luke/homelab

Watch

Fork 0

Update ghcr.io/patchmon/patchmon-server Docker tag to v2.1.6 #26

Open

renovate-bot wants to merge 1 commit from renovate/ghcr.io-patchmon-patchmon-server-2.x into main

renovate-bot commented

2026-10-18 04:01:28 +00:00

Collaborator

This PR contains the following updates:

Package	Update	Change
ghcr.io/patchmon/patchmon-server	patch	`2.1.3` → `2.1.6`

⚠️ Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

PatchMon/PatchMon (ghcr.io/patchmon/patchmon-server)

`v2.1.6`: Version 2.1.6

Compare Source

A one-fix release: agents install and check in behind Traefik with the CrowdSec bouncer's AppSec enabled. This fix was listed in the 2.1.5 notes but missed that release.

Upgrading

docker compose pull
docker compose up -d

No database or configuration changes. The fix is in the agent: existing hosts receive it through agent auto-update (on at Settings > Agent Updates) at their next restart or daily full report, and new installs get it from the upgraded server.

Fixes

Agent install failed with a 403 behind Traefik and CrowdSec. Behind Traefik with the CrowdSec bouncer's AppSec enabled, the installer's connectivity test failed with ping request failed with status 403 and the agent service was never created. The agent's check-in carried no body length over HTTP/2, which the bouncer blocks by default. The agent now always sends one. Until your agents are updated, setting crowdsecAppsecUnreadableBodyBlock: false on the bouncer middleware works around it.

Every change in this release

Issue	PR	Change
#1103	#1180	Agent install and check-in no longer fail with a 403 behind Traefik with the CrowdSec bouncer's AppSec over HTTP/2.

What is coming next

Bug fixes are tracked in GitHub milestones. Feature requests live on feedback.patchmon.net, where you can propose an idea, vote on existing ones, and see what has been accepted onto the roadmap.

Questions about this release

This release has its own thread under New Release Discussions. Open a new issue for a reproducible bug not already covered.

`v2.1.5`: Version 2.1.5

Compare Source

A bug-fix release: patch validation works again when more than five packages are selected, validation on dnf and yum hosts lists the dependencies it would pull in, and the AI assistant's model lists are updated for providers retiring older models.

Upgrading

docker compose pull
docker compose up -d

No database or configuration changes.

The Traefik and CrowdSec agent fix shown in the in-app notes for this release ships in 2.1.6.

Fixes

Run validation did nothing. In 2.1.4, choosing Run validation in the patch wizard did nothing when any host had more than five packages selected, with no error shown. Validation now runs for any selection, as it did in 2.1.3, and Skip validation is always available.

Validation on Fedora, RHEL and Rocky hosts showed no dependencies. On hosts that use dnf or yum, a validation always said "No additional packages", even when the update would install or upgrade other packages alongside the ones you picked. The validation result now lists every package dnf would change, and flags the extra dependencies for review. Validations run before upgrading are not updated; run them again to see the full list.

AI assistant could not connect with a new Google Gemini key. Google now limits Gemini 2.5 to accounts that already used it, so a new key failed Test Connection on every listed model. The Gemini list now offers 3.5 Flash-Lite (the default), 3.6 Flash and 3.8 Flash. OpenAI's gpt-4-turbo and OpenRouter's google/gemini-2.5-flash are also retired, as both providers are switching them off this month. If you had a retired model saved, the assistant moves to that provider's default; existing Gemini 2.5 users keep their selection.

Every change in this release

Issue	PR	Change
#1175	#1179	Run validation in the patch wizard did nothing when a host had more than five packages selected; it now validates any selection, as in 2.1.3.
	#1179	Validation on dnf and yum hosts now lists every package the update would install or upgrade, including dependencies, instead of none.
#1174	#1177	AI assistant model lists updated: Gemini 3.5 Flash-Lite, 3.6 Flash and 3.8 Flash replace Gemini 2.5; retired OpenAI and OpenRouter models removed.

What is coming next

Bug fixes are tracked in GitHub milestones. Feature requests live on feedback.patchmon.net, where you can propose an idea, vote on existing ones, and see what has been accepted onto the roadmap.

Questions about this release

This release has its own thread under New Release Discussions. Open a new issue for a reproducible bug not already covered.

`v2.1.4`: Version 2.1.4

Compare Source

Windows, Alpine Linux and openSUSE patching, Univention Corporate Server support, security fixes from an internal audit, working in-browser RDP, and many bug fixes.

Security

These issues were found in an internal security audit. Upgrading fixes them.

Script injection through an SVG logo, present in released versions. An uploaded logo could run script when opened. Logos, including existing ones, are now sanitised and served sandboxed.
Privilege escalation through roles and SSO settings. Editors could grant more access than they hold. They now cannot, and SSO provider settings need Manage Superusers.
Sign-in hardening. Sign-in no longer reveals which accounts exist, two-factor codes are single-use, "Disable local auth" is enforced by the server, and SSO accounts are bound to their identity provider.

Behaviour changes

Admins can no longer change another admin's role. Only a superadmin or a strictly higher role can. Only a superadmin can assign admin or use the Admin preset, and custom roles are compared by their permissions.
Passwords ignore leading and trailing spaces everywhere, and changing a password to the same value is refused.
Custom role names containing spaces are corrected on upgrade, signing their users out once.
Patch selected is refused on Arch Linux. Use Patch all.
The RDP keyboard layout defaults from the browser language.

Upgrading

docker compose pull
docker compose up -d

Database migrations run on start. Then update your agents to 2.1.4.

If you use in-browser RDP on Docker, update your docker-compose.yml before restarting. docker compose pull does not change your compose file, and the old guacd service cannot open RDP sessions. The guacd service now shares the server's network and listens on loopback only, and the server reaches it at 127.0.0.1:4822. Either replace your compose file with the new docker-compose.yml (keeping your own changes), or follow the step-by-step edit in Upgrading to 2.1.4. Then run docker compose up -d. Installs that don't use RDP need no change.

New

Patching on Windows, Alpine Linux and openSUSE, each with a dry run first. Alpine support builds on tekook's work in #863.

Univention Corporate Server (UCS), contributed by furch-services in #869. UCS hosts show their release and errata level, and Patch all installs every errata for the installed release without upgrading to a new UCS release.

Account recovery for admins. Reset a user's two-factor authentication, unlink their SSO identity, and allow superadmin password sign-in while the identity provider is down.

Worth knowing

Upgrade the server before the agents. A 2.1.4 agent cannot send Docker data to an older server.
Windows patch runs queued before the upgrade fail. Start new ones on the 2.1.4 agent.
Agents now contact image registries and, on Alpine, secdb.alpinelinux.org. Both can be turned off in config.yml.
Check agent auto-update on hosts added since 2.0.0. They were created with it off.
Compliance already enabled? Click Install Scanner once, and raise your reverse proxy's body size to 40m.
Threshold alerts no longer repeat. Set a Reminder interval under Alerts settings if you relied on that.

