chore(catalog): re-sign the catalog with the new pins, and fix a stale firewall list

Regenerates both catalogs from the manifests so the 15 pin bumps become
real. The catalog overrides on-disk manifests on every node, so until
now those bumps were edited but inert.

There are two catalogs and regenerating one is not enough:
generate-app-catalog.sh writes releases/app-catalog.json (the signed one
nodes fetch), while generate-app-catalog.py writes app-catalog/catalog.json
and neode-ui/public/catalog.json (the source pair, the second baked into
the frontend app store). check-app-catalog-drift.py --release --strict
reads the *source* catalog, so regenerating only the release one left it
failing and would have aborted the ISO gate at stage 1 — after the
signing and tagging were already done. Drift is now 0.

The regeneration also rewrote fips/app_ports.rs, which had not been
regenerated since the initial open-source import. Diffing the port values
rather than the reformat: 36 -> 37, a single addition, **8187 — Alby
Hub**. Its port has never been in the FIPS firewall allow-list, and by
the same token neither has any app onboarded since that import. Nothing
else changed.

Catalog signed by the pinned release root and verified with
`ceremony verify`; registry trust floor checked before signing, both
hosts trusted by the deployed fleet.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

app-catalog/catalog.json

@@ -73,7 +73,7 @@
       "author": "Mempool",
       "category": "money",
       "tier": "core",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/mempool-frontend:v3.0.1",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/mempool-frontend:v3.3.1",
       "repoUrl": "https://github.com/mempool/mempool",
       "requires": [
         "bitcoin-knots",
@@ -193,13 +193,13 @@
     {
       "id": "nostr-rs-relay",
       "title": "Nostr Relay (Rust)",
-      "version": "0.8.0",
+      "version": "0.10.0",
       "description": "High-performance Nostr relay written in Rust. Host your own decentralized social media relay and earn networking profits.",
       "icon": "/assets/img/app-icons/nostrudel.svg",
       "author": "Nostr RS Relay",
       "category": "community",
       "tier": "recommended",
-      "dockerImage": "scsibug/nostr-rs-relay:0.8.9",
+      "dockerImage": "scsibug/nostr-rs-relay:0.10.0",
       "repoUrl": "https://github.com/scsibug/nostr-rs-relay",
       "containerConfig": {
         "ports": [
@@ -223,7 +223,7 @@
       "author": "Vaultwarden",
       "category": "data",
       "tier": "recommended",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/vaultwarden:1.30.0-alpine",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/vaultwarden:1.37.1-alpine",
       "repoUrl": "https://github.com/dani-garcia/vaultwarden",
       "containerConfig": {
         "ports": [
@@ -262,7 +262,7 @@
       "icon": "/assets/img/app-icons/fedimint.png",
       "author": "Fedimint",
       "category": "money",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/fedimintd:v0.10.0",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/fedimintd:v0.10.1",
       "repoUrl": "https://github.com/fedimint/fedimint"
     },
     {
@@ -285,7 +285,7 @@
       "icon": "/assets/img/app-icons/fedimint.png",
       "author": "Fedimint",
       "category": "money",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/gatewayd:v0.10.0",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/gatewayd:v0.10.1",
       "repoUrl": "https://github.com/fedimint/fedimint",
       "containerConfig": {
         "ports": [
@@ -325,7 +325,7 @@
       "icon": "/assets/img/app-icons/jellyfin.webp",
       "author": "Jellyfin",
       "category": "data",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/jellyfin:10.8.13",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/jellyfin:10.11.11",
       "repoUrl": "https://github.com/jellyfin/jellyfin",
       "containerConfig": {
         "ports": [
@@ -356,7 +356,7 @@
       "icon": "/assets/img/app-icons/homeassistant.png",
       "author": "Home Assistant",
       "category": "home",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/home-assistant:2026.7.3",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/home-assistant:2026.8.2",
       "repoUrl": "https://github.com/home-assistant/core",
       "containerConfig": {
         "ports": [
@@ -374,11 +374,11 @@
       "id": "pine",
       "title": "Pine",
       "version": "1.3.0",
-      "description": "A private voice assistant for your home. Pine runs speech-to-text (Whisper), text-to-speech (Piper) and wake-word detection (openWakeWord) on your own node and pairs with a PineVoice satellite speaker, so Home Assistant Assist works locally with nothing sent to the cloud. Ask it about your node \u2014 block height, sync, peers, Lightning balance \u2014 and, when a Claude API key is set, anything else.",
+      "description": "A private voice assistant for your home. Pine runs speech-to-text (Whisper), text-to-speech (Piper) and wake-word detection (openWakeWord) on your own node and pairs with a PineVoice satellite speaker, so Home Assistant Assist works locally with nothing sent to the cloud. Ask it about your node — block height, sync, peers, Lightning balance — and, when a Claude API key is set, anything else.",
       "icon": "/assets/img/app-icons/pine.svg",
       "author": "Archipelago",
       "category": "home",
-      "dockerImage": "docker.io/library/nginx:1.27-alpine",
+      "dockerImage": "docker.io/library/nginx:1.31.3-alpine",
       "repoUrl": "https://github.com/rhasspy/wyoming"
     },
     {
@@ -442,7 +442,7 @@
       "author": "Portainer",
       "category": "development",
       "tier": "optional",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/portainer:2.39.1",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/portainer:2.39.6",
       "repoUrl": "https://github.com/portainer/portainer",
       "containerConfig": {
         "ports": [
@@ -459,12 +459,12 @@
       "id": "netbird",
       "title": "NetBird",
       "version": "2.38.0",
-      "description": "Self-hosted WireGuard mesh VPN control plane with dashboard, embedded identity provider, management API, signal, relay, and STUN. The user-facing entry point \u2014 a TLS proxy in front of the dashboard + server.",
+      "description": "Self-hosted WireGuard mesh VPN control plane with dashboard, embedded identity provider, management API, signal, relay, and STUN. The user-facing entry point — a TLS proxy in front of the dashboard + server.",
       "icon": "/assets/img/app-icons/netbird.svg",
       "author": "NetBird",
       "category": "networking",
       "tier": "recommended",
-      "dockerImage": "docker.io/library/nginx:1.27-alpine",
+      "dockerImage": "docker.io/library/nginx:1.31.3-alpine",
       "repoUrl": "https://github.com/netbirdio/netbird",
       "containerConfig": {
         "ports": [
@@ -552,19 +552,19 @@
       "id": "alby-hub",
       "title": "Alby Hub",
       "version": "1.23.0",
-      "description": "Self-custodial Lightning wallet hub. Runs its own Lightning node on your Archipelago and connects your apps to it over Nostr Wallet Connect \u2014 one hub, every app pays through it.",
+      "description": "Self-custodial Lightning wallet hub. Runs its own Lightning node on your Archipelago and connects your apps to it over Nostr Wallet Connect — one hub, every app pays through it.",
       "icon": "/assets/img/app-icons/alby-hub.svg",
       "author": "Alby",
       "category": "money",
       "tier": "optional",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/alby-hub:v1.23.0",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/alby-hub:v1.24.0",
       "repoUrl": "https://github.com/getAlby/hub"
     },
     {
       "id": "phoenixd",
       "title": "phoenixd",
       "version": "0.9.0",
-      "description": "Headless Lightning daemon by ACINQ (the Phoenix wallet team). No screen of its own \u2014 it exposes a small local API that other apps and tools use to send and receive Lightning payments. Channel liquidity is managed automatically for a fee.",
+      "description": "Headless Lightning daemon by ACINQ (the Phoenix wallet team). No screen of its own — it exposes a small local API that other apps and tools use to send and receive Lightning payments. Channel liquidity is managed automatically for a fee.",
       "icon": "/assets/img/app-icons/phoenixd.svg",
       "author": "ACINQ",
       "category": "money",

