GitHub bot: changelog [nobuild]

Fix/npm apparmor bash 2777 version bump

.github/addon_submitters.json

@@ -8,6 +8,7 @@
   "manyfold": "ToledoEM",
   "navidrome": "baldarn",
   "netalertx": "jokob-sk",
+  "nginx proxy manager": "ToledoEM",
   "openproject": "baldarn",
   "resiliosync": "tyjtyj",
   "spotweb": "woutercoppens",

CLAUDE.md

@@ -43,15 +43,21 @@ Shared build-time scripts are pulled from `.templates/` at build time:
 - `bashio-standalone.sh` – Bashio library for scripts outside Supervisor context
 
 The `ARG MODULES=` line lists template scripts to download at build time (e.g., `00-banner.sh 01-custom_script.sh 00-smb_mounts.sh`). Commonly-used modules in `.templates/` (not exhaustive):
+- `00-banner.sh` – Print the add-on startup banner
 - `00-global_var.sh` – Initialize global env vars from HA options
 - `00-local_mounts.sh` – Mount local disks (localdisks option)
 - `00-smb_mounts.sh` – SMB/CIFS network mount support
+- `00-deprecated.sh` – Print a deprecation warning for add-ons superseded by official ones
 - `01-config_yaml.sh` – Map HA options → app's `config.yaml`
 - `01-custom_script.sh` – Run user-provided custom scripts
+- `19-json_repair.sh` – Validate/repair JSON config files
 - `90-disable_ingress.sh` – Allow disabling HA ingress
 - `90-dns_set.sh` – Configure custom DNS
+- `91-silent.sh` – Reduce log verbosity
 - `91-universal_graphic_drivers.sh` – GPU driver detection
-- `19-json_repair.sh` – Validate/repair JSON config files
+- `99-custom_script.sh` – Run a user `script.sh` from the add-on config dir at startup
+
+Other helper scripts in `.templates/` used at build/run time: `ha_automatic_packages.sh` (resolve package names across distros), `ha_entrypoint_modif.sh`, `00-aaa_dockerfile_backup.sh`, plus `config.template`/`script.template`/`show_text_color` (templates/assets copied into add-ons).
 
 ## config.yaml Schema
 
@@ -120,6 +126,15 @@ When an upstream version is bumped, update `version` in `config.yaml`. If the ad
 
 **Weekly** (`weekly_addons_updater`): Runs the `addons_updater` container to bump add-on versions to match upstream.
 
+Other automation workflows:
+- `daily_README.yaml` – Regenerates the root `README.md` add-on table.
+- `weekly_crlftolf.yaml` – Finds and fixes CRLF line endings repo-wide.
+- `weekly_reduceimagesize.yml` – Compresses images and opens a PR with savings.
+- `weekly_stats.yaml` / `helper_stats_graphs.yaml` – Refresh the `Stats`/`Stats2` files and stat graphs.
+- `daily_stale.yml` – Warns and closes stale issues/PRs.
+- `on_issues.yml` / `on_issues_ping_submitter.yml` – Link issues to add-on READMEs and ping submitters.
+- `generate_stargazer_map.yml` – Regenerates the stargazer map image.
+
 Adding `[nobuild]` anywhere in a commit message skips the builder workflow.
 
 ## Linting Rules
@@ -146,3 +161,7 @@ Scripts in `rootfs/etc/cont-init.d/` run in lexicographic order. Common numberin
 - `80-*` – Application configuration
 - `90-*` – Misc pre-startup tasks (ssl, vpn, custom run)
 - `99-*` – Final startup / launch
+
+## User Customization
+
+Add-ons support end-user customization without rebuilding the image (see the repo wiki). At startup, `99-custom_script.sh` looks in the add-on's config directory for a user-provided `script.sh` (seeded from `.templates/script.template`) and executes it. Combined with the `env_vars` passthrough and the custom-script modules, this lets users inject commands and environment without forking the add-on.

birdnet-pi/CHANGELOG.md

@@ -1,3 +1,5 @@
+## 2026.06.01 (19-06-2026)
+- Minor bugs fixed
 ## 2026.02.25 (25-02-2026)
 - Minor bugs fixed
 ## 2026.02.01 (01-02-2026)

birdnet-pi/config.yaml

@@ -116,5 +116,5 @@ tmpfs: true
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/birdnet-pi
 usb: true
-version: 2026.02.25
+version: 2026.06.01
 video: true

nginx_webserver_proxy/CHANGELOG.md

@@ -1,13 +1,15 @@
-## 2.14.0 (10-05-2026)
+## 2.14.1 (19-06-2026)
 - Minor bugs fixed
 # Changelog
 
-## Unreleased
+## 2.14.1
+- Fix startup failure on aarch64/HAos: "/usr/bin/env: 'bash': Permission denied" (#2777)
+- Add s6-overlay/env/with-contenv exec rules to AppArmor profile
 
-- Fix Codacy style warnings: add blank lines around lists in README
+## 2.14.0 
+- Minor bugs fixed
 
 ## 2.14.0
-
 - Initial release wrapping jc21/nginx-proxy-manager:latest
 - NPM Admin UI on port 81; HTTP on port 80; HTTPS on port 443
 - Configurable static file server via NPM's default_host nginx config

nginx_webserver_proxy/apparmor.txt

@@ -5,20 +5,47 @@ profile nginx-proxy-manager flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/nameservice>
   #include <abstractions/openssl>
 
