App updates 2026-09-07T19-46-33Z

[ClaydeCode]

Summary

Eight apps bumped, all AUTO. No support-image drift found: only paperless-ngx carries a second image, and its valkey:9-alpine already matches upstream's own compose at v3.1.3 exactly.

App	Current → new	Jump	Verdict
actual	26.8.1 → 26.9.0	minor	AUTO. The release blog flags one breaking change: container images move to Node 24, dropping 32-bit ARM Ubuntu support. Shards are x86-64 on OVH, so it does not apply to us.
docuseal	3.2.1 → 3.2.4	patch	AUTO, bug fixes only.
dozzle	v10.7.4 → v10.10.0	minor	AUTO. Features, bundled app icons and UI fixes across v10.8–v10.10; nothing operator-facing.
drawio	31.3.2 → 31.4.4	minor	AUTO. Upstream publishes empty release bodies; single stateless container.
element	v1.12.26 → v1.12.27	patch	AUTO.
grist	1.7.17 → 1.7.19	patch	AUTO.
paperless-ngx	3.0.5 → 3.1.3	minor	AUTO. Upstream compose diff between the two versions is version-only, and a direct comparison against upstream's docker-compose.sqlite.yml at v3.1.3 confirms our broker image is identical.
vikunja	2.5.0 → 2.6.0	minor	AUTO. 380 commits including 18 security fixes; the changelog names no migration step, schema migrations run on start as usual.

Skipped as non-upgrades (same version, different image variant): baikal 0.10.1 → 0.10.1-nginx, glances 4.5.6 → 4.5.6-full.

Icon changes

None. Every updated app's icon was compared against the current upstream brand asset: docuseal, dozzle, element and paperless-ngx are byte-identical to upstream's file; actual, drawio and vikunja are the same mark with the same palette; grist is the same mark in the same three brand colours, differing only in that upstream also ships it on a dark rounded tile.

Smoke-test bundle

After CI completes the preview job, download and bulk-install on a fresh shard:

updated_apps.zip

Errors / unattended apps

• filebrowser v2.30.0 → v2.63.23 — held back. docker compose pull --dry-run failed, the recurring ACR lag: our image is the private build portalapps.azurecr.io/ptl-apps/filebrowser, and the new tag has to be pushed into the mirror before any runner can pull it. It is also a 33-minor span in one step on a custom build, so it wants a manual smoke test rather than a bundled one.
• affine — :stable mutable tag; listing GHCR tags needs a packages:read scope the check does not have.
• dumb-budget — upstream publishes :latest only, no versioned releases.
• dumb-drop — Docker Hub carries only latest and git-SHA tags.
• mirotalk — private branch-tracking tag ptl-apps/mirotalk:master, no public version to compare against.
• joplin-server, mosquitto — deliberate opt-outs (prerelease tags published as plain Docker tags; self-built image). Manual updates.

🤖 Generated with Claude Code

https://claude.ai/code/session_01V8c42WVrFL5vMfsonTeT2J