core/archipelago/src/fips/app_ports.rs

@@ -6,7 +6,41 @@
 //! no listener, so allowing them is inert.
 
 pub const APP_LAUNCH_PORTS: &[u16] = &[
-    2283, 2342, 3000, 3001, 3002, 4080, 5180, 7778, 8080, 8081, 8082, 8083, 8084, 8085, 8087, 8088,
+    2283,
-    8089, 8090, 8096, 8123, 8175, 8176, 8240, 8334, 8336, 8888, 8999, 9000, 9100, 10380, 11434,
+    2342,
-    18081, 18083, 23000, 32838, 50002,
+    3000,
+    3001,
+    3002,
+    4080,
+    5180,
+    7778,
+    8080,
+    8081,
+    8082,
+    8083,
+    8084,
+    8085,
+    8087,
+    8088,
+    8089,
+    8090,
+    8096,
+    8123,
+    8175,
+    8176,
+    8187,
+    8240,
+    8334,
+    8336,
+    8888,
+    8999,
+    9000,
+    9100,
+    10380,
+    11434,
+    18081,
+    18083,
+    23000,
+    32838,
+    50002,
 ];

neode-ui/public/catalog.json

@@ -73,7 +73,7 @@
       "author": "Mempool",
       "category": "money",
       "tier": "core",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/mempool-frontend:v3.0.1",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/mempool-frontend:v3.3.1",
       "repoUrl": "https://github.com/mempool/mempool",
       "requires": [
         "bitcoin-knots",
@@ -193,13 +193,13 @@
     {
       "id": "nostr-rs-relay",
       "title": "Nostr Relay (Rust)",
-      "version": "0.8.0",
+      "version": "0.10.0",
       "description": "High-performance Nostr relay written in Rust. Host your own decentralized social media relay and earn networking profits.",
       "icon": "/assets/img/app-icons/nostrudel.svg",
       "author": "Nostr RS Relay",
       "category": "community",
       "tier": "recommended",
-      "dockerImage": "scsibug/nostr-rs-relay:0.8.9",
+      "dockerImage": "scsibug/nostr-rs-relay:0.10.0",
       "repoUrl": "https://github.com/scsibug/nostr-rs-relay",
       "containerConfig": {
         "ports": [
@@ -223,7 +223,7 @@
       "author": "Vaultwarden",
       "category": "data",
       "tier": "recommended",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/vaultwarden:1.30.0-alpine",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/vaultwarden:1.37.1-alpine",
       "repoUrl": "https://github.com/dani-garcia/vaultwarden",
       "containerConfig": {
         "ports": [
@@ -262,7 +262,7 @@
       "icon": "/assets/img/app-icons/fedimint.png",
       "author": "Fedimint",
       "category": "money",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/fedimintd:v0.10.0",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/fedimintd:v0.10.1",
       "repoUrl": "https://github.com/fedimint/fedimint"
     },
     {
@@ -285,7 +285,7 @@
       "icon": "/assets/img/app-icons/fedimint.png",
       "author": "Fedimint",
       "category": "money",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/gatewayd:v0.10.0",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/gatewayd:v0.10.1",
       "repoUrl": "https://github.com/fedimint/fedimint",
       "containerConfig": {
         "ports": [
@@ -325,7 +325,7 @@
       "icon": "/assets/img/app-icons/jellyfin.webp",
       "author": "Jellyfin",
       "category": "data",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/jellyfin:10.8.13",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/jellyfin:10.11.11",
       "repoUrl": "https://github.com/jellyfin/jellyfin",
       "containerConfig": {
         "ports": [
@@ -356,7 +356,7 @@
       "icon": "/assets/img/app-icons/homeassistant.png",
       "author": "Home Assistant",
       "category": "home",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/home-assistant:2026.7.3",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/home-assistant:2026.8.2",
       "repoUrl": "https://github.com/home-assistant/core",
       "containerConfig": {
         "ports": [
@@ -374,11 +374,11 @@
       "id": "pine",
       "title": "Pine",
       "version": "1.3.0",
-      "description": "A private voice assistant for your home. Pine runs speech-to-text (Whisper), text-to-speech (Piper) and wake-word detection (openWakeWord) on your own node and pairs with a PineVoice satellite speaker, so Home Assistant Assist works locally with nothing sent to the cloud. Ask it about your node \u2014 block height, sync, peers, Lightning balance \u2014 and, when a Claude API key is set, anything else.",
+      "description": "A private voice assistant for your home. Pine runs speech-to-text (Whisper), text-to-speech (Piper) and wake-word detection (openWakeWord) on your own node and pairs with a PineVoice satellite speaker, so Home Assistant Assist works locally with nothing sent to the cloud. Ask it about your node — block height, sync, peers, Lightning balance — and, when a Claude API key is set, anything else.",
       "icon": "/assets/img/app-icons/pine.svg",
       "author": "Archipelago",
       "category": "home",
-      "dockerImage": "docker.io/library/nginx:1.27-alpine",
+      "dockerImage": "docker.io/library/nginx:1.31.3-alpine",
       "repoUrl": "https://github.com/rhasspy/wyoming"
     },
     {
@@ -442,7 +442,7 @@
       "author": "Portainer",
       "category": "development",
       "tier": "optional",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/portainer:2.39.1",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/portainer:2.39.6",
       "repoUrl": "https://github.com/portainer/portainer",
       "containerConfig": {
         "ports": [
@@ -459,12 +459,12 @@
       "id": "netbird",
       "title": "NetBird",
       "version": "2.38.0",
-      "description": "Self-hosted WireGuard mesh VPN control plane with dashboard, embedded identity provider, management API, signal, relay, and STUN. The user-facing entry point \u2014 a TLS proxy in front of the dashboard + server.",
+      "description": "Self-hosted WireGuard mesh VPN control plane with dashboard, embedded identity provider, management API, signal, relay, and STUN. The user-facing entry point — a TLS proxy in front of the dashboard + server.",
       "icon": "/assets/img/app-icons/netbird.svg",
       "author": "NetBird",
       "category": "networking",
       "tier": "recommended",
-      "dockerImage": "docker.io/library/nginx:1.27-alpine",
+      "dockerImage": "docker.io/library/nginx:1.31.3-alpine",
       "repoUrl": "https://github.com/netbirdio/netbird",
       "containerConfig": {
         "ports": [
@@ -552,19 +552,19 @@
       "id": "alby-hub",
       "title": "Alby Hub",
       "version": "1.23.0",
-      "description": "Self-custodial Lightning wallet hub. Runs its own Lightning node on your Archipelago and connects your apps to it over Nostr Wallet Connect \u2014 one hub, every app pays through it.",
+      "description": "Self-custodial Lightning wallet hub. Runs its own Lightning node on your Archipelago and connects your apps to it over Nostr Wallet Connect — one hub, every app pays through it.",
       "icon": "/assets/img/app-icons/alby-hub.svg",
       "author": "Alby",
       "category": "money",
       "tier": "optional",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/alby-hub:v1.23.0",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/alby-hub:v1.24.0",
       "repoUrl": "https://github.com/getAlby/hub"
     },
     {
       "id": "phoenixd",
       "title": "phoenixd",
       "version": "0.9.0",
-      "description": "Headless Lightning daemon by ACINQ (the Phoenix wallet team). No screen of its own \u2014 it exposes a small local API that other apps and tools use to send and receive Lightning payments. Channel liquidity is managed automatically for a fee.",
+      "description": "Headless Lightning daemon by ACINQ (the Phoenix wallet team). No screen of its own — it exposes a small local API that other apps and tools use to send and receive Lightning payments. Channel liquidity is managed automatically for a fee.",
       "icon": "/assets/img/app-icons/phoenixd.svg",
       "author": "ACINQ",
       "category": "money",

