
             "tooltip": "Impossibile analizzare il provider, impostarlo manualmente dopo aver importato le immagini"
           },
           "tokens": {
-            "label": "",
-            "token": "",
-            "configured": "",
-            "notConfigured": "",
+            "label": "Token Provider",
+            "token": "Token",
+            "configured": "Token configurato",
+            "notConfigured": "Nessun token impostato",
             "save": "Salva"
           }
         }
@@ -3236,9 +3236,9 @@
           "invalidIdentifier": "Identificatore non valido",
           "noMatchingVersion": "Nessuna versione corrispondente trovata",
           "noReleasesFound": "Nessun rilascio trovato",
-          "noProviderSelected": "",
+          "noProviderSelected": "Nessun provider selezionato",
           "noProviderResponse": "Nessuna risposta dal provider",
-          "unexpected": ""
+          "unexpected": "Errore provider inaspettato"
         }
       }
     },

packages/translation/src/lang/lv.json

@@ -6,9 +6,9 @@
         "subtitle": "",
         "description": "",
         "action": {
-          "scratch": "",
+          "scratch": "Sākt no jauna",
           "importOldmarr": "",
-          "restoreSqlite": "",
+          "restoreSqlite": "SQLite rezerves kopija",
           "restoreSqliteDescription": "",
           "backToOptions": ""
         }
@@ -26,19 +26,19 @@
           }
         },
         "importSettings": {
-          "title": "",
+          "title": "Importēt iestatījumus",
           "description": ""
         },
         "boardSelection": {
           "title": "",
           "description": "",
           "action": {
-            "selectAll": "",
+            "selectAll": "Atzīmēt visu",
             "unselectAll": ""
           }
         },
         "summary": {
-          "title": "",
+          "title": "Importēšanas kopsavilkums",
           "description": "",
           "action": {
             "import": ""
@@ -46,7 +46,7 @@
           "entities": {
             "apps": "Lietotnes",
             "boards": "Dēļi",
-            "integrations": "",
+            "integrations": "Integrācijas",
             "credentialUsers": ""
           }
         },
@@ -67,15 +67,15 @@
         }
       },
       "user": {
-        "title": "",
+        "title": "Administratora lietotājs",
         "subtitle": "",
         "notification": {
           "success": {
-            "title": "",
+            "title": "Lietotājs izveidots",
             "message": ""
           },
           "error": {
-            "title": ""
+            "title": "Lietotāja izveide neizdevās"
           }
         }
       },
@@ -94,19 +94,19 @@
         "subtitle": ""
       },
       "integrations": {
-        "title": "",
+        "title": "Integrācijas",
         "subtitle": "",
         "description": "",
         "action": {
-          "continue": "",
-          "skip": ""
+          "continue": "Turpināt",
+          "skip": "Pagaidām izlaist šo soli"
         },
         "configure": {
-          "progress": "",
-          "skip": "",
+          "progress": "{current} no {total}",
+          "skip": "Izlaist šo integrāciju",
           "finishing": "",
           "error": {
-            "title": "",
+            "title": "Neizdevās iestatīt!",
             "message": ""
           },
           "helpers": {
@@ -115,7 +115,7 @@
           }
         },
         "urlTemplate": {
-          "label": "",
+          "label": "Bāzes URL",
           "placeholder": "",
           "hint": "",
           "warning": "",
@@ -136,14 +136,14 @@
         }
       },
       "finish": {
-        "title": "",
+        "title": "Pabeigt Iestatīšanu",
         "subtitle": "",
         "description": "",
         "action": {
           "goToBoard": "",
           "createBoard": "",
-          "inviteUser": "",
-          "docs": ""
+          "inviteUser": "Ielūgt citus lietotājus",
+          "docs": "Lasīt dokumentāciju"
         }
       }
     },
@@ -158,7 +158,7 @@
         "subtitle": ""
       },
       "invite": {
-        "title": "",
+        "title": "Pievienoties Homarr",
         "subtitle": "",
         "description": ""
       },
@@ -177,20 +177,20 @@
       },
       "password": {
         "label": "Parole",
-        "suggestionsTitle": "",
+        "suggestionsTitle": "Paroles ieteikumi",
         "suggestion": {
-          "length": "",
+          "length": "Vismaz 8 rakstzīmes",
           "lowercase": "Ietver mazo burtu",
           "uppercase": "Ietver lielo burtu",
           "number": "Ietver numuru",
-          "special": ""
+          "special": "Iekļauj speciālo simbolu"
         }
       },
       "passwordConfirm": {
         "label": "Apstipriniet paroli"
       },
       "previousPassword": {
-        "label": ""
+        "label": "Iepriekšējā parole"
       },
       "homeBoard": {
         "label": ""
@@ -218,10 +218,10 @@
         "notification": {
           "success": {
             "title": "",
-            "message": ""
+            "message": "Jūs esat veiksmīgi pieteicies"
           },
           "error": {
-            "title": "",
+            "title": "Pieteikšanās neizdevās",
             "message": ""
           }
         },
@@ -245,13 +245,13 @@
       },
       "create": "Izveidot lietotāju",
       "changePassword": {
-        "label": "",
+        "label": "Mainīt paroli",
         "notification": {
           "success": {
-            "message": ""
+            "message": "Parole veiksmīgi nomainīta."
           },
           "error": {
-            "message": ""
+            "message": "Nav iespējams nomainīt paroli"
           }
         }
       },
@@ -595,12 +595,12 @@
       }
     },
     "defaultGroup": {
-      "name": "",
+      "name": "Noklusētā grupa",
       "description": ""
     }
   },
   "app": {
-    "search": "",
+    "search": "Atrast aplikāciju",
     "page": {
       "list": {
         "title": "Lietotnes",
@@ -689,7 +689,7 @@
       "list": {
         "title": "",
         "noResults": "",
-        "loading": ""
+        "loading": "Notiek ielāde..."
       },
       "create": {
         "title": "",
@@ -700,7 +700,7 @@
       }
     },
     "action": {
-      "create": "",
+      "create": "Izveidot",
       "import": "",
       "save": "",
       "delete": "",

