v1.16.4 (Hotfix)

Bug fixes

• pin and enforce trivy scanner digest(7975270 by @kmendell )

Full Changelog: v1.16.3...v1.16.4

v1.16.3

Bug fixes

• docker container creation on api 1.44 attach primary network then remaining networks (#2053 by @kmendell)
• add configurable security options for trivy scans (#2072 by @kmendell)
• allow configuring whether to prune trivy cache or not (#2075 by @kmendell)
• use configured DOCKER_HOST for trivy containers (#2076 by @kmendell)
• add missing arcane labels for auto updater (#2079 by @kmendell)
• unable to edit env when synced from git (#2069 by @kmendell)
• image update inspection fallback to manual vs using mobys distribution inspect (#2080 by @kmendell)

Dependencies

• bump charm.land/lipgloss/v2 from 2.0.0 to 2.0.2 in /cli (#2056 by @dependabot[bot])
• bump github.com/nicholas-fedor/shoutrrr from 0.13.2 to 0.14.0 in /backend (#2057 by @dependabot[bot])
• bump golang.org/x/text from 0.34.0 to 0.35.0 in /backend (#2058 by @dependabot[bot])
• bump golang.org/x/mod from 0.33.0 to 0.34.0 in /backend (#2063 by @dependabot[bot])
• bump charm.land/bubbletea/v2 from 2.0.1 to 2.0.2 in /cli (#2059 by @dependabot[bot])
• bump golang.org/x/crypto from 0.48.0 to 0.49.0 in /backend (#2061 by @dependabot[bot])
• bump golang.org/x/net from 0.51.0 to 0.52.0 in /backend (#2060 by @dependabot[bot])
• bump github.com/getarcaneapp/arcane/types from 1.16.0 to 1.16.2 in /cli (#2054 by @dependabot[bot])
• bump marocchino/sticky-pull-request-comment from 2 to 3 (#2055 by @dependabot[bot])
• upgrade frontend deps(d83fb41 by @kmendell)
• bump pnpm to v10.32.1(3b71e1b by @kmendell)
• bump @react-email/components from 1.0.8 to 1.0.9 (#2064 by @dependabot[bot])

Full Changelog: v1.16.2...v1.16.3

v1.16.2

Bug fixes

• forward and validate origin header in websocket tunnel (#2003 by @kmendell)
• containers on user created networks not restarted when updated (#2006 by @kmendell)
• avoid restoring offline environment on app init (#2011 by @timwedde)
• incorrect volume mount in agent snippets (#2027 by @kmendell)
• strip TE: trailers header to prevent false grpc requests (#2026 by @kmendell)
• allow yaml merge syntax (#2033 by @kmendell)
• dialogs in light mode showing too dark(8a29abc by @kmendell)
• build workspace panels using incorrect colors(e46f445 by @kmendell)
• analytics job managed interally without a fixed cron schedule (#2028 by @kmendell)
• volume size usage not showing on docker api >1.52 (#2037 by @kmendell)
• containers fail to start due to cgroup oci error (#2039 by @kmendell)
• unable to create users with rfc compliant emails (#2038 by @kmendell)
• incorrect ipv6 parsing on api responses (#2040 by @kmendell)
• only allow deleting admins if more than one exists (#2041 by @kmendell)
• use docker daemon backed trust store for registry operations (#2042 by @kmendell)
• send all notifications from the manager, add environment info to notifications (#2046 by @kmendell)
• containers grouped by projects split between pages (#2049 by @kmendell)
• memory_unit json unmarshaling format error (#2051 by @kmendell)

Documentation

• Update SECURITY.md to include AI submission guidelines (#2023 by @ben-kuhn)

Dependencies

• bump github.com/mattn/go-runewidth from 0.0.20 to 0.0.21 in /cli (#1997 by @dependabot[bot])
• bump golang.org/x/sync from 0.19.0 to 0.20.0 in /backend (#2013 by @dependabot[bot])
• bump golang.org/x/oauth2 from 0.35.0 to 0.36.0 in /backend (#2012 by @dependabot[bot])
• bump github.com/moby/buildkit from 0.27.1 to 0.28.0 in /backend (#2014 by @dependabot[bot])
• bump svelte from 5.53.7 to 5.53.8 (#2019 by @dependabot[bot])
• bump @uiw/codemirror-themes from 4.25.7 to 4.25.8 (#2017 by @dependabot[bot])
• bump devalue to 5.6.4(2d97071 by @kmendell)

