birdnet-go: resolve MariaDB host to IPv4 before connecting

On HAOS >=17.3 the Supervisor network gained IPv6, but the MariaDB addon
only grants the service user from the IPv4 subnet. Connecting via IPv6
causes auth failure and makes CREATE DATABASE appear to lack privileges.
Mirror the fix from the photoprism addon: resolve via getent ahostsv4
and add --skip-ssl. Password remains in MYSQL_PWD env var (safer than
--password= on the CLI).

.coderabbit.yaml

@@ -0,0 +1,173 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+#
+# CodeRabbit configuration for alexbelgium/hassio-addons
+# Goals:
+#   1. Triage and provide first-line help on issues (bug reports, feature requests).
+#   2. Review pull requests against this repository's add-on conventions and linters.
+# Docs: https://docs.coderabbit.ai/getting-started/configure-coderabbit
+language: "en-US"
+
+# Max 250 chars. Detailed context lives in path_instructions below.
+tone_instructions: "HA add-on repo with 120+ Docker add-ons for Home Assistant Supervisor. Be concise, practical and friendly; most contributors are hobbyists. Link to add-on READMEs and the repo wiki. Follow existing conventions over generic best practices."
+
+early_access: false
+enable_free_tier: true
+
+reviews:
+  # "chill" keeps reviews helpful without nitpicking the many small upstream
+  # version-bump PRs that dominate this repo.
+  profile: "chill"
+  # Don't block merges; this repo merges frequently and relies on CI gating.
+  request_changes_workflow: false
+  high_level_summary: true
+  high_level_summary_placeholder: "@coderabbitai summary"
+  auto_title_placeholder: "@coderabbitai"
+  review_status: true
+  commit_status: true
+  poem: false
+  collapse_walkthrough: false
+  changed_files_summary: true
+  sequence_diagrams: false
+  assess_linked_issues: true
+  related_issues: true
+  related_prs: true
+  suggested_labels: true
+  suggested_reviewers: true
+
+  # Auto-apply labels consistent with the repo's existing scheme.
+  labeling_instructions:
+    - label: "bug"
+      instructions: >-
+        Apply when the PR fixes incorrect behavior in an add-on (broken startup,
+        crash, regression) rather than adding functionality.
+    - label: "enhancement"
+      instructions: >-
+        Apply when the PR adds a new add-on, a new option/feature, or otherwise
+        extends functionality.
+
+  # Skip generated/vendored content and large data artifacts that produce noise.
+  path_filters:
+    - "!**/*.png"
+    - "!**/*.svg"
+    - "!**/*.jpg"
+    - "!**/*.jpeg"
+    - "!**/*.csv"
+    - "!**/Stats"
+    - "!**/Stats2"
+    - "!README.md"
+    - "!.github/stargazer_countries.csv"
+    - "!**/translations/**"
+
+  # Repository-specific review guidance keyed by file path.
+  path_instructions:
+    - path: "**/config.yaml"
+      instructions: >-
+        Home Assistant add-on metadata. Verify that `version` was bumped when the
+        upstream version changes, that `image` follows
+        `ghcr.io/alexbelgium/{slug}-{arch}`, and that `arch`, `schema`, `map` and
+        `ports` are internally consistent. The `env_vars` schema key enables
+        arbitrary env-var passthrough handled at runtime by 00-global_var.sh; do
+        not flag it as insecure by default. Versions legitimately vary in format
+        (semver, X.Y.Z-N patch counter, LSIO tags, date-based, nightly).
+    - path: "**/Dockerfile"
+      instructions: >-
+        Add-on Dockerfiles follow a 6-section pattern and pull shared scripts from
