Project and Compose fixes

• Create missing project bind directories as the runtime user — 8bcb59d538a28bcd149b42bcbb9e096d10eb1059 (#4138) (@kmendell)
• Update the Compose example to include DISTRIBUTION=1 — 1b21e5c3594d3e60d8f8a449981a078a989790d6 (@kmendell)

Container update and backup fixes

• Allow manual updates for containers excluded from automatic updates — 6c227d02de0f412371f4124214934af2933fe7f5 (#4139) (@kmendell)
• Preserve data volumes when recreating containers during upgrades — 75f6ddb2bb8cee8cec52259d11d5123fe7b97f4d (#4141) (@kmendell)
• Include separately mounted projects in system backups — 081e638de8000ec033a7fe4b4ac036ff8571e238 (#4144) (@kmendell)

2.13.1

2.13.1

2.13.1

Features

• Added a stream label toggle for distinguishing STDOUT and STDERR in logs. (#3976, 4f10dee49f7a3c4b32a695cc9f05584403ea674d) — @kmendell
• Added Telegram topic destinations for notifications. (#3978, e47164421a22b8a9f12714a923be566889d2cbe1) — @kmendell
• Added a timestamp toggle to the log viewer controls. (#3979, 9fa57c867b1085a7142d7e755f87ddd9318b1a1d) — @kmendell
• Added personal defaults for the project editor layout. (#3986, 67b34b9c032d8f56379ed60322839d39dc5af855) — @kmendell
• Added bulk updates for selected containers. (#3971, 0365c6861d50ef5fc5aaf7f816e370955eadc398) — @mewajda
• Added retained log viewing for stopped projects. (#4097, b350d394cd19027e90bb8dd581474de54745c434) — @kmendell

Fixes and UI improvements

• Nested Compose services and networks under their respective sections in the outline. (#3985, f4573188664d88d6d3a8ac0427c34611211dcb72) — @angst911
• Let the backend generate run IDs for manually submitted jobs. (#3987, af96a6e99b3fdc0b64cd8b26552e624be7732e54) — @kmendell
• Added a separate tag-listing timeout for large registries. (#3990, 5262d2f33af966b856a10b8572c061bf7ba8fc18) — @kmendell
• Updated the sidebar update item. (#4003, 476d8b17fc4f695e90a2758740fa77acf8ab42aa) — @kmendell
• Sorted containers globally by live CPU and memory usage. (#4099, 18e4e3f5b1b2d8abf3999008cf3a0934bae6d4f3) — @kmendell
• Surfaced Update All startup errors and adopted already-running jobs. (#4104, dc89ea0b1920f4f2d6eefb92f2cafb9b528822ca) — @kmendell
• Sorted network subnet and gateway columns numerically. (#4119, 324adf3585ece4ecd1f4f3317875521398028ea7) — @kmendell
• Prevented header actions from overlapping badges and added per-device layout modes. (#4121, 9454ce57db6763263e4628cc58a4c2e1c169183d) — @kmendell
• Included container image references in update discovery. (#4126, e0357ec8468fadb8a8daba7804ec20594092d3b0) — @kmendell
• Displayed project-scoped versions instead of image digests. (#4127, ddead64b8b96e0929a0e79acd8d1a4f350e2f5a3) — @kmendell

Performance

• Skipped repeated per-message visibility reads and source lookups on the local activity stream. (#4105, 423cd549b74271f8a4b3992cf04e5920d6a06dc5) — @kmendell
• Resolved GitOps Compose paths once per project list request. (#4106, f5d6f37dba1c9cab72271d6e9d183cbe1f7fd79e) — @kmendell
• Enriched filtered project lists after pagination. (#4108, 92349aa97949e54ee2409a1c4a3c35758df60e8a) — @kmendell
• Deduplicated and parallelized container tag checks. (#4109, 57812f8f0511e9f2d3f6b6fa17242da6db98d592) — @kmendell
• Replaced repeated update-record scans with indexed lookups. (#4110, 109f22402d059167b079f735b19b72e4029ca4ef) — @kmendell