neode-ui/src/views/appSession/generatedAppSessionConfig.ts

@@ -2,6 +2,7 @@
 
 export const GENERATED_APP_PORTS: Record<string, number> = {
   "aiui": 5180,
+  "alby-hub": 8187,
   "archy-mempool-web": 4080,
   "archy-nbxplorer": 32838,
   "bitcoin-ui": 8334,
@@ -38,6 +39,7 @@ export const GENERATED_APP_PORTS: Record<string, number> = {
 
 export const GENERATED_APP_TITLES: Record<string, string> = {
   "aiui": "AI Assistant",
+  "alby-hub": "Alby Hub",
   "archy-btcpay-db": "BTCPay Postgres",
   "archy-mempool-db": "Mempool MariaDB",
   "archy-mempool-web": "Mempool Web",
@@ -82,6 +84,7 @@ export const GENERATED_APP_TITLES: Record<string, string> = {
   "netbird-server": "NetBird Server",
   "nextcloud": "Nextcloud",
   "nostr-rs-relay": "Nostr Relay (Rust)",
+  "phoenixd": "phoenixd",
   "photoprism": "PhotoPrism",
   "pine": "Pine",
   "pine-openwakeword": "Pine Wake Word (openWakeWord)",

releases/app-catalog.json

@@ -46,6 +46,9 @@
             "seccomp_profile": "default",
             "user": 1000
           },
+          "upstream": {
+            "kind": "internal"
+          },
           "version": "0.1.0"
         }
       },
@@ -56,7 +59,7 @@
         "app": {
           "category": "money",
           "container": {
-            "image": "source.archipelago-foundation.org/lfg2025/alby-hub:v1.23.0",
+            "image": "source.archipelago-foundation.org/lfg2025/alby-hub:v1.24.0",
             "pull_policy": "if-not-present"
           },
           "dependencies": [
@@ -123,6 +126,10 @@
             "no_new_privileges": true,
             "readonly_root": true
           },
+          "upstream": {
+            "kind": "github",
+            "repo": "getAlby/hub"
+          },
           "version": "1.23.0",
           "volumes": [
             {
@@ -192,6 +199,10 @@
             "network_policy": "isolated",
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "dockerhub",
+            "repo": "library/postgres"
+          },
           "version": "15.17",
           "volumes": [
             {
@@ -265,6 +276,10 @@
             "network_policy": "isolated",
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "dockerhub",
+            "repo": "library/mariadb"
+          },
           "version": "11.4.10",
           "volumes": [
             {
@@ -288,7 +303,7 @@
             "sync_required": false
           },
           "container": {
-            "image": "source.archipelago-foundation.org/lfg2025/mempool-frontend:v3.0.1",
+            "image": "source.archipelago-foundation.org/lfg2025/mempool-frontend:v3.3.1",
             "network": "archy-net",
             "pull_policy": "if-not-present"
           },
@@ -331,6 +346,10 @@
             "network_policy": "isolated",
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "github",
+            "repo": "mempool/mempool"
+          },
           "version": "3.0.1"
         }
       },
@@ -408,6 +427,10 @@
             "network_policy": "isolated",
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "github",
+            "repo": "dgarage/NBXplorer"
+          },
           "version": "2.6.0",
           "volumes": [
             {
@@ -508,7 +531,7 @@
           },
           "container": {
             "custom_args": [
-              "BITCOIND=\"$(command -v bitcoind || true)\"; if [ -z \"$BITCOIND\" ]; then\n  BITCOIND=\"$(find /opt -path '*/bin/bitcoind' -type f 2>/dev/null | sort | tail -n 1)\";\nfi; if [ -z \"$BITCOIND\" ]; then\n  echo \"bitcoind not found in image\" >&2;\n  exit 127;\nfi; RPC_USER=\"$(printenv BITCOIN_RPC_USER)\"; RPC_PASS=\"$(printenv BITCOIN_RPC_PASS)\"; RPC_CONF=\"/tmp/rpc.conf\"; umask 077; { echo \"rpcuser=$RPC_USER\"; echo \"rpcpassword=$RPC_PASS\"; } > \"$RPC_CONF\"; if [ -f /home/bitcoin/.bitcoin/bitcoin.conf ]; then\n  echo \"archipelago: ignoring legacy datadir bitcoin.conf; RPC config comes from $RPC_CONF\" >&2;\nfi; RPC_TXRELAY_AUTH=\"$(printenv BITCOIN_RPC_TXRELAY_RPCAUTH || true)\"; DISK_GB_VALUE=\"$(printenv DISK_GB || true)\"; RPC_HEADROOM=\"-rpcthreads=16 -rpcworkqueue=256\"; RPC_TXRELAY_FLAGS=\"-rpcwhitelistdefault=0\"; if [ -n \"$RPC_TXRELAY_AUTH\" ]; then\n  RPC_TXRELAY_FLAGS=\"$RPC_TXRELAY_FLAGS -rpcauth=$RPC_TXRELAY_AUTH -rpcwhitelist=txrelay:sendrawtransaction,submitpackage,testmempoolaccept,getmempoolinfo,getrawmempool,getmempoolentry,getnetworkinfo,getblockchaininfo,getblockcount,getblockhash,getblock,getblockheader,getrawtransaction,gettxout,gettxspendingprevout,decoderawtransaction,decodescript,estimatesmartfee,uptime,ping,getconnectioncount,getpeerinfo,getindexinfo,getdeploymentinfo,getchaintips\";\nfi; if [ \"${DISK_GB_VALUE:-0}\" -lt 1000 ]; then\n  exec \"$BITCOIND\" -datadir=/home/bitcoin/.bitcoin -conf=\"$RPC_CONF\" -allowignoredconf=1 -printtoconsole=0 -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=1024 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;\nelse\n  exec \"$BITCOIND\" -datadir=/home/bitcoin/.bitcoin -conf=\"$RPC_CONF\" -allowignoredconf=1 -printtoconsole=0 -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;\nfi"