+        .templates/. `ARG BUILD_FROM` + `FROM ${BUILD_FROM}` is expected. Package
+        pinning is NOT required (Hadolint DL3008/DL3018 are intentionally ignored).
+        If the file has an `ARG BUILD_UPSTREAM` line it must match the upstream
+        version in config.yaml. Do not suggest generic pinning or multi-stage
+        rewrites that conflict with the shared-template convention.
+    - path: "**/rootfs/etc/cont-init.d/**"
+      instructions: >-
+        S6-overlay init scripts that run in lexicographic order. Respect the
+        numbering convention (20- folders, 32- nginx ingress, 80- app config,
+        90- misc, 99- launch). Check that scripts use bashio where appropriate and
+        fail safely. SC2002 is intentionally disabled in shellcheck.
+    - path: "**/rootfs/etc/services.d/**"
+      instructions: >-
+        S6-overlay supervised service definitions. Verify run/finish scripts are
+        executable and long-running services do not exit prematurely.
+    - path: "**/*.sh"
+      instructions: >-
+        Shell scripts are formatted with shfmt (4-space indent) and linted with
+        shellcheck (SC2002 disabled). Prefer bashio helpers in add-on scripts.
+    - path: "**/updater.json"
+      instructions: >-
+        Upstream tracking config for the addons_updater automation. Validate the
+        `source` is a supported type (github, dockerhub, pip, gitlab, bitbucket,
+        helm_chart, ...) and that `upstream_repo`/`slug` are coherent. Do not
+        hand-edit `upstream_version`; it is auto-populated.
+    - path: "**/CHANGELOG.md"
+      instructions: >-
+        Every changed add-on must update its CHANGELOG.md (CI enforces this).
+        Confirm the new entry matches the bumped version in config.yaml.
+    - path: ".github/workflows/**"
+      instructions: >-
+        GitHub Actions CI/CD. Be careful with permissions and pinned action
+        versions. Note that `[nobuild]` in a commit message intentionally skips
+        the builder workflow.
+
+  abort_on_close: true
+
+  auto_review:
+    enabled: true
+    auto_incremental_review: true
+    drafts: false
+    # Skip bot-generated upstream version bumps and explicit skip markers to
+    # save review budget; humans can still request a review with @coderabbitai.
+    ignore_title_keywords:
+      - "[nobuild]"
+      - "bump"
+      - "dependabot"
+    base_branches:
+      - "master"
+
+  finishing_touches:
+    docstrings:
+      enabled: true
+    unit_tests:
+      enabled: false
+
+  # Enable the linters that match this repo's CI so CodeRabbit surfaces the same
+  # issues reviewers and CI would flag.
+  tools:
+    shellcheck:
+      enabled: true
+    hadolint:
+      enabled: true
+    markdownlint:
+      enabled: true
+    yamllint:
+      enabled: true
+    actionlint:
+      enabled: true
+    gitleaks:
+      enabled: true
+    checkov:
+      enabled: true
+    languagetool:
+      enabled: true
+      level: "default"
+    github-checks:
+      enabled: true
+      timeout_ms: 120000
+
+# Issue triage & first-line help. CodeRabbit replies in issues and PRs; auto_reply
+# lets it respond without an explicit @coderabbitai mention, and the knowledge
+# base lets it reuse past issues/PRs/learnings for better triage.
+chat:
+  auto_reply: true
+
+knowledge_base:
+  opt_out: false
+  learnings:
+    scope: "auto"
+  issues:
+    scope: "auto"
+  pull_requests:
+    scope: "auto"
+
+# Match generated docstrings to the repo language.
+code_generation:
+  docstrings:
+    language: "en-US"

