Fixhancement: crowdsec widget improvements (#7075)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/release-drafter.yml

@@ -10,6 +10,7 @@ version-resolver:
       - 'breaking-change'
   minor:
     labels:
+      - 'minor'
       - 'enhancement'
       - 'feature'
   patch:

.github/workflows/crowdin.yml

@@ -10,6 +10,10 @@ on:
     ]
     branches: [ dev ]
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   synchronize-with-crowdin:
     name: Crowdin Sync
@@ -19,7 +23,7 @@ jobs:
     - name: Checkout
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: crowdin action
-      uses: crowdin/github-action@c7af9bc98b01694653031fef2a0dc6c7888ce9bc # v2
+      uses: crowdin/github-action@8f01d54f70f1713ee3f09d82c2bbb2daeac28689 # v2
       with:
         upload_translations: false
         download_translations: true

.github/workflows/docker-publish.yml

@@ -17,6 +17,8 @@ on:
 env:
   IMAGE_NAME: ${{ github.repository }}
 
+permissions: {}
+
 jobs:
 
 
@@ -27,7 +29,6 @@ jobs:
     permissions:
       contents: read
       packages: write
-      id-token: write
 
     steps:
       - name: Checkout repository
@@ -101,7 +102,7 @@ jobs:
         uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
 
       - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
 
       - name: Build and push Docker image
         id: build-and-push

.github/workflows/docs-publish.yml

@@ -10,8 +10,6 @@ on:
 
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 jobs:
 
@@ -25,7 +23,7 @@ jobs:
         with:
           python-version-file: ".python-version"
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
       - run: sudo apt-get install pngquant
       - name: Test Docs Build
         run: uv run --frozen zensical build --clean
@@ -33,6 +31,10 @@ jobs:
     name: Build & Deploy Docs
     if: github.repository == 'gethomepage/homepage' && github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
@@ -43,7 +45,7 @@ jobs:
         with:
           python-version-file: ".python-version"
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
       - run: sudo apt-get install pngquant
       - name: Build Docs
         run: uv run --frozen zensical build --clean

.github/workflows/issue-triage.yml

@@ -6,15 +6,15 @@ on:
   discussion:
     types: [labeled]
 
-permissions:
-  discussions: write
-  issues: write
+permissions: {}
 
 jobs:
   close-needs-discussion:
     name: Issues Need Discussion
     if: github.event_name == 'issues' && github.event.label.name == 'needs-discussion'
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
     steps:
       - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
@@ -49,6 +49,8 @@ jobs:
     name: Discussions Need Information
     if: github.event_name == 'discussion' && github.event.label.name == 'needs-information'
     runs-on: ubuntu-latest
+    permissions:
+      discussions: write
     steps:
       - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:

.github/workflows/lint.yml

@@ -6,6 +6,9 @@ on:
   workflow_dispatch:
   merge_group:
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     name: Linting Checks

.github/workflows/pr-quality.yml

@@ -2,7 +2,6 @@ name: PR Quality
 
 permissions:
   contents: read
-  issues: read
   pull-requests: write
 
 on:

.github/workflows/pr-triage.yml

@@ -5,7 +5,6 @@ on:
     types: [labeled]
 
 permissions:
-  issues: write
   pull-requests: write
 
 jobs:

.github/workflows/repo-maintenance.yml

@@ -5,10 +5,7 @@ on:
     - cron: '0 3 * * *'
   workflow_dispatch:
 
-permissions:
-  issues: write
-  pull-requests: write
-  discussions: write
+permissions: {}
 
 concurrency:
   group: lock
@@ -17,6 +14,9 @@ jobs:
   stale:
     name: 'Stale'
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
     steps:
       - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10
         with:
@@ -31,6 +31,10 @@ jobs:
   lock-threads:
     name: 'Lock Old Threads'
     runs-on: ubuntu-latest
+    permissions:
+      discussions: write
+      issues: write
+      pull-requests: write
     steps:
       - uses: dessant/lock-threads@89ae32b08ed1a541efecbab17912962a5e38981c # v6.0.2
         with:
@@ -56,6 +60,8 @@ jobs:
   close-answered-discussions:
     name: 'Close Answered Discussions'
     runs-on: ubuntu-latest
+    permissions:
+      discussions: write
     steps:
       - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
@@ -112,6 +118,8 @@ jobs:
   close-outdated-discussions:
     name: 'Close Outdated Discussions'
     runs-on: ubuntu-latest
+    permissions:
+      discussions: write
     steps:
       - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
@@ -203,6 +211,8 @@ jobs:
   close-unsupported-feature-requests:
     name: 'Close Unsupported Feature Requests'
     runs-on: ubuntu-latest
+    permissions:
+      discussions: write
     steps:
       - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:

.github/workflows/test.yml

@@ -5,6 +5,9 @@ on:
   push:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   vitest:
     runs-on: ubuntu-latest

docs/configs/custom-css-js.md

@@ -7,6 +7,10 @@ As of version v0.6.30 homepage supports adding your own custom css & javascript.
 
 To add custom css simply edit the `custom.css` file under your config directory, similarly for javascript you would edit `custom.js`. You can then target elements in homepage with various classes / ids to customize things to your liking.
 
+!!! warning
+
+    When Homepage authentication is enabled, `custom.css` remains publicly accessible so it can style the sign-in page. Do not include secrets or sensitive internal URLs in this file. `custom.js` remains protected and is only loaded after authentication.
+
 You can also set a specific `id` for a service or bookmark to target with your custom css or javascript, e.g.
 
 ```yaml

docs/configs/mcp.md

@@ -49,6 +49,23 @@ environment:
   HOMEPAGE_MCP_TOKEN: "generate-with-openssl-rand-base64-32"
 ```
 
+## Connecting Claude Desktop
+
+Claude Desktop can use [`mcp-remote`](https://www.npmjs.com/package/mcp-remote) to communicate with the homepage MCP endpoint in `claude_desktop_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "homepage": {
+      "command": "npx",
+      "args": ["-y", "mcp-remote", "http://localhost:3000/api/mcp", "--header", "X-Homepage-MCP-Token: your-token"]
+    }
+  }
+}
+```
+
+The **Add custom connector** option will not work: remote connectors authenticate with OAuth and cannot supply `HOMEPAGE_MCP_TOKEN`.
+
 ## Read-only by default
 
 The MCP endpoint exposes tools for reading and validating supported Homepage config files. File writes are disabled unless you opt in with:

docs/installation/index.md

@@ -74,6 +74,6 @@ For OIDC login (overrides password login):
 
     Homepage grants access to any identity that the configured OIDC provider authorizes for this client. Configure client assignments, groups, or access policies at the identity provider. Homepage does not apply additional claim-based authorization.
 
-All app pages and `/api` routes except `/api/healthcheck` will require a signed-in session. Static assets remain public.
+All app pages and `/api` routes except `/api/healthcheck` and `/api/config/custom.css` will require a signed-in session. Static assets remain public.
 
 Configure your OIDC provider with the a callback URI like `https://homepage.example.com/api/auth/callback/homepage-oidc`.

docs/widgets/authoring/getting-started.md

@@ -85,6 +85,7 @@ To ensure cohesiveness of various widgets, the following should be used as a gui
 - Note that we reserve the right to decline widgets for projects that are very young (eg < ~1y) or those with a small reach (eg low GitHub stars). Again, this is in an effort to keep overall widget maintenance under control.
 - Widgets should be only one row of blocks
 - Widgets should be no more than 4 blocks wide and generally conform to the styling / design choices of other widgets
+- Use `withWidgetFields(service, defaultFields)` from `utils/widget-fields` to apply default fields and cap configured fields without mutating the service. The helper limits widgets to 4 fields.
 - Minimize the number of API calls
 - Avoid the use of custom proxy unless absolutely necessary
 - Widgets should be 'read-only', as in they should not make write changes using the relevant tool's API. Homepage widgets are designed to surface information, not to be a (usually worse) replacement for the tool itself.

docs/widgets/services/authentik.md

@@ -5,7 +5,7 @@ description: Authentik Widget Configuration
 
 Learn more about [Authentik](https://github.com/goauthentik/authentik).
 
-This widget reads the number of active users in the system, as well as logins for the last 24 hours.
+This widget reads the number of active users in the system, as well as logins for the last 24 hours, and authorizations when using widget version 2.
 
 You will need to generate an API token for an existing user under `Admin Portal` > `Directory` > `Tokens & App passwords`.
 Make sure to set Intent to "API Token".
@@ -15,7 +15,7 @@ The account you made the API token for also needs the following **Assigned globa
 - authentik Core -> Can view User (Model: User)
 - authentik Events -> Can view Event (Model: Event)
 
-Allowed fields: `["users", "loginsLast24H", "failedLoginsLast24H"]`.
+Allowed fields: `["users", "loginsLast24H", "failedLoginsLast24H", "authorizationsLast24H"]` (`authorizationsLast24H` works with v2 only).
 
 | Authentik Version | Homepage Widget Version |
 | ----------------- | ----------------------- |

docs/widgets/services/crowdsec.md

@@ -9,7 +9,9 @@ See the [crowdsec docs](https://docs.crowdsec.net/docs/local_api/intro/#machines
 in most instances you can use the default credentials (`/etc/crowdsec/local_api_credentials.yaml`).
 
 !!! note
-Without the `limit24h` option, the widget will fetch all alerts which is limited to 100 by the API to avoid performance issues.
+
+    `alerts` counts alerts raised by your own engine in the last 24 hours. Alerts originating from the
+    CrowdSec community blocklist are excluded.
 
 Allowed fields: `["alerts", "bans"]`.
 
@@ -19,5 +21,4 @@ widget:
   url: http://crowdsechostorip:port
   username: localhost # machine_id in crowdsec
   password: password
-  limit24h: true # optional, limits alerts to last 24h. Default: false
 ```

docs/widgets/services/proxmoxbackupserver.md

@@ -15,5 +15,5 @@ widget:
   url: https://proxmoxbackupserver.host:port
   username: api_token_id
   password: api_token_secret
-  datastore: datastore_name #optional; if ommitted, will display a combination of all datastores used / total
+  datastore: datastore_name #optional; if omitted, will display a combination of all datastores used / total
 ```