+              "BITCOIND=\"$(command -v bitcoind || true)\"; if [ -z \"$BITCOIND\" ]; then\n  BITCOIND=\"$(find /opt -path '*/bin/bitcoind' -type f 2>/dev/null | sort | tail -n 1)\";\nfi; if [ -z \"$BITCOIND\" ]; then\n  echo \"bitcoind not found in image\" >&2;\n  exit 127;\nfi; RPC_USER=\"$(printenv BITCOIN_RPC_USER)\"; RPC_PASS=\"$(printenv BITCOIN_RPC_PASS)\"; RPC_CONF=\"/tmp/rpc.conf\"; umask 077; { echo \"rpcuser=$RPC_USER\"; echo \"rpcpassword=$RPC_PASS\"; } > \"$RPC_CONF\"; if [ -f /home/bitcoin/.bitcoin/bitcoin.conf ]; then\n  echo \"archipelago: ignoring legacy datadir bitcoin.conf; RPC config comes from $RPC_CONF\" >&2;\nfi; RPC_TXRELAY_AUTH=\"$(printenv BITCOIN_RPC_TXRELAY_RPCAUTH || true)\"; DISK_GB_VALUE=\"$(printenv DISK_GB || true)\"; RPC_HEADROOM=\"-rpcthreads=16 -rpcworkqueue=256\"; RPC_TXRELAY_FLAGS=\"-rpcwhitelistdefault=0\"; if [ -n \"$RPC_TXRELAY_AUTH\" ]; then\n  RPC_TXRELAY_FLAGS=\"$RPC_TXRELAY_FLAGS -rpcauth=$RPC_TXRELAY_AUTH -rpcwhitelist=txrelay:sendrawtransaction,submitpackage,testmempoolaccept,getmempoolinfo,getrawmempool,getmempoolentry,getnetworkinfo,getblockchaininfo,getblockcount,getblockhash,getblock,getblockheader,getrawtransaction,gettxout,gettxspendingprevout,decoderawtransaction,decodescript,estimatesmartfee,uptime,ping,getconnectioncount,getpeerinfo,getindexinfo,getdeploymentinfo,getchaintips\";\nfi; if [ \"${DISK_GB_VALUE:-0}\" -lt 1000 ]; then\n  exec \"$BITCOIND\" -datadir=/home/bitcoin/.bitcoin -conf=\"$RPC_CONF\" -allowignoredconf=1 -printtoconsole=0 -server=1 -prune=50000 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=1024 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;\nelse\n  exec \"$BITCOIND\" -datadir=/home/bitcoin/.bitcoin -conf=\"$RPC_CONF\" -allowignoredconf=1 -printtoconsole=0 -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;\nfi"
             ],
             "data_uid": "100101:100101",
             "derived_env": [
@@ -586,6 +609,10 @@
             "network_policy": "isolated",
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "github",
+            "repo": "bitcoin/bitcoin"
+          },
           "version": "28.4.0",
           "volumes": [
             {
@@ -654,7 +681,7 @@
           },
           "container": {
             "custom_args": [
-              "BITCOIND=\"$(command -v bitcoind || true)\"; if [ -z \"$BITCOIND\" ]; then\n  BITCOIND=\"$(find /opt -path '*/bin/bitcoind' -type f 2>/dev/null | sort | tail -n 1)\";\nfi; if [ -z \"$BITCOIND\" ]; then\n  echo \"bitcoind not found in image\" >&2;\n  exit 127;\nfi; RPC_USER=\"$(printenv BITCOIN_RPC_USER)\"; RPC_PASS=\"$(printenv BITCOIN_RPC_PASS)\"; RPC_CONF=\"/tmp/rpc.conf\"; umask 077; { echo \"rpcuser=$RPC_USER\"; echo \"rpcpassword=$RPC_PASS\"; } > \"$RPC_CONF\"; if [ -f /home/bitcoin/.bitcoin/bitcoin.conf ]; then\n  echo \"archipelago: ignoring legacy datadir bitcoin.conf; RPC config comes from $RPC_CONF\" >&2;\nfi; RPC_TXRELAY_AUTH=\"$(printenv BITCOIN_RPC_TXRELAY_RPCAUTH || true)\"; DISK_GB_VALUE=\"$(printenv DISK_GB || true)\"; RPC_HEADROOM=\"-rpcthreads=16 -rpcworkqueue=256\"; RPC_TXRELAY_FLAGS=\"-rpcwhitelistdefault=0\"; if [ -n \"$RPC_TXRELAY_AUTH\" ]; then\n  RPC_TXRELAY_FLAGS=\"$RPC_TXRELAY_FLAGS -rpcauth=$RPC_TXRELAY_AUTH -rpcwhitelist=txrelay:sendrawtransaction,submitpackage,testmempoolaccept,getmempoolinfo,getrawmempool,getmempoolentry,getnetworkinfo,getblockchaininfo,getblockcount,getblockhash,getblock,getblockheader,getrawtransaction,gettxout,gettxspendingprevout,decoderawtransaction,decodescript,estimatesmartfee,uptime,ping,getconnectioncount,getpeerinfo,getindexinfo,getdeploymentinfo,getchaintips\";\nfi; if [ \"${DISK_GB_VALUE:-0}\" -lt 1000 ]; then\n  exec \"$BITCOIND\" -datadir=/home/bitcoin/.bitcoin -conf=\"$RPC_CONF\" -allowignoredconf=1 -printtoconsole=0 -server=1 -prune=550 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=2048 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;\nelse\n  exec \"$BITCOIND\" -datadir=/home/bitcoin/.bitcoin -conf=\"$RPC_CONF\" -allowignoredconf=1 -printtoconsole=0 -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;\nfi"
+              "BITCOIND=\"$(command -v bitcoind || true)\"; if [ -z \"$BITCOIND\" ]; then\n  BITCOIND=\"$(find /opt -path '*/bin/bitcoind' -type f 2>/dev/null | sort | tail -n 1)\";\nfi; if [ -z \"$BITCOIND\" ]; then\n  echo \"bitcoind not found in image\" >&2;\n  exit 127;\nfi; RPC_USER=\"$(printenv BITCOIN_RPC_USER)\"; RPC_PASS=\"$(printenv BITCOIN_RPC_PASS)\"; RPC_CONF=\"/tmp/rpc.conf\"; umask 077; { echo \"rpcuser=$RPC_USER\"; echo \"rpcpassword=$RPC_PASS\"; } > \"$RPC_CONF\"; if [ -f /home/bitcoin/.bitcoin/bitcoin.conf ]; then\n  echo \"archipelago: ignoring legacy datadir bitcoin.conf; RPC config comes from $RPC_CONF\" >&2;\nfi; RPC_TXRELAY_AUTH=\"$(printenv BITCOIN_RPC_TXRELAY_RPCAUTH || true)\"; DISK_GB_VALUE=\"$(printenv DISK_GB || true)\"; RPC_HEADROOM=\"-rpcthreads=16 -rpcworkqueue=256\"; RPC_TXRELAY_FLAGS=\"-rpcwhitelistdefault=0\"; if [ -n \"$RPC_TXRELAY_AUTH\" ]; then\n  RPC_TXRELAY_FLAGS=\"$RPC_TXRELAY_FLAGS -rpcauth=$RPC_TXRELAY_AUTH -rpcwhitelist=txrelay:sendrawtransaction,submitpackage,testmempoolaccept,getmempoolinfo,getrawmempool,getmempoolentry,getnetworkinfo,getblockchaininfo,getblockcount,getblockhash,getblock,getblockheader,getrawtransaction,gettxout,gettxspendingprevout,decoderawtransaction,decodescript,estimatesmartfee,uptime,ping,getconnectioncount,getpeerinfo,getindexinfo,getdeploymentinfo,getchaintips\";\nfi; if [ \"${DISK_GB_VALUE:-0}\" -lt 1000 ]; then\n  exec \"$BITCOIND\" -datadir=/home/bitcoin/.bitcoin -conf=\"$RPC_CONF\" -allowignoredconf=1 -printtoconsole=0 -server=1 -prune=50000 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=2048 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;\nelse\n  exec \"$BITCOIND\" -datadir=/home/bitcoin/.bitcoin -conf=\"$RPC_CONF\" -allowignoredconf=1 -printtoconsole=0 -server=1 -txindex=1 -rpcallowip=0.0.0.0/0 -rpcbind=0.0.0.0:8332 -listen=1 -bind=0.0.0.0:8333 -dbcache=4096 -par=0 -maxconnections=125 $RPC_HEADROOM $RPC_TXRELAY_FLAGS;\nfi"
             ],
             "data_uid": "100101:100101",
             "derived_env": [
@@ -732,6 +759,10 @@
             "network_policy": "isolated",
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "github",