packages/translation/src/lang/pl.json

@@ -1599,7 +1599,7 @@
     "menu": {
       "label": {
         "settings": "Ustawienia",
-        "refresh": "",
+        "refresh": "Odśwież",
         "options": "Opcje",
         "actions": "Akcje"
       }
@@ -1904,7 +1904,7 @@
       "noStation": "Nie wybrano stacji",
       "option": {
         "baseUrl": {
-          "label": ""
+          "label": "Szukaj adresu URL"
         },
         "station": {
           "label": "Stacja"
@@ -2791,8 +2791,8 @@
           "description": "Wyświetl datę zdjęcia oraz bieżący indeks na dole pokazu slajdów"
         },
         "randomizePhotos": {
-          "label": "",
-          "description": ""
+          "label": "Losowe zdjęcia",
+          "description": "Pokaż zdjęcia w losowej kolejności, zamiast zawsze rozpoczynać się od tej samej kolejności albumu."
         }
       },
       "description": "Pokaz slajdów zdjęć z Twojego albumu w Immich",
@@ -3158,7 +3158,7 @@
             "label": "Dostawca"
           },
           "providerUrl": {
-            "label": ""
+            "label": "URL dostawcy"
           },
           "identifier": {
             "label": "Identyfikator",
@@ -3209,11 +3209,11 @@
             "tooltip": "Nie udało się rozpoznać dostawcy. Ustaw go ręcznie po zaimportowaniu obrazów."
           },
           "tokens": {
-            "label": "",
-            "token": "",
-            "configured": "",
-            "notConfigured": "",
-            "save": ""
+            "label": "Tokeny dostawcy",
+            "token": "Token",
+            "configured": "Token skonfigurowany",
+            "notConfigured": "Brak ustawionych tokenów",
+            "save": "Zapisz"
           }
         }
       },
@@ -3236,9 +3236,9 @@
           "invalidIdentifier": "Nieprawidłowy identyfikator",
           "noMatchingVersion": "Nie znaleziono pasującej wersji",
           "noReleasesFound": "Nie znaleziono wydań!",
-          "noProviderSelected": "",
+          "noProviderSelected": "Nie wybrano dostawcy",
           "noProviderResponse": "Brak odpowiedzi od dostawcy",
-          "unexpected": ""
+          "unexpected": "Nieoczekiwany błąd dostawcy"
         }
       }
     },