Every change in this release

Issue	PR	Change
#1123	#1127	Remediation scripts lost their line breaks during XML text normalisation, collapsing multi-line fixes onto a single line
#1091	#1127	Remediation scripts could emit consecutive commands with no separator between them, so the script failed to parse
#1074	#1127	Remediation scripts left SCAP profile variables unresolved, producing invalid directives such as an empty `remember=`. Scripts now carry the scanned profile's values, and an unresolved variable is marked visibly rather than left blank
#1089	#1127	Profiles discovered on a host failed to resolve when a scan was requested against them
#1097	#1127	Ubuntu derivatives with their own `VERSION_ID`, such as Zorin OS, were scanned against content that did not apply to them, with no warning. They now use their base release's content
#1093	#1127	Scanner installation failed on Debian because `apt` output was read in the operator's locale. It is now queried in the C locale
#788	#1127	Cancelling a scan left the dashboard showing it as running. Cancel now marks the scan cancelled immediately, reaches a scan that has not started, uploads nothing, and warns when the agent could not be reached
#891	#1127	A host with warnings but no failed rules was counted Critical, so the overview figures did not match the findings behind them
#841	#1127	The agent's startup sync flattened on-demand compliance mode to scheduled, so hosts ran daily scans nobody had asked for
	#1127	A scan or scanner install aimed at an offline agent was lost. Both now retry while the agent reconnects, run as soon as it does with the chosen profile, and report a clear failure if it never arrives
	#1127	Enabling compliance with OpenSCAP on a host queues the scanner install again. Hosts whose package manager cannot install it, meaning Windows, FreeBSD, Alpine and Arch, are skipped rather than queued to fail
	#1127	A second scan or scanner install on a busy host is refused with a clear message instead of colliding with the one already running, and cancelling an install no longer blocks a reinstall
	#1127	Paging through scan results repeated some rules and skipped others
	#1127	A host's status icon, its Passed, Failed and Skipped counts and the Scan Results tab could each describe a different scan. They now agree, and the counts link through to the results already filtered
	#1127	A scan that failed permanently blocked the host's next scans, and install progress from an earlier run could be credited to a newer job
#1095		Ubuntu 26.04 hosts had no OpenSCAP content to scan against, because the SSG release the image was built from predated it. The content set moves to SSG 0.1.82, which carries `ssg-ubuntu2604-ds.xml`
#686	#1077	Compliance scan results over 5MB were rejected, so scans completed on the host and never appeared. A dedicated `COMPLIANCE_BODY_LIMIT` now applies, defaulting to 20MB
#686	#1077	A body limit set on one endpoint could only lower the general API limit, never raise it, so raising `AGENT_UPDATE_BODY_LIMIT` above 5MB silently did nothing
#686	#1077	An oversized body was reported as `Invalid JSON body` or `Invalid request body`. Both endpoints now return 413 naming the limit and the setting that changes it
#686	#1077	`AGENT_PING_BODY_LIMIT` can now be changed from the database and the Settings page. It was previously env-only
#686	#1077	Settings showed the `AGENT_UPDATE_BODY_LIMIT` default as `2mb` when it has been `5mb` since 2.0.2
#686	#1077	A body limit large enough to overflow removed the limit entirely instead of raising it. All four limits are now bounded at 32MB, and a larger value is reduced rather than ignored
#686	#1077	Compliance ingest rejects payloads carrying an implausible number of results, and now sits behind the agent rate limiter like every other agent endpoint
#686	#1077	The operator guide gave `client_max_body_size` as 16m, 20m and 25m in three places, all below what a real compliance scan needs. It now says 40m throughout
#1079	#1124	Periodic check-in failed with `Invalid request body` on hosts with many disk mounts, such as Kubernetes nodes, and the host silently left inventory. The `AGENT_PING_BODY_LIMIT` default rises from 8KB to 64KB
	#1124	A `gb` value set in the environment was ignored for `AGENT_PING_BODY_LIMIT` and fell back to the default, while the same value set in Settings was reduced to the 32MB ceiling. Both now reduce to the ceiling, as the operator guide says
	#1124	Server and agent move to Go 1.26.9 and current `golang.org/x/net`, `x/text` and `x/crypto`, clearing 15 reachable advisories in the server and 11 in the agent
	#1124	The frontend moves to axios 1.20.0, clearing 12 advisories, and to react-router-dom 6.30.6
	#1124	Removed an unused express static server left over from the two-container architecture, along with the express, express-rate-limit, http-proxy-middleware and cors dependencies it was the only consumer of
#1079	#1124, #1126	An oversized check-in returned a bare `Invalid request body` with nothing identifying the cause, and the server logged nothing. It now returns 413 naming the limit and the setting that changes it, and all three agent endpoints log the rejection
#1079	#1126	The agent reported each Kubernetes CSI volume twice, once per mount, so half of its disk reporting was redundant. It now reports one entry per volume
	#1075	Agents on high-latency links failed self-update with `context deadline exceeded` at exactly 30 seconds. The download is now bounded by progress, so a slow but healthy link finishes
	#1075	Agent binaries are served compressed, taking the transfer from roughly 12MB to 5MB. Agents on 2.1.0 and later benefit as soon as the server is upgraded
	#1075	Two agent self-updates could run at once and overwrite the same binary. A second update is now refused while one is running
	#1075	A stalled download now reports how far it got, distinguishing a dead link from a slow one
#1071, #759	#1075	Windows Server 2016 and 2019 LTSC reported `osVersion=Unknown`. The agent now falls back to `ReleaseId` and then the build string
#1067	#1075	The operator guide documents the manual replacement that recovers Windows agents stranded on 2.0.2, which cannot self-update
#1111	#1117	The agent installer failed silently at "Downloading PatchMon agent binary" on hosts without `/usr/local/bin`. It now creates the directory first
#1107	#1120	The operator guide's Compose example lacked the database, Redis and guacd healthchecks the server waits on, so the server never started. They now match the shipped `docker-compose.yml`
	#1128	The agent installer could leave a broken binary when the download failed after the old one had been moved aside, because an HTTP error body was written as the executable. The download is now verified before it replaces anything, and the previous binary is restored on failure
	#1128	The agent remove script left FreeBSD hosts with the rc.d service, the `patchmon_agent_enable` line and the pidfile in place. It now removes all of them, and it no longer kills unrelated processes such as `journalctl -u patchmon-agent` whose command line mentions the agent
	#1128	Proxmox LXC auto-enrolment stopped at the first container the server rejected, with no summary. It now continues, prints enrolled, skipped and failed counts, exits non-zero when anything failed, and the dpkg recovery prompt works when the script is piped through `bash`
	#1128	Re-enrolling a host whose machine ID and name are already known created a duplicate host. The server now answers 409 (cloned containers that share a machine ID but carry different names still enrol separately) and both enrolment scripts skip it with a message saying the host must be removed in PatchMon first. Both auto-enrolment endpoints are now rate limited like the other agent endpoints, and `hosts.machine_id` gains an index (migration 000049)
	#1128	Direct-host auto-enrolment broke on host names containing quotes or backslashes and did not always send the machine ID. The payload is now escaped correctly and the machine ID is always sent
	#1128	The Windows installer exchanged the one-time bootstrap token before checking for Administrator, so a non-admin run burned the token. The check now runs first. The install command shown in the UI sets a process-scoped execution policy bypass before running the script, so it works under the default Restricted policy on Windows clients
	#1128	Re-running the Docker installer on an existing install replaced `.env` and regenerated every secret, so the server could no longer reach its own database. An existing `.env` is now kept and only missing keys are added. The installer's prompts now work when piped through `sudo bash`, `--update` restarts only when the pulled image differs from the running one, and Fedora 41 and later (dnf5) can add Docker's repository
	#1128	The 1.4.2 to 2.0.0 migration script only worked from the compose directory, could stop the stack before its downloads had succeeded, overwrote its own backups on a rerun and dropped a custom Compose project name. All four are fixed
	#1128	CI: a manual image build with the push box ticked never pushed, and publishing a release candidate failed the changelog job. Both fixed
	#1128	Removed `tools/diagnostics.sh`. It only recognised the retired native Node install, so on every supported deployment it reported that no PatchMon installation was found
#1096	#1136	A second patch run on a host with one already queued or running failed on the package manager lock. It is now refused with a clear message, and 12 simultaneous starts give exactly one run
#1096	#1136	Runs waiting for a policy maintenance window have a new Scheduled status and no longer block the host. If the host is busy when the window opens, the run is skipped with the reason recorded
#1096	#1136	A queued or validating run that never reached the agent stayed queued forever. It is now timed out 24 hours after it falls due, on upgrade and by the regular cleanup
	#1137	"Run immediately" on a host with a maintenance window reported the window's time as the start time. It now reports the actual start
#1083	#1136, #1137	A delayed "host down" notification was still sent when the host came back within the delay, unless "host recovered" was enabled and routed. It is now cancelled however the recovery is seen, and a new outage after a recovery still alerts
	#1137	A host that stayed down sent "host down" again every two minutes, and a host inside the reconnect grace window could flip between down and recovered. Each outage now sends one notification
	#1137	Saving one alert setting through the API reset the settings left out of the request. Omitted settings now keep their values
#757, #1122	#1139	Security and pending updates threshold alerts were sent on every check while a host stayed over the threshold, unless Internal Alerts was routed. Each exceedance now notifies once until the host drops back under
#757	#1139	Changing a threshold alert's frequency needed a server restart, both types ran at the shorter of the two, and 90 minutes ran hourly. Each type now runs on its own interval, any number of minutes, applied straight away
#757	#1139	Threshold alerts gain an optional reminder interval in hours (0, the default, means no reminders). Silencing an alert holds its reminders until it is unsilenced
#1116, #1072	#1136	Raspberry Pi hosts always showed "reboot required", because the agent treated the v6, v7, v7l and v8 kernel builds as one and saw the installed v8 build as newer. Fixed in the agent
#1084, #639	#1070	Containers, volumes and networks removed from a host stayed listed in PatchMon. They are now removed on the next report, and a failed Docker call never removes anything. Removing a host's last container needs the 2.1.4 agent
#1082	#1130	Security updates were never flagged on Fedora 41 and later (dnf5) or on Amazon Linux 2. They are now detected
#1081	#1092	Security updates were missed on dnf and yum hosts using a non-English language. dnf and yum output is now read in English
	#1131	A security advisory for one package with a dash and digit in its name, such as `java-17-openjdk`, could mark an unrelated package as a security update. Names are now matched in full
#1105	#1106	IPv6-only hosts reported no IP address. They now report their global IPv6 address, the host IP field accepts IPv6, and SSH to an IPv6 host works
#1098	#1099	Scheduled reports scoped to host groups included every group's hosts. Every section now respects the scope, and a report whose group is empty or deleted shows no host data
#1078	#1110	The patch wizard opened behind the pinned sidebar
#1138	#1140	The AI terminal assistant only offered retired Anthropic models, so every request failed with 404. It now offers Claude Sonnet 5.5, Opus 5.5 and Haiku 5.5, and a saved retired model moves to the default automatically. Retired OpenRouter and Gemini models are replaced too
#1138	#1141	AI command completion through the API returned explanations and broken spacing. It now returns only the text to append
#723	#1140	Hosts added since 2.0.0 were created with agent auto-update switched off, so their agents never auto-updated. New hosts now default to on, so the server-wide setting decides
#747	#1140	The 1.4.2 to 2.0.0 migration script lost secrets written directly in the old compose file, such as the Redis password and JWT secret, so the upgraded stack would not start. They are now carried over, a missing `.env` is created, and secrets are hidden in its output