+            "repo": "bitcoinknots/bitcoin"
+          },
           "version": "28.1.0",
           "volumes": [
             {
@@ -811,6 +842,9 @@
             "network_policy": "host",
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "internal"
+          },
           "version": "1.0.0",
           "volumes": [
             {
@@ -918,6 +952,9 @@
             "seccomp_profile": "default",
             "user": 999
           },
+          "upstream": {
+            "kind": "internal"
+          },
           "version": "1.2.11",
           "volumes": [
             {
@@ -1038,7 +1075,8 @@
           "name": "BTCPay Server",
           "ports": [
             {
-              "auth": "gated",
+              "auth": "open",
+              "auth_rationale": "BTCPay enforces its own login for administration, and its checkout, invoice and webhook endpoints are designed to be reached by anonymous payers and payment processors.",
               "bind": "127.0.0.1",
               "container": 49392,
               "host": 23000,
@@ -1055,6 +1093,10 @@
             "network_policy": "isolated",
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "github",
+            "repo": "btcpayserver/btcpayserver"
+          },
           "version": "2.4.2",
           "volumes": [
             {
@@ -1140,6 +1182,10 @@
             "seccomp_profile": "default",
             "user": 1000
           },
+          "upstream": {
+            "kind": "github",
+            "repo": "ElementsProject/lightning"
+          },
           "version": "23.08.2",
           "volumes": [
             {
@@ -1209,6 +1255,9 @@
             "seccomp_profile": "default",
             "user": 1000
           },
+          "upstream": {
+            "kind": "internal"
+          },
           "version": "1.0.0",
           "volumes": [
             {
@@ -1270,6 +1319,9 @@
             "network_policy": "host",
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "internal"
+          },
           "version": "1.0.0",
           "volumes": []
         }
@@ -1362,6 +1414,10 @@
             "network_policy": "isolated",
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "github",
+            "repo": "spesmilo/electrumx"
+          },
           "version": "1.18.0",
           "volumes": [
             {
@@ -1378,7 +1434,7 @@
       "version": "v1.18.0"
     },
     "fedimint": {
-      "image": "source.archipelago-foundation.org/lfg2025/fedimintd:v0.10.0",
+      "image": "source.archipelago-foundation.org/lfg2025/fedimintd:v0.10.1",
       "manifest": {
         "app": {
           "bitcoin_integration": {
@@ -1408,7 +1464,7 @@
               "sh",
               "-lc"
             ],
-            "image": "source.archipelago-foundation.org/lfg2025/fedimintd:v0.10.0",
+            "image": "source.archipelago-foundation.org/lfg2025/fedimintd:v0.10.1",
             "network": "archy-net",
             "pull_policy": "if-not-present",
             "secret_env": [
@@ -1489,6 +1545,10 @@
             "network_policy": "isolated",
             "readonly_root": true
           },
+          "upstream": {
+            "kind": "github",
+            "repo": "fedimint/fedimint"
+          },
           "version": "0.10.0",
           "volumes": [
             {
@@ -1502,7 +1562,7 @@
           ]
         }
       },
-      "version": "v0.10.0"
+      "version": "v0.10.1"
     },
     "fedimint-clientd": {
       "manifest": {
@@ -1571,6 +1631,10 @@
             "network_policy": "bridge",
             "readonly_root": true
           },
+          "upstream": {
+            "kind": "github",
+            "repo": "fedimint/fedimint-clientd"
+          },
           "version": "0.8.0",
           "volumes": [
             {
@@ -1587,7 +1651,7 @@
       "version": "0.8.0"
     },
     "fedimint-gateway": {
-      "image": "source.archipelago-foundation.org/lfg2025/gatewayd:v0.10.0",
+      "image": "source.archipelago-foundation.org/lfg2025/gatewayd:v0.10.1",
       "manifest": {
         "app": {
           "bitcoin_integration": {
@@ -1615,7 +1679,7 @@
                 "name": "fedimint-gateway-hash"
               }
             ],
-            "image": "source.archipelago-foundation.org/lfg2025/gatewayd:v0.10.0",
+            "image": "source.archipelago-foundation.org/lfg2025/gatewayd:v0.10.1",
             "network": "archy-net",
             "pull_policy": "if-not-present",
             "secret_env": [
@@ -1679,6 +1743,10 @@
             "network_policy": "isolated",
             "readonly_root": true
           },
+          "upstream": {
+            "kind": "github",
+            "repo": "fedimint/fedimint"
+          },
           "version": "0.10.0",
           "volumes": [
             {
@@ -1700,7 +1768,7 @@
           ]
         }
       },
-      "version": "v0.10.0"
+      "version": "v0.10.1"
     },
     "filebrowser": {
       "image": "source.archipelago-foundation.org/lfg2025/filebrowser:v2.27.0",
@@ -1762,6 +1830,10 @@
             "network_policy": "isolated",
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "github",
+            "repo": "filebrowser/filebrowser"
+          },
           "version": "2.27.0",
           "volumes": [
             {
@@ -1828,6 +1900,9 @@
             "network_policy": "host",
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "internal"
+          },
           "version": "1.0.0",
           "volumes": []
         }
@@ -1902,7 +1977,8 @@
           },
           "ports": [
             {
-              "auth": "gated",
+              "auth": "open",