.github/addon_submitters.json

@@ -8,6 +8,7 @@
   "manyfold": "ToledoEM",
   "navidrome": "baldarn",
   "netalertx": "jokob-sk",
+  "nginx proxy manager": "ToledoEM",
   "openproject": "baldarn",
   "resiliosync": "tyjtyj",
   "spotweb": "woutercoppens",

.github/stargazer_countries.csv

@@ -18,6 +18,7 @@ username,country
 5kat3R,
 5quirrel,
 5vy4-88,
+6zXo8aMn2TRXOs,
 92Xiaowang,
 9turnbull,
 A-n-k-a,
@@ -413,7 +414,7 @@ LackyUA,
 Laithsters,
 Lancenas,
 LaneaLucy,
-Lars6503,
+Lars6503,Sweden
 LazyTarget,Sweden
 Lea-MR,
 Lee-View,
@@ -876,6 +877,7 @@ andrey-kovalev,Latvia
 andrkrasnov,
 andygrunwald,Germany
 andynbaker,
+andyrockt,
 angelside,United Kingdom
 anggiaj,Indonesia
 angristan,France
@@ -1115,6 +1117,7 @@ coxde,Colombia
 cpsancha,
 craftyshaun,Australia
 cramertj,
+crazyrokr,
 crazzyyfool,United Kingdom
 croess,
 cromulus,United States
@@ -1264,6 +1267,7 @@ ebahou,
 ebertti,Brazil
 ebonyschneider462359,
 echauvet,France
+economistgame,Spain
 ecrfix,United States
 eddgeywing,
 eduba,
@@ -1632,6 +1636,7 @@ justinmarks1,
 justinreeves00,United States
 jvdeijnden,
 jweingardt12,United States
+jzabroski,United States
 k-wojcik,Poland
 kabaumanis,
 kaesekuchen32,
@@ -1915,6 +1920,7 @@ muCruiser,
 mustafababil,Netherlands
 mwhaite,
 mww,
+mxstzdev,Germany
 mxwlf,United States
 myAlterX,Portugal
 mytire,United States
@@ -2061,6 +2067,7 @@ pietervanh,Belgium
 pietervanstee,
 pilottijavier,
 ping-localhost,
+pipchell,United Kingdom
 pixeye33,
 pjolivon,
 pjosalgado,Brazil
@@ -2341,6 +2348,7 @@ swerveshot,Netherlands
 swiewiora,
 swimly,
 sycx2,Germany
+syl-25,
 sysadm47362,United States
 szabinho,United Kingdom
 szjzaq,
@@ -2454,6 +2462,7 @@ user45876,
 ustoopia,Netherlands
 ustsv,
 v1k70rk4,Hungary
+valodec,
 vandyckruben,
 vanessa,Brazil
 vantuh,Ukraine
@@ -2512,6 +2521,7 @@ willigenburggihaux,
 willnewcombe,United Kingdom
 wimb0,
 witold-gren,Poland
+wonderfulhuber,
 wonkygecko,United States
 worgarside,United Kingdom
 wotography,

.github/workflows/archived_lint-checks.yaml

@@ -13,7 +13,7 @@ jobs:
     container: ghcr.io/hadolint/hadolint:latest-alpine
     steps:
       - name: ↩️ Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Get changed files
         id: changed_files
@@ -34,7 +34,7 @@ jobs:
     container: koalaman/shellcheck-alpine:latest
     steps:
       - name: ↩️ Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Get changed files
         id: changed_files
@@ -54,7 +54,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: ↩️ Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           # Full git history is needed to get a proper list of changed files within `super-linter`
           fetch-depth: 0

.github/workflows/daily_README.yaml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install jq + yq (v4)
         run: |

.github/workflows/daily_stale.yml

@@ -8,8 +8,8 @@
 name: Mark stale issues and pull requests
 
 on:
-  #schedule:
+  schedule:
-  #- cron: '0 12 * * 0'
+  - cron: '0 12 * * 0'
   workflow_dispatch:
 
 jobs:

.github/workflows/generate_stargazer_map.yml

@@ -9,7 +9,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up Python
         uses: actions/setup-python@v6

.github/workflows/helper_stats_graphs.yaml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Install apps
         run: |
           git pull --rebase origin master

.github/workflows/lint.yml

@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -82,7 +82,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/on_issues.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
     - name: Assign issues
       run: |
         # Init

.github/workflows/on_issues_ping_submitter.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Ping mapped submitter when add-on is mentioned
         env:

.github/workflows/onpr_check-pr.yaml

@@ -18,7 +18,7 @@ jobs:
       changedChangelogFiles: ${{ steps.changed-files.outputs.changelogs_files }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Find changed addon directories
         id: find_addons
         run: |
@@ -72,7 +72,7 @@ jobs:
         addon: ${{ fromJSON(needs.check-addon-changes.outputs.changedAddons) }}
     steps:
       - name: ↩️ Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: 🔎 Run Home Assistant Add-on Lint
         uses: frenck/action-addon-linter@v2
@@ -90,7 +90,7 @@ jobs:
         addon: ${{ fromJSON(needs.check-addon-changes.outputs.changedAddons) }}
     steps:
       - name: ↩️ Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: ℹ️ Gather addon info
         id: information

.github/workflows/onpush_builder.yaml

@@ -22,7 +22,7 @@ jobs:
       changedAddons: ${{ steps.find_addons.outputs.changed_addons }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -56,7 +56,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -108,7 +108,7 @@ jobs:
       matrix:
         addon: ${{ fromJSON(needs.detect-changed-addons.outputs.changedAddons) }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Run Home Assistant Add-on Lint
         uses: frenck/action-addon-linter@v2
         with:
@@ -133,7 +133,7 @@ jobs:
           - arch: aarch64
             runner: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
 