Other

• add 'poll' edge agent type and more reliable edge agent data (#2008 by @kmendell)
• add pr quality action(d3de73a by @kmendell)
• add depot ci shadow workflows(52b6e94 by @kmendell)
• depot ci update just install(6562ba5 by @kmendell)
• update depot ci workflows(3ad8ae3 by @kmendell)
• remove depot shadow workflows(a5ef6e8 by @kmendell)

Full Changelog: v1.16.1...v1.16.2

v1.16.1

Bug fixes

• explicitly set docker api version based on daemon api version (#1964 by @kmendell)
• dockerfile_inline builds not working from projects (#1965 by @kmendell)
• allow rolling back migrations via ALLOW_DOWNGRADE env (#1966 by @kmendell)
• allow remote git build contexts (#1968 by @kmendell)
• env variables not resolving in volumes and labels (#1970 by @nargotik)
• last used date not being updated for environment api keys(b1f3287 by @kmendell)

Dependencies

• bump github.com/go-git/go-git/v5 from 5.16.5 to 5.17.0 in /backend (#1917 by @dependabot[bot])
• update frontend dependencies(a261df8 by @kmendell)
• bump docker/login-action from 3 to 4 (#1972 by @dependabot[bot])
• bump docker/metadata-action from 5 to 6 (#1973 by @dependabot[bot])
• bump github.com/shirou/gopsutil/v4 from 4.26.1 to 4.26.2 in /backend (#1976 by @dependabot[bot])
• bump github.com/gin-gonic/gin from 1.11.0 to 1.12.0 in /backend (#1977 by @dependabot[bot])
• bump google.golang.org/grpc from 1.79.1 to 1.79.2 in /backend (#1974 by @dependabot[bot])
• bump charm.land/bubbletea/v2 from 2.0.0 to 2.0.1 in /cli (#1998 by @dependabot[bot])

Full Changelog: v1.16.0...v1.16.1

v1.16.0

New features

• add grpc support to edge agent tunnel (#1730 by @kmendell)
• add auto-heal job to restart unhealthy containers (#1780 by @garrett-edwards)
• editor enhancements, switch back to code mirror editor (#1861 by @kmendell)
• updated dashboard layout with action items (#1761 by @kmendell)
• support direct https setup via environment variables (#1877 by @kmendell)
• selectable trivy container network (#1896 by @kmendell)
• image build support (#1687 by @kmendell)
• show template icons based on x-arcane labels (#1933 by @kmendell)
• oled dark theme (#1937 by @kmendell)
• configurable compose up button (#1940 by @kmendell)
• persistent volume backup mount (#1942 by @kmendell)
• add jwt refresh interval variable (#1952 by @kmendell)

CLI - New features

• implement missing cli commands (projects, jobs, containers, gitops) (#1946 by @james-crowley)

Bug fixes

• image pulls failing for certain public images (#1855 by @kmendell)
• unable to update existing users usernames(5ab4294 by @kmendell)
• project folder not renamed when project name is updated (#1858 by @kmendell)
• update compose schema detection to remove false positive secret detections (#1876 by @kmendell)
• downloading files from volumes causes panic (#1907 by @kmendell)
• vulnerability image filter only shows images on current page (#1908 by @kmendell)
• edge agent status being incorrectly reported (#1929 by @kmendell)
• disable cors on edge agent requests (#1930 by @kmendell)
• Automatically Place API Key In New Env Run Command (#1932 by @jasonlaguidice)
• project logs not streaming (#1909 by @kmendell)
• tighten sidebar padding/margin values(44a56cf by @kmendell)
• handle frontend errors better to reduce 500 error codes (#1936 by @kmendell)
• unable to save project due to name normalization(3e31a19 by @kmendell)
• unable to save project due to env miss-validation(35e4366 by @kmendell)
• panic on image detail view(b455919 by @kmendell)
• build workspace file upload mime type(4acc604 by @kmendell)
• incorrect containers showing on auto updater exlcude settings(5078e31 by @kmendell)
• inconsistient behavior with pull and redeploy button via project table (#1953 by @kmendell)
• add missing title to ntfy provider (#1955 by @kmendell)