docs/widgets/services/pulse.md

@@ -12,5 +12,6 @@ widget:
   type: pulse
   url: http://pulse.host.or.ip:7655
   key: your-api-token # `monitoring:read` scope is required
+  version: 2 # required for Pulse v6, defaults to 1
   fields: ["nodes", "vms", "lxcs"] # optional
 ```

eslint.config.mjs

@@ -17,6 +17,8 @@ const compat = new FlatCompat({
 
 export default defineConfig([
   {
+    files: ["**/*.{js,mjs,cjs,jsx}"],
+
     extends: fixupConfigRules(compat.extends("next/core-web-vitals", "prettier", "plugin:react-hooks/recommended")),
 
     plugins: {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "homepage",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "private": true,
   "scripts": {
     "preinstall": "npx only-allow pnpm",
@@ -15,7 +15,7 @@
   },
   "dependencies": {
     "@headlessui/react": "^2.2.10",
-    "@kubernetes/client-node": "^1.4.0",
+    "@kubernetes/client-node": "^2.0.0",
     "classnames": "^2.5.1",
     "compare-versions": "^6.1.1",
     "dockerode": "^5.0.0",
@@ -23,7 +23,7 @@
     "gamedig": "^5.3.3",
     "i18next": "^26.3.6",
     "ical.js": "^2.2.1",
-    "js-yaml": "^4.3.1",
+    "js-yaml": "^5.3.0",
     "json-rpc-2.0": "^1.7.1",
     "luxon": "^3.7.2",
     "memory-cache": "^0.2.0",
@@ -39,7 +39,7 @@
     "react-i18next": "^17.0.11",
     "react-icons": "^5.6.0",
     "recharts": "^3.1.2",
-    "swr": "^2.4.2",
+    "swr": "^2.5.1",
     "systeminformation": "^5.33.1",
     "tough-cookie": "^6.0.2",
     "urbackup-server-api": "^0.92.2",
@@ -53,7 +53,7 @@
     "@eslint/js": "^9.39.4",
     "@tailwindcss/forms": "^0.5.11",
     "@tailwindcss/postcss": "^4.3.3",
-    "@testing-library/jest-dom": "^7.0.0",
+    "@testing-library/jest-dom": "^7.0.1",
     "@testing-library/react": "^16.3.0",
     "@vitest/coverage-v8": "^4.1.10",
     "eslint": "^9.25.1",
@@ -63,7 +63,7 @@
     "eslint-plugin-jsx-a11y": "^6.10.2",
     "eslint-plugin-prettier": "^5.5.6",
     "eslint-plugin-react": "^7.37.4",
-    "eslint-plugin-react-hooks": "^5.2.0",
+    "eslint-plugin-react-hooks": "^7.1.1",
     "jsdom": "^30.0.1",
     "postcss": "^8.5.26",
     "prettier": "^3.8.4",

public/images/solisquad.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 10 10"><circle cx="5" cy="5" r="4"/></svg>

public/locales/af/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Gebruikers",
         "loginsLast24H": "Aantekenings (24h)",
-        "failedLoginsLast24H": "Mislukte Aantekenings (24h)"
+        "failedLoginsLast24H": "Mislukte Aantekenings (24h)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "GEH",

public/locales/ar/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "المستخدمون",
         "loginsLast24H": "تسجيلات الدخول (٢٤س)",
-        "failedLoginsLast24H": "فشل تسجيلات الدخول (٢٤س)"
+        "failedLoginsLast24H": "فشل تسجيلات الدخول (٢٤س)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "الذاكرة",

public/locales/bg/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Потребители",
         "loginsLast24H": "Logins (24h)",
-        "failedLoginsLast24H": "Failed Logins (24h)"
+        "failedLoginsLast24H": "Failed Logins (24h)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "MEM",

public/locales/ca/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Usuaris",
         "loginsLast24H": "Inicis de sessió (24h)",
-        "failedLoginsLast24H": "Errors d'inici de sessió (24h)"
+        "failedLoginsLast24H": "Errors d'inici de sessió (24h)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "MEM",

public/locales/cs/common.json

@@ -21,7 +21,7 @@
         "seconds": "s"
     },
     "auth": {
-        "signout": "Sign out"
+        "signout": "Odhlásit se"
     },
     "widget": {
         "missing_type": "Chybí typ widgetu: {{type}}",
@@ -75,13 +75,13 @@
         "no_data": "Nejsou k dispozici žádná data úložiště"
     },
     "duplicati": {
-        "jobs": "Jobs",
-        "stored": "Stored",
-        "lastBackup": "Last Run",
-        "nextRun": "Next Run",
-        "running": "Running",
-        "warnings": "Warnings",
-        "errors": "Errors"
+        "jobs": "Úlohy",
+        "stored": "Uloženo",
+        "lastBackup": "Naposledy spuštěno",
+        "nextRun": "Další spuštění",
+        "running": "Běží",
+        "warnings": "Upozornění",
+        "errors": "Chyby"
     },
     "docker": {
         "rx": "RX",
@@ -133,7 +133,7 @@
         "series": "Seriály",
         "episodes": "Epizody",
         "songs": "Skladby",
-        "albums": "Albums"
+        "albums": "Alba"
     },
     "esphome": {
         "offline": "Offline",
@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Uživatelé",
         "loginsLast24H": "Příhlášení (24h)",
-        "failedLoginsLast24H": "Neúspěšná přihlášení (24h)"
+        "failedLoginsLast24H": "Neúspěšná přihlášení (24h)",
+        "authorizationsLast24H": "Autorizace (24h)"
     },
     "proxmox": {
         "mem": "Využití paměti",
@@ -951,15 +952,15 @@
         "storage": "Úložiště"
     },
     "maintainerr": {
-        "itemsHandled": "Items Handled",
-        "episodesHandled": "Episodes Handled",
-        "moviesHandled": "Movies Handled",
-        "showsHandled": "Shows Handled",
-        "seasonsHandled": "Seasons Handled",
-        "reclaimable": "Reclaimable",
-        "movieReclaimable": "Movie Reclaimable",
-        "showReclaimable": "Show Reclaimable",
-        "totalCapacity": "Total Capacity"
+        "itemsHandled": "Zpracované položky",
+        "episodesHandled": "Zpracované epizody",
+        "moviesHandled": "Zpracované filmy",
+        "showsHandled": "Zpracované seriály",
+        "seasonsHandled": "Zpracované série",
+        "reclaimable": "Uvolnitelné",
+        "movieReclaimable": "Uvolnitelné filmy",
+        "showReclaimable": "Uvolnitelné seriály",
+        "totalCapacity": "Celková kapacita"
     },
     "netdata": {
         "warnings": "Upozornění",
@@ -1241,14 +1242,14 @@
         "steps": "Kroky"
     },
     "syncthing": {
-        "connected": "Connected",
-        "synced": "Synced",
-        "errors": "Errors",
-        "storage": "Storage"
+        "connected": "Připojeno",
+        "synced": "Synchronizováno",
+        "errors": "Chyby",
+        "storage": "Úložiště"
     },
     "sportarr": {
-        "wanted": "Wanted",
-        "queued": "Queued",
-        "leagues": "Leagues"
+        "wanted": "Požadované",
+        "queued": "Ve frontě",
+        "leagues": "Ligy"
     }
 }

public/locales/da/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Users",
         "loginsLast24H": "Login (24 timer)",
-        "failedLoginsLast24H": "Mislykkede logins (24 timer)"
+        "failedLoginsLast24H": "Mislykkede logins (24 timer)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "MEM",

public/locales/de/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Benutzer",
         "loginsLast24H": "Anmeldungen (24 h)",
-        "failedLoginsLast24H": "Fehlversuche (24 h)"
+        "failedLoginsLast24H": "Fehlversuche (24 h)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "RAM",

public/locales/el/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Users",
         "loginsLast24H": "Συνδέσεις (24h)",
-        "failedLoginsLast24H": "Αποτυχημένες Συνδέσεις (24h)"
+        "failedLoginsLast24H": "Αποτυχημένες Συνδέσεις (24h)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "MEM",

public/locales/en/common.json

@@ -39,7 +39,9 @@
         "wait": "Please wait"
     },
     "search": {
-        "placeholder": "Search…"
+        "placeholder": "Search…",
+        "provider": "Search engine: {{name}}",
+        "select_provider": "Select search engine"
     },
     "resources": {
         "cpu": "CPU",
@@ -471,7 +473,8 @@
     "authentik": {
         "users": "Users",
         "loginsLast24H": "Logins (24h)",
-        "failedLoginsLast24H": "Failed Logins (24h)"
+        "failedLoginsLast24H": "Failed Logins (24h)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "MEM",

public/locales/eo/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Users",
         "loginsLast24H": "Logins (24h)",
-        "failedLoginsLast24H": "Failed Logins (24h)"
+        "failedLoginsLast24H": "Failed Logins (24h)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "MEM",

public/locales/es/common.json

@@ -133,7 +133,7 @@
         "series": "Series",
         "episodes": "Episodios",
         "songs": "Canciones",
-        "albums": "Albums"
+        "albums": "Álbumes"
     },
     "esphome": {
         "offline": "Fuera de línea",
@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Usuarios",
         "loginsLast24H": "Inicios de sesión (24h)",
-        "failedLoginsLast24H": "Inicios de sesión fallidos (24h)"
+        "failedLoginsLast24H": "Inicios de sesión fallidos (24h)",
+        "authorizationsLast24H": "Autenticaciones (24 h)"
     },
     "proxmox": {
         "mem": "MEM",

public/locales/eu/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Users",
         "loginsLast24H": "Logins (24h)",
-        "failedLoginsLast24H": "Failed Logins (24h)"
+        "failedLoginsLast24H": "Failed Logins (24h)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "MEM",

public/locales/fi/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Users",
         "loginsLast24H": "Kirjautumisia (24h)",
-        "failedLoginsLast24H": "Epäonnistuneita kirjautumisia (24h)"
+        "failedLoginsLast24H": "Epäonnistuneita kirjautumisia (24h)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "MEM",

public/locales/fr/common.json

@@ -21,7 +21,7 @@
         "seconds": "s"
     },
     "auth": {
-        "signout": "Sign out"
+        "signout": "Se déconnecter"
     },
     "widget": {
         "missing_type": "Type de widget manquant : {{type}}",
@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Utilisateurs",
         "loginsLast24H": "Connexions (24 h)",
-        "failedLoginsLast24H": "Connexions échouées (24 h)"
+        "failedLoginsLast24H": "Connexions échouées (24 h)",
+        "authorizationsLast24H": "Authentifications (24h)"
     },
     "proxmox": {
         "mem": "RAM",

public/locales/he/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "משתמשים",
         "loginsLast24H": "כניסות (24h)",
-        "failedLoginsLast24H": "כניסות שנכשלו (24h)"
+        "failedLoginsLast24H": "כניסות שנכשלו (24h)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "זיכרון",

public/locales/hi/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Users",
         "loginsLast24H": "Logins (24h)",
-        "failedLoginsLast24H": "Failed Logins (24h)"
+        "failedLoginsLast24H": "Failed Logins (24h)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "MEM",

public/locales/hr/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Korisnici",
         "loginsLast24H": "Prijave (24 h)",
-        "failedLoginsLast24H": "Neuspjele prijave (24 h)"
+        "failedLoginsLast24H": "Neuspjele prijave (24 h)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "MEM",

public/locales/hu/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Felhasználók",
         "loginsLast24H": "Bejelentkezések (24 óra)",
-        "failedLoginsLast24H": "Sikertelen bejelentkezések (24h)"
+        "failedLoginsLast24H": "Sikertelen bejelentkezések (24h)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "MEM",

public/locales/id/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Users",
         "loginsLast24H": "Login (24j)",
-        "failedLoginsLast24H": "Login Gagal (24j)"
+        "failedLoginsLast24H": "Login Gagal (24j)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "MEM",

public/locales/it/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Utenti",
         "loginsLast24H": "Accessi (24h)",
-        "failedLoginsLast24H": "Accessi Falliti (24h)"
+        "failedLoginsLast24H": "Accessi Falliti (24h)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "MEM",

public/locales/ja/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Users",
         "loginsLast24H": "ログイン (24時間)",
-        "failedLoginsLast24H": "ログイン失敗(24時間)"
+        "failedLoginsLast24H": "ログイン失敗(24時間)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "MEM",

public/locales/ko/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "사용자",
         "loginsLast24H": "로그인 (24시간)",
-        "failedLoginsLast24H": "실패한 로그인 (24시간)"
+        "failedLoginsLast24H": "실패한 로그인 (24시간)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "메모리",

public/locales/lv/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Users",
         "loginsLast24H": "Logins (24h)",
-        "failedLoginsLast24H": "Failed Logins (24h)"
+        "failedLoginsLast24H": "Failed Logins (24h)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "MEM",

public/locales/ms/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Users",
         "loginsLast24H": "Logmasuk (24j)",
-        "failedLoginsLast24H": "Logmasuk Gagal (24j)"
+        "failedLoginsLast24H": "Logmasuk Gagal (24j)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "MEM",

public/locales/nl/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Gebruikers",
         "loginsLast24H": "Logins (24u)",
-        "failedLoginsLast24H": "Mislukte Logins (24u)"
+        "failedLoginsLast24H": "Mislukte Logins (24u)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "GEH",

public/locales/no/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Users",
         "loginsLast24H": "Logins (24h)",
-        "failedLoginsLast24H": "Mislykket innlogginger (24t)"
+        "failedLoginsLast24H": "Mislykket innlogginger (24t)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "MEM",

public/locales/pl/common.json

@@ -21,7 +21,7 @@
         "seconds": "s"
     },
     "auth": {
-        "signout": "Sign out"
+        "signout": "Wyloguj się"
     },
     "widget": {
         "missing_type": "Brakujący typ widżetu: {{type}}",
@@ -133,7 +133,7 @@
         "series": "Seriale",
         "episodes": "Odcinki",