#1073	#1140	The operator guide gains a "Migrating from 1.4.2 to 2.0.0" section
#667	#1140	The sidebar did not highlight Patching, Compliance, Reporting or Docker sub-items. These pages now keep their tab in the URL and the sidebar follows it
#624	#1140	The host page lost its selected tab on reload. The tab is now kept in the URL
#775	#1140, #1144	An OIDC issuer URL ending in `/.well-known/openid-configuration` failed discovery. It is now accepted, and the operator guide explains how to trust an internal certificate authority without replacing the public certificate bundle
	#1144	With automatic user creation on, every new user's first single sign-on login was rejected with "Unable to sign in with this account", and only the second attempt worked. The first login now succeeds
#1145	#1150	Accounts created automatically on first single sign-on login ignored the identity provider's `preferred_username` and took the part of the email before the `@`. They now use `preferred_username`, falling back to the email when the provider does not send one
#1149	#1152	Windows: Microsoft framework packages such as VCLibs and Windows App Runtime showed an old version with an update available, because the agent saw a leftover copy rather than the one installed. The agent now reports the installed version
	#1156	Windows: on hosts without the Visual C++ runtime, such as a clean Windows 11 install or Windows Server 2025, the agent reported no apps from winget and no app updates. winget now works on these hosts, so their app updates are reported
	#1157	The Packages list filtered to one host could show "Update Available" for a package that host had already updated, because the status came from all hosts. It now shows that host's own status
	#1159	Windows hosts can be patched: Windows Updates through the Windows Update Agent and apps through winget by Id, from Host Detail, the Packages page and the Patch wizard, with dry runs, per-item results and restart tracking. A failed Windows Update search no longer empties the host's update list
#1149	#1159	Windows: Store apps were reported at the version the Store had staged rather than the one users have, and apps no user had installed appeared in the inventory. The agent now reports the installed version and leaves out staged-only copies
#774	#1140	With logging disabled, the server could exit at startup without printing why. Fatal startup errors now always print
#820	#1140	The server now logs the Redis address it connects to at startup
#839, #713	#1140	The docs said the Windows agent used Chocolatey and that patch policies create recurring runs. Neither is true, and both are corrected
#668	#1142	The Hosts page lost its search, filters and sort on reload. They are now kept in the URL, so reload, back and shared links restore the view
#693	#1142	Settings set in `.env` could be edited under Settings then Environment, appeared to save, and reverted. They now show "Set in .env", and saving tells you whether a restart is needed
#1108	#1143	On Windows, SQL Server showed version "Unknown" and was flagged for an update. Its real version is now reported, and an app whose version is unknown is never flagged
#760	#1143	On Windows, Visual C++ redistributables and other apps could show the wrong available version, miss a real update, or be flagged when the available version was older. Each app is now matched to the right entry and versions are compared properly
#1101, #727	#1143	A RHEL or CentOS host with an `apt` binary installed (EPEL ships one) was treated as Debian-based and reported no packages, failing with "Packages array is required". The agent now chooses the package manager from the operating system
	#1146	The Automation and Environment settings tables were wider than the page, hiding columns such as Status and Action. They now fit, with descriptions behind an (i) icon, and the Environment page has a mobile layout
	#1146	Tooltips, including the host status pills, did not open when tapped on a phone. They now do
	#1147	An invalid body limit saved through the API was stored and silently ignored. It is now rejected with a message explaining the accepted format
	#1147	Body limits were shown rounded down (1500kb as 1mb), so saving the field unchanged in Settings could lower the limit. They now show exactly
	#1147	A check-in rejected for being too large now appears in the host's activity log
#237	#1151	Docker image update detection was missing from the current server, yet every image and container showed "Up to date". The agent now checks each image's tag against its registry (digest only, no pull) every six hours and on request, and flags containers running an image their tag no longer points at. The badge says Up to date only after a check
	#1151	Docker container changes, and the container stopped and started alerts, could reach PatchMon up to a day late. They are now sent within seconds
	#1151	Images in use never showed their digest, size or created date, and some appeared twice or under a hash name. Fixed, along with wrong fields on the image, volume, network and host Docker pages
#412	#1155	Re-running auto-enrolment on a host whose agent had broken, or whose install had failed, created a second host. The enrol scripts now repair the agent with its existing credentials, or re-issue credentials for a host that never reported, and the duplicate check no longer misses hosts after their first report
	#1155	Each agent now keeps its host's PatchMon ID and a config version in `config.yml`. The UI shows the config version beside the agent version, flags a mismatch, and warns when two machines appear to share one host's identity (for example a cloned VM or container)
	#1155	`FORCE_NEW_HOST` now splits a cloned host into its own entry even when its agent still works. On Proxmox it accepts container IDs
#863	#1161	Alpine Linux hosts can be patched: Patch all and Patch selected on Alpine 3.21 and later (apk-tools 2 and 3), with a dry run first. Runs refuse downgrades, replacements and removal of packages listed in `/etc/apk/world`, skip held packages, and list packages apk removes because nothing needs them. Builds on tekook's #863
	#1161	Alpine security updates are flagged from Alpine's security database (secdb), and Patch selected also upgrades packages built from the same source, such as `libcrypto3` with `libssl3`
	#1161	Alpine and Arch hosts showed their OS version as Unknown. Alpine now shows its release, such as 3.21.0, and Arch shows rolling
	#1161	Reboot required now works on Alpine, comparing the running kernel with the installed one. It is never set inside containers
	#1161	The agent reads every apk repositories file, including apk-tools 3's format and `repositories.d`, so Alpine repositories are listed correctly
	#1161	Packages changed by an apk patch run are recorded correctly for apk-tools 3 output, and package names containing dots, such as `lua5.4-libs`, are no longer cut short
	#1158	Signing in twice within the same second, for example straight after first-run setup or from parallel scripts, failed with "Failed to create token". Every sign-in now gets its own token
	#1166	Security: an uploaded SVG logo could run script when its URL was opened. Present in released versions. Logos are now parsed and rebuilt from an allow-list, malformed SVG is rejected, and logos are served with a sandboxing policy, which also covers logos stored before the upgrade
	#1166	Security: a role could be created, edited or assigned with permissions its editor did not hold. Anyone other than a superadmin may now only work with roles whose permissions they all hold
	#1166	Security: the default role for new users and SSO group role mappings could be set to admin or superadmin by a settings manager. They now follow the same rule as assigning a role, and a role must exist to be granted
	#1166	Security: changing the SSO provider, client, redirect URI, unverified email trust, role mapping, enabling SSO, disabling local login or auto-creating users now needs Manage Superusers. Settings managers can still change the button text and scopes
	#1166	Security: SSO accounts are matched on the identity provider as well as the user ID. Moving to a new provider refuses users linked through the old one until an admin unlinks them
	#1166	Security: an OIDC UserInfo response without a subject is refused, and provider responses are capped in size
	#1166	Security: "Disable local auth" only hid the password form. Password sign-in, two-factor sign-in, signup and Discord sign-in are now refused by the server while it is on
	#1166	Security: sign-in no longer reveals which accounts exist through response time or messages. A wrong password on a disabled account says "Invalid credentials". When the server is saturated, every sign-in gets the same "Too many sign-in attempts, try again shortly"
	#1166	Security: two-factor codes are single-use, and one backup code can no longer be used twice at once
	#1166	Security: `X-Forwarded-For` is read only from a trusted proxy, and every header line is read
	#1166	Security: the login lockout counter could lose its expiry and never reset
	#1166	Security: the users list showed each user's two-factor status to anyone who could view users. It is now shown only to user managers
	#1166	Security: an SSH terminal whose browser disappeared kept its shell open on the target host. Idle dead sessions are now closed
	#1166	Admins can reset another user's two-factor authentication, confirming with their own password and code. The user must enrol again before using the app, and the admin can set a temporary password that must be changed first
	#1166	Admins can unlink a user's SSO identity, so a user whose identity provider account was re-created (for example in PocketID) can sign in again
	#1166	"Superadmin password login if SSO is down": while local login is disabled and the identity provider is unreachable, superadmins with two-factor authentication can sign in by password. Every such sign-in raises a notification
	#1166	Changing a user's role needs a role strictly above their current one. Admins can no longer change another admin's role, and only a superadmin can assign admin or use the Admin preset. Custom roles are compared by permissions
	#1166	Custom roles named with spaces or punctuation were stored encoded, such as `Ops%20Team%20(EU)`. New roles are stored correctly, existing ones are renamed on upgrade, and their users are signed out once
	#1166	Leading and trailing spaces in passwords are now ignored everywhere a password is set, as sign-in already did, so such a password can be used. Changing a password to the same value is refused
	#1166	Patch selected is refused on Arch Linux, because a partial upgrade could leave pacman unable to start. Queued Arch selected runs from before the upgrade fail without running
	#1166	SMTP relays offering only AUTH LOGIN, such as Microsoft 365, rejected every email. LOGIN is now used when PLAIN is not offered
	#1166	A patch run whose agent stayed offline could stay queued forever and block the host. It is now retried until the agent returns
	#1166	Clicking a Windows update in a patch run opened an error page. Package names link correctly, and a removed package shows "Package not found"
	#1166	The SSH terminal in direct mode kept wrapping at its starting size when the panel grew
	#1166	Windows hosts: the terminal defaults to the Administrator user and explains that OpenSSH Server must be enabled, and the Linux agent install shortcut is hidden
	#1166	Patch validation can be closed while it runs, survives agent reconnects, no longer reports slow Windows hosts as offline, counts only hosts that validated, and is reused only for the selection it validated
	#1167	The patch wizard's validation and packages-to-patch lists hid packages, including winget apps. Every package is now shown
	#1167	In-browser RDP did not work on the stock Docker install. It works after updating the compose file, sessions end cleanly, tickets are single-use and rate limited, and errors are clearer
	#1167	RDP gains clipboard paste (including Ctrl+V on macOS), a screen that follows the panel size, and a keyboard layout chosen per host that defaults from the browser language
	#1167	The RDP and Terminal tabs are hidden from users without remote access permission
	#1167	RDP session log lines changed: a closing line now records the reason, user, host and duration, and the opening line no longer repeats the `port` field. Check any log filters built on them
	#1168	openSUSE and SLES hosts can be patched through zypper, tested on Leap 15.6, Leap 16.0 and Tumbleweed. Transactional hosts are inventory only
	#1169	On phones, the host page's Integrations card showed only Docker and its "Manage in Integrations tab" link did nothing. Every integration now shows, and the link works
	#1170	Docker is labelled "New" instead of "Beta" in the side menu
	#869	Univention Corporate Server (UCS) support: hosts show as UCS with release, patch level and errata level instead of Debian. Patch all installs all errata for the installed release, never a release upgrade or App Center update. Compliance scanning works on UCS 5.2. Needs agent 2.1.4
	#1171	Windows and FreeBSD hosts no longer show an SELinux status row