@@ -331,7 +331,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -402,7 +402,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/weekly_crlftolf.yaml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository contents
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Use action to check for CRLF endings
         uses: erclu/check-crlf@v1
@@ -29,7 +29,7 @@ jobs:
     runs-on: ubuntu-latest # Use a Linux runner
     steps:
       - name: Checkout repository contents
-        uses: actions/checkout@v6 # Use the checkout action
+        uses: actions/checkout@v7 # Use the checkout action
       - name: Find files with CRLF endings
         uses: erclu/check-crlf@v1.2.0 # Use the check-crlf action
         id: check-crlf # Assign an id to this step

.github/workflows/weekly_reduceimagesize.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Compress Images
         id: calibre

.github/workflows/weekly_stats.yaml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Create stats
         run: |
           echo "Starting"

.templates/ha_autoapps.sh

@@ -9,6 +9,61 @@ set -e
 PACKAGES="$1"
 echo "To install : $PACKAGES"
 
+apt_has_sources() {
+    [ -d /etc/apt ] || return 1
+    find /etc/apt -type f \( -name "sources.list" -o -name "*.list" -o -name "*.sources" \) \
+        -exec grep -Ehs '^[[:space:]]*(deb|Types:[[:space:]]*deb)' {} \; | grep -q .
+}
+
+restore_apt_sources_if_missing() {
+    command -v apt-get > /dev/null 2> /dev/null || return 0
+    apt_has_sources && return 0
+
+    if [ -r /etc/os-release ]; then
+        # shellcheck disable=SC1091
+        . /etc/os-release
+    fi
+
+    codename="${VERSION_CODENAME:-${UBUNTU_CODENAME:-}}"
+    if [ -z "$codename" ]; then
+        echo "Error: apt sources are missing and OS codename could not be detected" >&2
+        exit 1
+    fi
+
+    mkdir -p /etc/apt
+    case "${ID:-}" in
+        ubuntu)
+            arch="$(dpkg --print-architecture 2> /dev/null || true)"
+            if [ "$arch" = "amd64" ] || [ "$arch" = "i386" ]; then
+                mirror="http://archive.ubuntu.com/ubuntu"
+                security_mirror="http://security.ubuntu.com/ubuntu"
+            else
+                mirror="http://ports.ubuntu.com/ubuntu-ports"
+                security_mirror="$mirror"
+            fi
+            cat > /etc/apt/sources.list <<EOF2
+deb ${mirror} ${codename} main restricted universe multiverse
+deb ${mirror} ${codename}-updates main restricted universe multiverse
+deb ${security_mirror} ${codename}-security main restricted universe multiverse
+EOF2
+            ;;
+        debian)
+            cat > /etc/apt/sources.list <<EOF2
+deb http://deb.debian.org/debian ${codename} main contrib non-free non-free-firmware
+deb http://deb.debian.org/debian ${codename}-updates main contrib non-free non-free-firmware
+deb http://deb.debian.org/debian-security ${codename}-security main contrib non-free non-free-firmware
+EOF2
+            ;;
+        *)
+            echo "Error: apt sources are missing for unsupported OS '${ID:-unknown}'" >&2
+            exit 1
+            ;;
+    esac
+}
+
+restore_apt_sources_if_missing
+rm -f /ERROR
+
 # Install bash if needed
 if ! command -v bash > /dev/null 2> /dev/null; then
     (apt-get update && apt-get install -yqq --no-install-recommends bash || apk add --no-cache bash) > /dev/null

CLAUDE.md

@@ -43,15 +43,21 @@ Shared build-time scripts are pulled from `.templates/` at build time:
 - `bashio-standalone.sh` – Bashio library for scripts outside Supervisor context
 