2.13.0

2.13.0

2.13.0

Backups and Git sync

• Added Back up to Git sync mode and the ability to link existing projects to syncs — dadf87f93d9214dcd741c7ed503dfbf504c9df54 (#3932) (@kmendell)
• Added configurable Git identity for pushes — 372f168940702645d63d34d0d6d80b742a7cb8da (#3935) (@kmendell)
• Added an explicit environment-backup switch with a warning for project backups — 9ba395d5272ee5a3506682e61b9d1e06c4752f16 (#3937) (@kmendell)
• Added support for binary files in Git backups and reused the editor file tree in the sync dialog — b80880fab4146572c02f071126d44751391031b9 (#3946) (@kmendell)
• Preserved pre-deploy hooks and deployment options when importing GitOps syncs — da22a65fac881f7b6ff6048bae91399608d2eeab (#3952) (@kmendell)
• Added S3 backup discovery and re-keyed volume backups to the recovery key — 02208f5cd24e028dfb0e2221305febbf3ee58837 (#3885) (@neurekadev)

Security and vulnerability scanning

• Added CSV export to the security vulnerabilities table — af5538dde929bcc0e94053fd9ad4f3d263820da7 (#3936) (@kmendell)
• Added a Fix available filter to the security vulnerabilities table — bf48ce6eebebca249607b02dcebb7df37079ab90 (#3944) (@kmendell)
• Added vulnerability-count sorting to the images table — 9f89ceefbfcd6dd16581cf520b40d4b201d41801 (#3945) (@kmendell)
• Added Trivy configuration and ignore-file settings for vulnerability scans — eff16eb5688e981b36847f55995d92990d02d30c (#3949) (@kmendell)
• Added support for decimal CPU limits in Trivy scans — 02225a2d03529ef14ec7e4009f6f4b746feca2b6 (#3972) (@kmendell)

Containers and networks

• Added subnet and gateway columns to the networks table — 146b4b9658d163c1290453203172b3cd286bdf3f (#3942) (@kmendell)
• Added IPv6 addresses for containers and network members — 8345e5669ac2580a0b67385fbb9868ab6468e97e (#3957) (@kmendell)
• Added optional IP ranges when creating networks — 38d3ed8c19faea20e4d9457395519196f074ce6a (#3959) (@kmendell)
• Linked container overview volume and network counts to their respective tabs — f9988528d1a94e3440d2d295bfcd1c658aff1798 (#3958) (@kmendell)
• Added support for downloading container logs — 9a83c5ac02944dc72c3fc4a39691eb8a1a832403 (#3960) (@kmendell)

Interface and settings

• Added Shift-select range support to selectable tables — 472b01f5855c642afe192be448fe6339f6a6f74c (#3943) (@kmendell)
• Clarified ntfy token authentication, required Matrix credentials, and cleaned up test menu labels — e68ab5ab4b8e3df7528b6f365846c383a49d381e (#3951) (@kmendell)
• Updated theme colors and added support for inheriting theme colors — eee8a84bd5d467ca5f1f6dac4ca20768a377dcf4 (#3965) (@kmendell)

Authentication, permissions, and reliability

• Surfaced OIDC and settings errors, allowed clearing the OIDC secret, and required it while OIDC is enabled — 70cf8a2596d32f2fd84685e5827bc79f95e2a3b7 (#3954) (@kmendell)
• Hid the Automations tab and stopped job polling without jobs:manage permission — 94d6d79d533cd941d46d2cacaba391167d570c96 (#3963) (@kmendell)
• Updated the legacy users.roles backfill to run only once — a4ae1a0f20463c7dc018f7bae4996e3cab2e34ac (#3964) (@kmendell)

Agents and edge tunnel

• Fixed Docker snippets to use the port number from the agent address input — 2c34ade39db5f8686f73e7f76bb8df691f39cebc (#3955) (@tinkrynite)
• Added missing job commands to the edge tunnel — 6af4589a12376f7fe40a9f1d8778fbbe6e5afbf4 (@kmendell)

2.12.0

2.12.0

2.12.0

Authentication and notifications

• Align first-login password validation with the configured policy — b71892d0902480a5e430bf4c10439d167508301c (@kmendell)
• Prevent passkey MFA failures caused by reactive options — 95e5a3bc14706e69a9a366794d92706c55a53a7f (#3926) (@kmendell)
• Preserve notification event subscriptions during partial settings updates and warn when none are subscribed — 817444abbd7984401e9f2e3ef59447e474f8d97b (#3925) (@kmendell)