         "songs": "Piosenki",
-        "albums": "Albums"
+        "albums": "Albumy"
     },
     "esphome": {
         "offline": "Offline",
@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Użytkownicy",
         "loginsLast24H": "Logowania (24h)",
-        "failedLoginsLast24H": "Nieudane logowania (24h)"
+        "failedLoginsLast24H": "Nieudane logowania (24h)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "RAM",

public/locales/pt_BR/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Usuários",
         "loginsLast24H": "Inícios de sessão (24h)",
-        "failedLoginsLast24H": "Inícios de sessão falhados (24h)"
+        "failedLoginsLast24H": "Inícios de sessão falhados (24h)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "MEM",

public/locales/ro/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Users",
         "loginsLast24H": "Autentificări (24h)",
-        "failedLoginsLast24H": "Conectări eșuate (24h)"
+        "failedLoginsLast24H": "Conectări eșuate (24h)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "MEM",

public/locales/ru/common.json

@@ -21,7 +21,7 @@
         "seconds": "сек"
     },
     "auth": {
-        "signout": "Sign out"
+        "signout": "Выход"
     },
     "widget": {
         "missing_type": "Отсутствует тип виджета: {{type}}",
@@ -75,13 +75,13 @@
         "no_data": "Нет доступных данных о хранилище"
     },
     "duplicati": {
-        "jobs": "Jobs",
-        "stored": "Stored",
-        "lastBackup": "Last Run",
-        "nextRun": "Next Run",
-        "running": "Running",
-        "warnings": "Warnings",
-        "errors": "Errors"
+        "jobs": "Работы",
+        "stored": "Сохранено",
+        "lastBackup": "Последний запуск",
+        "nextRun": "Следующий запуск",
+        "running": "Запущено",
+        "warnings": "Предупреждения",
+        "errors": "Ошибки"
     },
     "docker": {
         "rx": "RX",
@@ -133,7 +133,7 @@
         "series": "Сериалы",
         "episodes": "Эпизоды",
         "songs": "Песни",
-        "albums": "Albums"
+        "albums": "Альбомы"
     },
     "esphome": {
         "offline": "Не в сети",
@@ -235,17 +235,17 @@
     "rutorrent": {
         "active": "Активно",
         "upload": "Отдача",
-        "download": "Скачивание"
+        "download": "Загрузка"
     },
     "transmission": {
-        "download": "Скачивание",
+        "download": "Загрузка",
         "upload": "Отдача",
         "leech": "Лич",
         "seed": "Сид"
     },
     "qbittorrent": {
-        "download": "Скачивание",
-        "upload": "Загрузка",
+        "download": "Загрузка",
+        "upload": "Отдача",
         "leech": "Лич",
         "seed": "Сид"
     },
@@ -258,8 +258,8 @@
         "invalid": "Некорректный"
     },
     "deluge": {
-        "download": "Скачивание",
-        "upload": "Загрузка",
+        "download": "Загрузка",
+        "upload": "Отдача",
         "leech": "Лич",
         "seed": "Сид"
     },
@@ -268,8 +268,8 @@
         "cachemissbytes": "Мисс байты кэша"
     },
     "downloadstation": {
-        "download": "Скачивание",
-        "upload": "Загрузка",
+        "download": "Загрузка",
+        "upload": "Отдача",
         "leech": "Лич",
         "seed": "Сид"
     },
@@ -334,8 +334,8 @@
         "latency": "Задержка"
     },
     "speedtest": {
-        "upload": "Загрузка",
-        "download": "Скачивание",
+        "upload": "Отдача",
+        "download": "Загрузка",
         "ping": "Пинг"
     },
     "portainer": {
@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Пользователи",
         "loginsLast24H": "Входы (24ч)",
-        "failedLoginsLast24H": "Неудачные входы (24ч)"
+        "failedLoginsLast24H": "Неудачные входы (24ч)",
+        "authorizationsLast24H": "Входы (24ч)"
     },
     "proxmox": {
         "mem": "Память",
@@ -480,9 +481,9 @@
         "vms": "Виртуальные машины"
     },
     "pulse": {
-        "nodes": "Nodes",
-        "vms": "VMs",
-        "lxcs": "LXCs"
+        "nodes": "Узлы",
+        "vms": "Виртуальные машины",
+        "lxcs": "Контейнеры LXC"
     },
     "glances": {
         "cpu": "ЦП",
@@ -581,7 +582,7 @@
         "up": "В сети",
         "pending": "Ожидают",
         "down": "Не в сети",
-        "ok": "Ok"
+        "ok": "OK"
     },
     "healthchecks": {
         "new": "Новый",
@@ -649,7 +650,7 @@
         "total": "Всего"
     },
     "pangolin": {
-        "orgs": "Orgs",
+        "orgs": "Организации",
         "sites": "Сайты",
         "resources": "Ресурсы",
         "targets": "Цели",
@@ -687,7 +688,7 @@
         "limit": "Лимит"
     },
     "opnsense": {
-        "cpu": "ЦП",
+        "cpu": "Нагрузка ЦП",
         "memory": "Активно ОЗУ",
         "wanUpload": "WAN Загрузка",
         "wanDownload": "WAN скачивание"
@@ -822,7 +823,7 @@
         "gross_percent_today": "Сегодня",
         "gross_percent_1y": "Один год",
         "gross_percent_max": "Все время",
-        "net_worth": "Net Worth"
+        "net_worth": "Общая стоимость"
     },
     "audiobookshelf": {
         "podcasts": "Подкасты",
@@ -951,15 +952,15 @@
         "storage": "Хранилище"
     },
     "maintainerr": {
-        "itemsHandled": "Items Handled",
-        "episodesHandled": "Episodes Handled",
-        "moviesHandled": "Movies Handled",
-        "showsHandled": "Shows Handled",
-        "seasonsHandled": "Seasons Handled",
-        "reclaimable": "Reclaimable",
-        "movieReclaimable": "Movie Reclaimable",
-        "showReclaimable": "Show Reclaimable",
-        "totalCapacity": "Total Capacity"
+        "itemsHandled": "Элементы обрабатываются",
+        "episodesHandled": "Серии обрабатываются",
+        "moviesHandled": "Фильмы обрабатываются",
+        "showsHandled": "Шоу обрабатываются",
+        "seasonsHandled": "Сезоны обрабатываются",
+        "reclaimable": "Восстановленные",
+        "movieReclaimable": "Восстановленный фильм",
+        "showReclaimable": "Восстановленное шоу",
+        "totalCapacity": "Общая ёмкость"
     },
     "netdata": {
         "warnings": "Предупреждения",
@@ -968,7 +969,7 @@
     "ntfy": {
         "title": "Название",
         "priority": "Приоритет",
-        "lastReceived": "Last Received",
+        "lastReceived": "Последние полученные",
         "message": "Сообщение",
         "tags": "Теги",
         "none": "Отсутствует",
@@ -1105,7 +1106,7 @@
         "apps": "Приложения",
         "synced": "Синхронизированные",
         "outOfSync": "Не синхронизированные",
-        "healthy": "Healthy",
+        "healthy": "Здоров",
         "degraded": "Деградированные",
         "progressing": "Выполняются",
         "missing": "Отсутствует",
@@ -1152,18 +1153,18 @@
         "other": "Другое"
     },
     "checkmk": {
-        "serviceErrors": "Service issues",
-        "hostErrors": "Host issues"
+        "serviceErrors": "Проблемы сервиса",
+        "hostErrors": "Проблемы узла"
     },
     "komodo": {
         "total": "Всего",
         "running": "Запущено",
         "stopped": "Остановлено",
         "down": "Не в сети",
-        "unhealthy": "Unhealthy",
+        "unhealthy": "Неисправен",
         "unknown": "Неизвестно",
         "servers": "Серверы",
-        "stacks": "Stacks",
+        "stacks": "Стеки",
         "containers": "Контейнеры"
     },
     "filebrowser": {
@@ -1186,7 +1187,7 @@
         "DISABLE_DISK": "Диск отключен",
         "SWAP_DSBL": "Swap отключён",
         "INVALID_EXPANSION": "Неверное Расширение",
-        "PARITY_NOT_BIGGEST": "Parity Not Biggest",
+        "PARITY_NOT_BIGGEST": "Четность не наибольшая",
         "TOO_MANY_MISSING_DISKS": "Слишком много отсутствующих дисков",
         "NEW_DISK_TOO_SMALL": "Новый диск слишком мал",
         "NO_DATA_DISKS": "Нет дисков данных",
@@ -1195,18 +1196,18 @@
         "cpu": "ЦП",
         "memoryUsed": "Использовано ОЗУ",
         "memoryAvailable": "Доступная память",
-        "arrayUsed": "Array Used",
-        "arrayFree": "Array Free",
+        "arrayUsed": "Используемый массив",
+        "arrayFree": "Свободный массив",
         "poolUsed": "{{pool}} Использовано",
         "poolFree": "{{pool}} Свободно"
     },
     "backrest": {
-        "num_plans": "Plans",
-        "num_success_30": "Successes",
+        "num_plans": "Планы",
+        "num_success_30": "Успешные",
         "num_failure_30": "Ошибки",
-        "num_success_latest": "Succeeding",
-        "num_failure_latest": "Failing",
-        "bytes_added_30": "Bytes Added"
+        "num_success_latest": "Успешно",
+        "num_failure_latest": "Неудачные",
+        "bytes_added_30": "Байты добавлены"
     },
     "yourspotify": {
         "songs": "Треков",
@@ -1235,20 +1236,20 @@
         "environment_not_found": "Среда не найдена"
     },
     "sparkyfitness": {
-        "eaten": "Eaten",
-        "burned": "Burned",
-        "remaining": "Remaining",
-        "steps": "Steps"
+        "eaten": "Съедено",
+        "burned": "Сожжено",
+        "remaining": "Осталось",
+        "steps": "Шаги"
     },
     "syncthing": {
-        "connected": "Connected",
-        "synced": "Synced",
-        "errors": "Errors",
-        "storage": "Storage"
+        "connected": "Подключено",
+        "synced": "Синхронизировано",
+        "errors": "Ошибки",
+        "storage": "Хранилище"
     },
     "sportarr": {
-        "wanted": "Wanted",
-        "queued": "Queued",
-        "leagues": "Leagues"
+        "wanted": "Требуется",
+        "queued": "В очереди",
+        "leagues": "Лиги"
     }
 }

public/locales/sk/common.json

@@ -21,7 +21,7 @@
         "seconds": "s"
     },
     "auth": {
-        "signout": "Sign out"
+        "signout": "Odhlásiť sa"
     },
     "widget": {
         "missing_type": "Chýba typ widgetu: {{type}}",
@@ -133,7 +133,7 @@
         "series": "Seriálov",
         "episodes": "Epizód",
         "songs": "Skladieb",
-        "albums": "Albums"
+        "albums": "Albumov"
     },
     "esphome": {
         "offline": "Nedostupné",
@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Používateľov",
         "loginsLast24H": "Prihlás. (24 hod.)",
-        "failedLoginsLast24H": "Neúspešné prihlás. (24 hod.)"
+        "failedLoginsLast24H": "Neúspešné prihlás. (24 hod.)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "RAM",
@@ -959,7 +960,7 @@
         "reclaimable": "Reclaimable",
         "movieReclaimable": "Movie Reclaimable",
         "showReclaimable": "Show Reclaimable",
-        "totalCapacity": "Total Capacity"
+        "totalCapacity": "Celková kapacita"
     },
     "netdata": {
         "warnings": "Upozornenia",
@@ -1248,7 +1249,7 @@
     },
     "sportarr": {
         "wanted": "Wanted",
-        "queued": "Queued",
+        "queued": "V poradí",
         "leagues": "Leagues"
     }
 }

public/locales/sl/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Users",
         "loginsLast24H": "Prijave (24h)",
-        "failedLoginsLast24H": "Neveljavne prijave (24h)"
+        "failedLoginsLast24H": "Neveljavne prijave (24h)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "MEM",

public/locales/sr/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Корисника",
         "loginsLast24H": "Пријаве (24ч)",
-        "failedLoginsLast24H": "Неуспешне пријаве (24ч)"
+        "failedLoginsLast24H": "Неуспешне пријаве (24ч)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "Меморија",

public/locales/sv/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Users",
         "loginsLast24H": "Inloggningar (24h)",
-        "failedLoginsLast24H": "Misslyckade inloggningar (24h)"
+        "failedLoginsLast24H": "Misslyckade inloggningar (24h)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "MEM",

public/locales/te/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Users",
         "loginsLast24H": "లాగిన్లు (24గం)",
-        "failedLoginsLast24H": "విఫలమైన లాగిన్‌లు (24గం)"
+        "failedLoginsLast24H": "విఫలమైన లాగిన్‌లు (24గం)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "MEM",

public/locales/th/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Users",
         "loginsLast24H": "Logins (24h)",
-        "failedLoginsLast24H": "Failed Logins (24h)"
+        "failedLoginsLast24H": "Failed Logins (24h)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "MEM",

public/locales/tr/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Kullanıcılar",
         "loginsLast24H": "Girişler (24 Saat)",
-        "failedLoginsLast24H": "Başarısız Girişler (24 Saat)"
+        "failedLoginsLast24H": "Başarısız Girişler (24 Saat)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "Bellek",

public/locales/uk/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Користувачі",
         "loginsLast24H": "Вхід (протягом доби)",
-        "failedLoginsLast24H": "Невдалі входи (протягом доби)"
+        "failedLoginsLast24H": "Невдалі входи (протягом доби)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "Пам'ять",

public/locales/vi/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Users",
         "loginsLast24H": "Logins (24h)",
-        "failedLoginsLast24H": "Failed Logins (24h)"
+        "failedLoginsLast24H": "Failed Logins (24h)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "MEM",

public/locales/yue/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Users",
         "loginsLast24H": "登錄（ 24小时）",
-        "failedLoginsLast24H": "登錄失敗（ 24鐘頭）"
+        "failedLoginsLast24H": "登錄失敗（ 24鐘頭）",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "MEM",

public/locales/zh-Hans/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Users",
         "loginsLast24H": "登录 (24h)",
-        "failedLoginsLast24H": "登录失败 (24h)"
+        "failedLoginsLast24H": "登录失败 (24h)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "内存",

public/locales/zh-Hant/common.json

@@ -471,7 +471,8 @@
     "authentik": {
         "users": "Users",
         "loginsLast24H": "登入 (過去 24 小時)",