Dependencies

• bump @sveltejs/kit from 2.49.5 to 2.53.0 (#1841 by @dependabot[bot])
• bump prettier-plugin-svelte from 3.4.1 to 3.5.0 (#1840 by @dependabot[bot])
• bump github.com/getarcaneapp/arcane/types from 1.15.2 to 1.15.3 in /cli (#1834 by @dependabot[bot])
• bump github.com/getarcaneapp/arcane/types from 1.15.2 to 1.15.3 in /backend (#1839 by @dependabot[bot])
• bump github.com/danielgtaylor/huma/v2 from 2.37.0 to 2.37.2 in /backend (#1837 by @dependabot[bot])
• bump goreleaser/goreleaser-action from 6 to 7 (#1867 by @dependabot[bot])
• bump google.golang.org/grpc from 1.78.0 to 1.79.1 in /backend (#1868 by @dependabot[bot])
• bump svelte from 5.51.5 to 5.53.3 (#1870 by @dependabot[bot])
• bump @react-email/components from 1.0.6 to 1.0.8 (#1873 by @dependabot[bot])
• bump github.com/sigstore/sigstore from 1.10.0 to 1.10.4 in /backend in the go_modules group across 1 directory (#1882 by @dependabot[bot])
• bump dependencies(59499ae by @kmendell)
• bump pnpm to v10.30.2(495e519 by @kmendell)
• bump actions/github-script from 7 to 8 (#1883 by @dependabot[bot])
• bump @uiw/codemirror-themes from 4.25.4 to 4.25.5 (#1919 by @dependabot[bot])
• bump svelte from 5.53.3 to 5.53.6 (#1922 by @dependabot[bot])
• bump the go_modules group across 2 directories with 2 updates (#1911 by @dependabot[bot])
• bump golang.org/x/net from 0.50.0 to 0.51.0 in /backend (#1916 by @dependabot[bot])
• bump actions/upload-artifact from 6 to 7 (#1915 by @dependabot[bot])
• bump actions/attest-build-provenance from 3 to 4 (#1914 by @dependabot[bot])

Other

• release next versions of the cli on homebrew(c752dce by @kmendell)
• revert next cli builds(b89fe2a by @kmendell)
• cli config rework and pagination tweaks (#1854 by @kmendell)
• add armv7 platform to docker builds (#1865 by @dampflok2000)
• migrate to moby dependencies (#1878 by @kmendell)
• update cli layouts for help commands (#1910 by @kmendell)

Full Changelog: v1.15.3...v1.16.0

v1.15.3

Bug fixes

• use cpuset instead of cpusnano on synology devices (#1782 by @kmendell)
• clear image update records by image ID not just repo/tag (#1809 by @kmendell)
• clear update records by image ID and fail closed on used-image discovery errors (#1810 by @kmendell)
• bound environment health sync concurrency and prevent overlapping runs (#1813 by @kmendell)
• track active updates in status maps and bound error-event logging path (#1817 by @kmendell)
• dont force pull images on project start and respect pull policy (#1820 by @kmendell)
• registry syncing to environments not running on initially pairing (#1822 by @kmendell)
• limit container create options based on docker api (#1823 by @kmendell)

Performance improvements

• improve performance of image update, prune, and vuln actions (#1808 by @kmendell)
• remove N+1 project service calls in used-image collection (#1811 by @kmendell)
• reduce restart planning API calls by deferring container inspect (#1812 by @kmendell)
• fetch vulnerability summaries only for paginated image results (#1814 by @kmendell)
• replace nested usage enrichment loop with map lookup (#1815 by @kmendell)
• prefilter list-all scans and inline ignored vuln filtering (#1816 by @kmendell)