packages/translation/src/lang/uk.json

@@ -3132,7 +3132,7 @@
           "label": ""
         },
         "showOnlyIcon": {
-          "label": ""
+          "label": "Показати тільки іконку"
         },
         "topReleases": {
           "label": "",
@@ -3229,7 +3229,7 @@
       "openReleasePage": "",
       "releaseDescription": "",
       "projectDescription": "",
-      "created": "",
+      "created": "Створено",
       "error": {
         "label": "",
         "messages": {
@@ -3350,7 +3350,7 @@
           "label": ""
         }
       },
-      "latestResult": "",
+      "latestResult": "Останній результат",
       "averages": "",
       "tests": "",
       "recentResults": "",
@@ -3437,7 +3437,7 @@
           "description": ""
         },
         "maxNowPlayingItems": {
-          "label": "",
+          "label": "Максимум елементів для відтворення",
           "description": ""
         },
         "showLibraryCount": {

packages/widgets/src/_inputs/widget-multiReleasesRepositories-input.tsx

@@ -50,6 +50,7 @@ import {
 } from "@homarr/definitions";
 import { findBestIconMatch, IconPicker } from "@homarr/forms-collection";
 import { createModal, useModalAction } from "@homarr/modals";
+import { showErrorNotification } from "@homarr/notifications";
 import { useScopedI18n } from "@homarr/translation/client";
 import { MaskedImage } from "@homarr/ui";
 
@@ -269,8 +270,24 @@ const providersWithAuth: ReleaseProviderKind[] = [
 const ProviderTokensSection = ({ itemId, repositories }: { itemId: string; repositories: ReleasesRepository[] }) => {
   const tRepository = useScopedI18n("widget.releases.option.repositories");
   const { data: configuredKinds = [], refetch } = clientApi.widget.secrets.getConfiguredKinds.useQuery({ itemId });
-  const setSecret = clientApi.widget.secrets.setSecret.useMutation({ onSuccess: () => refetch() });
-  const deleteSecret = clientApi.widget.secrets.deleteSecret.useMutation({ onSuccess: () => refetch() });
+  const setSecret = clientApi.widget.secrets.setSecret.useMutation({
+    onSuccess: () => refetch(),
+    onError: (error) => {
+      showErrorNotification({
+        title: "Failed to save token",
+        message: error.message,
+      });
+    },
+  });
+  const deleteSecret = clientApi.widget.secrets.deleteSecret.useMutation({
+    onSuccess: () => refetch(),
+    onError: (error) => {
+      showErrorNotification({
+        title: "Failed to delete token",
+        message: error.message,
+      });
+    },
+  });
 
   const authProviders = useMemo(() => {
     const usedProviders = repositories.map((r) => r.provider).filter((p): p is ReleaseProviderKind => p !== undefined);