+              "auth_rationale": "Gitea enforces its own account login on every page and API route; git clients authenticate with basic-auth/tokens and cannot complete a browser login challenge.",
               "bind": "127.0.0.1",
               "container": 3000,
               "host": 3001,
@@ -1933,6 +2009,10 @@
             "no_new_privileges": false,
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "github",
+            "repo": "go-gitea/gitea"
+          },
           "version": "1.23",
           "volumes": [
             {
@@ -2016,6 +2096,10 @@
             "seccomp_profile": "default",
             "user": 1000
           },
+          "upstream": {
+            "kind": "github",
+            "repo": "grafana/grafana"
+          },
           "version": "10.2.0",
           "volumes": [
             {
@@ -2032,11 +2116,11 @@
       "version": "10.2.0"
     },
     "homeassistant": {
-      "image": "source.archipelago-foundation.org/lfg2025/home-assistant:2026.7.3",
+      "image": "source.archipelago-foundation.org/lfg2025/home-assistant:2026.8.2",
       "manifest": {
         "app": {
           "container": {
-            "image": "source.archipelago-foundation.org/lfg2025/home-assistant:2026.7.3",
+            "image": "source.archipelago-foundation.org/lfg2025/home-assistant:2026.8.2",
             "network": "pasta",
             "pull_policy": "if-not-present"
           },
@@ -2109,6 +2193,10 @@
             "seccomp_profile": "default",
             "user": 1000
           },
+          "upstream": {
+            "kind": "github",
+            "repo": "home-assistant/core"
+          },
           "version": "2026.7.3",
           "volumes": [
             {
@@ -2122,7 +2210,7 @@
           ]
         }
       },
-      "version": "2026.7.3"
+      "version": "2026.8.2"
     },
     "immich": {
       "image": "source.archipelago-foundation.org/lfg2025/immich-server:release",
@@ -2211,6 +2299,10 @@
             "network_policy": "isolated",
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "github",
+            "repo": "immich-app/immich"
+          },
           "version": "2.7.4",
           "volumes": [
             {
@@ -2331,6 +2423,10 @@
             "network_policy": "isolated",
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "dockerhub",
+            "repo": "valkey/valkey"
+          },
           "version": "7-alpine",
           "volumes": []
         }
@@ -2453,6 +2549,9 @@
             "network_policy": "isolated",
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "internal"
+          },
           "version": "1.0.0",
           "volumes": [
             {
@@ -2561,6 +2660,9 @@
             "network_policy": "isolated",
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "internal"
+          },
           "version": "1.0.0",
           "volumes": []
         }
@@ -2619,6 +2721,9 @@
             "network_policy": "isolated",
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "internal"
+          },
           "version": "1.0.0",
           "volumes": []
         }
@@ -2758,6 +2863,10 @@
             "network_policy": "isolated",
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "dockerhub",
+            "repo": "library/postgres"
+          },
           "version": "16.13-alpine",
           "volumes": [
             {
@@ -2816,6 +2925,10 @@
             "network_policy": "isolated",
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "dockerhub",
+            "repo": "library/redis"
+          },
           "version": "7.4.8-alpine",
           "volumes": [
             {
@@ -2836,7 +2949,7 @@
         "app": {
           "category": "community",
           "container": {
-            "image": "source.archipelago-foundation.org/lfg2025/nostr-rs-relay:0.9.0",
+            "image": "source.archipelago-foundation.org/lfg2025/nostr-rs-relay:0.10.0",
             "network": "indeedhub-net",
             "network_aliases": [
               "relay"
@@ -2870,6 +2983,10 @@
             "network_policy": "isolated",
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "github",
+            "repo": "scsibug/nostr-rs-relay"
+          },
           "version": "0.9.0",
           "volumes": [
             {
@@ -2886,11 +3003,11 @@
       "version": "0.9.0"
     },
     "jellyfin": {
-      "image": "source.archipelago-foundation.org/lfg2025/jellyfin:10.8.13",
+      "image": "source.archipelago-foundation.org/lfg2025/jellyfin:10.11.11",
       "manifest": {
         "app": {
           "container": {
-            "image": "source.archipelago-foundation.org/lfg2025/jellyfin:10.8.13",
+            "image": "source.archipelago-foundation.org/lfg2025/jellyfin:10.11.11",
             "network": "pasta",
             "pull_policy": "if-not-present"
           },
@@ -2950,6 +3067,10 @@
             "network_policy": "isolated",
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "github",
+            "repo": "jellyfin/jellyfin"
+          },
           "version": "10.8.13",
           "volumes": [
             {
@@ -2971,7 +3092,7 @@
           ]
         }
       },
-      "version": "10.8.13"
+      "version": "10.11.11"
     },
     "lightning-stack": {
       "manifest": {
@@ -3159,6 +3280,10 @@
             "network_policy": "isolated",
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "github",
+            "repo": "lightningnetwork/lnd"
+          },
           "version": "0.18.4",
           "volumes": [
             {
@@ -3219,6 +3344,9 @@
             "network_policy": "host",
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "internal"
+          },
           "version": "1.0.0",
           "volumes": []
         }
@@ -3226,11 +3354,11 @@
       "version": "1.7.123-alpha"
     },
     "mempool": {