 The `ARG MODULES=` line lists template scripts to download at build time (e.g., `00-banner.sh 01-custom_script.sh 00-smb_mounts.sh`). Commonly-used modules in `.templates/` (not exhaustive):
+- `00-banner.sh` – Print the add-on startup banner
 - `00-global_var.sh` – Initialize global env vars from HA options
 - `00-local_mounts.sh` – Mount local disks (localdisks option)
 - `00-smb_mounts.sh` – SMB/CIFS network mount support
+- `00-deprecated.sh` – Print a deprecation warning for add-ons superseded by official ones
 - `01-config_yaml.sh` – Map HA options → app's `config.yaml`
 - `01-custom_script.sh` – Run user-provided custom scripts
+- `19-json_repair.sh` – Validate/repair JSON config files
 - `90-disable_ingress.sh` – Allow disabling HA ingress
 - `90-dns_set.sh` – Configure custom DNS
+- `91-silent.sh` – Reduce log verbosity
 - `91-universal_graphic_drivers.sh` – GPU driver detection
-- `19-json_repair.sh` – Validate/repair JSON config files
+- `99-custom_script.sh` – Run a user `script.sh` from the add-on config dir at startup
+
+Other helper scripts in `.templates/` used at build/run time: `ha_automatic_packages.sh` (resolve package names across distros), `ha_entrypoint_modif.sh`, `00-aaa_dockerfile_backup.sh`, plus `config.template`/`script.template`/`show_text_color` (templates/assets copied into add-ons).
 
 ## config.yaml Schema
 
@@ -120,6 +126,15 @@ When an upstream version is bumped, update `version` in `config.yaml`. If the ad
 
 **Weekly** (`weekly_addons_updater`): Runs the `addons_updater` container to bump add-on versions to match upstream.
 
+Other automation workflows:
+- `daily_README.yaml` – Regenerates the root `README.md` add-on table.
+- `weekly_crlftolf.yaml` – Finds and fixes CRLF line endings repo-wide.
+- `weekly_reduceimagesize.yml` – Compresses images and opens a PR with savings.
+- `weekly_stats.yaml` / `helper_stats_graphs.yaml` – Refresh the `Stats`/`Stats2` files and stat graphs.
+- `daily_stale.yml` – Warns and closes stale issues/PRs.
+- `on_issues.yml` / `on_issues_ping_submitter.yml` – Link issues to add-on READMEs and ping submitters.
+- `generate_stargazer_map.yml` – Regenerates the stargazer map image.
+
 Adding `[nobuild]` anywhere in a commit message skips the builder workflow.
 
 ## Linting Rules
@@ -146,3 +161,7 @@ Scripts in `rootfs/etc/cont-init.d/` run in lexicographic order. Common numberin
 - `80-*` – Application configuration
 - `90-*` – Misc pre-startup tasks (ssl, vpn, custom run)
 - `99-*` – Final startup / launch
+
+## User Customization
+
+Add-ons support end-user customization without rebuilding the image (see the repo wiki). At startup, `99-custom_script.sh` looks in the add-on's config directory for a user-provided `script.sh` (seeded from `.templates/script.template`) and executes it. Combined with the `env_vars` passthrough and the custom-script modules, this lets users inject commands and environment without forking the add-on.

README.md

@@ -56,7 +56,7 @@ If you want to do add the repository manually, please follow the procedure highl
 
 ### Number of addons
 
-- In the repository : 131
+- In the repository : 132
 - Installed : 187951
 
 ### Top 3
@@ -1044,6 +1044,13 @@ If you want to do add the repository manually, please follow the procedure highl
 ![amd64][amd64-badge]
 ![MariaDB][mariadb-badge]
 
+✓  [Zoraxy](zoraxy/) : 🦓 General purpose request (reverse) proxy and forwarding tool with web management UI
+
+  ![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fzoraxy%2Fconfig.yaml)
+![Update](https://img.shields.io/badge/dynamic/json?label=Updated&query=%24.last_update&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fzoraxy%2Fupdater.json)
+![aarch64][aarch64-badge]
+![amd64][amd64-badge]
+
 ✓ ![image](https://api.iconify.design/mdi/monitor.svg) [chromium](browser_chromium/) : chromium browser
 
   ![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fbrowser_chromium%2Fconfig.yaml)

addons_updater/apparmor.txt

@@ -2,6 +2,7 @@
 
 profile addon_updater flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
+  capability sys_chroot,
 