Vulnerability management and Docker compatibility

• Fall back to cpuset for Trivy when the Docker host lacks CFS quota support — 41eae6334d8807d7fd7c159b73f157b28422e2a8 (#3910) (@kmendell)
• Allow vulnerability management to be disabled per environment — 4e432b30a69458c2077f9eac5ceb1a83709282b6 (#3914) (@kmendell)
• Pull pre-deploy runner images using configured registry credentials — 989e160ec544842d0db69ade182037cd2976b310 (#3918) (@kmendell)
• Fail image patching early when Docker lacks the containerd image store — 6fdcf37c2dba690a227d09e1bf5aaf3a3c632330 (#3928) (@kmendell)

Projects and GitOps

• Preserve existing file modes when saving project and global environment files — c92f3932cca1597c3d3fe3484b3d9a1e41289216 (#3919) (@kmendell)
• Preserve configured directory modes for GitOps directory-sync project roots — 31081659de472c06a639bd53e1615dff5077b5ac (#3920) (@kmendell)
• Treat identity bind mounts as mapped when re-resolving escaped relative Compose paths — 7b19b854ace736bedafd0a632e8cb54f3420696a (#3924) (@kmendell)
• Sort projects by live status instead of the stale persisted status — 0b594d1fd17c50285d9e7956f7bc8a488200c27b (#3923) (@kmendell)

Interface and dashboard

• Keep the environment detail page stable when navigating back to the list — 73d478211ebe090dc5afe38c098361e2b5770472 (#3921) (@kmendell)
• Prevent the project log panel from recursing on the viewer stop callback — e8cc329c1042b896669ae091d64e6a8cbd15bf0f (#3927) (@kmendell)
• End dashboard statistics loading on stream failure and retry on refresh — 16b7b59d5e6442bd8d2e0181356fb8f5d6488ebc (#3930) (@kmendell)

2.11.1

2.11.1

2.11.1

Features and improvements

• Added durable job execution with offline recovery (58823c2ac4afd674f88bccee38b5da9e985da335, #3863) (@kmendell).
• Streamed Docker daemon events to the Arcane event log (2a61718a3af98393ddcdef40d02d30fe416c70ec, #3862) (@kmendell).
• Added tag-based container updates (f8f456a62b866108b3c8c433cb04f8d6f6c119bb, #3865) (@kmendell).
• Added filtering for containers and projects by labels, plus support for hiding containers through labels and Compose metadata (5dfd281c628bac0b4880c465bd629040d94a301e, #3874; 6006dbefd64e437e4935c80e38006b96d53c4b93, #3875) (@kmendell).
• Added support for uploading non-UTF-8 workspace files (a38a0a2fbff09efeeda6430be15c933af00719fe, #3859) (@neurekadev).
• Linked Git-managed projects and synced files to their repositories (6eed748e3fc976ebeaa8a227239ec8b7565ad86d, #3879) (@FusselTV).
• Added backup recovery key import and reset confirmation controls (16db5a33747b49350407073aa0040baa5e151947, #3884) (@neurekadev).
• Improved environment synchronization by surfacing failures and recording manual sync activity (c6ad1016d913efd100260967dc1a5da8cacb7e32, #3854) (@kmendell).
• Improved auto-update recovery, job activity integration, and per-container outcome reporting (5d055f66d796ca79aabf59adfd3d4b7c3986404e, #3867; 472b50ed15b7d550eee0173e01f1f77a129601bb, #3872) (@kmendell).
• Improved user validation and password policy feedback (832cf6eca30be8fbf5f3eb19786f5d8a16c43751, #3851) (@baejihoon).
• Improved frontend table scrolling while preserving glass effects (ca9917fc5cbdd462734754409c5657908bd30475) (@kmendell).
• Improved Easy Join discovery on non-manager environments (436e20bcee37138fc369eecf02eab6b5f682ace2, #3902) (@kmendell).
• Improved diagnostics for projects with unreadable .env files (e8c92c5e6bae99251268749c4d16c53ecbebd16f, #3909) (@kmendell).