-  # Core capabilities
+  # Blanket file access, following the official Home Assistant add-on AppArmor
+  # template. Confinement is enforced through the capability allow-list and the
+  # explicit deny rules below rather than by enumerating every path. Enumerating
+  # paths is impractical here: this add-on wraps the s6-overlay based
+  # jc21/nginx-proxy-manager image, whose boot runs useradd/groupadd, certbot,
+  # nginx and a Node.js backend across a deep exec chain (issue #2777).
+  file,
+
+  # Signals used by the s6-overlay supervision tree.
+  signal (send) set=(kill,term,int,hup,cont),
+
+  # Network
+  network inet stream,
+  network inet dgram,
+  network inet6 stream,
+  network inet6 dgram,
+  network unix stream,
+  network unix dgram,
+
+  # Capabilities required by the boot chain.
+  # - chown/fowner/fsetid/dac_override: file ownership and mode changes
+  # - setgid/setuid/setfcap: useradd/groupadd and privilege drops (s6-setuidgid)
+  # - net_bind_service: bind ports 80/443/81
+  # - sys_chroot: s6/nginx
+  # - kill: s6 service supervision
+  # - audit_write: PAM/useradd audit records
+  # - sys_resource: raise limits
+  capability audit_write,
   capability chown,
   capability dac_override,
+  capability fowner,
+  capability fsetid,
+  capability kill,
   capability net_bind_service,
   capability setfcap,
   capability setgid,
   capability setuid,
   capability sys_chroot,
-  capability kill,
-
-  # Process and memory management
   capability sys_resource,
 
-  # Deny dangerous capabilities
+  # Deny dangerous capabilities outright.
   deny capability dac_read_search,
   deny capability linux_immutable,
   deny capability mac_admin,
@@ -29,72 +56,30 @@ profile nginx-proxy-manager flags=(attach_disconnected,mediate_deleted) {
   deny capability sys_rawio,
   deny capability syslog,
 
-  # Network
-  network inet stream,
-  network inet dgram,
-  network inet6 stream,
-  network inet6 dgram,
-  network unix stream,
-  network unix dgram,
+  # S6-Overlay boot chain and the add-on entrypoint.
+  # The run.sh shebang is "#!/usr/bin/with-contenv bash", and with-contenv
+  # execs "/usr/bin/env bash"; without exec access here AppArmor denied it with
+  # "/usr/bin/env: 'bash': Permission denied" (issue #2777).
+  /init ix,
+  /bin/** ix,
+  /usr/bin/** ix,
+  /sbin/** ix,
+  /usr/sbin/** ix,
+  /usr/local/bin/** ix,
+  /usr/local/sbin/** ix,
+  /opt/** ix,
+  /run/{s6,s6-rc*,service}/** ix,
+  /package/** ix,
+  /command/** ix,
+  /npm-addon-init.sh ix,
+  /etc/s6-overlay/** rwix,
+  /etc/services.d/** rwix,
+  /etc/cont-init.d/** rwix,
+  /etc/cont-finish.d/** rwix,
+  /run/{,**} rwk,
+  /dev/tty rw,
 
-  # /data - addon config (read/write)
-  /data/ r,
-  /data/** rwk,
-
-  # /share - Home Assistant storage (read/write)
-  /share/ r,
-  /share/** rwk,
-
-  # /media - Home Assistant media (read/write)
-  /media/ r,
-  /media/** rwk,
-
-  # /config - Home Assistant config (read/write)
-  /config/ r,
-  /config/** rwk,
-
-  # /addon_configs - addon instance config
-  /addon_configs/ r,
-  /addon_configs/** rwk,
-
-  # /etc/letsencrypt - SSL certs
-  /etc/letsencrypt/ r,
-  /etc/letsencrypt/** rwk,
-
-  # /proc and /sys
-  @{PROC}/ r,
-  @{PROC}/** rw,
-  @{sys}/ r,
-  @{sys}/** rw,
-
-  # Temporary files
-  /tmp/ r,
-  /tmp/** rwk,
-  /var/tmp/ r,
-  /var/tmp/** rwk,
-
-  # Basic system access
-  /bin/bash ix,
-  /bin/sh ix,
-  /bin/ls ix,
-  /bin/cat ix,
-  /bin/sed ix,
-  /usr/bin/jq ix,
-
-  # Nginx binary and libraries
-  /usr/sbin/nginx ix,
-  /usr/local/sbin/nginx ix,
-  /usr/lib/** rm,
-  /lib/** rm,
-  /usr/local/lib/** rm,
-
-  # Allow reading app-specific configs (read-only)
-  /etc/nginx/ r,
-  /etc/nginx/** r,
-  /var/log/ r,
-  /var/log/** w,
-
-  # Deny sensitive system areas
+  # Deny sensitive system areas.
   deny /root/** rwkl,
   deny /home/** rwkl,
   deny /proc/sysrq-trigger rwkl,

nginx_webserver_proxy/config.yaml

@@ -1,7 +1,7 @@
 name: "Nginx Proxy Manager + Static Web Server"
 slug: nginx_webserver_proxy
 description: "Nginx Proxy Manager with a built-in configurable static file server. Manage reverse proxies via NPM UI on port 81 while serving files from HA storage on port 80."
-version: "2.14.0"
+version: "2.14.1"
 url: "https://github.com/alexbelgium/hassio-addons/tree/master/nginx_webserver_proxy"
 arch:
   - amd64