   # Capabilities
   file,

arpspoof/apparmor.txt

@@ -9,6 +9,7 @@ profile arpspoof_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

aurral/CHANGELOG.md

@@ -1,3 +1,6 @@
+ 
+## 1.76.51 (2026-06-17)
+- Update to latest version from lklynet/aurral (changelog : https://github.com/lklynet/aurral/releases)
 ## 1.76.49 (2026-06-05)
 - Update to latest version from lklynet/aurral (changelog : https://github.com/lklynet/aurral/releases)
 ## 1.76.42 (2026-06-01)

aurral/apparmor.txt

@@ -2,6 +2,7 @@
 
 profile aurral flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
+  capability sys_chroot,
 
   file,
   signal (send) set=(kill,term,int,hup,cont),

aurral/config.yaml

@@ -1,5 +1,5 @@
 name: Aurral
-version: "1.76.49"
+version: "1.76.51"
 slug: aurral
 description: >-
   Self-hosted music discovery, request management, flows, and playlist

aurral/updater.json

@@ -1,8 +1,9 @@
 {
-  "last_update": "2026-06-05",
+  "last_update": "2026-06-17",
   "repository": "alexbelgium/hassio-addons",
   "slug": "aurral",
   "source": "github",
   "upstream_repo": "lklynet/aurral",
-  "upstream_version": "1.76.49"
+  "upstream_version": "1.76.51",
+  "github_beta": false
 }

autobrr/apparmor.txt

@@ -9,6 +9,7 @@ profile autobrr_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

baikal/apparmor.txt

@@ -9,6 +9,7 @@ profile baikal_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

battybirdnet-pi/apparmor.txt

@@ -9,6 +9,7 @@ profile battybirdnet-pi_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

bazarr/apparmor.txt

@@ -10,6 +10,7 @@ profile bazarr_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

bentopdf/apparmor.txt

@@ -2,6 +2,7 @@
 
 profile bentopdf flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
+  capability sys_chroot,
 
   # Capabilities
   file,

binance-trading-bot/apparmor.txt

@@ -9,6 +9,7 @@ profile db21ed7f_binance-trading-bot flags=(attach_disconnected,mediate_deleted)
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

birdnet-go/CHANGELOG.md

@@ -1,3 +1,15 @@
+## nightly-20260615-2 (2026-06-23)
+- MariaDB auto-config: resolve MariaDB hostname to IPv4 before connecting — on HAOS >=17.3 the Supervisor network gained IPv6 but the MariaDB addon only grants the service user from the IPv4 subnet, causing authentication failures and `CREATE DATABASE` errors; also add `--skip-ssl` to match the connection approach used by other addons
+- MariaDB auto-config: disabling `mariadb_auto_config` now reverts to SQLite only when `output.mysql.host` in config.yaml matches the HA MariaDB host (avoids clobbering manually-configured MySQL pointing at a different server)
+- Added `mariadb-client` to the addon packages so the `mysql` CLI used for database creation is available inside the container
+
+ - MQTT auto-config now also enables BirdNET-Go's native Home Assistant MQTT auto-discovery: detection sensors appear in Home Assistant automatically with no manual YAML (existing UI/config.yaml edits are preserved)
+- MQTT auto-config seeds `realtime.mqtt.retain: true` (only when unset) so sensor states survive Home Assistant restarts
+- Added supervisor watchdog (tcp://[HOST]:[PORT:8080]) so the add-on is automatically restarted if BirdNET-Go stops responding
+- Added backup_exclude for rotated logs, making Home Assistant backups smaller (SQLite journals are kept so hot backups stay consistent)
+
+## nightly-20260615 (2026-06-17)
+- Update to latest version from tphakala/birdnet-go (changelog : https://github.com/tphakala/birdnet-go/releases)
 ## nightly-20260601-2 (03-06-2026)
 - Minor bugs fixed
 ## nightly-20260601 (2026-06-01)

birdnet-go/Dockerfile

@@ -62,7 +62,7 @@ COPY ha_automodules.sh /ha_automodules.sh
 RUN chmod 744 /ha_automodules.sh && /ha_automodules.sh "$MODULES" && rm /ha_automodules.sh
 
 # Manual apps
-ENV PACKAGES="alsa-utils libasound2-plugins nginx yq"
+ENV PACKAGES="alsa-utils libasound2-plugins mariadb-client nginx yq"
 
 # Automatic apps & bashio
 COPY ha_autoapps.sh /ha_autoapps.sh

birdnet-go/HAINTEGRATION.md

@@ -2,6 +2,15 @@
 
 BirdNET-Go can be integrated with Home Assistant using a MQTT Broker.
 