Fixes

• Surfaced JWKS initialization errors instead of readiness timeouts (eeb79a68e86702825eca2531b933c9bd801d6201) (@kmendell).
• Normalized identity and display text with Kit struct tags (b51613f2c6d389e20be507be5db1f53f48600ac6, #3856) (@kmendell).
• Detected missing S3 repositories and paused remote backups (4ff83971e1a20c80ceceba27153549047461898d, #3869) (@kmendell).
• Enforced administrator requirements for environment tokens (4fe4c7ed9483dff7d43e3c4bee6a92037ce886b4, #3881) (@kmendell).
• Added missing edge tunnel routes (88514f756319179e407c96a5b9226825944ccdc0) (@kmendell).
• Clarified credential requirements when changing repository URLs (2081406e035b0f761533fa23fdae5e5c810ecdb7, #3886) (@kmendell).
• Fixed mobile navigation label stacking (de66d6330d6cf19584b38aa201ae56f8047ebda1) (@kmendell).

Refactoring

• Centralized Compose workflows and consolidated project files (9b45fd5572e59b0696ebfcb61a7d7a983ea0b4ce, #3860) (@kmendell).
• Consolidated frontend components (1ad4f285c5a2b8ac471c9fa1b1100b1ab773d5fa, #3864) (@kmendell).
• Adopted Echo request IDs and SPA static middleware (f8e4f75473950f4772bb141a8554ce22d9d99393, #3873) (@kmendell).
• Replaced svelte-check-rs with the official svelte-check (3dac10c2d53e2cae90e63b18e468c9263347c693) (@kmendell).
• Cleaned up effect usage and adopted proper Svelte reactivity (5df09ed475c4bac4ab6f54e1b9bdde1ac1c55105, #3904) (@kmendell).
• Aligned frontend stores and attachments with Svelte best practices (2d0ac4a8c93c04d5657a7c3c5880b739703bc8cd, #3907) (@kmendell).

Dependencies

• Updated go.getarcane.app/acfs to v0.6.0 (5ba5ad4d20d8302051112c9c18ad29edc90c2d9f, #3857) (@kmendell).
• Updated charm.land/log/v2 from 2.0.0 to 2.0.1 (57bd14795309fe11901cef510dc1cf8332c9a984, #3890) (@dependabot[bot]).
• Updated github.com/containerd/containerd/v2 from 2.3.4 to 2.3.5 (a8bf2eee2bf1f197cd254b356e89d80c3df08e3f, #3895) (@dependabot[bot]).
• Updated golang.org/x/time from 0.15.0 to 0.16.0 (34e73a4648f34205a86f3bb460b0626307d72c8e, #3894) (@dependabot[bot]).
• Updated golang.org/x/sys from 0.47.0 to 0.48.0 (987548b2a807d8d0916592faab55c589abb74a68, #3889) (@dependabot[bot]).
• Updated golang.org/x/oauth2 from 0.36.0 to 0.37.0 (6a9ff7aa64fbec74e379b5dc9622699189093d73, #3892) (@dependabot[bot]).
• Updated golang.org/x/sync from 0.22.0 to 0.23.0 (a50ab984528cf443c07e1a58052a09af2632dd63, #3893) (@dependabot[bot]).
• Updated golang.org/x/mod from 0.40.0 to 0.41.0 (a423806a3f1c99073382c6e3b0ce5184aecdd52b, #3888) (@dependabot[bot]).
• Updated modernc.org/sqlite from 1.57.0 to 1.58.0 (da6712ddfee61340f5286aa9982fd5f8f87bc647, #3891) (@dependabot[bot]).