pnpm-workspace.yaml

@@ -14,7 +14,7 @@ catalog:
   "@dnd-kit/utilities": ^3.2.2
   "@drizzle-team/brocli": ^0.12.0
   "@extractus/feed-extractor": 7.2.1
-  '@gfazioli/mantine-onboarding-tour': ^4.0.6
+  "@gfazioli/mantine-onboarding-tour": ^4.0.6
   "@gitbeaker/rest": ^43.8.0
   "@homarr/gridstack": ^1.12.0
   "@homarr/node-unifi": ^2.6.0
@@ -33,26 +33,26 @@ catalog:
   "@mantine/notifications": ^9.4.1
   "@mantine/spotlight": ^9.4.1
   "@mantine/tiptap": ^9.4.1
-  "@next/eslint-plugin-next": 16.2.9
+  "@next/eslint-plugin-next": 16.2.10
   "@octokit/auth-app": ^8.2.0
   "@paralleldrive/cuid2": ^3.3.0
   "@playwright/test": ^1.61.1
   "@semantic-release/changelog": ^6.0.3
   "@semantic-release/commit-analyzer": ^13.0.1
   "@semantic-release/git": ^10.0.1
-  "@semantic-release/github": ^12.0.8
+  "@semantic-release/github": ^12.0.9
   "@semantic-release/npm": ^13.1.5
   "@semantic-release/release-notes-generator": ^14.1.1
   "@t3-oss/env-nextjs": ^0.13.11
   "@tabler/icons-react": ^3.44.0
-  "@tanstack/query-async-storage-persister": ^5.101.0
-  "@tanstack/react-query": ^5.101.0
-  "@tanstack/react-query-devtools": ^5.101.0
-  "@tanstack/react-query-next-experimental": ^5.101.0
-  "@tanstack/react-query-persist-client": ^5.101.0
-  "@testcontainers/mysql": ^12.0.3
-  "@testcontainers/postgresql": ^12.0.3
-  "@testcontainers/redis": ^12.0.3
+  "@tanstack/query-async-storage-persister": ^5.101.2
+  "@tanstack/react-query": ^5.101.2
+  "@tanstack/react-query-devtools": ^5.101.2
+  "@tanstack/react-query-next-experimental": ^5.101.2
+  "@tanstack/react-query-persist-client": ^5.101.2
+  "@testcontainers/mysql": ^12.0.4
+  "@testcontainers/postgresql": ^12.0.4
+  "@testcontainers/redis": ^12.0.4
   "@tiptap/extension-color": 3.27.1
   "@tiptap/extension-highlight": 3.27.1
   "@tiptap/extension-image": 3.27.1
@@ -69,12 +69,12 @@ catalog:
   "@tiptap/extension-underline": 3.27.1
   "@tiptap/react": ^3.27.1
   "@tiptap/starter-kit": ^3.27.1
-  "@trpc/client": ^11.17.0
-  "@trpc/next": ^11.17.0
-  "@trpc/react-query": ^11.17.0
-  "@trpc/server": ^11.17.0
-  "@trpc/tanstack-react-query": ^11.17.0
-  "@turbo/gen": ^2.10.0
+  "@trpc/client": ^11.18.0
+  "@trpc/next": ^11.18.0
+  "@trpc/react-query": ^11.18.0
+  "@trpc/server": ^11.18.0
+  "@trpc/tanstack-react-query": ^11.18.0
+  "@turbo/gen": ^2.10.2
   "@types/adm-zip": 0.5.8
   "@types/bcrypt": 6.0.0
   "@types/better-sqlite3": 7.6.13
@@ -89,29 +89,29 @@ catalog:
   "@types/prismjs": ^1.26.6
   "@types/react": 19.2.17
   "@types/react-dom": 19.2.3
-  "@scalar/api-reference-react": ^0.9.49
+  "@scalar/api-reference-react": ^0.9.51
   "@types/video.js": ^7.3.58
   "@types/ws": ^8.18.1
   "@types/xml2js": ^0.4.14
-  posthog-js: ^1.395.0
-  posthog-node: ^4.18.0
+  posthog-js: ^1.396.4
+  posthog-node: ^5.39.2
   "@vitejs/plugin-react": ^6.0.3
   "@vitest/coverage-v8": ^4.1.9
   "@vitest/ui": ^4.1.9
   "@xterm/addon-canvas": ^0.7.0
   "@xterm/addon-fit": 0.11.0
   "@xterm/xterm": ^6.0.0
-  adm-zip: 0.5.17
+  adm-zip: 0.5.18
   jszip: ^3.10.1
   sql.js: ^1.14.1
   babel-plugin-react-compiler: ^1.0.0
   bcrypt: ^6.0.0