-      "image": "source.archipelago-foundation.org/lfg2025/mempool-frontend:v3.0.1",
+      "image": "source.archipelago-foundation.org/lfg2025/mempool-frontend:v3.3.1",
       "images": {
         "archy-mempool-db": "source.archipelago-foundation.org/lfg2025/mariadb:11.4.10",
-        "archy-mempool-web": "source.archipelago-foundation.org/lfg2025/mempool-frontend:v3.0.1",
+        "archy-mempool-web": "source.archipelago-foundation.org/lfg2025/mempool-frontend:v3.3.1",
-        "mempool-api": "source.archipelago-foundation.org/lfg2025/mempool-backend:v3.0.0"
+        "mempool-api": "source.archipelago-foundation.org/lfg2025/mempool-backend:v3.3.1"
       },
       "manifest": {
         "app": {
@@ -3239,7 +3367,7 @@
             "sync_required": true
           },
           "container": {
-            "image": "source.archipelago-foundation.org/lfg2025/mempool-frontend:v3.0.1",
+            "image": "source.archipelago-foundation.org/lfg2025/mempool-frontend:v3.3.1",
             "image_signature": "cosign://...",
             "pull_policy": "if-not-present"
           },
@@ -3294,6 +3422,10 @@
             "seccomp_profile": "default",
             "user": 1000
           },
+          "upstream": {
+            "kind": "github",
+            "repo": "mempool/mempool"
+          },
           "version": "3.0.0",
           "volumes": [
             {
@@ -3307,7 +3439,7 @@
           ]
         }
       },
-      "version": "v3.0.1"
+      "version": "v3.3.1"
     },
     "mempool-api": {
       "manifest": {
@@ -3324,7 +3456,7 @@
                 "template": "{{BITCOIN_HOST}}"
               }
             ],
-            "image": "source.archipelago-foundation.org/lfg2025/mempool-backend:v3.0.0",
+            "image": "source.archipelago-foundation.org/lfg2025/mempool-backend:v3.3.1",
             "network": "archy-net",
             "pull_policy": "if-not-present",
             "secret_env": [
@@ -3394,6 +3526,10 @@
             "network_policy": "isolated",
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "github",
+            "repo": "mempool/mempool"
+          },
           "version": "3.0.0",
           "volumes": [
             {
@@ -3460,6 +3596,9 @@
             "seccomp_profile": "default",
             "user": 1000
           },
+          "upstream": {
+            "kind": "internal"
+          },
           "version": "1.0.0",
           "volumes": [
             {
@@ -3486,7 +3625,7 @@
                 "key": "/var/lib/archipelago/netbird/tls.key"
               }
             ],
-            "image": "docker.io/library/nginx:1.27-alpine",
+            "image": "docker.io/library/nginx:1.31.3-alpine",
             "network": "netbird-net",
             "pull_policy": "if-not-present"
           },
@@ -3567,6 +3706,10 @@
             "network_policy": "isolated",
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "dockerhub",
+            "repo": "library/nginx"
+          },
           "version": "2.38.0",
           "volumes": [
             {
@@ -3680,6 +3823,10 @@
             "network_policy": "isolated",
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "github",
+            "repo": "netbirdio/dashboard"
+          },
           "version": "2.38.0",
           "volumes": []
         }
@@ -3776,6 +3923,10 @@
             "network_policy": "isolated",
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "github",
+            "repo": "netbirdio/netbird"
+          },
           "version": "0.71.2",
           "volumes": [
             {
@@ -3867,6 +4018,10 @@
             "network_policy": "isolated",
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "github",
+            "repo": "nextcloud/server"
+          },
           "version": "29",
           "volumes": [
             {
@@ -3887,12 +4042,12 @@
       "version": "latest"
     },
     "nostr-rs-relay": {
-      "image": "source.archipelago-foundation.org/lfg2025/nostr-rs-relay:0.9.0",
+      "image": "source.archipelago-foundation.org/lfg2025/nostr-rs-relay:0.10.0",
       "manifest": {
         "app": {
           "container": {
             "data_uid": "1000:1000",
-            "image": "scsibug/nostr-rs-relay:0.8.9",
+            "image": "scsibug/nostr-rs-relay:0.10.0",
             "image_signature": "cosign://...",
             "pull_policy": "verify-signature"
           },
@@ -3946,7 +4101,11 @@
             "seccomp_profile": "default",
             "user": 1000
           },
-          "version": "0.8.0",
+          "upstream": {
+            "kind": "github",
+            "repo": "scsibug/nostr-rs-relay"
+          },
+          "version": "0.10.0",
           "volumes": [
             {
               "options": [
@@ -3959,7 +4118,7 @@
           ]
         }
       },
-      "version": "0.9.0"
+      "version": "0.10.0"
     },
     "nostr-vpn": {
       "image": "source.archipelago-foundation.org/lfg2025/nostr-vpn:v0.3.7",
@@ -4039,6 +4198,10 @@
             "no_new_privileges": true,
             "readonly_root": true
           },
+          "upstream": {
+            "kind": "github",
+            "repo": "ACINQ/phoenixd"
+          },
           "version": "0.9.0",
           "volumes": [
             {
@@ -4122,6 +4285,10 @@
             "network_policy": "isolated",
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "github",
+            "repo": "photoprism/photoprism"
+          },
           "version": "240915",
           "volumes": [
             {
@@ -4148,7 +4315,7 @@
                 "key": "/var/lib/archipelago/pine/tls.key"
               }
             ],
-            "image": "docker.io/library/nginx:1.27-alpine",