What is coming next

Bug fixes are tracked in GitHub milestones. Feature requests live on feedback.patchmon.net, where you can propose an idea, vote on existing ones, and see what has been accepted onto the roadmap.

Questions about this release

This release has its own thread under New Release Discussions. Open a new issue for a reproducible bug not already covered.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/patchmon/patchmon-server](https://github.com/PatchMon/PatchMon) | patch | `2.1.3` → `2.1.6` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the warning logs for more information. --- ### Release Notes <details> <summary>PatchMon/PatchMon (ghcr.io/patchmon/patchmon-server)</summary> ### [`v2.1.6`](https://github.com/PatchMon/PatchMon/releases/tag/v2.1.6): Version 2.1.6 [Compare Source](https://github.com/PatchMon/PatchMon/compare/v2.1.5...v2.1.6) A one-fix release: agents install and check in behind Traefik with the CrowdSec bouncer's AppSec enabled. This fix was listed in the 2.1.5 notes but missed that release. #### Upgrading ```bash docker compose pull docker compose up -d ``` No database or configuration changes. The fix is in the agent: existing hosts receive it through agent auto-update (on at Settings > Agent Updates) at their next restart or daily full report, and new installs get it from the upgraded server. #### Fixes **Agent install failed with a 403 behind Traefik and CrowdSec.** Behind Traefik with the CrowdSec bouncer's AppSec enabled, the installer's connectivity test failed with `ping request failed with status 403` and the agent service was never created. The agent's check-in carried no body length over HTTP/2, which the bouncer blocks by default. The agent now always sends one. Until your agents are updated, setting `crowdsecAppsecUnreadableBodyBlock: false` on the bouncer middleware works around it. #### Every change in this release | Issue | PR | Change | | --------------------------------------------------------- | ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- | | [#1103](https://github.com/PatchMon/PatchMon/issues/1103) | [#1180](https://github.com/PatchMon/PatchMon/pull/1180) | Agent install and check-in no longer fail with a 403 behind Traefik with the CrowdSec bouncer's AppSec over HTTP/2. | *** #### What is coming next Bug fixes are tracked in [GitHub milestones](https://github.com/PatchMon/PatchMon/milestones). Feature requests live on [feedback.patchmon.net](https://feedback.patchmon.net), where you can propose an idea, vote on existing ones, and see what has been accepted onto the roadmap. #### Questions about this release This release has its own thread under [New Release Discussions](https://github.com/PatchMon/PatchMon/discussions/categories/new-release-discussions). Open a new issue for a reproducible bug not already covered. ### [`v2.1.5`](https://github.com/PatchMon/PatchMon/releases/tag/v2.1.5): Version 2.1.5 [Compare Source](https://github.com/PatchMon/PatchMon/compare/v2.1.4...v2.1.5) A bug-fix release: patch validation works again when more than five packages are selected, validation on dnf and yum hosts lists the dependencies it would pull in, and the AI assistant's model lists are updated for providers retiring older models. #### Upgrading ```bash docker compose pull docker compose up -d ``` No database or configuration changes. The Traefik and CrowdSec agent fix shown in the in-app notes for this release ships in [2.1.6](https://github.com/PatchMon/PatchMon/releases/tag/v2.1.6). #### Fixes **Run validation did nothing.** In 2.1.4, choosing Run validation in the patch wizard did nothing when any host had more than five packages selected, with no error shown. Validation now runs for any selection, as it did in 2.1.3, and Skip validation is always available. **Validation on Fedora, RHEL and Rocky hosts showed no dependencies.** On hosts that use dnf or yum, a validation always said "No additional packages", even when the update would install or upgrade other packages alongside the ones you picked. The validation result now lists every package dnf would change, and flags the extra dependencies for review. Validations run before upgrading are not updated; run them again to see the full list. **AI assistant could not connect with a new Google Gemini key.** Google now limits Gemini 2.5 to accounts that already used it, so a new key failed Test Connection on every listed model. The Gemini list now offers 3.5 Flash-Lite (the default), 3.6 Flash and 3.8 Flash. OpenAI's `gpt-4-turbo` and OpenRouter's `google/gemini-2.5-flash` are also retired, as both providers are switching them off this month. If you had a retired model saved, the assistant moves to that provider's default; existing Gemini 2.5 users keep their selection. #### Every change in this release | Issue | PR | Change | | --------------------------------------------------------- | ------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | | [#1175](https://github.com/PatchMon/PatchMon/issues/1175) | [#1179](https://github.com/PatchMon/PatchMon/pull/1179) | Run validation in the patch wizard did nothing when a host had more than five packages selected; it now validates any selection, as in 2.1.3. | | | [#1179](https://github.com/PatchMon/PatchMon/pull/1179) | Validation on dnf and yum hosts now lists every package the update would install or upgrade, including dependencies, instead of none. | | [#1174](https://github.com/PatchMon/PatchMon/issues/1174) | [#1177](https://github.com/PatchMon/PatchMon/pull/1177) | AI assistant model lists updated: Gemini 3.5 Flash-Lite, 3.6 Flash and 3.8 Flash replace Gemini 2.5; retired OpenAI and OpenRouter models removed. | *** #### What is coming next Bug fixes are tracked in [GitHub milestones](https://github.com/PatchMon/PatchMon/milestones). Feature requests live on [feedback.patchmon.net](https://feedback.patchmon.net), where you can propose an idea, vote on existing ones, and see what has been accepted onto the roadmap. #### Questions about this release This release has its own thread under [New Release Discussions](https://github.com/PatchMon/PatchMon/discussions/categories/new-release-discussions). Open a new issue for a reproducible bug not already covered. ### [`v2.1.4`](https://github.com/PatchMon/PatchMon/releases/tag/v2.1.4): Version 2.1.4 [Compare Source](https://github.com/PatchMon/PatchMon/compare/v2.1.3...v2.1.4) Windows, Alpine Linux and openSUSE patching, Univention Corporate Server support, security fixes from an internal audit, working in-browser RDP, and many bug fixes. #### Security These issues were found in an internal security audit. Upgrading fixes them. - **Script injection through an SVG logo**, present in released versions. An uploaded logo could run script when opened. Logos, including existing ones, are now sanitised and served sandboxed. - **Privilege escalation through roles and SSO settings.** Editors could grant more access than they hold. They now cannot, and SSO provider settings need Manage Superusers. - **Sign-in hardening.** Sign-in no longer reveals which accounts exist, two-factor codes are single-use, "Disable local auth" is enforced by the server, and SSO accounts are bound to their identity provider. #### Behaviour changes - **Admins can no longer change another admin's role.** Only a superadmin or a strictly higher role can. Only a superadmin can assign admin or use the Admin preset, and custom roles are compared by their permissions. - **Passwords ignore leading and trailing spaces everywhere**, and changing a password to the same value is refused. - **Custom role names containing spaces are corrected on upgrade**, signing their users out once. - **Patch selected is refused on Arch Linux.** Use Patch all. - **The RDP keyboard layout defaults from the browser language.** #### Upgrading ```bash docker compose pull docker compose up -d ``` Database migrations run on start. Then update your agents to 2.1.4. **If you use in-browser RDP on Docker, update your `docker-compose.yml` before restarting.** `docker compose pull` does not change your compose file, and the old `guacd` service cannot open RDP sessions. The `guacd` service now shares the server's network and listens on loopback only, and the server reaches it at `127.0.0.1:4822`. Either replace your compose file with the new [`docker-compose.yml`](https://github.com/PatchMon/PatchMon/blob/main/docker/docker-compose.yml) (keeping your own changes), or follow the step-by-step edit in [Upgrading to 2.1.4](https://patchmon.net/docs/patchmon-operator-guide#upgrading-to-2-1-4-guacd). Then run `docker compose up -d`. Installs that don't use RDP need no change. #### New **Patching on Windows, Alpine Linux and openSUSE**, each with a dry run first. Alpine support builds on tekook's work in [#863](https://github.com/PatchMon/PatchMon/issues/863). **Univention Corporate Server (UCS)**, contributed by furch-services in [#869](https://github.com/PatchMon/PatchMon/issues/869). UCS hosts show their release and errata level, and Patch all installs every errata for the installed release without upgrading to a new UCS release. **Account recovery for admins.** Reset a user's two-factor authentication, unlink their SSO identity, and allow superadmin password sign-in while the identity provider is down. #### Worth knowing - **Upgrade the server before the agents.** A 2.1.4 agent cannot send Docker data to an older server. - **Windows patch runs queued before the upgrade fail.** Start new ones on the 2.1.4 agent. - **Agents now contact image registries** and, on Alpine, `secdb.alpinelinux.org`. Both can be turned off in `config.yml`. - **Check agent auto-update on hosts added since 2.0.0.** They were created with it off. - **Compliance already enabled? Click Install Scanner once**, and raise your reverse proxy's body size to 40m. - **Threshold alerts no longer repeat.** Set a Reminder interval under Alerts settings if you relied on that. #### Every change in this release | Issue | PR | Change | | -------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | [#1123](https://github.com/PatchMon/PatchMon/issues/1123) | [#1127](https://github.com/PatchMon/PatchMon/pull/1127) | Remediation scripts lost their line breaks during XML text normalisation, collapsing multi-line fixes onto a single line | | [#1091](https://github.com/PatchMon/PatchMon/issues/1091) | [#1127](https://github.com/PatchMon/PatchMon/pull/1127) | Remediation scripts could emit consecutive commands with no separator between them, so the script failed to parse | | [#1074](https://github.com/PatchMon/PatchMon/issues/1074) | [#1127](https://github.com/PatchMon/PatchMon/pull/1127) | Remediation scripts left SCAP profile variables unresolved, producing invalid directives such as an empty `remember=`. Scripts now carry the scanned profile's values, and an unresolved variable is marked visibly rather than left blank | | [#1089](https://github.com/PatchMon/PatchMon/issues/1089) | [#1127](https://github.com/PatchMon/PatchMon/pull/1127) | Profiles discovered on a host failed to resolve when a scan was requested against them | | [#1097](https://github.com/PatchMon/PatchMon/issues/1097) | [#1127](https://github.com/PatchMon/PatchMon/pull/1127) | Ubuntu derivatives with their own `VERSION_ID`, such as Zorin OS, were scanned against content that did not apply to them, with no warning. They now use their base release's content | | [#1093](https://github.com/PatchMon/PatchMon/issues/1093) | [#1127](https://github.com/PatchMon/PatchMon/pull/1127) | Scanner installation failed on Debian because `apt` output was read in the operator's locale. It is now queried in the C locale | | [#788](https://github.com/PatchMon/PatchMon/issues/788) | [#1127](https://github.com/PatchMon/PatchMon/pull/1127) | Cancelling a scan left the dashboard showing it as running. Cancel now marks the scan cancelled immediately, reaches a scan that has not started, uploads nothing, and warns when the agent could not be reached | | [#891](https://github.com/PatchMon/PatchMon/issues/891) | [#1127](https://github.com/PatchMon/PatchMon/pull/1127) | A host with warnings but no failed rules was counted Critical, so the overview figures did not match the findings behind them | | [#841](https://github.com/PatchMon/PatchMon/issues/841) | [#1127](https://github.com/PatchMon/PatchMon/pull/1127) | The agent's startup sync flattened on-demand compliance mode to scheduled, so hosts ran daily scans nobody had asked for | | | [#1127](https://github.com/PatchMon/PatchMon/pull/1127) | A scan or scanner install aimed at an offline agent was lost. Both now retry while the agent reconnects, run as soon as it does with the chosen profile, and report a clear failure if it never arrives | | | [#1127](https://github.com/PatchMon/PatchMon/pull/1127) | Enabling compliance with OpenSCAP on a host queues the scanner install again. Hosts whose package manager cannot install it, meaning Windows, FreeBSD, Alpine and Arch, are skipped rather than queued to fail | | | [#1127](https://github.com/PatchMon/PatchMon/pull/1127) | A second scan or scanner install on a busy host is refused with a clear message instead of colliding with the one already running, and cancelling an install no longer blocks a reinstall | | | [#1127](https://github.com/PatchMon/PatchMon/pull/1127) | Paging through scan results repeated some rules and skipped others | | | [#1127](https://github.com/PatchMon/PatchMon/pull/1127) | A host's status icon, its Passed, Failed and Skipped counts and the Scan Results tab could each describe a different scan. They now agree, and the counts link through to the results already filtered | | | [#1127](https://github.com/PatchMon/PatchMon/pull/1127) | A scan that failed permanently blocked the host's next scans, and install progress from an earlier run could be credited to a newer job | | [#1095](https://github.com/PatchMon/PatchMon/issues/1095) | | Ubuntu 26.04 hosts had no OpenSCAP content to scan against, because the SSG release the image was built from predated it. The content set moves to SSG 0.1.82, which carries `ssg-ubuntu2604-ds.xml` | | [#686](https://github.com/PatchMon/PatchMon/issues/686) | [#1077](https://github.com/PatchMon/PatchMon/pull/1077) | Compliance scan results over 5MB were rejected, so scans completed on the host and never appeared. A dedicated `COMPLIANCE_BODY_LIMIT` now applies, defaulting to 20MB | | [#686](https://github.com/PatchMon/PatchMon/issues/686) | [#1077](https://github.com/PatchMon/PatchMon/pull/1077) | A body limit set on one endpoint could only lower the general API limit, never raise it, so raising `AGENT_UPDATE_BODY_LIMIT` above 5MB silently did nothing | | [#686](https://github.com/PatchMon/PatchMon/issues/686) | [#1077](https://github.com/PatchMon/PatchMon/pull/1077) | An oversized body was reported as `Invalid JSON body` or `Invalid request body`. Both endpoints now return 413 naming the limit and the setting that changes it | | [#686](https://github.com/PatchMon/PatchMon/issues/686) | [#1077](https://github.com/PatchMon/PatchMon/pull/1077) | `AGENT_PING_BODY_LIMIT` can now be changed from the database and the Settings page. It was previously env-only | | [#686](https://github.com/PatchMon/PatchMon/issues/686) | [#1077](https://github.com/PatchMon/PatchMon/pull/1077) | Settings showed the `AGENT_UPDATE_BODY_LIMIT` default as `2mb` when it has been `5mb` since 2.0.2 | | [#686](https://github.com/PatchMon/PatchMon/issues/686) | [#1077](https://github.com/PatchMon/PatchMon/pull/1077) | A body limit large enough to overflow removed the limit entirely instead of raising it. All four limits are now bounded at 32MB, and a larger value is reduced rather than ignored | | [#686](https://github.com/PatchMon/PatchMon/issues/686) | [#1077](https://github.com/PatchMon/PatchMon/pull/1077) | Compliance ingest rejects payloads carrying an implausible number of results, and now sits behind the agent rate limiter like every other agent endpoint | | [#686](https://github.com/PatchMon/PatchMon/issues/686) | [#1077](https://github.com/PatchMon/PatchMon/pull/1077) | The operator guide gave `client_max_body_size` as 16m, 20m and 25m in three places, all below what a real compliance scan needs. It now says 40m throughout | | [#1079](https://github.com/PatchMon/PatchMon/issues/1079) | [#1124](https://github.com/PatchMon/PatchMon/pull/1124) | Periodic check-in failed with `Invalid request body` on hosts with many disk mounts, such as Kubernetes nodes, and the host silently left inventory. The `AGENT_PING_BODY_LIMIT` default rises from 8KB to 64KB | | | [#1124](https://github.com/PatchMon/PatchMon/pull/1124) | A `gb` value set in the environment was ignored for `AGENT_PING_BODY_LIMIT` and fell back to the default, while the same value set in Settings was reduced to the 32MB ceiling. Both now reduce to the ceiling, as the operator guide says | | | [#1124](https://github.com/PatchMon/PatchMon/pull/1124) | Server and agent move to Go 1.26.9 and current `golang.org/x/net`, `x/text` and `x/crypto`, clearing 15 reachable advisories in the server and 11 in the agent | | | [#1124](https://github.com/PatchMon/PatchMon/pull/1124) | The frontend moves to axios 1.20.0, clearing 12 advisories, and to react-router-dom 6.30.6 | | | [#1124](https://github.com/PatchMon/PatchMon/pull/1124) | Removed an unused express static server left over from the two-container architecture, along with the express, express-rate-limit, http-proxy-middleware and cors dependencies it was the only consumer of | | [#1079](https://github.com/PatchMon/PatchMon/issues/1079) | [#1124](https://github.com/PatchMon/PatchMon/pull/1124), [#1126](https://github.com/PatchMon/PatchMon/pull/1126) | An oversized check-in returned a bare `Invalid request body` with nothing identifying the cause, and the server logged nothing. It now returns 413 naming the limit and the setting that changes it, and all three agent endpoints log the rejection | | [#1079](https://github.com/PatchMon/PatchMon/issues/1079) | [#1126](https://github.com/PatchMon/PatchMon/pull/1126) | The agent reported each Kubernetes CSI volume twice, once per mount, so half of its disk reporting was redundant. It now reports one entry per volume | | | [#1075](https://github.com/PatchMon/PatchMon/pull/1075) | Agents on high-latency links failed self-update with `context deadline exceeded` at exactly 30 seconds. The download is now bounded by progress, so a slow but healthy link finishes | | | [#1075](https://github.com/PatchMon/PatchMon/pull/1075) | Agent binaries are served compressed, taking the transfer from roughly 12MB to 5MB. Agents on 2.1.0 and later benefit as soon as the server is upgraded | | | [#1075](https://github.com/PatchMon/PatchMon/pull/1075) | Two agent self-updates could run at once and overwrite the same binary. A second update is now refused while one is running | | | [#1075](https://github.com/PatchMon/PatchMon/pull/1075) | A stalled download now reports how far it got, distinguishing a dead link from a slow one | | [#1071](https://github.com/PatchMon/PatchMon/issues/1071), [#759](https://github.com/PatchMon/PatchMon/issues/759) | [#1075](https://github.com/PatchMon/PatchMon/pull/1075) | Windows Server 2016 and 2019 LTSC reported `osVersion=Unknown`. The agent now falls back to `ReleaseId` and then the build string | | [#1067](https://github.com/PatchMon/PatchMon/issues/1067) | [#1075](https://github.com/PatchMon/PatchMon/pull/1075) | The operator guide documents the manual replacement that recovers Windows agents stranded on 2.0.2, which cannot self-update | | [#1111](https://github.com/PatchMon/PatchMon/issues/1111) | [#1117](https://github.com/PatchMon/PatchMon/pull/1117) | The agent installer failed silently at "Downloading PatchMon agent binary" on hosts without `/usr/local/bin`. It now creates the directory first | | [#1107](https://github.com/PatchMon/PatchMon/issues/1107) | [#1120](https://github.com/PatchMon/PatchMon/pull/1120) | The operator guide's Compose example lacked the database, Redis and guacd healthchecks the server waits on, so the server never started. They now match the shipped `docker-compose.yml` | | | [#1128](https://github.com/PatchMon/PatchMon/pull/1128) | The agent installer could leave a broken binary when the download failed after the old one had been moved aside, because an HTTP error body was written as the executable. The download is now verified before it replaces anything, and the previous binary is restored on failure | | | [#1128](https://github.com/PatchMon/PatchMon/pull/1128) | The agent remove script left FreeBSD hosts with the rc.d service, the `patchmon_agent_enable` line and the pidfile in place. It now removes all of them, and it no longer kills unrelated processes such as `journalctl -u patchmon-agent` whose command line mentions the agent | | | [#1128](https://github.com/PatchMon/PatchMon/pull/1128) | Proxmox LXC auto-enrolment stopped at the first container the server rejected, with no summary. It now continues, prints enrolled, skipped and failed counts, exits non-zero when anything failed, and the dpkg recovery prompt works when the script is piped through `bash` | | | [#1128](https://github.com/PatchMon/PatchMon/pull/1128) | Re-enrolling a host whose machine ID and name are already known created a duplicate host. The server now answers 409 (cloned containers that share a machine ID but carry different names still enrol separately) and both enrolment scripts skip it with a message saying the host must be removed in PatchMon first. Both auto-enrolment endpoints are now rate limited like the other agent endpoints, and `hosts.machine_id` gains an index (migration 000049) | | | [#1128](https://github.com/PatchMon/PatchMon/pull/1128) | Direct-host auto-enrolment broke on host names containing quotes or backslashes and did not always send the machine ID. The payload is now escaped correctly and the machine ID is always sent | | | [#1128](https://github.com/PatchMon/PatchMon/pull/1128) | The Windows installer exchanged the one-time bootstrap token before checking for Administrator, so a non-admin run burned the token. The check now runs first. The install command shown in the UI sets a process-scoped execution policy bypass before running the script, so it works under the default Restricted policy on Windows clients | | | [#1128](https://github.com/PatchMon/PatchMon/pull/1128) | Re-running the Docker installer on an existing install replaced `.env` and regenerated every secret, so the server could no longer reach its own database. An existing `.env` is now kept and only missing keys are added. The installer's prompts now work when piped through `sudo bash`, `--update` restarts only when the pulled image differs from the running one, and Fedora 41 and later (dnf5) can add Docker's repository | | | [#1128](https://github.com/PatchMon/PatchMon/pull/1128) | The 1.4.2 to 2.0.0 migration script only worked from the compose directory, could stop the stack before its downloads had succeeded, overwrote its own backups on a rerun and dropped a custom Compose project name. All four are fixed | | | [#1128](https://github.com/PatchMon/PatchMon/pull/1128) | CI: a manual image build with the push box ticked never pushed, and publishing a release candidate failed the changelog job. Both fixed | | | [#1128](https://github.com/PatchMon/PatchMon/pull/1128) | Removed `tools/diagnostics.sh`. It only recognised the retired native Node install, so on every supported deployment it reported that no PatchMon installation was found | | [#1096](https://github.com/PatchMon/PatchMon/issues/1096) | [#1136](https://github.com/PatchMon/PatchMon/pull/1136) | A second patch run on a host with one already queued or running failed on the package manager lock. It is now refused with a clear message, and 12 simultaneous starts give exactly one run | | [#1096](https://github.com/PatchMon/PatchMon/issues/1096) | [#1136](https://github.com/PatchMon/PatchMon/pull/1136) | Runs waiting for a policy maintenance window have a new Scheduled status and no longer block the host. If the host is busy when the window opens, the run is skipped with the reason recorded | | [#1096](https://github.com/PatchMon/PatchMon/issues/1096) | [#1136](https://github.com/PatchMon/PatchMon/pull/1136) | A queued or validating run that never reached the agent stayed queued forever. It is now timed out 24 hours after it falls due, on upgrade and by the regular cleanup | | | [#1137](https://github.com/PatchMon/PatchMon/pull/1137) | "Run immediately" on a host with a maintenance window reported the