-  better-sqlite3: ^12.10.0
+  better-sqlite3: ^12.11.1
   chroma-js: ^3.2.0
   clsx: ^2.1.1
   concurrently: ^10.0.3
-  conventional-changelog-conventionalcommits: ^9.3.1
-  cookie: 1.1.1
+  conventional-changelog-conventionalcommits: ^10.2.0
+  cookie: 2.0.1
   cookies: ^0.9.1
   croner: 10.0.1
   cross-env: ^10.1.0
@@ -139,20 +139,20 @@ catalog:
   jsonpath-plus: ^10.4.0
   ldapts: 8.1.8
   lodash.clonedeep: ^4.5.0
-  lucide-react: ^1.22.0
+  lucide-react: ^1.23.0
   "mantine-contextmenu": ^9.3.1
   mantine-datatable: ^9.3.1
   mantine-react-table: npm:mantine-react-table-open@9.0.3
   mcp-handler: ^1.1.0
   maria2: ^0.4.1
   mysql2: 3.22.5
-  next: 16.2.9
+  next: 16.2.10
   next-auth: 5.0.0-beta.31
-  next-intl: 4.13.0
+  next-intl: 4.13.1
   node-loader: ^2.1.0
   octokit: ^5.0.5
-  oxfmt: ^0.56.0
-  oxlint: ^1.71.0
+  oxfmt: ^0.57.0
+  oxlint: ^1.72.0
   pg: ^8.22.0
   postcss-preset-mantine: ^1.18.0
   prismjs: ^1.30.0
@@ -164,22 +164,22 @@ catalog:
   react-markdown: ^10.1.0
   react-quill-new: ^3.8.3
   react-simple-code-editor: ^0.14.1
-  recharts: ^3.9.0
+  recharts: ^3.9.1
   sass: ^1.101.0
   semantic-release: ^25.0.5
   semver-parser: ^4.2.1
   superjson: 2.2.6
   svgson: ^5.3.1
-  testcontainers: ^12.0.3
+  testcontainers: ^12.0.4
   timezones-ical-library: ^2.2.1
   trpc-to-mcp: ^1.3.2
   trpc-to-openapi: ^3.3.0
-  tsdav: ^2.2.2
+  tsdav: ^2.3.0
   tsx: 4.20.4
-  turbo: ^2.10.0
+  turbo: ^2.10.2
   typescript: ^6.0.3
-  vite: ^8.1.0
-  undici: 7.27.2
+  vite: ^8.1.2
+  undici: 7.28.0
   use-deep-compare-effect: ^1.8.1
   video.js: ^8.23.9
   vite-tsconfig-paths: ^6.1.1
@@ -191,6 +191,7 @@ catalog:
   zod: ^4.4.3
   zod-form-data: ^3.0.2
   zod-validation-error: ^5.0.0
+
 catalogMode: strict
 nodeLinker: hoisted
 strictPeerDependencies: false
@@ -205,29 +206,34 @@ minimumReleaseAgeExclude:
   - turbo@2.9.14
   # Renovate security update: form-data@4.0.6
   - form-data@4.0.6
+  # Renovate security update: undici@7.28.0
+  - undici@7.28.0
+  # Renovate security update: esbuild@0.28.1
+  - esbuild@0.28.1
 overrides:
   "@babel/helpers@<7.26.10": ">=7.29.7"
   "@babel/runtime@<7.26.10": ">=7.29.7"
   "axios@>=1.0.0 <1.8.2": ">=1.18.1"
   "brace-expansion@>=2.0.0 <=2.0.1": ">=5.0.7"
   "brace-expansion@>=1.0.0 <=1.1.11": ">=5.0.7"
-  "esbuild@<=0.24.2": ">=0.28.0"
+  "esbuild@<=0.24.2": ">=0.28.1"
   "form-data@>=4.0.0 <4.0.4": ">=4.0.6"
   "hono@<4.6.5": ">=4.12.27"
   "linkifyjs@<4.3.2": ">=4.3.3"
   "nanoid@>=4.0.0 <5.0.9": ">=5.1.16"
   "prismjs@<1.30.0": ">=1.30.0"
-  "proxmox-api>undici": "7.27.1"
+  "proxmox-api>undici": "7.28.0"
   "react-is": "^19.2.7"
   "rollup@>=4.0.0 <4.22.4": ">=4.62.2"
   "sha.js@<=2.4.11": ">=2.4.12"
   "tar-fs@>=3.0.0 <3.0.9": ">=3.1.3"
   "tar-fs@>=2.0.0 <2.1.3": ">=3.1.3"
   "tmp@<=0.2.3": ">=0.2.7"
-  "vite@>=5.0.0 <=5.4.18": ">=8.1.0"
+  "vite@>=5.0.0 <=5.4.18": ">=8.1.3"
 patchedDependencies:
   "@types/node-unifi": "patches/@types__node-unifi.patch"
   "trpc-to-openapi": "patches/trpc-to-openapi.patch"
+
 allowUnusedPatches: true
 allowBuilds:
   "@tree-sitter-grammars/tree-sitter-yaml": true