-        "failedLoginsLast24H": "登入失敗 (過去 24 小時)"
+        "failedLoginsLast24H": "登入失敗 (過去 24 小時)",
+        "authorizationsLast24H": "Auths (24h)"
     },
     "proxmox": {
         "mem": "MEM",

src/__tests__/pages/api/auth/[...nextauth].test.js

@@ -73,6 +73,7 @@ describe("pages/api/auth/[...nextauth]", () => {
   it("routes sanitized NextAuth logs through the Homepage logger", async () => {
     const mod = await import("pages/api/auth/[...nextauth]");
     const sensitiveMetadata = {
+      error: Object.assign(new Error("State cookie was missing."), { access_token: "sensitive-access-token" }),
       clientSecret: "sensitive-client-secret",
       access_token: "sensitive-access-token",
       id_token: "sensitive-id-token",
@@ -82,7 +83,7 @@ describe("pages/api/auth/[...nextauth]", () => {
     mod.authOptions.logger.warn("NEXTAUTH_URL", sensitiveMetadata);
     mod.authOptions.logger.debug("OAUTH_CALLBACK_RESPONSE", sensitiveMetadata);
 
-    expect(errorMock).toHaveBeenCalledWith("%s", "OAUTH_CALLBACK_ERROR");
+    expect(errorMock).toHaveBeenCalledWith("%s: %s", "OAUTH_CALLBACK_ERROR", "State cookie was missing.");
     expect(warnMock).toHaveBeenCalledWith("%s", "NEXTAUTH_URL");
     expect(debugMock).toHaveBeenCalledWith("%s", "OAUTH_CALLBACK_RESPONSE");
     expect(JSON.stringify([...errorMock.mock.calls, ...warnMock.mock.calls, ...debugMock.mock.calls])).not.toContain(

src/__tests__/pages/auth/signin.test.jsx

@@ -3,21 +3,27 @@
 import { render, screen, waitFor } from "@testing-library/react";
 import { describe, expect, it, vi } from "vitest";
 
-const { getSettingsMock } = vi.hoisted(() => ({
+const { getSettingsMock, authOptionsMock } = vi.hoisted(() => ({
   getSettingsMock: vi.fn(),
+  authOptionsMock: vi.fn(),
 }));
 
 vi.mock("utils/config/config", () => ({
   getSettings: getSettingsMock,
 }));
 
+vi.mock("pages/api/auth/[...nextauth]", () => ({
+  get authOptions() {
+    return authOptionsMock();
+  },
+}));
+
 vi.mock("next/router", () => ({
   useRouter: () => ({
     query: {},
   }),
 }));
 
-import { getProviders } from "next-auth/react";
 import SignInPage, { getServerSideProps } from "pages/auth/signin";
 
 describe("pages/auth/signin", () => {
@@ -33,7 +39,7 @@ describe("pages/auth/signin", () => {
       />,
     );
 
-    expect(screen.getByText("Authentication not configured")).toBeInTheDocument();
+    expect(screen.getByText("Authentication error")).toBeInTheDocument();
 
     await waitFor(() => {
       expect(document.documentElement.classList.contains("dark")).toBe(true);
@@ -61,7 +67,7 @@ describe("pages/auth/signin", () => {
   });
 
   it("getServerSideProps returns providers and only public sign-in settings", async () => {
-    getProviders.mockResolvedValueOnce({ foo: { id: "foo", name: "Foo" } });
+    authOptionsMock.mockReturnValueOnce({ providers: [{ id: "foo", name: "Foo", type: "oauth" }] });
     getSettingsMock.mockReturnValueOnce({
       theme: "dark",
       color: "slate",
@@ -79,11 +85,10 @@ describe("pages/auth/signin", () => {
 
     const res = await getServerSideProps({});
 
-    expect(getProviders).toHaveBeenCalled();
     expect(getSettingsMock).toHaveBeenCalled();
     expect(res).toEqual({
       props: {
-        providers: { foo: { id: "foo", name: "Foo" } },
+        providers: { foo: { id: "foo", name: "Foo", type: "oauth" } },
         settings: {
           theme: "dark",
           color: "slate",
@@ -96,4 +101,53 @@ describe("pages/auth/signin", () => {
     expect(res.props.settings).not.toHaveProperty("providers");
     expect(res.props.settings).not.toHaveProperty("layout");
   });
+
+  it("getServerSideProps falls back to no providers when auth options fail to load", async () => {
+    const consoleError = vi.spyOn(console, "error").mockImplementation(() => {});
+    authOptionsMock.mockImplementationOnce(() => {
+      throw new Error("Homepage auth is enabled but HOMEPAGE_EXTERNAL_URL (or NEXTAUTH_URL) is missing.");
+    });
+    getSettingsMock.mockReturnValueOnce({ theme: "dark" });
+
+    const res = await getServerSideProps({});
+
+    expect(res.props.providers).toEqual({});
+    expect(consoleError).toHaveBeenCalled();
+    consoleError.mockRestore();
+  });
+
+  it("getServerSideProps passes only id, name and type from each provider", async () => {
+    authOptionsMock.mockReturnValueOnce({
+      providers: [
+        {
+          id: "homepage-oidc",
+          name: "Homepage OIDC",
+          type: "oauth",
+          issuer: "https://oidc.example",
+          clientId: "canary-client-id",
+          clientSecret: "canary-client-secret",
+          wellKnown: "https://oidc.example/.well-known/openid-configuration",
+          authorization: { params: { scope: "openid email profile" } },
+          profile: () => ({}),
+        },
+        {
+          id: "credentials",
+          name: "Password",
+          type: "credentials",
+          credentials: { password: { label: "Password", type: "password" } },
+          authorize: () => null,
+        },
+      ],
+    });
+    getSettingsMock.mockReturnValueOnce({ theme: "dark" });
+
+    const res = await getServerSideProps({});
+
+    expect(res.props.providers).toEqual({
+      "homepage-oidc": { id: "homepage-oidc", name: "Homepage OIDC", type: "oauth" },
+      credentials: { id: "credentials", name: "Password", type: "credentials" },
+    });
+    // These props get serialized into the sign-in page, which is unauthenticated
+    expect(JSON.stringify(res.props)).not.toMatch(/canary-client-secret|canary-client-id|oidc\.example/);
+  });
 });

src/__tests__/pages/index.test.jsx

@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 
-import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { act, fireEvent, render, screen, waitFor } from "@testing-library/react";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
 import { ColorContext } from "utils/contexts/color";
@@ -25,6 +25,7 @@ const {
     throwIn: null,
     validateData: [],
     hashData: null,
+    hashConfig: null,
     mutateHash: vi.fn(),
     servicesData: [],
     bookmarksData: [],
@@ -59,9 +60,12 @@ const {
   const serverSideTranslations = vi.fn(async (language) => ({ _translations: language }));
   const logger = { error: vi.fn() };
 
-  const useSWR = vi.fn((key) => {
+  const useSWR = vi.fn((key, config) => {
     if (key === "/api/validate") return { data: state.validateData };
-    if (key === "/api/hash") return { data: state.hashData, mutate: state.mutateHash };
+    if (key === "/api/hash") {
+      state.hashConfig = config;
+      return { data: state.hashData, mutate: state.mutateHash };
+    }
     if (key === "/api/services") return { data: state.servicesData };
     if (key === "/api/bookmarks") return { data: state.bookmarksData };
     if (key === "/api/widgets") return { data: state.widgetsData };
@@ -172,6 +176,7 @@ describe("pages/index getStaticProps", () => {
     state.throwIn = null;
     state.validateData = [];
     state.hashData = null;
+    state.hashConfig = null;
     state.servicesData = [];
     state.bookmarksData = [];
     state.widgetsData = [];
@@ -351,6 +356,7 @@ describe("pages/index Index routing + SWR branches", () => {
     }
 
     await renderIndex({ initialSettings: { title: "Homepage", layout: {} }, settings: { layout: {} } });
+    act(() => state.hashConfig.onSuccess(state.hashData));
 
     await waitFor(() => {
       expect(fetchSpy).toHaveBeenCalledWith("/api/revalidate");
@@ -379,11 +385,24 @@ describe("pages/index Index routing + SWR branches", () => {
     localStorage.removeItem("hash");
 
     await renderIndex({ initialSettings: { title: "Homepage", layout: {} }, settings: { layout: {} } });
+    act(() => state.hashConfig.onSuccess(state.hashData));
 
     await waitFor(() => {
       expect(localStorage.getItem("hash")).toBe("first-hash");
     });
   });
+
+  it("ignores a hash response without a hash", async () => {
+    state.validateData = [];
+    localStorage.setItem("hash", "old-hash");
+
+    await renderIndex({ initialSettings: { title: "Homepage", layout: {} }, settings: { layout: {} } });
+
+    expect(() => act(() => state.hashConfig.onSuccess(null))).not.toThrow();
+    expect(() => act(() => state.hashConfig.onSuccess({}))).not.toThrow();
+    expect(localStorage.getItem("hash")).toBe("old-hash");
+    expect(document.querySelector(".animate-spin")).toBeFalsy();
+  });
 });
 
 describe("pages/index Home behavior", () => {
@@ -419,11 +438,27 @@ describe("pages/index Home behavior", () => {
 
     fireEvent.keyDown(document.body, { key: "a" });
     expect(screen.getByTestId("quicklaunch")).toHaveTextContent("open:3");
+    expect(state.quickLaunchProps.searchString).toBe("a");
 
     fireEvent.keyDown(document.body, { key: "Escape" });
     expect(screen.getByTestId("quicklaunch")).toHaveTextContent("closed:3");
   });
 
+  it("opens search on space without seeding the query with whitespace", async () => {
+    await renderIndex({
+      initialSettings: { title: "Homepage", layout: {} },
+      settings: { title: "Homepage", layout: {}, language: "en" },
+    });
+
+    await waitFor(() => {
+      expect(state.quickLaunchProps).toBeTruthy();
+    });
+
+    fireEvent.keyDown(document.body, { key: " " });
+    expect(screen.getByTestId("quicklaunch")).toHaveTextContent("open:3");
+    expect(state.quickLaunchProps.searchString).toBe("");
+  });
+
   it("renders services and bookmark groups when present", async () => {
     await renderIndex({
       initialSettings: { title: "Homepage", layout: {} },
@@ -489,7 +524,7 @@ describe("pages/index Home behavior", () => {
     state.widgetsData = [];
 
     const { setTheme, setColor, setSettings } = await renderIndex({
-      initialSettings: { title: "Homepage", layout: {} },
+      initialSettings: { title: "Homepage", layout: {}, favicon: "/x.ico" },
       settings: {
         title: "Homepage",
         layout: {},
@@ -498,7 +533,6 @@ describe("pages/index Home behavior", () => {
         color: "emerald",
         disableIndexing: true,
         base: "/base/",
-        favicon: "/x.ico",
       },
       theme: "dark",
       color: "slate",
@@ -516,6 +550,20 @@ describe("pages/index Home behavior", () => {
     expect(document.querySelector('link[rel="icon"]')?.getAttribute("href")).toBe("/x.ico");
   });
 
+  // Safari reads the head without running JS, so the favicon has to be there before the
+  // settings context is populated, and mask-icon must not be
+  it("renders a custom favicon before the settings context is populated", async () => {
+    await renderIndex({
+      initialSettings: { title: "Homepage", layout: {}, favicon: "/x.ico" },
+      settings: {},
+    });
+
+    expect(document.querySelector('link[rel="icon"]')?.getAttribute("href")).toBe("/x.ico");
+    expect(document.querySelector('link[rel="apple-touch-icon"]')?.getAttribute("href")).toBe("/x.ico");
+    expect(document.querySelector('link[rel="mask-icon"]')).toBeNull();
+    expect(document.querySelector('link[rel="shortcut icon"]')).toBeNull();
+  });
+
   it("marks information widgets as right-aligned for known widget types", async () => {
     await renderIndex({
       initialSettings: { title: "Homepage", layout: {} },

src/components/errorboundry.jsx

@@ -15,7 +15,6 @@ export default class ErrorBoundary extends React.Component {
 
     // You can also log error messages to an error reporting service here
     if (error || errorInfo) {
-      // eslint-disable-next-line no-console
       console.error("component error: %s, info: %s", error, errorInfo);
     }
   }

src/components/quicklaunch.jsx

@@ -15,6 +15,69 @@ const MOBILE_BUTTON_POSITIONS = {
   "bottom-right": "bottom-4 right-4",
 };
 
+function parseUrl(searchString) {
+  if (!/.+[.:].+/.test(searchString)) return null; // basic test for probably a url
+
+  try {
+    return new URL(searchString.toLowerCase().startsWith("http") ? searchString : `https://${searchString}`);
+  } catch {
+    return null;
+  }
+}
+
+function getSearchResults({
+  hideVisitURL,
+  searchDescriptions,
+  searchProvider,
+  searchString,
+  searchSuggestions,
+  servicesAndBookmarks,
+  t,
+  url,
+}) {
+  if (searchString.trim().length === 0) return [];
+
+  const results = servicesAndBookmarks.flatMap((result) => {
+    const nameMatch = result.name.toLowerCase().includes(searchString);
+    const descriptionMatch = searchDescriptions && result.description?.toLowerCase().includes(searchString);
+
+    if (!nameMatch && !descriptionMatch) return [];
+    return [{ ...result, ...(searchDescriptions && { priority: nameMatch ? 2 : +descriptionMatch }) }];
+  });
+
+  if (searchDescriptions) {
+    results.sort((a, b) => b.priority - a.priority);
+  }
+
+  if (searchProvider) {
+    results.push({
+      href: searchProvider.url + encodeURIComponent(searchString),
+      name: `${searchProvider.name ?? t("quicklaunch.custom")} ${t("quicklaunch.search")}`,
+      type: "search",
+    });
+
+    if (searchProvider.showSearchSuggestions && searchProvider.suggestionUrl && searchSuggestions[1]) {
+      results.push(
+        ...searchSuggestions[1].map((suggestion) => ({
+          href: searchProvider.url + encodeURIComponent(suggestion),
+          name: suggestion,
+          type: "searchSuggestion",
+        })),
+      );
+    }
+  }
+
+  if (!hideVisitURL && url) {
+    results.unshift({
+      href: url.toString(),
+      name: `${t("quicklaunch.visit")} URL`,
+      type: "url",
+    });
+  }
+
+  return results;
+}
+
 export default function QuickLaunch({ servicesAndBookmarks, searchString, setSearchString, isOpen, setSearching }) {
   const { t } = useTranslation();
 
@@ -23,9 +86,8 @@ export default function QuickLaunch({ servicesAndBookmarks, searchString, setSea
 
   const searchField = useRef();
 
-  const [results, setResults] = useState([]);
   const [currentItemIndex, setCurrentItemIndex] = useState(null);