2.11.0

2.11.0

2.11.0

Fixes

• Surface container shell close reasons and disable WebSocket compression — 30e1bb590a34d9aeded744a71d39e8709b3b7b33, b9b8c813f6d3735770f2bc1bf5c80b4967eb7e26 / #3814 (@kmendell)
• Skip overlapping scheduled cron job runs — 51cf6bb6a1049a01596a5933ddb2508de6938dea, 5232b4d04bfb482ed9d3ec869f30ec2fee03ca30 / #3815 (@kmendell)
• Refactor image digest inspection logic — d256fc2787efd18341d84e63e59e7cd38300e99d / #3826 (@jdrouhard)
• Keep the first-login password dialog open and clear its flag after an admin password change — 6f90da73f3606e42e58a0f00c98208f5817c27c9 / #3831 (@kmendell)
• Allow the frontend to recover from stale chunks after a redeploy — 8c294a7316f3616a704edfec366f4adccd91a577 (@kmendell)
• Keep edge agents on gRPC after a manager restart — 4febf6d0dcf64997b53cba7743d082b4c7550979 (@kmendell)
• Show digest-pinned image references — 5c0592994278ac9ab4600966dcdb460ecbef857b / #3836 (@kmendell)
• Hide passkey login when no credentials are registered — b7b568e1a6911bf1b8369de129af792fb0f23e4e (@kmendell)
• Honor SSH usernames in Git repository URLs — 837fe10c92ddbb2391d7b13475d475a68f7fca2c (@kmendell)
• Support host memory accounting for Docker inside LXC — 416e93a4be282a5d26025f9fd00f3ae56c70bb71 / #3846 (@kmendell)
• Load project digests automatically when entering the Updates page — 8d5eaeb9dda0072736eb67272de4d7d781d7472b (@kmendell)
• Sort environments by name while placing the current selection first — 4e0f1dcfc074a4562b59ef03ee49dabbd68f40f5 (@kmendell)
• Rate-limit webhook triggers by token instead of client IP — de1e978810a490fd7930a634bd4df765a50f65b2 / #3742 (@ohOgil)
• Run backups in an activity instead of locking the UI — dd16fd942afaed4db4d63ad4fa787bce20251f8d / #3847 (@kmendell)

Performance

• Serve cached authentication token state — 65fcfa637919992c81b373396265455a1f08ae3c, 5e8ecabd4f0c2aa3c3011baab6761dc13aabc96f / #3816 (@kmendell)
• Route Docker daemon calls through singleflight callers — 64c2500b669f343451f2541a045b578e10ee172b / #3818 (@kmendell)
• Share one stream producer across all clients — db9878d01dccfed0406cee7c5e573a7f2c8637fe / #3819 (@kmendell)
• Look up Copa targets by digest instead of issuing database queries — ddcd50530759ed0b31d2f717e7d82a213bfd655d / #3821 (@kmendell)
• Validate the projects metadata cache by file modification time and resolve entries in parallel — 0b44e8dd5e16131015e18c70601c79b1c2cad9a9 / #3823 (@kmendell)
• Serve the CVE list from a normalized table — 31a9896dfb052ece34d7ba4c14d8347b9ad8a8b5 / #3825 (@kmendell)
• Bound scheduled scans, skip unchanged images, and avoid remounting during navigation — 8299a56c5430f9a04ee132b15f58a9e46f810dc0 / #3829 (@kmendell)
• Dispatch notification providers concurrently — 767992dc34a4b98d35fb220425bf51ea9b123961 / #3820 (@kmendell)

Improvements and refactoring

• Allow selecting registries for Arcane Tools and Trivy databases — b85caceeef0ba5dd094ce1fcb82805acfd2a6445 / #3830 (@kmendell)
• Clean up duplicate HTTP client logic — 8a74c1b729e6bd0b02e1bcf17a824cc445cb2eb3 (@kmendell)

