Traefik v3.7.17 (GHSA-xv5x-242w-7hf7); R-1347 a restore forgets the update-held flag; R-1348 a failed put-back at start-up mails; R-1339, R-1351, R-1323 truthful start-up lines and one lock over FileBrowser's compose. Commit only.

CHANGELOG.md

@@ -1,3 +1,37 @@
+## Unreleased — next controller release (MinAgent unchanged, 0.158.1); commit only, 2026-11-02 night
+
+**Traefik v3.7.17 (GHSA-xv5x-242w-7hf7, high, published 2026-11-02).** v3.7.14–v3.7.16: an unauthenticated client that
+sends a `Negotiate` or `NTLM` `Authorization` header gets a dedicated backend transport per connection, and it is not
+released when the connection closes: many short connections exhaust Traefik's memory, whether or not an NTLM backend
+exists. Traefik fronts every box. `TraefikImage` v3.7.16 → v3.7.17; a running box takes it by the reconcile at start
+(`TestEnsureTraefik_ANewImageRecreatesTraefik`). The upgrade notes name Go 1.27 (GODEBUG TLS settings: we set none; 500
+request-header values at most, else 431) and the ingress-nginx provider (not used). Found by reading the release itself:
+the watch had flagged it on a word-only line (felhom.eu R-1310).
+
+**R-1347 — a restore that lifts an update hold forgets the „update held" flag.** `clearUpdateHoldAfterRestore` cleared the
+hold in settings, but `stacks.Manager` kept `updateHeld`: the crash-loop watcher did not watch the app and the night leg
+skipped it until the controller restarted. New seam `backup.SetUpdateHeldForgetter` (`stackMgr.ForgetUpdateHeld`). Tests
+`TestR1347_*` (the seam, the wiring, and the consequence: the same restarts trip the watcher once the flag is gone).
+
+**R-1348 — a failed put-back at start-up mails the operator.** `holdPutBackFailed` writes the D20 hold at `Recover`, before any
+notifier exists, so only the hold reporter's info and the hub's later reminder said anything. `AppStopGuard.SetHeldNotify`
+hands over what `Recover` held, once, and mails a later failure (a drive that returned) at once: the R-1340 sentence for
+`MixedCauseInterruptedPutBack`, from the hold record. Tests `TestR1348_*`.
+
+**R-1339 — no false „drive … not mounted".** A per-app folder under a mounted drive is never a mountpoint itself; nine false lines
+at every start on 9202. The folder still gets no bind and no skeleton of its own (the row's „not skipped" would write a
+`userdata/` inside the app's folder and recreate the file manager, so the behaviour stays and only the line changes). A drive that
+is really absent keeps its line, and a folder of it names the drive. `TestR1339_*`.
+
+**R-1351 — FileBrowser's two start paths at boot take one lock.** `EnsureBaseStack`'s `compose up` and
+`web.syncFileBrowserMounts`' `compose up --force-recreate` in the same second gave „Conflict. The container name … is already in
+use", two ERROR lines and a first-boot WARN for an app that then ran healthy. `stacks.Manager.LockFileBrowserStack`.
+`TestR1351_*`.
+
+**R-1323 — „No such container" is not „every app can still reach it".** The checked container was replaced between the check and
+the leave; the line now reads the CURRENT container's networks and says the truth. A current container on the app network, an
+unreadable one, or any other failure keeps the alarm. `TestR1323_*`.
+
 ## v0.349.0 (2026-10-29) — the household line after an operator reboot and the busy file for it (D65 = A); a hold clear records the wanted stop (R-1350)
 
 ### 2026-10-29 (evening)