-  const [url, setUrl] = useState(null);
+  const url = parseUrl(searchString);
   const [searchSuggestions, setSearchSuggestions] = useState([]);
 
   const { data: widgets } = useSWR("/api/widgets");
@@ -62,7 +124,7 @@ export default function QuickLaunch({ servicesAndBookmarks, searchString, setSea
     : null;
 
   function openCurrentItem(newWindow) {
-    const result = results[currentItemIndex];
+    const result = results[activeItemIndex];
     window.open(
       result.href,
       newWindow ? "_blank" : (result.target ?? searchProvider?.target ?? settings.target ?? "_blank"),
@@ -81,17 +143,9 @@ export default function QuickLaunch({ servicesAndBookmarks, searchString, setSea
 
   function handleSearchChange(event) {
     const rawSearchString = event.target.value;
-    try {
-      if (!/.+[.:].+/g.test(rawSearchString)) throw new Error(); // basic test for probably a url
-      let urlString = rawSearchString;
-      if (urlString.toLowerCase().indexOf("http") !== 0) urlString = `https://${rawSearchString}`;
-      setUrl(new URL(urlString)); // basic validation
-      setSearchString(rawSearchString);
-      return;
-    } catch (e) {
-      setUrl(null);
-    }
-    setSearchString(rawSearchString.toLowerCase());
+    setCurrentItemIndex(null);
+    // urls keep their casing, everything else is lowercased for matching
+    setSearchString(parseUrl(rawSearchString) ? rawSearchString : rawSearchString.toLowerCase());
   }
 
   function handleSearchKeyDown(event) {
@@ -103,18 +157,19 @@ export default function QuickLaunch({ servicesAndBookmarks, searchString, setSea
     } else if (event.key === "Enter" && results.length) {
       closeAndReset();
       openCurrentItem(event.metaKey);
-    } else if (event.key === "ArrowDown" && results[currentItemIndex + 1]) {
-      setCurrentItemIndex(currentItemIndex + 1);
+    } else if (event.key === "ArrowDown" && results[activeItemIndex + 1]) {
+      setCurrentItemIndex(activeItemIndex + 1);
       event.preventDefault();
-    } else if (event.key === "ArrowUp" && currentItemIndex > 0) {
-      setCurrentItemIndex(currentItemIndex - 1);
+    } else if (event.key === "ArrowUp" && activeItemIndex > 0) {
+      setCurrentItemIndex(activeItemIndex - 1);
       event.preventDefault();
     } else if (
       event.key === "ArrowRight" &&
-      results[currentItemIndex] &&
-      results[currentItemIndex].type === "searchSuggestion"
+      results[activeItemIndex] &&
+      results[activeItemIndex].type === "searchSuggestion"
     ) {
-      setSearchString(results[currentItemIndex].name);
+      setCurrentItemIndex(null);
+      setSearchString(results[activeItemIndex].name);
     }
   }
 
@@ -138,88 +193,51 @@ export default function QuickLaunch({ servicesAndBookmarks, searchString, setSea
   }
 
   useEffect(() => {
-    const abortController = new AbortController();
-
-    if (searchString.trim().length === 0) setResults([]);
-    else {
-      let newResults = servicesAndBookmarks.filter((r) => {
-        const nameMatch = r.name.toLowerCase().includes(searchString);
-        let descriptionMatch;
-        if (searchDescriptions) {
-          descriptionMatch = r.description?.toLowerCase().includes(searchString);
-          r.priority = nameMatch ? 2 * +nameMatch : +descriptionMatch; // eslint-disable-line no-param-reassign
-        }
-        return nameMatch || descriptionMatch;
-      });
-
-      if (searchDescriptions) {
-        newResults = newResults.sort((a, b) => b.priority - a.priority);
-      }
-
-      if (searchProvider) {
-        newResults.push({
-          href: searchProvider.url + encodeURIComponent(searchString),
-          name: `${searchProvider.name ?? t("quicklaunch.custom")} ${t("quicklaunch.search")}`,
-          type: "search",
-        });
-
-        if (searchProvider.showSearchSuggestions && searchProvider.suggestionUrl) {
-          if (searchString.trim() !== searchSuggestions[0]?.trim()) {
-            fetch(
-              `/api/search/searchSuggestion?query=${encodeURIComponent(searchString)}&providerName=${
-                searchProvider.name ?? "Custom"
-              }`,
-              { signal: abortController.signal },
-            )
-              .then(async (searchSuggestionResult) => {
-                const newSearchSuggestions = await searchSuggestionResult.json();
-
-                if (newSearchSuggestions) {
-                  if (newSearchSuggestions[1].length > 4) {
-                    newSearchSuggestions[1] = newSearchSuggestions[1].splice(0, 4);
-                  }
-                  setSearchSuggestions(newSearchSuggestions);
-                }
-              })
-              .catch(() => {
-                // If there is an error, just ignore it. There just will be no search suggestions.
-              });
-          }
-
-          if (searchSuggestions[1]) {
-            newResults = newResults.concat(
-              searchSuggestions[1].map((suggestion) => ({
-                href: searchProvider.url + encodeURIComponent(suggestion),
-                name: suggestion,
-                type: "searchSuggestion",
-              })),
-            );
-          }
-        }
-      }
-
-      if (!hideVisitURL && url) {
-        newResults.unshift({
-          href: url.toString(),
-          name: `${t("quicklaunch.visit")} URL`,
-          type: "url",
-        });
-      }
-
-      setResults(newResults);
-
-      if (newResults.length) {
-        setCurrentItemIndex(0);
-      }
+    if (
+      searchString.trim().length === 0 ||
+      !searchProvider?.showSearchSuggestions ||
+      !searchProvider.suggestionUrl ||
+      searchString.trim() === searchSuggestions[0]?.trim()
+    ) {
+      return undefined;
     }
 
-    return () => {
-      abortController.abort();
-    };
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [searchString, servicesAndBookmarks, searchDescriptions, hideVisitURL, searchSuggestions, searchProvider, url]);
+    const abortController = new AbortController();
+
+    fetch(
+      `/api/search/searchSuggestion?query=${encodeURIComponent(searchString)}&providerName=${
+        searchProvider.name ?? "Custom"
+      }`,
+      { signal: abortController.signal },
+    )
+      .then(async (searchSuggestionResult) => {
+        const newSearchSuggestions = await searchSuggestionResult.json();
+
+        if (newSearchSuggestions) {
+          setCurrentItemIndex(null);
+          setSearchSuggestions([newSearchSuggestions[0], newSearchSuggestions[1].slice(0, 4)]);
+        }
+      })
+      .catch(() => {
+        // If there is an error, just ignore it. There just will be no search suggestions.
+      });
+
+    return () => abortController.abort();
+  }, [searchProvider, searchString, searchSuggestions]);
+
+  const results = getSearchResults({
+    hideVisitURL,
+    searchDescriptions,
+    searchProvider,
+    searchString,
+    searchSuggestions,
+    servicesAndBookmarks,
+    t,
+    url,
+  });
+
+  const activeItemIndex = currentItemIndex ?? (results.length ? 0 : null);
 
-  const [hidden, setHidden] = useState(true);
   useEffect(() => {
     function handleBackdropClick(event) {
       if (event.target?.tagName === "DIV") closeAndReset();
@@ -228,14 +246,11 @@ export default function QuickLaunch({ servicesAndBookmarks, searchString, setSea
     if (isOpen) {
       searchField.current.focus();
       document.body.addEventListener("click", handleBackdropClick);
-      setHidden(false);
     } else {
-      document.body.removeEventListener("click", handleBackdropClick);
       searchField.current.blur();
-      setTimeout(() => {
-        setHidden(true);
-      }, 300); // disable on close
     }
+
+    return () => document.body.removeEventListener("click", handleBackdropClick);
   }, [isOpen, closeAndReset]);
 
   function highlightText(text) {
@@ -244,7 +259,6 @@ export default function QuickLaunch({ servicesAndBookmarks, searchString, setSea
       <span>
         {parts.map((part, i) =>
           part.toLowerCase() === searchString.toLowerCase() ? (
-            // eslint-disable-next-line react/no-array-index-key
             <span key={`${searchString}_${i}`} className="bg-theme-300/10">
               {part}
             </span>
@@ -260,13 +274,17 @@ export default function QuickLaunch({ servicesAndBookmarks, searchString, setSea
     <>
       <div
         className={classNames(
-          "relative z-40 ease-in-out duration-300 transition-opacity",
-          hidden && !isOpen && "hidden",
-          !hidden && isOpen && "opacity-100",
-          !isOpen && "opacity-0",
+          "relative z-40 ease-in-out",
+          isOpen ? "visible opacity-100" : "invisible opacity-0 pointer-events-none",
         )}
+        style={{
+          transitionProperty: "opacity, visibility",
+          transitionDuration: "300ms, 0s",
+          transitionDelay: isOpen ? "0s, 0s" : "0s, 300ms",
+        }}
         role="dialog"
         aria-modal="true"
+        aria-hidden={!isOpen}
       >
         <div className="fixed inset-0 bg-gray-500 opacity-50" />
         <div className="fixed inset-0 z-20 overflow-y-auto">
@@ -298,7 +316,7 @@ export default function QuickLaunch({ servicesAndBookmarks, searchString, setSea
                         onKeyDown={handleItemKeyDown}
                         className={classNames(
                           "flex flex-row w-full items-center justify-between rounded-md text-sm md:text-xl py-2 px-4 cursor-pointer text-theme-700 dark:text-theme-200",
-                          i === currentItemIndex && "bg-theme-300/50 dark:bg-theme-700/50",
+                          i === activeItemIndex && "bg-theme-300/50 dark:bg-theme-700/50",
                         )}
                       >
                         <div className="flex flex-row items-center mr-4 pointer-events-none">

src/components/quicklaunch.test.jsx

@@ -46,13 +46,25 @@ function Wrapper({ servicesAndBookmarks = [], initialOpen = true } = {}) {
   const [isOpen, setSearching] = useState(initialOpen);
 
   return (
-    <QuickLaunch
-      servicesAndBookmarks={servicesAndBookmarks}
-      searchString={searchString}
-      setSearchString={setSearchString}
-      isOpen={isOpen}
-      setSearching={setSearching}
-    />
+    <>
+      <button
+        type="button"
+        data-testid="seed-key"
+        onClick={() => {
+          setSearchString((current) => `${current}g`);
+          setSearching(true);
+        }}
+      >
+        seed
+      </button>
+      <QuickLaunch
+        servicesAndBookmarks={servicesAndBookmarks}
+        searchString={searchString}
+        setSearchString={setSearchString}
+        isOpen={isOpen}
+        setSearching={setSearching}
+      />
+    </>
   );
 }
 
@@ -151,6 +163,35 @@ describe("components/quicklaunch", () => {
     openSpy.mockRestore();
   });
 
+  it("does not carry a previous url result into a search seeded by a keypress", async () => {
+    renderWithProviders(<Wrapper />, {
+      settings: {
+        target: "_self",
+        quicklaunch: {
+          provider: "duckduckgo",
+          showSearchSuggestions: false,
+        },
+      },
+    });
+
+    const input = screen.getByPlaceholderText("Search");
+    await waitFor(() => expect(input).toHaveFocus());
+
+    fireEvent.change(input, { target: { value: "example.com" } });
+    expect(await screen.findByText("quicklaunch.visit URL")).toBeInTheDocument();
+
+    fireEvent.keyDown(input, { key: "Escape" });
+    await act(async () => {
+      await new Promise((r) => setTimeout(r, 350));
+    });
+
+    // reopen by "typing" a character, the way pages/index does
+    fireEvent.click(screen.getByTestId("seed-key"));
+
+    expect(input).toHaveValue("g");
+    expect(screen.queryByText("quicklaunch.visit URL")).not.toBeInTheDocument();
+  });
+
   it("closes on Escape and clears the search string after the timeout", async () => {
     renderWithProviders(<Wrapper />, {
       settings: {

src/components/services/widget/error.jsx

@@ -13,13 +13,13 @@ export default function Error({ error }) {
   const { t } = useTranslation();
 
   if (typeof error === "string") {
-    error = { message: error }; // eslint-disable-line no-param-reassign
+    error = { message: error };
   } else if (typeof error === "number") {
-    error = { message: `Error ${error}` }; // eslint-disable-line no-param-reassign
+    error = { message: `Error ${error}` };
   }
 
   if (error?.data?.error) {
-    error = error.data.error; // eslint-disable-line no-param-reassign
+    error = error.data.error;
   }
 
   return (

src/components/widgets/datetime/datetime.jsx

@@ -1,9 +1,11 @@
 import { useTranslation } from "next-i18next/pages";
-import { useEffect, useState } from "react";
+import { useMemo } from "react";
 
 import Container from "../widget/container";
 import Raw from "../widget/raw";
 
+import useCurrentTime from "utils/hooks/use-current-time";
+
 const textSizes = {
   "4xl": "text-4xl",
   "3xl": "text-3xl",
@@ -18,17 +20,10 @@ const textSizes = {
 export default function DateTime({ options }) {
   const { text_size: textSize, locale, format } = options;
   const { i18n } = useTranslation();
-  const [date, setDate] = useState("");
   const dateLocale = locale ?? i18n.language;
-
-  useEffect(() => {
-    const dateFormat = new Intl.DateTimeFormat(dateLocale, { ...format });
-    setDate(dateFormat.format(new Date()));
-    const interval = setInterval(() => {
-      setDate(dateFormat.format(new Date()));
-    }, 1000);
-    return () => clearInterval(interval);
-  }, [date, setDate, dateLocale, format]);
+  const currentTime = useCurrentTime(1000);
+  const dateFormatter = useMemo(() => new Intl.DateTimeFormat(dateLocale, { ...format }), [dateLocale, format]);
+  const date = currentTime === null ? "" : dateFormatter.format(new Date(currentTime));
 
   return (