Dependency updates

• Bump react-email from 6.9.2 to 6.9.3 — 0cbb2590792d935ff2c7a20468e91edc3b318304 (@dependabot[bot]); 8dd0210aec7303fa506cdf77e235804961107a7d / #3806 (@kmendell)
• Update the tanstack-table group with two updates — f58bc47404cbc61ca0c2a62a4d48436e5b2b5688 (@dependabot[bot]); 0a7ea50401c95aff42f90b94172b0c2f42ece4cb / #3799 (@kmendell)
• Bump ky from 2.0.2 to 2.1.0 — 5700fb7f52a95e3e21ab0fce8d5a7e453cb0201c (@dependabot[bot]); ab3eaae5751c0abe8ae326b35b565b43f2ed678f / #3802 (@kmendell)
• Bump svelte from 5.56.10 to 5.57.0 — 3db4f4a591fd43aff54d5d9ca679780f6d9c5e35 (@dependabot[bot]); efb72f212b9795ecccfcf3b792a0e76dedebb1c6 / #3808 (@kmendell)
• Bump @tanstack/svelte-query from 6.1.43 to 6.1.48 — 917e6c267748da315f93855dadbea3444466f12c (@dependabot[bot]); 242744189b8e1065be494d5cd25c8a97ecb511c0 / #3807 (@kmendell)
• Bump pnpm to v12.2.1 — 7d33837fd5a2d8bfd9617dabe7347f1ea06ca1c2 (@kmendell)
• Bump @xyflow/svelte from 1.6.3 to 1.6.5 — 1829e66194ca404bd8ff4b211e693a7d149ac184 / #3810 (@dependabot[bot])
• Bump github.com/nicholas-fedor/shoutrrr from 0.18.0 to 0.19.0 in /backend — 343dc2020f10c610f81bb5834bcc5b858377afbe / #3840 (@dependabot[bot])
• Bump golang.org/x/crypto from 0.55.0 to 0.56.0 in /backend — 37226ae35749563489551c840ca2b1620e07e3e6 / #3844 (@dependabot[bot])
• Bump github.com/coreos/go-oidc/v3 from 3.20.0 to 3.21.0 in /backend — 504e5b6dda7ea16bdab84eb6b72c1da47e90414d / #3845 (@dependabot[bot])
• Bump github.com/pressly/goose/v3 from 3.27.3 to 3.28.0 in /backend — d6271ea3045682a063b516ea0f1d71fc2f7e4a64 / #3841 (@dependabot[bot])
• Bump github.com/klauspost/compress from 1.19.2 to 1.20.0 in /backend — 71d866fefdd79552afd4db123fd01cbd29199753 / #3843 (@dependabot[bot])
• Bump github.com/mattn/go-runewidth from 0.0.28 to 0.0.29 in /cli — 5137b5dcb4efe2e6107adc7d316af4ec9132f01b / #3838 (@dependabot[bot])

2.10.2

2.10.2

2.10.2

Fixes

• Issue compact browser session cookies instead of the larger ML-DSA access JWT — df7c24c85e9d4fa9d380532db928ecc3aa13dc17 (@kmendell); e874390f6b4ca611a4b5f733868cca1e01138aca / #3813 (@kmendell).
• Fall back to the username when the display name is unset in the sidebar user menu — 0c7174f1089079d79535563ac2d54b032ea6914a (@kmendell).

Dependencies

• Bump github.com/shirou/gopsutil/v4, including 4.26.7 to 4.26.8 — c9ad2e6f9f9751764e5608128b7e55abf9349b88 (@dependabot[bot]); dd02c011c575c298dbd3f3167e4ba291edc06c59 / #3798 (@kmendell).
• Bump zod from 4.4.3 to 4.5.4 — d95764cf15a2867e2ac573f8cf6f78654da597d7 / #3812 (@dependabot[bot]).

2.10.1

2.10.1

2.10.1

Backups and recovery

• Add selective system restores and harden recovery — 874134cfedc2e8ae44e6f0cd7e957e87bc760988 (#3708) (@neurekadev)
• Add system-managed volume backup scheduling — 53a959f93e26193c6c9ac4bb4053555f18e8b2ff (#3737) (@neurekadev)
• Reduce S3 backup download amplification — 538350af6c72d0e6d80164f6aacb3b8dd02cd1bd (#3773) (@kmendell)

Containers, images, and projects

• Add experimental Convert to Compose for running containers — 9aef34e4ea703cbee29d31a4338413018ce54f34 (#3746) (@kmendell)
• Add direct Copacetic image patching — 3617720518f0bdfc4282a7b5844508f3b7da60ec (#3744) (@kmendell)
• Restrict Copa patches to OS-level issues — e95c55326a59a615993113e0ee809df734a40b0a (@kmendell)
• Store raw Trivy reports in the database and fix patch-target pagination — 53e7e82715bfebd9ed0d1a27dc0b777d0bbd68b0 (@kmendell)
• Honor UI container exclusions during image update discovery — b9b2092c0e36d3eaba66335e003b7ecd5e858540 (#3763) (@kmendell)
• Stop checking Arcane-built local images against registries — 8d10b7db2d34aefa44f0f9a684f3b84b2ae355d7 (@kmendell)
• Query image update information directly instead of caching it per container listing — 509c6e81babef8c3ac0b4bf9c418c1d3115c50a8 (@kmendell)
• Resolve upgrade target images for blank-target self-upgrades — 8bbd157a2963874998c481487d132f460cb15b1c (#3772) (@kmendell)
• Honor COMPOSE_FILE and other predefined environment variables in projects — 6e1dbb2d22858014970f3b235b73acea0fc70ad5 (#3709) (@kmendell)
• Forward registry authentication when deploying Swarm stacks from Git Sync or source edits — 1570a1da7a00e20012dcdf3d5496e2d9f39f732f (#3787) (@elfensky)