window's time as the start time. It now reports the actual start | | [#1083](https://github.com/PatchMon/PatchMon/issues/1083) | [#1136](https://github.com/PatchMon/PatchMon/pull/1136), [#1137](https://github.com/PatchMon/PatchMon/pull/1137) | A delayed "host down" notification was still sent when the host came back within the delay, unless "host recovered" was enabled and routed. It is now cancelled however the recovery is seen, and a new outage after a recovery still alerts | | | [#1137](https://github.com/PatchMon/PatchMon/pull/1137) | A host that stayed down sent "host down" again every two minutes, and a host inside the reconnect grace window could flip between down and recovered. Each outage now sends one notification | | | [#1137](https://github.com/PatchMon/PatchMon/pull/1137) | Saving one alert setting through the API reset the settings left out of the request. Omitted settings now keep their values | | [#757](https://github.com/PatchMon/PatchMon/issues/757), [#1122](https://github.com/PatchMon/PatchMon/issues/1122) | [#1139](https://github.com/PatchMon/PatchMon/pull/1139) | Security and pending updates threshold alerts were sent on every check while a host stayed over the threshold, unless Internal Alerts was routed. Each exceedance now notifies once until the host drops back under | | [#757](https://github.com/PatchMon/PatchMon/issues/757) | [#1139](https://github.com/PatchMon/PatchMon/pull/1139) | Changing a threshold alert's frequency needed a server restart, both types ran at the shorter of the two, and 90 minutes ran hourly. Each type now runs on its own interval, any number of minutes, applied straight away | | [#757](https://github.com/PatchMon/PatchMon/issues/757) | [#1139](https://github.com/PatchMon/PatchMon/pull/1139) | Threshold alerts gain an optional reminder interval in hours (0, the default, means no reminders). Silencing an alert holds its reminders until it is unsilenced | | [#1116](https://github.com/PatchMon/PatchMon/issues/1116), [#1072](https://github.com/PatchMon/PatchMon/issues/1072) | [#1136](https://github.com/PatchMon/PatchMon/pull/1136) | Raspberry Pi hosts always showed "reboot required", because the agent treated the v6, v7, v7l and v8 kernel builds as one and saw the installed v8 build as newer. Fixed in the agent | | [#1084](https://github.com/PatchMon/PatchMon/issues/1084), [#639](https://github.com/PatchMon/PatchMon/issues/639) | [#1070](https://github.com/PatchMon/PatchMon/pull/1070) | Containers, volumes and networks removed from a host stayed listed in PatchMon. They are now removed on the next report, and a failed Docker call never removes anything. Removing a host's last container needs the 2.1.4 agent | | [#1082](https://github.com/PatchMon/PatchMon/issues/1082) | [#1130](https://github.com/PatchMon/PatchMon/pull/1130) | Security updates were never flagged on Fedora 41 and later (dnf5) or on Amazon Linux 2. They are now detected | | [#1081](https://github.com/PatchMon/PatchMon/issues/1081) | [#1092](https://github.com/PatchMon/PatchMon/pull/1092) | Security updates were missed on dnf and yum hosts using a non-English language. dnf and yum output is now read in English | | | [#1131](https://github.com/PatchMon/PatchMon/pull/1131) | A security advisory for one package with a dash and digit in its name, such as `java-17-openjdk`, could mark an unrelated package as a security update. Names are now matched in full | | [#1105](https://github.com/PatchMon/PatchMon/issues/1105) | [#1106](https://github.com/PatchMon/PatchMon/pull/1106) | IPv6-only hosts reported no IP address. They now report their global IPv6 address, the host IP field accepts IPv6, and SSH to an IPv6 host works | | [#1098](https://github.com/PatchMon/PatchMon/issues/1098) | [#1099](https://github.com/PatchMon/PatchMon/pull/1099) | Scheduled reports scoped to host groups included every group's hosts. Every section now respects the scope, and a report whose group is empty or deleted shows no host data | | [#1078](https://github.com/PatchMon/PatchMon/issues/1078) | [#1110](https://github.com/PatchMon/PatchMon/pull/1110) | The patch wizard opened behind the pinned sidebar | | [#1138](https://github.com/PatchMon/PatchMon/issues/1138) | [#1140](https://github.com/PatchMon/PatchMon/pull/1140) | The AI terminal assistant only offered retired Anthropic models, so every request failed with 404. It now offers Claude Sonnet 5.5, Opus 5.5 and Haiku 5.5, and a saved retired model moves to the default automatically. Retired OpenRouter and Gemini models are replaced too | | [#1138](https://github.com/PatchMon/PatchMon/issues/1138) | [#1141](https://github.com/PatchMon/PatchMon/pull/1141) | AI command completion through the API returned explanations and broken spacing. It now returns only the text to append | | [#723](https://github.com/PatchMon/PatchMon/issues/723) | [#1140](https://github.com/PatchMon/PatchMon/pull/1140) | Hosts added since 2.0.0 were created with agent auto-update switched off, so their agents never auto-updated. New hosts now default to on, so the server-wide setting decides | | [#747](https://github.com/PatchMon/PatchMon/issues/747) | [#1140](https://github.com/PatchMon/PatchMon/pull/1140) | The 1.4.2 to 2.0.0 migration script lost secrets written directly in the old compose file, such as the Redis password and JWT secret, so the upgraded stack would not start. They are now carried over, a missing `.env` is created, and secrets are hidden in its output | | [#1073](https://github.com/PatchMon/PatchMon/issues/1073) | [#1140](https://github.com/PatchMon/PatchMon/pull/1140) | The operator guide gains a "Migrating from 1.4.2 to 2.0.0" section | | [#667](https://github.com/PatchMon/PatchMon/issues/667) | [#1140](https://github.com/PatchMon/PatchMon/pull/1140) | The sidebar did not highlight Patching, Compliance, Reporting or Docker sub-items. These pages now keep their tab in the URL and the sidebar follows it | | [#624](https://github.com/PatchMon/PatchMon/issues/624) | [#1140](https://github.com/PatchMon/PatchMon/pull/1140) | The host page lost its selected tab on reload. The tab is now kept in the URL | | [#775](https://github.com/PatchMon/PatchMon/issues/775) | [#1140](https://github.com/PatchMon/PatchMon/pull/1140), [#1144](https://github.com/PatchMon/PatchMon/pull/1144) | An OIDC issuer URL ending in `/.well-known/openid-configuration` failed discovery. It is now accepted, and the operator guide explains how to trust an internal certificate authority without replacing the public certificate bundle | | | [#1144](https://github.com/PatchMon/PatchMon/pull/1144) | With automatic user creation on, every new user's first single sign-on login was rejected with "Unable to sign in with this account", and only the second attempt worked. The first login now succeeds | | [#1145](https://github.com/PatchMon/PatchMon/issues/1145) | [#1150](https://github.com/PatchMon/PatchMon/pull/1150) | Accounts created automatically on first single sign-on login ignored the identity provider's `preferred_username` and took the part of the email before the `@`. They now use `preferred_username`, falling back to the email when the provider does not send one | | [#1149](https://github.com/PatchMon/PatchMon/issues/1149) | [#1152](https://github.com/PatchMon/PatchMon/pull/1152) | Windows: Microsoft framework packages such as VCLibs and Windows App Runtime showed an old version with an update available, because the agent saw a leftover copy rather than the one installed. The agent now reports the installed version | | | [#1156](https://github.com/PatchMon/PatchMon/pull/1156) | Windows: on hosts without the Visual C++ runtime, such as a clean Windows 11 install or Windows Server 2025, the agent reported no apps from winget and no app updates. winget now works on these hosts, so their app updates are reported | | | [#1157](https://github.com/PatchMon/PatchMon/pull/1157) | The Packages list filtered to one host could show "Update Available" for a package that host had already updated, because the status came from all hosts. It now shows that host's own status | | | [#1159](https://github.com/PatchMon/PatchMon/pull/1159) | Windows hosts can be patched: Windows Updates through the Windows Update Agent and apps through winget by Id, from Host Detail, the Packages page and the Patch wizard, with dry runs, per-item results and restart tracking. A failed Windows Update search no longer empties the host's update list | | [#1149](https://github.com/PatchMon/PatchMon/issues/1149) | [#1159](https://github.com/PatchMon/PatchMon/pull/1159) | Windows: Store apps were reported at the version the Store had staged rather than the one users have, and apps no user had installed appeared in the inventory. The agent now reports the installed version and leaves out staged-only copies | | [#774](https://github.com/PatchMon/PatchMon/issues/774) | [#1140](https://github.com/PatchMon/PatchMon/pull/1140) | With logging disabled, the server could exit at startup without printing why. Fatal startup errors now always print | | [#820](https://github.com/PatchMon/PatchMon/issues/820) | [#1140](https://github.com/PatchMon/PatchMon/pull/1140) | The server now logs the Redis address it connects to at startup | | [#839](https://github.com/PatchMon/PatchMon/issues/839), [#713](https://github.com/PatchMon/PatchMon/issues/713) | [#1140](https://github.com/PatchMon/PatchMon/pull/1140) | The docs said the Windows agent used Chocolatey and that patch policies create recurring runs. Neither is true, and both are corrected | | [#668](https://github.com/PatchMon/PatchMon/issues/668) | [#1142](https://github.com/PatchMon/PatchMon/pull/1142) | The Hosts page lost its search, filters and sort on reload. They are now kept in the URL, so reload, back and shared links restore the view | | [#693](https://github.com/PatchMon/PatchMon/issues/693) | [#1142](https://github.com/PatchMon/PatchMon/pull/1142) | Settings set in `.env` could be edited under Settings then Environment, appeared to save, and reverted. They now show "Set in .env", and saving tells you whether a restart is needed | | [#1108](https://github.com/PatchMon/PatchMon/issues/1108) | [#1143](https://github.com/PatchMon/PatchMon/pull/1143) | On Windows, SQL Server showed version "Unknown" and was flagged for an update. Its real version is now reported, and an app whose version is unknown is never flagged | | [#760](https://github.com/PatchMon/PatchMon/issues/760) | [#1143](https://github.com/PatchMon/PatchMon/pull/1143) | On Windows, Visual C++ redistributables and other apps could show the wrong available version, miss a real update, or be flagged when the available version was older. Each app is now matched to the right entry and versions are compared properly | | [#1101](https://github.com/PatchMon/PatchMon/issues/1101), [#727](https://github.com/PatchMon/PatchMon/issues/727) | [#1143](https://github.com/PatchMon/PatchMon/pull/1143) | A RHEL or CentOS host with an `apt` binary installed (EPEL ships one) was treated as Debian-based and reported no packages, failing with "Packages array is required". The agent now chooses the package manager from the operating system | | | [#1146](https://github.com/PatchMon/PatchMon/pull/1146) | The Automation and Environment settings tables were wider than the page, hiding columns such as Status and Action. They now fit, with descriptions behind an (i) icon, and the Environment page has a mobile layout | | | [#1146](https://github.com/PatchMon/PatchMon/pull/1146) | Tooltips, including the host status pills, did not open when tapped on a phone. They now do | | | [#1147](https://github.com/PatchMon/PatchMon/pull/1147) | An invalid body limit saved through the API was stored and silently ignored. It is now rejected with a message explaining the accepted format | | | [#1147](https://github.com/PatchMon/PatchMon/pull/1147) | Body limits were shown rounded down (1500kb as 1mb), so saving the field unchanged in Settings could lower the limit. They now show exactly | | | [#1147](https://github.com/PatchMon/PatchMon/pull/1147) | A check-in rejected for being too large now appears in the host's activity log | | [#237](https://github.com/PatchMon/PatchMon/issues/237) | [#1151](https://github.com/PatchMon/PatchMon/pull/1151) | Docker image update detection was