+> **💡 Easiest path — automatic discovery.** If you run the Home Assistant
+> Mosquitto (MQTT) addon, just set `mqtt_auto_config: true` in this add-on's
+> options. The add-on then wires in the broker credentials **and** enables
+> BirdNET-Go's native Home Assistant MQTT auto-discovery, so the detection
+> sensors appear in Home Assistant automatically with **no manual YAML at
+> all**. The manual sensor/template/card configuration below is only needed if
+> you want to build your own custom entities instead of (or in addition to) the
+> auto-discovered ones.
+
 ## MQTT Configuration
 
 Your Home Assistant must be setup with MQTT and BirdNET-Go MQTT integration must be enabled. Modify the BirdNET-Go config.yaml file to enable MQTT. If you are using the Mosquitto Broker addon, you will see a log message during the BirdNET-Go startup showing the internal MQTT server details needed for configuration similar to below.

birdnet-go/README.md

@@ -64,7 +64,7 @@ Additional environment variables can be configured there
 
 ### MQTT and MariaDB auto-configuration (opt-in)
 
-If the Home Assistant **MQTT** addon is installed and running and you set `mqtt_auto_config: true` in the addon options, the addon writes the HA Mosquitto credentials directly into BirdNET-Go's `config.yaml` on every startup: `realtime.mqtt.enabled`, `broker`, `username`, and `password` are populated, and the topic defaults to `birdnet`. When the option is `false` (the default), the addon still logs the broker details and reminds you about the option whenever Mosquitto is detected — nothing is written.
+If the Home Assistant **MQTT** addon is installed and running and you set `mqtt_auto_config: true` in the addon options, the addon writes the HA Mosquitto credentials directly into BirdNET-Go's `config.yaml` on every startup: `realtime.mqtt.enabled`, `broker`, `username`, and `password` are populated, and the topic defaults to `birdnet`. In addition, it enables BirdNET-Go's **native Home Assistant MQTT auto-discovery** (`realtime.mqtt.homeassistant.enabled`), so the detection sensors show up in Home Assistant automatically — **no manual MQTT sensor YAML required** (the hand-written sensors in [HAINTEGRATION.md](./HAINTEGRATION.md) remain available if you prefer to build your own). Messages are also retained (`realtime.mqtt.retain: true`) so sensor states survive Home Assistant restarts. When the option is `false` (the default), the addon still logs the broker details and reminds you about the option whenever Mosquitto is detected — nothing is written.
 
 If the Home Assistant **MariaDB** addon is installed and running and you set `mariadb_auto_config: true`, the addon writes the HA credentials into `output.mysql.*` and sets `output.sqlite.enabled` to `false` (database name `birdnet`, created on first connect). When the option is `false` (the default), the addon only logs the credentials so you can configure them manually.
 

birdnet-go/apparmor.txt

@@ -9,6 +9,7 @@ profile db21ed7f_birdnet-go flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   capability sys_resource,
   file,

birdnet-go/config.yaml

@@ -2,6 +2,8 @@ arch:
   - aarch64
   - amd64
 audio: true
+backup_exclude:
+  - logs/**
 description: Realtime BirdNET and Battybirdnet soundscape analyzer
 devices:
   - /dev/dri
@@ -126,4 +128,5 @@ slug: birdnet-go
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/birdnet-go
 usb: true
-version: "nightly-20260601-2"
+version: "nightly-20260615-2"
+video: true

birdnet-go/rootfs/etc/cont-init.d/33-mariadb.sh

@@ -6,8 +6,17 @@ set -e
 # credentials directly into BirdNET-Go's config.yaml. Upstream reads MySQL
 # settings only from YAML (no env-var overrides exist), so this is the only
 # way to auto-configure them. The behaviour is opt-in via the
-# mariadb_auto_config addon option. When the option is off but MariaDB is
+# mariadb_auto_config addon option.
-# detected, we log a one-shot hint pointing users at the option.
+#
+# When the option is off but MariaDB is detected, we log a one-shot hint and
+# ensure config.yaml falls back to SQLite (reverting any previously written
+# mysql block). This is safe because BirdNET-Go's config.yaml defaults to
+# SQLite and the mysql block is only ever written by this script.
+#
+# When the option is on we:
+#   1. Create the "birdnet" database if it does not already exist — birdnet-go
+#      connects to an existing schema and does not create it automatically.
+#   2. Write the MySQL credentials into config.yaml and disable SQLite.
 