Dependencies

• bump github.com/getarcaneapp/arcane/types from 0.0.0-20260209233421-0952125a149f to 1.15.2 in /backend (#1800 by @dependabot[bot])
• bump github.com/getarcaneapp/arcane/types from 1.15.0 to 1.15.2 in /cli (#1796 by @dependabot[bot])
• bump golang.org/x/net from 0.49.0 to 0.50.0 in /backend (#1797 by @dependabot[bot])
• bump github.com/lmittmann/tint from 1.1.2 to 1.1.3 in /backend (#1801 by @dependabot[bot])
• bump github.com/mattn/go-runewidth from 0.0.19 to 0.0.20 in /cli (#1798 by @dependabot[bot])
• bump github.com/danielgtaylor/huma/v2 from 2.35.0 to 2.36.0 in /backend (#1799 by @dependabot[bot])
• bump svelte from 5.51.0 to 5.51.5 in the npm_and_yarn group across 1 directory (#1805 by @dependabot[bot])

Full Changelog: v1.15.2...v1.15.3

v1.15.2

Bug fixes

• git test connection not using default branch (#1766 by @kmendell)
• missing settings making env settings not able to be saved (#1775 by @kmendell)
• change notification logs to TEXT instead of VARCHAR(255) (#1779 by @kmendell)
• allow trivy container limits to be configured (#1778 by @kmendell)
• convert cron expressions from utc into TZ var timezone (#1781 by @kmendell)
• image size mismatch on details page (#1790 by @kmendell)
• use non-http context for jobs (#1770 by @kmendell)
• silently refresh token on version mismatch instead of forcing logout (#1791 by @kmendell)
• image counts are incorrectly calculated (#1760 by @kmendell)

Dependencies

• bump pnpm to v10.30(e24173a by @kmendell)
• require ajv 8.18.0 or higher(27b3cdb by @kmendell)

Other

• add logging for docker api versions(83c15a1 by @kmendell)
• update pointer calls to use new() (#1722 by @kmendell)
• modernize backend code (#1793 by @kmendell)
• modernize cli and types code(bb2ae34 by @kmendell)

Full Changelog: v1.15.1...v1.15.2

v1.15.1

Bug fixes

• unable to upload files to volume browser(a13dd4b by @kmendell)
• environment settings not saving(87d6af2 by @kmendell)
• add podman-compose file support (#1728 by @bastiengrignon)
• add language and theme selector to appearance settings(9697323 by @kmendell)
• add option for trivy scan timeout (#1749 by @kmendell)
• use temp file for trivy output (#1751 by @kmendell)
• incorrect markdown format for telegram(d56c2b7 by @kmendell)
• hide internal volumes for backups and volume browser (#1755 by @kmendell)
• git sync counts only showing paginated values(be8b99b by @kmendell)

Dependencies

• bump github.com/getarcaneapp/arcane/types from 0.0.0-20260110011808-8759100aa57c to 1.15.0 in /cli (#1740 by @dependabot[bot])
• bump svelte from 5.50.0 to 5.51.0 (#1745 by @dependabot[bot])
• bump golang.org/x/oauth2 from 0.34.0 to 0.35.0 in /backend (#1734 by @dependabot[bot])
• bump golang.org/x/text from 0.33.0 to 0.34.0 in /backend (#1738 by @dependabot[bot])
• bump golang.org/x/crypto from 0.47.0 to 0.48.0 in /backend (#1735 by @dependabot[bot])
• bump golang.org/x/mod from 0.32.0 to 0.33.0 in /backend (#1736 by @dependabot[bot])
• bump github.com/samber/slog-gin from 1.20.1 to 1.21.0 in /backend (#1733 by @dependabot[bot])
• bump github.com/charmbracelet/bubbletea from 1.3.4 to 1.3.10 in /cli (#1737 by @dependabot[bot])
• bump github.com/charmbracelet/bubbles from 0.21.0 to 1.0.0 in /cli (#1741 by @dependabot[bot])

Other

• remove bytes package for manual util (#1752 by @kmendell)