     <Container options={options} additionalClassNames="information-widget-datetime">

src/components/widgets/resources/network.jsx

@@ -7,10 +7,9 @@ import Resource from "../widget/resource";
 
 export default function Network({ options, refresh = 1500 }) {
   const { t } = useTranslation();
-  // eslint-disable-next-line no-param-reassign
-  if (options.network === true) options.network = "default";
+  const network = options.network === true ? "default" : options.network;
 
-  const { data, error } = useSWR(`/api/widgets/resources?type=network&interfaceName=${options.network}`, {
+  const { data, error } = useSWR(`/api/widgets/resources?type=network&interfaceName=${network}`, {
     refreshInterval: refresh,
   });
 

src/components/widgets/resources/network.test.jsx

@@ -22,10 +22,12 @@ describe("components/widgets/resources/network", () => {
 
   it("normalizes options.network=true to default interfaceName in the request", () => {
     useSWR.mockReturnValue({ data: undefined, error: undefined });
+    const options = Object.freeze({ network: true });
 
-    render(<Network options={{ network: true }} />);
+    render(<Network options={options} />);
 
     expect(useSWR).toHaveBeenCalledWith(expect.stringContaining("interfaceName=default"), expect.any(Object));
+    expect(options.network).toBe(true);
   });
 
   it("renders rates and usage percentage when data is present", () => {

src/components/widgets/search/search.jsx

@@ -11,7 +11,7 @@ import {
 } from "@headlessui/react";
 import classNames from "classnames";
 import { useTranslation } from "next-i18next/pages";
-import { Fragment, useEffect, useState } from "react";
+import { Fragment, useEffect, useMemo, useState, useSyncExternalStore } from "react";
 import { BiLogoBing } from "react-icons/bi";
 import { FiSearch } from "react-icons/fi";
 import { SiBaidu, SiBrave, SiDuckduckgo, SiGoogle } from "react-icons/si";
@@ -57,12 +57,12 @@ export const searchProviders = {
   },
 };
 
-function getAvailableProviderIds(options) {
-  if (options.provider && Array.isArray(options.provider)) {
-    return options.provider.filter((value) => searchProviders.hasOwnProperty(value));
+function getAvailableProviderIds(provider) {
+  if (provider && Array.isArray(provider)) {
+    return provider.filter((value) => searchProviders.hasOwnProperty(value));
   }
-  if (options.provider && searchProviders[options.provider]) {
-    return [options.provider];
+  if (provider && searchProviders[provider]) {
+    return [provider];
   }
   return null;
 }
@@ -79,23 +79,32 @@ export function getStoredProvider() {
   return null;
 }
 
+function subscribeToStoredProvider(onStoreChange) {
+  const handleStorage = (event) => {
+    if (event.key === localStorageKey) onStoreChange();
+  };
+
+  window.addEventListener("storage", handleStorage);
+  return () => window.removeEventListener("storage", handleStorage);
+}
+
 export default function Search({ options }) {
   const { t } = useTranslation();
 
-  const availableProviderIds = getAvailableProviderIds(options) ?? [];
+  // options is a fresh object each render, so memo on provider itself
+  const availableProviderIds = useMemo(() => getAvailableProviderIds(options.provider) ?? [], [options.provider]);
+  const storedProvider = useSyncExternalStore(subscribeToStoredProvider, getStoredProvider, () => null);
+  const storedProviderId = Object.keys(searchProviders).find(
+    (providerId) => searchProviders[providerId] === storedProvider,
+  );
+  const initialProvider = availableProviderIds.includes(storedProviderId)
+    ? storedProvider
+    : searchProviders[availableProviderIds[0] ?? "google"];
 
   const [query, setQuery] = useState("");
-  const [selectedProvider, setSelectedProvider] = useState(searchProviders[availableProviderIds[0] ?? "google"]);
+  const [providerOverride, setProviderOverride] = useState(null);
   const [searchSuggestions, setSearchSuggestions] = useState([]);
-
-  useEffect(() => {
-    const storedProvider = getStoredProvider();
-    let storedProviderKey = null;
-    storedProviderKey = Object.keys(searchProviders).find((pkey) => searchProviders[pkey] === storedProvider);
-    if (storedProvider && availableProviderIds.includes(storedProviderKey)) {
-      setSelectedProvider(storedProvider);
-    }
-  }, [availableProviderIds]);
+  const selectedProvider = providerOverride ?? initialProvider;
 
   useEffect(() => {
     const abortController = new AbortController();
@@ -129,8 +138,6 @@ export default function Search({ options }) {
     };
   }, [selectedProvider, options, query, searchSuggestions]);
 
-  let currentSuggestion;
-
   function doSearch(value) {
     const q = encodeURIComponent(value);
     const { url } = selectedProvider;
@@ -141,13 +148,11 @@ export default function Search({ options }) {
     }
 
     setQuery("");
-    currentSuggestion = null;
   }
 
   const handleSearchKeyDown = (event) => {
-    const useSuggestion = searchSuggestions.length && currentSuggestion;
-    if (event.key === "Enter") {
-      doSearch(useSuggestion ? currentSuggestion : event.target.value);
+    if (event.key === "Enter" && !searchSuggestions[1]?.length) {
+      doSearch(event.target.value);
     }
   };
 
@@ -156,7 +161,7 @@ export default function Search({ options }) {
   }
 
   const onChangeProvider = (provider) => {
-    setSelectedProvider(provider);
+    setProviderOverride(provider);
     localStorage.setItem(localStorageKey, provider.name);
   };
 
@@ -165,7 +170,7 @@ export default function Search({ options }) {
       <Raw>
         <div className="flex-col relative h-8 my-4 min-w-fit z-20">
           <div className="flex absolute inset-y-0 left-0 items-center pl-3 pointer-events-none w-full text-theme-800 dark:text-white" />
-          <Combobox value={query}>
+          <Combobox value={query} onChange={doSearch}>
             <ComboboxInput
               type="text"
               className="
@@ -177,6 +182,7 @@ export default function Search({ options }) {
               focus:border-theme-500 dark:focus:border-white/50
               border border-theme-300 dark:border-theme-200/50"
               placeholder={t("search.placeholder")}
+              aria-label={t("search.placeholder")}
               onChange={(event) => {
                 setQuery(event.target.value);
               }}
@@ -184,7 +190,6 @@ export default function Search({ options }) {
               autoCapitalize="off"
               autoCorrect="off"
               autoComplete="off"
-              // eslint-disable-next-line jsx-a11y/no-autofocus
               autoFocus={options.focus}
               onBlur={(e) => e.preventDefault()}
               onKeyDown={handleSearchKeyDown}
@@ -204,8 +209,8 @@ export default function Search({ options }) {
                   bg-theme-600/40 dark:bg-white/10
                   focus:ring-theme-500 dark:focus:ring-white/50"
                 >
-                  <selectedProvider.icon className="text-white w-3 h-3" />
-                  <span className="sr-only">{t("search.search")}</span>
+                  <selectedProvider.icon className="text-white w-3 h-3" aria-hidden="true" />
+                  <span className="sr-only">{t("search.provider", { name: selectedProvider.name })}</span>
                 </ListboxButton>
               </div>
               <Transition
@@ -218,6 +223,7 @@ export default function Search({ options }) {
                 leaveTo="transform opacity-0 scale-95"
               >
                 <ListboxOptions
+                  aria-label={t("search.select_provider")}
                   className="absolute right-0 z-10 mt-1 origin-top-right rounded-md
                   bg-theme-100 dark:bg-theme-600 shadow-lg
                   ring-1 ring-black ring-opacity-5 focus:outline-hidden"
@@ -234,7 +240,8 @@ export default function Search({ options }) {
                                 active ? "bg-theme-600/10 dark:bg-white/10 dark:text-gray-900" : "dark:text-gray-100",
                               )}
                             >
-                              <p.icon className="h-4 w-4 mx-4 my-2" />
+                              <p.icon className="h-4 w-4 mx-4 my-2" aria-hidden="true" />
+                              <span className="sr-only">{p.name}</span>
                             </li>
                           )}
                         </ListboxOption>
@@ -248,32 +255,24 @@ export default function Search({ options }) {
             {searchSuggestions[1]?.length > 0 && (
               <ComboboxOptions className="mt-1 rounded-md bg-theme-50 dark:bg-theme-800 border border-theme-300 dark:border-theme-200/30 cursor-pointer shadow-lg">
                 <div className="p-1 bg-white/50 dark:bg-white/10 text-theme-900/90 dark:text-white/90 text-xs">
-                  <ComboboxOption key={query} value={query} />
+                  <ComboboxOption key={query} value={query}>
+                    <span className="sr-only">{query}</span>
+                  </ComboboxOption>
                   {searchSuggestions[1].map((suggestion) => (
-                    <ComboboxOption
-                      key={suggestion}
-                      value={suggestion}
-                      onMouseDown={() => {
-                        doSearch(suggestion);
-                      }}
-                      className="flex w-full"
-                    >
-                      {({ active }) => {
-                        if (active) currentSuggestion = suggestion;
-                        return (
-                          <div
-                            className={classNames(
-                              "px-2 py-1 rounded-md w-full flex-nowrap",
-                              active ? "bg-theme-300/20 dark:bg-white/10" : "",
-                            )}
-                          >
-                            <span className="whitespace-pre">{suggestion.indexOf(query) === 0 ? query : ""}</span>
-                            <span className="mr-4 whitespace-pre opacity-50">
-                              {suggestion.indexOf(query) === 0 ? suggestion.substring(query.length) : suggestion}
-                            </span>
-                          </div>
-                        );
-                      }}
+                    <ComboboxOption key={suggestion} value={suggestion} className="flex w-full">
+                      {({ active }) => (
+                        <div
+                          className={classNames(
+                            "px-2 py-1 rounded-md w-full flex-nowrap",
+                            active ? "bg-theme-300/20 dark:bg-white/10" : "",
+                          )}
+                        >
+                          <span className="whitespace-pre">{suggestion.indexOf(query) === 0 ? query : ""}</span>
+                          <span className="mr-4 whitespace-pre opacity-50">
+                            {suggestion.indexOf(query) === 0 ? suggestion.substring(query.length) : suggestion}
+                          </span>
+                        </div>
+                      )}
                     </ComboboxOption>
                   ))}
                 </div>

src/components/widgets/search/search.test.jsx

@@ -9,6 +9,7 @@ import { renderWithProviders } from "test-utils/render-with-providers";
 vi.mock("@headlessui/react", async () => {
   const React = await import("react");
   const { Fragment, createContext, useContext } = React;
+  const ComboboxContext = createContext(null);
   const ListboxContext = createContext(null);
 
   function passthrough({ as: As = "div", children, ...props }) {
@@ -18,9 +19,21 @@ vi.mock("@headlessui/react", async () => {
   }
 
   return {
-    Combobox: passthrough,
+    Combobox: ({ onChange, children }) => (
+      <ComboboxContext.Provider value={{ onChange }}>
+        <div>{children}</div>
+      </ComboboxContext.Provider>
+    ),
     ComboboxInput: (props) => <input {...props} />,
-    ComboboxOption: passthrough,
+    ComboboxOption: ({ as: As = "div", value, children, ...props }) => {
+      const ctx = useContext(ComboboxContext);
+      const content = typeof children === "function" ? children({ active: false }) : children;
+      return (
+        <As value={value} onMouseDown={() => ctx?.onChange?.(value)} {...props}>
+          {content}
+        </As>
+      );
+    },
     ComboboxOptions: passthrough,
     Listbox: ({ value, onChange, children, ...props }) => (
       <ListboxContext.Provider value={{ value, onChange }}>
@@ -165,6 +178,28 @@ describe("components/widgets/search", () => {
     openSpy.mockRestore();
   });
 
+  it("gives every provider option an accessible name", () => {
+    renderWithProviders(
+      <Search options={{ provider: ["google", "duckduckgo", "brave"], showSearchSuggestions: false }} />,
+      { settings: {} },
+    );
+
+    expect(screen.getAllByRole("option").map((option) => option.textContent)).toEqual([
+      "Google",
+      "DuckDuckGo",
+      "Brave",
+    ]);
+  });
+
+  it("labels the search input and the provider button", () => {
+    renderWithProviders(<Search options={{ provider: ["google", "duckduckgo"], showSearchSuggestions: false }} />, {
+      settings: {},
+    });
+
+    expect(screen.getByRole("textbox")).toHaveAccessibleName("search.placeholder");
+    expect(screen.getByRole("button")).toHaveAccessibleName(/search\.provider/);
+  });
+
   it("fetches search suggestions and triggers a search when a suggestion is selected", async () => {
     const openSpy = vi.spyOn(window, "open").mockImplementation(() => null);
 

src/components/widgets/unifi_console/unifi_console.jsx

@@ -14,12 +14,11 @@ import useWidgetAPI from "utils/proxy/use-widget-api";
 export default function Widget({ options }) {
   const { t } = useTranslation();
 
-  // eslint-disable-next-line no-param-reassign, no-multi-assign
-  options.service_group = options.service_name = "unifi_console";