missing from the current server, yet every image and container showed "Up to date". The agent now checks each image's tag against its registry (digest only, no pull) every six hours and on request, and flags containers running an image their tag no longer points at. The badge says Up to date only after a check | | | [#1151](https://github.com/PatchMon/PatchMon/pull/1151) | Docker container changes, and the container stopped and started alerts, could reach PatchMon up to a day late. They are now sent within seconds | | | [#1151](https://github.com/PatchMon/PatchMon/pull/1151) | Images in use never showed their digest, size or created date, and some appeared twice or under a hash name. Fixed, along with wrong fields on the image, volume, network and host Docker pages | | [#412](https://github.com/PatchMon/PatchMon/issues/412) | [#1155](https://github.com/PatchMon/PatchMon/pull/1155) | Re-running auto-enrolment on a host whose agent had broken, or whose install had failed, created a second host. The enrol scripts now repair the agent with its existing credentials, or re-issue credentials for a host that never reported, and the duplicate check no longer misses hosts after their first report | | | [#1155](https://github.com/PatchMon/PatchMon/pull/1155) | Each agent now keeps its host's PatchMon ID and a config version in `config.yml`. The UI shows the config version beside the agent version, flags a mismatch, and warns when two machines appear to share one host's identity (for example a cloned VM or container) | | | [#1155](https://github.com/PatchMon/PatchMon/pull/1155) | `FORCE_NEW_HOST` now splits a cloned host into its own entry even when its agent still works. On Proxmox it accepts container IDs | | [#863](https://github.com/PatchMon/PatchMon/pull/863) | [#1161](https://github.com/PatchMon/PatchMon/pull/1161) | Alpine Linux hosts can be patched: Patch all and Patch selected on Alpine 3.21 and later (apk-tools 2 and 3), with a dry run first. Runs refuse downgrades, replacements and removal of packages listed in `/etc/apk/world`, skip held packages, and list packages apk removes because nothing needs them. Builds on tekook's [#863](https://github.com/PatchMon/PatchMon/issues/863) | | | [#1161](https://github.com/PatchMon/PatchMon/pull/1161) | Alpine security updates are flagged from Alpine's security database (secdb), and Patch selected also upgrades packages built from the same source, such as `libcrypto3` with `libssl3` | | | [#1161](https://github.com/PatchMon/PatchMon/pull/1161) | Alpine and Arch hosts showed their OS version as Unknown. Alpine now shows its release, such as 3.21.0, and Arch shows rolling | | | [#1161](https://github.com/PatchMon/PatchMon/pull/1161) | Reboot required now works on Alpine, comparing the running kernel with the installed one. It is never set inside containers | | | [#1161](https://github.com/PatchMon/PatchMon/pull/1161) | The agent reads every apk repositories file, including apk-tools 3's format and `repositories.d`, so Alpine repositories are listed correctly | | | [#1161](https://github.com/PatchMon/PatchMon/pull/1161) | Packages changed by an apk patch run are recorded correctly for apk-tools 3 output, and package names containing dots, such as `lua5.4-libs`, are no longer cut short | | | [#1158](https://github.com/PatchMon/PatchMon/pull/1158) | Signing in twice within the same second, for example straight after first-run setup or from parallel scripts, failed with "Failed to create token". Every sign-in now gets its own token | | | [#1166](https://github.com/PatchMon/PatchMon/pull/1166) | Security: an uploaded SVG logo could run script when its URL was opened. Present in released versions. Logos are now parsed and rebuilt from an allow-list, malformed SVG is rejected, and logos are served with a sandboxing policy, which also covers logos stored before the upgrade | | | [#1166](https://github.com/PatchMon/PatchMon/pull/1166) | Security: a role could be created, edited or assigned with permissions its editor did not hold. Anyone other than a superadmin may now only work with roles whose permissions they all hold | | | [#1166](https://github.com/PatchMon/PatchMon/pull/1166) | Security: the default role for new users and SSO group role mappings could be set to admin or superadmin by a settings manager. They now follow the same rule as assigning a role, and a role must exist to be granted | | | [#1166](https://github.com/PatchMon/PatchMon/pull/1166) | Security: changing the SSO provider, client, redirect URI, unverified email trust, role mapping, enabling SSO, disabling local login or auto-creating users now needs Manage Superusers. Settings managers can still change the button text and scopes | | | [#1166](https://github.com/PatchMon/PatchMon/pull/1166) | Security: SSO accounts are matched on the identity provider as well as the user ID. Moving to a new provider refuses users linked through the old one until an admin unlinks them | | | [#1166](https://github.com/PatchMon/PatchMon/pull/1166) | Security: an OIDC UserInfo response without a subject is refused, and provider responses are capped in size | | | [#1166](https://github.com/PatchMon/PatchMon/pull/1166) | Security: "Disable local auth" only hid the password form. Password sign-in, two-factor sign-in, signup and Discord sign-in are now refused by the server while it is on | | | [#1166](https://github.com/PatchMon/PatchMon/pull/1166) | Security: sign-in no longer reveals which accounts exist through response time or messages. A wrong password on a disabled account says "Invalid credentials". When the server is saturated, every sign-in gets the same "Too many sign-in attempts, try again shortly" | | | [#1166](https://github.com/PatchMon/PatchMon/pull/1166) | Security: two-factor codes are single-use, and one backup code can no longer be used twice at once | | | [#1166](https://github.com/PatchMon/PatchMon/pull/1166) | Security: `X-Forwarded-For` is read only from a trusted proxy, and every header line is read | | | [#1166](https://github.com/PatchMon/PatchMon/pull/1166) | Security: the login lockout counter could lose its expiry and never reset | | | [#1166](https://github.com/PatchMon/PatchMon/pull/1166) | Security: the users list showed each user's two-factor status to anyone who could view users. It is now shown only to user managers | | | [#1166](https://github.com/PatchMon/PatchMon/pull/1166) | Security: an SSH terminal whose browser disappeared kept its shell open on the target host. Idle dead sessions are now closed | | | [#1166](https://github.com/PatchMon/PatchMon/pull/1166) | Admins can reset another user's two-factor authentication, confirming with their own password and code. The user must enrol again before using the app, and the admin can set a temporary password that must be changed first | | | [#1166](https://github.com/PatchMon/PatchMon/pull/1166) | Admins can unlink a user's SSO identity, so a user whose identity provider account was re-created (for example in PocketID) can sign in again | | | [#1166](https://github.com/PatchMon/PatchMon/pull/1166) | "Superadmin password login if SSO is down": while local login is disabled and the identity provider is unreachable, superadmins with two-factor authentication can sign in by password. Every such sign-in raises a notification | | | [#1166](https://github.com/PatchMon/PatchMon/pull/1166) | Changing a user's role needs a role strictly above their current one. Admins can no longer change another admin's role, and only a superadmin can assign admin or use the Admin preset. Custom roles are compared by permissions | | | [#1166](https://github.com/PatchMon/PatchMon/pull/1166) | Custom roles named with spaces or punctuation were stored encoded, such as `Ops%20Team%20(EU)`. New roles are stored correctly, existing ones are renamed on upgrade, and their users are signed out once | | | [#1166](https://github.com/PatchMon/PatchMon/pull/1166) | Leading and trailing spaces in passwords are now ignored everywhere a password is set, as sign-in already did, so such a password can be used. Changing a password to the same value is refused | | | [#1166](https://github.com/PatchMon/PatchMon/pull/1166) | Patch selected is refused on Arch Linux, because a partial upgrade could leave pacman unable to start. Queued Arch selected runs from before the upgrade fail without running | | | [#1166](https://github.com/PatchMon/PatchMon/pull/1166) | SMTP relays offering only AUTH LOGIN, such as Microsoft 365, rejected every email. LOGIN is now used when PLAIN is not offered | | | [#1166](https://github.com/PatchMon/PatchMon/pull/1166) | A patch run whose agent stayed offline could stay queued forever and block the host. It is now retried until the agent returns | | | [#1166](https://github.com/PatchMon/PatchMon/pull/1166) | Clicking a Windows update in a patch run opened an error page. Package names link correctly, and a removed package shows "Package not found" | | | [#1166](https://github.com/PatchMon/PatchMon/pull/1166) | The SSH terminal in direct mode kept wrapping at its starting size when the panel grew | | | [#1166](https://github.com/PatchMon/PatchMon/pull/1166) | Windows hosts: the terminal defaults to the Administrator user and explains that OpenSSH Server must be enabled, and the Linux agent install shortcut is hidden | | | [#1166](https://github.com/PatchMon/PatchMon/pull/1166) | Patch validation can be closed while it runs, survives agent reconnects, no longer reports slow Windows hosts as offline, counts only hosts that validated, and is reused only for the selection it validated | | | [#1167](https://github.com/PatchMon/PatchMon/pull/1167) | The patch wizard's validation and packages-to-patch lists hid packages, including winget apps. Every package is now shown | | | [#1167](https://github.com/PatchMon/PatchMon/pull/1167) | In-browser RDP did not work on the stock Docker install. It works after updating the compose file, sessions end cleanly, tickets are single-use and rate limited, and errors are clearer | | | [#1167](https://github.com/PatchMon/PatchMon/pull/1167) | RDP gains clipboard paste (including Ctrl+V on macOS), a screen that follows the panel size, and a keyboard layout chosen per host that defaults from the browser language | | | [#1167](https://github.com/PatchMon/PatchMon/pull/1167) | The RDP and Terminal tabs are hidden from users without remote access permission | | | [#1167](https://github.com/PatchMon/PatchMon/pull/1167) | RDP session log lines changed: a closing line now records the reason, user, host and duration, and the opening line no longer repeats the `port` field. Check any log filters built on them | | | [#1168](https://github.com/PatchMon/PatchMon/pull/1168) | openSUSE and SLES hosts can be patched through zypper, tested on Leap 15.6, Leap 16.0 and Tumbleweed. Transactional hosts are inventory only | | | [#1169](https://github.com/PatchMon/PatchMon/pull/1169) | On phones, the host page's Integrations card showed only Docker and its "Manage in Integrations tab" link did nothing. Every integration now shows, and the link works | | | [#1170](https://github.com/PatchMon/PatchMon/pull/1170) | Docker is labelled "New" instead of "Beta" in the side menu | | | [#869](https://github.com/PatchMon/PatchMon/pull/869) | Univention Corporate Server (UCS) support: hosts show as UCS with release, patch level and errata level instead of Debian. Patch all installs all errata for the installed release, never a release upgrade or App Center update. Compliance scanning works on UCS 5.2. Needs agent 2.1.4 | | | [#1171](https://github.com/PatchMon/PatchMon/pull/1171) | Windows and FreeBSD hosts no longer show an SELinux status row | *** #### What is coming next Bug fixes are tracked in [GitHub milestones](https://github.com/PatchMon/PatchMon/milestones). Feature requests live on [feedback.patchmon.net](https://feedback.patchmon.net), where you can propose an idea, vote on existing ones, and see what has been accepted onto the roadmap. #### Questions about this release This release has its own thread under [New Release Discussions](https://github.com/PatchMon/PatchMon/discussions/categories/new-release-discussions). Open a new issue for a reproducible bug not already covered. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit

2026-10-18 04:01:28 +00:00

Update ghcr.io/patchmon/patchmon-server Docker tag to v2.1.6 cf6b20fd8b

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/ghcr.io-patchmon-patchmon-server-2.x:renovate/ghcr.io-patchmon-patchmon-server-2.x

git switch renovate/ghcr.io-patchmon-patchmon-server-2.x

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff renovate/ghcr.io-patchmon-patchmon-server-2.x

git switch renovate/ghcr.io-patchmon-patchmon-server-2.x

git rebase main

git switch main

git merge --ff-only renovate/ghcr.io-patchmon-patchmon-server-2.x

git switch renovate/ghcr.io-patchmon-patchmon-server-2.x

git rebase main

git switch main

git merge --no-ff renovate/ghcr.io-patchmon-patchmon-server-2.x

git switch main

git merge --squash renovate/ghcr.io-patchmon-patchmon-server-2.x

git switch main

git merge --ff-only renovate/ghcr.io-patchmon-patchmon-server-2.x

git switch main

git merge renovate/ghcr.io-patchmon-patchmon-server-2.x

git push origin main

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

luke/homelab!26

No description provided.

Rows
Columns

Update ghcr.io/patchmon/patchmon-server Docker tag to v2.1.6 #26

Release Notes

v2.1.6: Version 2.1.6

Upgrading

Fixes

Every change in this release

What is coming next

Questions about this release

v2.1.5: Version 2.1.5

Upgrading

Fixes

Every change in this release

What is coming next

Questions about this release

v2.1.4: Version 2.1.4

Security

Behaviour changes

Upgrading

New

Worth knowing

Every change in this release

What is coming next

Questions about this release

Configuration

Checkout

Merge

`v2.1.6`: Version 2.1.6

`v2.1.5`: Version 2.1.5

`v2.1.4`: Version 2.1.4