Reliability and operations

• Return HTTP 200 from the environment health check — 6b46c36a237328fc0728ac8fd02e8bc79a149986 (@kmendell)
• Write workspace files using the volume’s runtime identity instead of root — f4958ae8c8318bd921ef5be4ae9a6436309b0cd5 (#3745) (@kmendell)
• Match Docker CLI memory accounting for cgroup v1 containers — 4c479f1c5b01ae6932e2de2ad91ca79aa6874edc (@kmendell)
• Purge leftover Git clone scratch directories — d57d18f1136c1e518be656615f6e2df01d777e34 (#3771) (@kmendell)
• Preserve stderr streams and Docker timestamps in project logs — cac8a9090baea3b44aa2868d195cd21c3dcf62f0 (#3770) (@kmendell)
• Allow the Viewer role to browse Swarm resources — 3f205dea94fa6d40189cf80eec665e39c5131e60 (#3779) (@kmendell)
• Trigger agent self-upgrades asynchronously and pass the manager’s resolved target version — d857910d9b08f96e7739c679415b18fd192a01b4 (#3786) (@kmendell)
• Serialize explicit empty values in partial-update DTOs with omitzero — 24592561d9154da35d7fecd380e12c50e3c5783a (@kmendell)

Authentication and notifications

• Add native Apple push notifications for the iOS app — 4b1abefec6b9b93ea331e1259e061c6862025a11 (#3783) (@kmendell)
• Sign and verify sessions, OIDC, passkeys, and edge mTLS with ML-DSA-87 — 2993fd316d41fafc110476370870a49b9202969c (#3785) (@kmendell)
• Accept display names in email notification From addresses — 034e7e7efd4e756f0c3145099f24f2afe0bc7596 (#3776) (@ohOgil)

User interface

• Improve table-scrolling performance across all views — 1243d8e0bafdc110b8443ef710d999e5104ce632 (@kmendell)
• Keep dialog widths within the content area — 5e7acb61d3bb6ef4bc60a80266c424f1d40d02c2 (@kmendell)
• Move frontend files into a more maintainable structure — 938882a174322a1bbc6fe50fe926a4c61820797b (@kmendell)

Dependencies

• Bump github.com/aquasecurity/trivy from 0.69.3 to 0.72.0 in /backend — 29784fead298d740fb07db2754d53ff55e3bb9c4 (#3748) (@dependabot[bot])
• Bump github.com/sirupsen/logrus from 1.10.0 to 1.10.1 in /backend — be4220fa2cc44c348177de5c39354b716a517413 (#3753) (@dependabot[bot])
• Bump github.com/quay/claircore from 1.5.52 to 1.5.53 in /backend — 611b5d7ff298ccd51b0675874354282aa117356c (#3747) (@dependabot[bot])
• Bump github.com/samber/hot from 0.13.0 to 0.13.1 in /backend — cecdb777ec0f3487ab442f2bd1a45dc1120f0564 (#3754) (@dependabot[bot])
• Bump charm.land/bubbles/v2 from 2.2.0 to 2.2.1 in /cli — b631dd67c34ef642c3bb177ad3d9df09c0974b0d (#3752) (@dependabot[bot])
• Bump @tanstack/svelte-query from 6.1.39 to 6.1.43 — 55762896904d9453f2c2cbeb26645b6e0f6818a2 (#3761) (@dependabot[bot])
• Bump github.com/google/go-containerregistry from 0.21.9 to 0.22.0 in /backend — 3c0aac7c557ace8a15ffbd60dd6dc4448ec43a93 (#3755) (@dependabot[bot])
• Bump marked from 18.0.10 to 18.0.11 — 201a3ff183a0f07e342398d0b1b12ca3847777a5 (#3759) (@dependabot[bot])

Refactoring

• Use generics to eliminate redundant logic — 671ebef57234c40acba287925c5ee6ac9efdd399 (#3683) (@kmendell)
• Migrate JWT and JWKS handling to jwx v4 — 45b063a074f521f45591f58c7b1d89b4395dc267 (#3790) (@kmendell)

2.10.0