-  const { data: statsData, error: statsError } = useWidgetAPI(options, "stat/sites", { index: options.index });
+  const widgetOptions = { ...options, service_group: "unifi_console", service_name: "unifi_console" };
+  const { data: statsData, error: statsError } = useWidgetAPI(widgetOptions, "stat/sites", { index: options.index });
 
   if (statsError) {
-    return <Error options={options} />;
+    return <Error options={widgetOptions} />;
   }
 
   const defaultSite = options.site
@@ -28,27 +27,27 @@ export default function Widget({ options }) {
 
   if (!defaultSite) {
     return (
-      <Container options={options} additionalClassNames="information-widget-unifi-console">
+      <Container options={widgetOptions} additionalClassNames="information-widget-unifi-console">
         <PrimaryText>{t("unifi.wait")}</PrimaryText>
         <WidgetIcon icon={SiUbiquiti} />
       </Container>
     );
   }
 
-  const wan = defaultSite.health.find((h) => h.subsystem === "wan");
-  const lan = defaultSite.health.find((h) => h.subsystem === "lan");
-  const wlan = defaultSite.health.find((h) => h.subsystem === "wlan");
-  [wan, lan, wlan].forEach((s) => {
-    s.up = s.status === "ok"; // eslint-disable-line no-param-reassign
-    s.show = s.status !== "unknown"; // eslint-disable-line no-param-reassign
-  });
+  const getHealth = (subsystem) => {
+    const health = defaultSite.health.find((item) => item.subsystem === subsystem) ?? { status: "unknown" };
+    return { ...health, up: health.status === "ok", show: health.status !== "unknown" };
+  };
+  const wan = getHealth("wan");
+  const lan = getHealth("lan");
+  const wlan = getHealth("wlan");
   const name = wan.gw_name ?? defaultSite.desc;
   const uptime = wan["gw_system-stats"] ? wan["gw_system-stats"].uptime : null;
 
   const dataEmpty = !(wan.show || lan.show || wlan.show || uptime);
 
   return (
-    <Container options={options} additionalClassNames="information-widget-unifi-console">
+    <Container options={widgetOptions} additionalClassNames="information-widget-unifi-console">
       <Raw>
         <div className="flex-none flex flex-row items-center mr-3 py-1.5">
           <div className="flex flex-col">

src/components/widgets/unifi_console/unifi_console.test.jsx

@@ -40,32 +40,41 @@ describe("components/widgets/unifi_console", () => {
 
   it("renders a wait state when no site is available yet", () => {
     useWidgetAPI.mockReturnValue({ data: undefined, error: undefined });
+    const options = Object.freeze({ index: 0 });
 
-    renderWithProviders(<UnifiConsole options={{ index: 0 }} />, { settings: { target: "_self" } });
+    renderWithProviders(<UnifiConsole options={options} />, { settings: { target: "_self" } });
 
     expect(screen.getByText("unifi.wait")).toBeInTheDocument();
+    expect(useWidgetAPI).toHaveBeenCalledWith(
+      { index: 0, service_group: "unifi_console", service_name: "unifi_console" },
+      "stat/sites",
+      { index: 0 },
+    );
+    expect(options).toEqual({ index: 0 });
   });
 
   it("renders site name and uptime when data is available", () => {
+    const data = {
+      data: [
+        {
+          name: "default",
+          desc: "Home",
+          health: [
+            {
+              subsystem: "wan",
+              status: "ok",
+              gw_name: "Router",
+              "gw_system-stats": { uptime: 172800 },
+            },
+            { subsystem: "lan", status: "unknown" },
+            { subsystem: "wlan", status: "unknown" },
+          ],
+        },
+      ],
+    };
+    const originalData = structuredClone(data);
     useWidgetAPI.mockReturnValue({
-      data: {
-        data: [
-          {
-            name: "default",
-            desc: "Home",
-            health: [
-              {
-                subsystem: "wan",
-                status: "ok",
-                gw_name: "Router",
-                "gw_system-stats": { uptime: 172800 },
-              },
-              { subsystem: "lan", status: "unknown" },
-              { subsystem: "wlan", status: "unknown" },
-            ],
-          },
-        ],
-      },
+      data,
       error: undefined,
     });
 
@@ -75,6 +84,7 @@ describe("components/widgets/unifi_console", () => {
     // common.number is mocked to return the numeric value as a string.
     expect(screen.getByText("2")).toBeInTheDocument();
     expect(screen.getByText("unifi.days")).toBeInTheDocument();
+    expect(data).toEqual(originalData);
   });
 
   it("selects a site by description when options.site is set", () => {

src/components/widgets/widget/container.jsx

@@ -10,7 +10,6 @@ import WidgetIcon from "./widget_icon";
 export function getAllClasses(options, additionalClassNames = "") {
   if (options?.style?.header === "boxedWidgets") {
     if (options?.style?.cardBlur !== undefined) {
-      // eslint-disable-next-line no-param-reassign
       additionalClassNames = [
         additionalClassNames,
         `backdrop-blur${options.style.cardBlur.length ? "-" : ""}${options.style.cardBlur}`,

src/instrumentation.js

@@ -0,0 +1,7 @@
+import { applyNextAuthEnv } from "utils/env";
+
+export function register() {
+  if (process.env.NEXT_RUNTIME !== "nodejs") return;
+
+  applyNextAuthEnv();
+}

src/instrumentation.test.js

@@ -0,0 +1,53 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+describe("instrumentation", () => {
+  const originalEnv = process.env;
+
+  beforeEach(() => {
+    vi.resetModules();
+    process.env = { ...originalEnv };
+    delete process.env.NEXTAUTH_SECRET;
+    delete process.env.NEXTAUTH_URL;
+    delete process.env.HOMEPAGE_AUTH_SECRET;
+    delete process.env.HOMEPAGE_EXTERNAL_URL;
+    process.env.NEXT_RUNTIME = "nodejs";
+  });
+
+  afterEach(() => {
+    process.env = originalEnv;
+  });
+
+  it("maps HOMEPAGE_* auth envs to their NextAuth equivalents", async () => {
+    process.env.HOMEPAGE_AUTH_SECRET = "secret";
+    process.env.HOMEPAGE_EXTERNAL_URL = "https://homepage.example";
+    const { register } = await import("./instrumentation");
+
+    register();
+
+    expect(process.env.NEXTAUTH_SECRET).toBe("secret");
+    expect(process.env.NEXTAUTH_URL).toBe("https://homepage.example");
+  });
+
+  it("does not override explicitly configured NextAuth envs", async () => {
+    process.env.HOMEPAGE_AUTH_SECRET = "secret";
+    process.env.HOMEPAGE_EXTERNAL_URL = "https://homepage.example";
+    process.env.NEXTAUTH_SECRET = "explicit-secret";
+    process.env.NEXTAUTH_URL = "https://explicit.example";
+    const { register } = await import("./instrumentation");
+
+    register();
+
+    expect(process.env.NEXTAUTH_SECRET).toBe("explicit-secret");
+    expect(process.env.NEXTAUTH_URL).toBe("https://explicit.example");
+  });
+
+  it("is a no-op outside the node runtime", async () => {
+    process.env.NEXT_RUNTIME = "edge";
+    process.env.HOMEPAGE_EXTERNAL_URL = "https://homepage.example";
+    const { register } = await import("./instrumentation");
+
+    register();
+
+    expect(process.env.NEXTAUTH_URL).toBeUndefined();
+  });
+});

src/middleware.js

@@ -33,7 +33,8 @@ export async function middleware(req) {
   }
 
   const pathname = new URL(req.url).pathname;
-  if (authEnabled && !pathname.startsWith("/api/healthcheck")) {
+  const isPublicAuthPath = pathname.startsWith("/api/healthcheck") || pathname === "/api/config/custom.css";
+  if (authEnabled && !isPublicAuthPath) {
     // The MCP API handler authorizes both bearer tokens and Homepage sessions.
     if (pathname === "/api/mcp") {
       return withPrivateCache(NextResponse.next());

src/middleware.test.js

@@ -100,6 +100,31 @@ describe("middleware", () => {
     expect(res.type).toBe("next");
   });
 
+  it("allows custom CSS without auth so it can style the signin page", async () => {
+    process.env.HOMEPAGE_AUTH_ENABLED = "true";
+    process.env.HOMEPAGE_AUTH_SECRET = "secret";
+
+    const middleware = await loadMiddleware();
+    const res = await middleware(createReq("localhost:3000", "http://localhost:3000/api/config/custom.css"));
+
+    expect(getToken).not.toHaveBeenCalled();
+    expect(NextResponse.next).toHaveBeenCalled();
+    expect(res.type).toBe("next");
+  });
+
+  it("continues to require auth for custom JavaScript", async () => {
+    process.env.HOMEPAGE_AUTH_ENABLED = "true";
+    process.env.HOMEPAGE_AUTH_SECRET = "secret";
+
+    getToken.mockResolvedValueOnce(null);
+
+    const middleware = await loadMiddleware();
+    const res = await middleware(createReq("localhost:3000", "http://localhost:3000/api/config/custom.js"));
+
+    expect(getToken).toHaveBeenCalled();
+    expect(res.type).toBe("redirect");
+  });
+
   it.each(["false", "0", "no", "off", ""])("treats HOMEPAGE_AUTH_ENABLED=%j as disabled", async (value) => {
     process.env.HOMEPAGE_AUTH_ENABLED = value;
 

src/pages/_app.jsx

@@ -1,4 +1,3 @@
-/* eslint-disable react/jsx-props-no-spreading */
 import { SessionProvider } from "next-auth/react";
 import { appWithTranslation } from "next-i18next/pages";
 import Head from "next/head";
@@ -13,7 +12,6 @@ import { ThemeProvider } from "utils/contexts/theme";
 
 import nextI18nextConfig from "../../next-i18next.config";
 
-// eslint-disable-next-line no-unused-vars
 const tailwindSafelist = [
   // TODO: remove pending https://github.com/tailwindlabs/tailwindcss/pull/17147
   "backdrop-blur",

src/pages/api/auth/[...nextauth].js

@@ -3,7 +3,7 @@ import { createHash, timingSafeEqual } from "node:crypto";
 import NextAuth from "next-auth";
 import CredentialsProvider from "next-auth/providers/credentials";
 
-import { isAuthEnabled } from "utils/env";
+import { applyNextAuthEnv, isAuthEnabled } from "utils/env";
 import createLogger from "utils/logger";
 
 const MIN_AUTH_SECRET_LENGTH = 32;
@@ -12,20 +12,13 @@ const authEnabled = isAuthEnabled();
 const issuer = process.env.HOMEPAGE_OIDC_ISSUER;
 const clientId = process.env.HOMEPAGE_OIDC_CLIENT_ID;
 const clientSecret = process.env.HOMEPAGE_OIDC_CLIENT_SECRET;
-const homepageAuthSecret = process.env.HOMEPAGE_AUTH_SECRET;
-const homepageExternalUrl = process.env.HOMEPAGE_EXTERNAL_URL;
 const homepageAuthPassword = process.env.HOMEPAGE_AUTH_PASSWORD;
 const homepageAuthPasswordDigest = homepageAuthPassword
   ? createHash("sha256").update(homepageAuthPassword, "utf8").digest()
   : null;
 
-// Map HOMEPAGE_* envs to what NextAuth expects
-if (!process.env.NEXTAUTH_SECRET && homepageAuthSecret) {
-  process.env.NEXTAUTH_SECRET = homepageAuthSecret;
-}
-if (!process.env.NEXTAUTH_URL && homepageExternalUrl) {
-  process.env.NEXTAUTH_URL = homepageExternalUrl;
-}
+// Also done in instrumentation.js
+applyNextAuthEnv();
 
 const defaultScope = process.env.HOMEPAGE_OIDC_SCOPE || "openid email profile";
 const cleanedIssuer = issuer ? issuer.replace(/\/+$/, "") : issuer;
@@ -78,6 +71,16 @@ function logFailedPasswordSignIn() {
   createLogger("nextauth").warn("Failed password sign-in attempt");
 }
 
+function logNextAuthError(code, metadata) {
+  const error = metadata instanceof Error ? metadata : metadata?.error;
+
+  if (error?.message) {
+    createLogger("nextauth").error("%s: %s", code, error.message);
+  } else {
+    createLogger("nextauth").error("%s", code);
+  }
+}
+
 let providers = [];
 if (authEnabled) {
   if (hasOidcConfig) {
@@ -147,7 +150,7 @@ export const authOptions = {
     signIn: "/auth/signin",
   },
   logger: {
-    error: (code) => createLogger("nextauth").error("%s", code),
+    error: logNextAuthError,
     warn: (code) => createLogger("nextauth").warn("%s", code),
     debug: (code) => createLogger("nextauth").debug("%s", code),
   },

src/pages/api/mcp/index.js

@@ -15,6 +15,12 @@ export default async function handler(req, res) {
     return res.status(404).end("Not Found");
   }
 
+  // Method check precedes auth so CORS preflights aren't answered with a 401.
+  if (req.method !== "POST") {
+    res.setHeader("Allow", "POST");
+    return res.status(405).end("Method Not Allowed");
+  }
+
   const tokenError = mcpTokenConfigError();
   if (tokenError) {
     createLogger("mcp").error(tokenError);
@@ -25,11 +31,6 @@ export default async function handler(req, res) {
     return res.status(401).json({ error: "Unauthorized" });
   }
 
-  if (req.method !== "POST") {
-    res.setHeader("Allow", "POST");
-    return res.status(405).end("Method Not Allowed");
-  }
-
   const response = handleMcpRequest(req.body);
   if (!response) {
     return res.status(202).end();

src/pages/api/mcp/index.test.js

@@ -214,4 +214,38 @@ describe("pages/api/mcp", () => {
     expect(res.status).toHaveBeenCalledWith(405);
     expect(res.setHeader).toHaveBeenCalledWith("Allow", "POST");
   });
+
+  it("answers unauthenticated CORS preflights with 405 rather than 401", async () => {
+    process.env.HOMEPAGE_MCP_ENABLED = "true";
+    process.env.HOMEPAGE_MCP_TOKEN = "mcp-tok-0123456789abcdefghijklmnopqrstuv";
+    const handler = await loadHandler();
+    const res = mockResponse();
+
+    // a preflight never carries the Authorization header the browser strips
+    await handler(
+      {
+        method: "OPTIONS",
+        headers: {
+          origin: "https://claude.ai",
+          "access-control-request-method": "POST",
+          "access-control-request-headers": "authorization,content-type",
+        },
+      },
+      res,
+    );
+
+    expect(res.status).toHaveBeenCalledWith(405);
+    expect(res.setHeader).toHaveBeenCalledWith("Allow", "POST");
+    expect(getServerSession).not.toHaveBeenCalled();
+  });
+
+  it("still returns 404 for non-POST requests while disabled", async () => {
+    delete process.env.HOMEPAGE_MCP_ENABLED;
+    const handler = await loadHandler();
+    const res = mockResponse();
+
+    await handler({ method: "OPTIONS", headers: {} }, res);
+
+    expect(res.status).toHaveBeenCalledWith(404);
+  });
 });

src/pages/auth/signin.jsx

@@ -1,5 +1,5 @@
 import classNames from "classnames";