+            "image": "docker.io/library/nginx:1.31.3-alpine",
             "network": "archy-net",
             "network_aliases": [
               "pine"
@@ -4252,6 +4419,10 @@
             "no_new_privileges": true,
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "dockerhub",
+            "repo": "library/nginx"
+          },
           "version": "1.3.0",
           "volumes": [
             {
@@ -4358,6 +4529,10 @@
             "no_new_privileges": true,
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "github",
+            "repo": "rhasspy/wyoming-openwakeword"
+          },
           "version": "2.1.0",
           "volumes": [
             {
@@ -4382,7 +4557,7 @@
               "--voice",
               "en_GB-alba-medium"
             ],
-            "image": "docker.io/rhasspy/wyoming-piper:2.2.2",
+            "image": "docker.io/rhasspy/wyoming-piper:2.4.2",
             "network": "archy-net",
             "network_aliases": [
               "pine-piper"
@@ -4438,7 +4613,11 @@
             "no_new_privileges": true,
             "readonly_root": false
           },
-          "version": "2.2.2",
+          "upstream": {
+            "kind": "github",
+            "repo": "rhasspy/wyoming-piper"
+          },
+          "version": "2.4.2",
           "volumes": [
             {
               "options": [
@@ -4451,7 +4630,7 @@
           ]
         }
       },
-      "version": "2.2.2"
+      "version": "2.4.2"
     },
     "pine-whisper": {
       "manifest": {
@@ -4538,13 +4717,13 @@
       "version": "3.4.2"
     },
     "portainer": {
-      "image": "source.archipelago-foundation.org/lfg2025/portainer:2.39.1",
+      "image": "source.archipelago-foundation.org/lfg2025/portainer:2.39.6",
       "manifest": {
         "app": {
           "category": "development",
           "container": {
             "data_uid": "1000:1000",
-            "image": "source.archipelago-foundation.org/lfg2025/portainer:2.39.1",
+            "image": "source.archipelago-foundation.org/lfg2025/portainer:2.39.6",
             "pull_policy": "if-not-present"
           },
           "dependencies": [
@@ -4602,6 +4781,10 @@
             "no_new_privileges": true,
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "github",
+            "repo": "portainer/portainer"
+          },
           "version": "2.19.4",
           "volumes": [
             {
@@ -4631,7 +4814,7 @@
           ]
         }
       },
-      "version": "2.39.1"
+      "version": "2.39.6"
     },
     "router": {
       "manifest": {
@@ -4711,6 +4894,9 @@
             "seccomp_profile": "default",
             "user": 1000
           },
+          "upstream": {
+            "kind": "internal"
+          },
           "version": "1.0.0",
           "volumes": [
             {
@@ -4789,6 +4975,10 @@
             "seccomp_profile": "default",
             "user": 1000
           },
+          "upstream": {
+            "kind": "github",
+            "repo": "searxng/searxng"
+          },
           "version": "1.0.0",
           "volumes": [
             {
@@ -4808,7 +4998,7 @@
       "manifest": {
         "app": {
           "container": {
-            "image": "dockurr/strfry:1.0.4",
+            "image": "dockurr/strfry:1.1.1",
             "image_signature": "cosign://...",
             "pull_policy": "verify-signature"
           },
@@ -4861,7 +5051,11 @@
             "readonly_root": true,
             "seccomp_profile": "default"
           },
-          "version": "0.9.0",
+          "upstream": {
+            "kind": "github",
+            "repo": "hoytech/strfry"
+          },
+          "version": "1.1.1",
           "volumes": [
             {
               "options": [
@@ -4882,7 +5076,7 @@
           ]
         }
       },
-      "version": "0.9.0"
+      "version": "1.1.1"
     },
     "tailscale": {
       "image": "source.archipelago-foundation.org/lfg2025/tailscale:stable",
@@ -4954,6 +5148,10 @@
             "network_policy": "isolated",
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "github",
+            "repo": "louislam/uptime-kuma"
+          },
           "version": "1.23.0",
           "volumes": [
             {
@@ -4970,11 +5168,11 @@
       "version": "1"
     },
     "vaultwarden": {
-      "image": "source.archipelago-foundation.org/lfg2025/vaultwarden:1.30.0-alpine",
+      "image": "source.archipelago-foundation.org/lfg2025/vaultwarden:1.37.1-alpine",
       "manifest": {
         "app": {
           "container": {
-            "image": "source.archipelago-foundation.org/lfg2025/vaultwarden:1.30.0-alpine",
+            "image": "source.archipelago-foundation.org/lfg2025/vaultwarden:1.37.1-alpine",
             "network": "pasta",
             "pull_policy": "if-not-present"
           },
@@ -5037,6 +5235,10 @@
             "network_policy": "isolated",
             "readonly_root": false
           },
+          "upstream": {
+            "kind": "github",
+            "repo": "dani-garcia/vaultwarden"
+          },
           "version": "1.30.0",
           "volumes": [
             {
@@ -5050,11 +5252,11 @@
           ]
         }
       },
-      "version": "1.30.0-alpine"
+      "version": "1.37.1-alpine"
     }
   },
   "schema": 1,
-  "signature": "0aaf681435434b6e325269745d1fc3f90686c5391525d6b591666d6e36097bef0e5b999e2b9fe37d7a945e59aa40db74ed618824ab78c7fc6af73271c62ff20a",
+  "signature": "97628de24e3ffa17f639c663e19881cf6dea8c79aab272fe9c5442a4e951b3f0d257fee21aa9ce6158e3824b56a337acb71805f6fd34245e48345b86b46ec007",
   "signed_by": "did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT",
-  "updated": "2026-08-13"
+  "updated": "2026-08-19"
 }