Full Changelog: v1.15.0...v1.15.1

v1.15.0

New features

• sync .env files from git repositories (#1632 by @Icehunter)
• updated table UX, additional 'all' rows option (#1547 by @cabaucom376)
• container image vulnerability scanning (#1657 by @kmendell)
• implement container exclusion and prune notifications(#1635 by @spupuz)
• allow configurable LISTEN address (#1685 by @kmendell)
• add support for Matrix notifications (#1679 by @singularity0821)
• inline container exclusion list (#1693 by @spupuz)
• auto-login for specific use-cases (via buildables) (#1556 by @Nightbr)
• show projects and containers used by images column (#1715 by @kmendell)
• move port mappings to networks tab for container details (#1723 by @kmendell)

CLI - New features

• switch username and password login to OIDC device code (#1682 by @kmendell)
• allow resource actions by name instead of just id (#1683 by @kmendell)
• consolidate cli commands (#1688 by @kmendell)

Bug fixes

• ssh git repos commit hash links incorrect (#1643 by @kmendell)
• x-arcane metadata not allowing variable interpolation (#1654 by @kmendell)
• inject agent token headers in edge tunnel proxy path (#1680 by @dathtd119)
• abnormal cpu load climbing over time (#1652 by @kmendell)
• adjust database connection pool settings (#1690 by @user00265)
• scan all vulnerabilities causing lag/freezing (#1694 by @kmendell)
• only send prune summary when resources are pruned (#1703 by @kmendell)
• incorrect events api being used in frontend(e727a83 by @kmendell)
• OIDC_ENABLED=false not disabling frontend switch (#1719 by @kmendell)
• table sorting not persisting across reloads (#1721 by @kmendell)
• mobile project layout cramped(c03ed96 by @kmendell)

Dependencies

• bump svelte from 5.46.4 to 5.50.0 (#1673 by @dependabot[bot])
• bump github.com/shirou/gopsutil/v4 from 4.25.12 to 4.26.1 in /backend (#1672 by @dependabot[bot])
• bump go.podman.io/image/v5 from 5.38.0 to 5.39.1 in /backend (#1668 by @dependabot[bot])
• bump shiki from 3.21.0 to 3.22.0 (#1676 by @dependabot[bot])
• bump github.com/samber/slog-gin from 1.19.1 to 1.20.1 in /backend (#1670 by @dependabot[bot])
• bump github.com/nicholas-fedor/shoutrrr from 0.13.1 to 0.13.2 in /backend (#1669 by @dependabot[bot])
• bump pnpm to 10.29.1(ba6eca5 by @kmendell)
• bump github.com/go-git/go-git/v5 from 5.16.4 to 5.16.5 in /backend in the go_modules group across 1 directory (#1701 by @dependabot[bot])
• bump axios from 1.13.4 to 1.13.5 in the npm_and_yarn group across 1 directory (#1702 by @dependabot[bot])
• update go to v1.26.0(c7d6ff3 by @kmendell)
• update dockerfiles go version to v1.26.0(d96810e by @kmendell)
• bump pnpm to 10.29.3(8201c31 by @kmendell)

Other

• move all repo scripts to just over pnpm (#1630 by @kmendell)
• send vulnerability summary instead of individual(0355dc0 by @kmendell)
• consolidate notification provider forms (#1704 by @kmendell)
• move frontend api calls to use tanstack query (#1710 by @kmendell)

Full Changelog: v1.14.1...v1.15.0

v1.14.1

Bug fixes

• incorrect backgrounds on lightmode ui elements(635e5d0 by @kmendell)
• align view options dropdown to right side(adac953 by @kmendell)
• duplicated project/container logs when refreshing log viewer (#1620 by @kmendell)
• unable to save oidc auto redirect setting(889fb65 by @kmendell)
• allow enabling and disabling keyboard shortcuts (#1623 by @kmendell)
• keyboard shortcuts dont work for non qwerty layouts (#1624 by @kmendell)
• sync timeout settings to all environments (#1628 by @kmendell)

Dependencies

• bump react-dom from 19.2.3 to 19.2.4 (#1605 by @dependabot[bot])

Other

• shortcuts into tooltips (#1621 by @cabaucom376)

Full Changelog: v1.14.0...v1.14.1