-import { getProviders, signIn } from "next-auth/react";
+import { signIn } from "next-auth/react";
 import { useRouter } from "next/router";
 import { useEffect, useMemo, useState } from "react";
 import { BiShieldQuarter } from "react-icons/bi";
@@ -94,10 +94,8 @@ export default function SignIn({ providers, settings }) {
             <div className="mx-auto flex h-12 w-12 items-center justify-center rounded-2xl bg-theme-500/15 text-theme-600 dark:text-theme-300">
               <BiShieldQuarter className="h-6 w-6" />
             </div>
-            <h1 className="mt-6 text-2xl font-semibold text-gray-900 dark:text-slate-100">
-              Authentication not configured
-            </h1>
-            <p className="mt-3 text-sm text-gray-600 dark:text-slate-400">OIDC is disabled or misconfigured.</p>
+            <h1 className="mt-6 text-2xl font-semibold text-gray-900 dark:text-slate-100">Authentication error</h1>
+            <p className="mt-3 text-sm text-gray-600 dark:text-slate-400">Auth is disabled or misconfigured.</p>
           </div>
         </main>
       </>
@@ -202,7 +200,16 @@ export default function SignIn({ providers, settings }) {
 }
 
 export async function getServerSideProps(context) {
-  const providers = await getProviders();
+  // Avoid getProviders() fetch
+  let providers = {};
+  try {
+    // Dynamic so a bad config throws in here rather than at page load
+    const { authOptions } = await import("pages/api/auth/[...nextauth]");
+    providers = Object.fromEntries(authOptions.providers.map(({ id, name, type }) => [id, { id, name, type }]));
+  } catch (e) {
+    console.error("Unable to load auth providers: %s", e.message);
+  }
+
   const homepageSettings = getSettings();
   const settings = Object.fromEntries(
     PUBLIC_SIGN_IN_SETTINGS.filter((key) => Object.prototype.hasOwnProperty.call(homepageSettings, key)).map((key) => [

src/pages/index.jsx

@@ -1,4 +1,3 @@
-/* eslint-disable react/no-array-index-key */
 import classNames from "classnames";
 import BookmarksGroup from "components/bookmarks/group";
 import ErrorBoundary from "components/errorboundry";
@@ -13,7 +12,7 @@ import dynamic from "next/dynamic";
 import Head from "next/head";
 import { useRouter } from "next/router";
 import Script from "next/script";
-import { useContext, useEffect, useMemo, useState } from "react";
+import { useCallback, useContext, useEffect, useMemo, useState } from "react";
 import { BiError } from "react-icons/bi";
 import useSWR, { SWRConfig } from "swr";
 import { ColorContext } from "utils/contexts/color";
@@ -103,7 +102,29 @@ function Index({ initialSettings, fallback }) {
   const [stale, setStale] = useState(false);
   const { data: errorsData } = useSWR("/api/validate");
   const { error: validateError } = errorsData || {};
-  const { data: hashData, mutate: mutateHash } = useSWR("/api/hash");
+
+  const handleHashData = useCallback((hashData) => {
+    if (typeof window === "undefined" || !hashData?.hash) return;
+
+    const previousHash = localStorage.getItem("hash");
+
+    if (!previousHash) {
+      localStorage.setItem("hash", hashData.hash);
+    }
+
+    if (previousHash && previousHash !== hashData.hash) {
+      setStale(true);
+      localStorage.setItem("hash", hashData.hash);
+
+      fetch("/api/revalidate").then((res) => {
+        if (res.ok) {
+          window.location.reload();
+        }
+      });
+    }
+  }, []);
+
+  const { mutate: mutateHash } = useSWR("/api/hash", { onSuccess: handleHashData });
 
   useEffect(() => {
     if (windowFocused) {
@@ -111,29 +132,6 @@ function Index({ initialSettings, fallback }) {
     }
   }, [windowFocused, mutateHash]);
 
-  useEffect(() => {
-    if (hashData) {
-      if (typeof window !== "undefined") {
-        const previousHash = localStorage.getItem("hash");
-
-        if (!previousHash) {
-          localStorage.setItem("hash", hashData.hash);
-        }
-
-        if (previousHash && previousHash !== hashData.hash) {
-          setStale(true);
-          localStorage.setItem("hash", hashData.hash);
-
-          fetch("/api/revalidate").then((res) => {
-            if (res.ok) {
-              window.location.reload();
-            }
-          });
-        }
-      }
-    }
-  }, [hashData]);
-
   if (validateError) {
     return (
       <div className="w-full h-screen container m-auto justify-center p-10 pointer-events-none">
@@ -175,7 +173,7 @@ function Index({ initialSettings, fallback }) {
               </div>
               <div className="p-2 text-theme-100 dark:text-theme-200">
                 <pre className="opacity-50 font-bold pb-2">
-                  Reason: "{error.reason}" at line {error.mark?.line}
+                  Reason: &quot;{error.reason}&quot; at line {error.mark?.line}
                 </pre>
                 <pre className="font-italic">Check logs for details.</pre>
               </div>
@@ -265,6 +263,13 @@ function Home({ initialSettings }) {
           e.key.match(/([à-ü]|[À-Ü]|!)/g) ||
           (e.key === "v" && (e.ctrlKey || e.metaKey))
         ) {
+          if (e.key.length === 1 && !(e.key === "v" && (e.ctrlKey || e.metaKey))) {
+            e.preventDefault();
+            // whitespace opens the search but shouldn't be in it
+            if (e.key.trim()) {
+              setSearchString((currentSearchString) => currentSearchString + e.key);
+            }
+          }
           setSearching(true);
         } else if (e.key === "Escape") {
           setSearchString("");
@@ -421,10 +426,11 @@ function Home({ initialSettings }) {
         />
         {settings.disableIndexing && <meta name="robots" content="noindex, nofollow" />}
         {settings.base && <base href={settings.base} />}
-        {settings.favicon ? (
+        {/* from props, not context so its set before running JS */}
+        {initialSettings.favicon ? (
           <>
-            <link rel="icon" href={settings.favicon} />
-            <link rel="apple-touch-icon" sizes="180x180" href={settings.favicon} />
+            <link rel="icon" href={initialSettings.favicon} />
+            <link rel="apple-touch-icon" sizes="180x180" href={initialSettings.favicon} />
           </>
         ) : (
           <>

src/test-utils/render-with-providers.jsx

@@ -1,5 +1,4 @@
 import { render } from "@testing-library/react";
-
 import { SettingsContext } from "utils/contexts/settings";
 
 export function renderWithProviders(ui, { settings = {} } = {}) {

src/utils/config/api-response.js

@@ -1,8 +1,6 @@
 import { promises as fs } from "fs";
 import path from "path";
 
-import yaml from "js-yaml";
-
 import checkAndCopyConfig, { CONF_DIR, getSettings, substituteEnvironmentVars } from "utils/config/config";
 import {
   cleanServiceGroups,
@@ -12,6 +10,7 @@ import {
   servicesFromKubernetes,
 } from "utils/config/service-helpers";
 import { cleanWidgetGroups, widgetsFromConfig } from "utils/config/widget-helpers";
+import { loadYaml } from "utils/config/yaml";
 
 /**
  * Compares services by weight then by name.
@@ -30,7 +29,7 @@ export async function bookmarksResponse() {
   const bookmarksYaml = path.join(CONF_DIR, "bookmarks.yaml");
   const rawFileContents = await fs.readFile(bookmarksYaml, "utf8");
   const fileContents = substituteEnvironmentVars(rawFileContents);
-  const bookmarks = yaml.load(fileContents);
+  const bookmarks = loadYaml(fileContents);
 
   if (!bookmarks) return [];
 

src/utils/config/api-response.test.js

@@ -30,10 +30,7 @@ vi.mock("fs", () => ({
   promises: fs,
 }));
 
-vi.mock("js-yaml", () => ({
-  default: yaml,
-  ...yaml,
-}));
+vi.mock("utils/config/yaml", () => ({ loadYaml: yaml.load }));
 
 vi.mock("utils/config/config", () => config);
 vi.mock("utils/config/widget-helpers", () => widgetHelpers);

src/utils/config/config.check-copy.test.js

@@ -13,7 +13,7 @@ const { fs, yaml } = vi.hoisted(() => ({
 }));
 
 vi.mock("fs", () => fs);
-vi.mock("js-yaml", () => ({ default: yaml, ...yaml }));
+vi.mock("utils/config/yaml", () => ({ loadYaml: yaml.load }));
 
 describe("utils/config/config checkAndCopyConfig", () => {
   const originalEnv = process.env;

src/utils/config/config.js

@@ -1,9 +1,10 @@
 import { copyFileSync, existsSync, mkdirSync, readFileSync } from "fs";
 import { join } from "path";
 
-import yaml from "js-yaml";
 import cache from "memory-cache";
 
+import { loadYaml } from "utils/config/yaml";
+
 const cacheKey = "homepageEnvironmentVariables";
 const homepageVarPrefix = "HOMEPAGE_VAR_";
 const homepageFilePrefix = "HOMEPAGE_FILE_";
@@ -42,7 +43,7 @@ export default function checkAndCopyConfig(config) {
   }
 
   try {
-    yaml.load(readFileSync(configYaml, "utf8"));
+    loadYaml(readFileSync(configYaml, "utf8"));
     return true;
   } catch (e) {
     return { ...e, config };
@@ -85,7 +86,7 @@ export function getSettings() {
   const settingsYaml = join(CONF_DIR, "settings.yaml");
   const rawFileContents = readFileSync(settingsYaml, "utf8");
   const fileContents = substituteEnvironmentVars(rawFileContents);
-  const initialSettings = yaml.load(fileContents) ?? {};
+  const initialSettings = loadYaml(fileContents) ?? {};
 
   if (initialSettings.layout) {
     // support yaml list but old spec was object so convert to that

src/utils/config/docker.js

@@ -1,9 +1,8 @@
 import { readFileSync } from "fs";
 import path from "path";
 
-import yaml from "js-yaml";
-
 import checkAndCopyConfig, { CONF_DIR, substituteEnvironmentVars } from "utils/config/config";
+import { loadYaml } from "utils/config/yaml";
 
 export function getDefaultDockerArgs(platform = process.platform) {
   if (platform !== "win32" && platform !== "darwin") {
@@ -19,7 +18,7 @@ export default function getDockerArguments(server) {
   const configFile = path.join(CONF_DIR, "docker.yaml");
   const rawConfigData = readFileSync(configFile, "utf8");
   const configData = substituteEnvironmentVars(rawConfigData);
-  const servers = yaml.load(configData);
+  const servers = loadYaml(configData);
 
   if (!server) {
     return getDefaultDockerArgs();

src/utils/config/docker.test.js

@@ -21,10 +21,7 @@ vi.mock("fs", () => ({
   readFileSync: fs.readFileSync,
 }));
 
-vi.mock("js-yaml", () => ({
-  default: yaml,
-  ...yaml,
-}));
+vi.mock("utils/config/yaml", () => ({ loadYaml: yaml.load }));
 
 vi.mock("utils/config/config", () => ({
   default: checkAndCopyConfig,

src/utils/config/kubernetes.js

@@ -1,17 +1,18 @@
 import { readFileSync } from "fs";
+import { isIPv6 } from "net";
 import path from "path";
 
 import { ApiextensionsV1Api, KubeConfig } from "@kubernetes/client-node";
-import yaml from "js-yaml";
 
 import checkAndCopyConfig, { CONF_DIR, substituteEnvironmentVars } from "utils/config/config";
+import { loadYaml } from "utils/config/yaml";
 
 export function getKubernetes() {
   checkAndCopyConfig("kubernetes.yaml");
   const configFile = path.join(CONF_DIR, "kubernetes.yaml");
   const rawConfigData = readFileSync(configFile, "utf8");
   const configData = substituteEnvironmentVars(rawConfigData);
-  return yaml.load(configData);
+  return loadYaml(configData);
 }
 
 export const getKubeConfig = () => {
@@ -21,6 +22,10 @@ export const getKubeConfig = () => {
   switch (config?.mode) {
     case "cluster":
       kc.loadFromCluster();
+      // node < 26 can't match an IPv6 host against an IP SAN, so verify against the DNS SAN instead (nodejs/node#64032)
+      if (isIPv6(process.env.KUBERNETES_SERVICE_HOST ?? "")) {
+        kc.clusters = kc.clusters.map((cluster) => ({ ...cluster, tlsServerName: "kubernetes.default.svc" }));
+      }
       break;
     case "default":
       kc.loadFromDefault();

src/utils/config/kubernetes.test.js

@@ -32,10 +32,7 @@ vi.mock("fs", () => ({
   readFileSync: fs.readFileSync,
 }));
 
-vi.mock("js-yaml", () => ({
-  default: yaml,
-  ...yaml,
-}));
+vi.mock("utils/config/yaml", () => ({ loadYaml: yaml.load }));
 
 vi.mock("utils/config/config", () => ({
   default: checkAndCopyConfig,
@@ -46,6 +43,7 @@ vi.mock("@kubernetes/client-node", () => ({
   ApiextensionsV1Api: class ApiextensionsV1Api {},
   KubeConfig: class KubeConfig {
     loadFromCluster() {
+      this.clusters = [{ name: "inCluster", server: "https://host:443", skipTLSVerify: false }];
       return kube.loadFromCluster();
     }
     loadFromDefault() {
@@ -88,6 +86,27 @@ describe("utils/config/kubernetes", () => {
     expect(kc2).not.toBeNull();
   });
 
+  it("getKubeConfig sets tlsServerName when the in-cluster host is IPv6", () => {
+    vi.stubEnv("KUBERNETES_SERVICE_HOST", "fd00:1018:2000::1");
+    yaml.load.mockReturnValueOnce({ mode: "cluster" });
+
+    expect(getKubeConfig().clusters[0]).toMatchObject({
+      name: "inCluster",
+      tlsServerName: "kubernetes.default.svc",
+    });
+
+    vi.unstubAllEnvs();
+  });
+
+  it("getKubeConfig leaves tlsServerName unset for non-IPv6 in-cluster hosts", () => {
+    vi.stubEnv("KUBERNETES_SERVICE_HOST", "10.43.0.1");
+    yaml.load.mockReturnValueOnce({ mode: "cluster" });
+
+    expect(getKubeConfig().clusters[0].tlsServerName).toBeUndefined();
+
+    vi.unstubAllEnvs();
+  });
+
   it("checkCRD returns true when the CRD exists", async () => {
     apiExt.readCustomResourceDefinitionStatus.mockResolvedValueOnce({ ok: true });
     const logger = { error: vi.fn() };

src/utils/config/proxmox.js

@@ -1,14 +1,13 @@
 import { readFileSync } from "fs";
 import path from "path";
 
-import yaml from "js-yaml";
-
 import checkAndCopyConfig, { CONF_DIR, substituteEnvironmentVars } from "utils/config/config";
+import { loadYaml } from "utils/config/yaml";
 
 export function getProxmoxConfig() {
   checkAndCopyConfig("proxmox.yaml");
   const configFile = path.join(CONF_DIR, "proxmox.yaml");
   const rawConfigData = readFileSync(configFile, "utf8");
   const configData = substituteEnvironmentVars(rawConfigData);
-  return yaml.load(configData);
+  return loadYaml(configData);
 }