 CONFIG_LOCATION="/config/config.yaml"
 MYSQL_DATABASE="birdnet"
@@ -23,13 +32,27 @@ MYSQL_PASS="$(bashio::services 'mysql' 'password')"
 
 if ! bashio::config.true 'mariadb_auto_config'; then
     bashio::log.green "---"
-    bashio::log.yellow "Home Assistant MariaDB addon detected. Set 'mariadb_auto_config: true' in the addon options to wire it into BirdNET-Go automatically (and disable SQLite). Connection details:"
+    bashio::log.yellow "Home Assistant MariaDB addon detected but mariadb_auto_config is disabled; ensuring BirdNET-Go uses SQLite."
+    bashio::log.yellow "Set 'mariadb_auto_config: true' in the addon options to wire MariaDB into BirdNET-Go automatically. Connection details:"
     bashio::log.blue "Database user    : ${MYSQL_USER}"
-    bashio::log.blue "Database password: ${MYSQL_PASS}"
+    bashio::log.blue "Database password: [redacted]"
     bashio::log.blue "Database name    : ${MYSQL_DATABASE}"
     bashio::log.blue "Host-name        : ${MYSQL_HOST}"
     bashio::log.blue "Port             : ${MYSQL_PORT}"
     bashio::log.green "---"
+    if [ -f "$CONFIG_LOCATION" ]; then
+        # Only revert if config.yaml points at the HA MariaDB host we would have
+        # written — a mysql block pointing at a different host was set manually.
+        # shellcheck disable=SC2016
+        CURRENT_MYSQL_HOST="$(yq -r '.output.mysql.host // empty' "$CONFIG_LOCATION" 2>/dev/null || true)"
+        if yq -e '.output.mysql.enabled == true' "$CONFIG_LOCATION" >/dev/null 2>&1 \
+            && [ "${CURRENT_MYSQL_HOST}" = "${MYSQL_HOST}" ]; then
+            yq -i -y \
+                '.output.mysql.enabled = false
+                 | .output.sqlite.enabled = true' \
+                "$CONFIG_LOCATION"
+        fi
+    fi
     exit 0
 fi
 
@@ -39,12 +62,36 @@ if [ ! -f "$CONFIG_LOCATION" ]; then
 fi
 
 bashio::log.green "---"
-bashio::log.blue "mariadb_auto_config enabled; writing Home Assistant MariaDB credentials into BirdNET-Go config and disabling SQLite"
+bashio::log.blue "mariadb_auto_config enabled; creating MariaDB database and wiring credentials into BirdNET-Go config"
 bashio::log.blue "Host:     ${MYSQL_HOST}:${MYSQL_PORT}"
 bashio::log.blue "User:     ${MYSQL_USER}"
-bashio::log.blue "Database: ${MYSQL_DATABASE} (will be created by BirdNET-Go on first connect)"
+bashio::log.blue "Database: ${MYSQL_DATABASE}"
 bashio::log.green "---"
 
+# Resolve MariaDB hostname to IPv4: on HAOS >=17.3 the Supervisor network
+# gained IPv6, but the MariaDB addon only grants its user from the IPv4
+# subnet. Fall back to the raw hostname if resolution fails.
+MYSQL_HOST_RESOLVED="$(getent ahostsv4 "${MYSQL_HOST}" 2>/dev/null | awk '{print $1; exit}')"
+MYSQL_HOST_RESOLVED="${MYSQL_HOST_RESOLVED:-${MYSQL_HOST}}"
+if [ "${MYSQL_HOST_RESOLVED}" != "${MYSQL_HOST}" ]; then
+    bashio::log.blue "Resolved ${MYSQL_HOST} -> ${MYSQL_HOST_RESOLVED} (forcing IPv4)"
+fi
+
+# Create the database — birdnet-go connects to an existing schema and does NOT
+# create it automatically. MYSQL_PWD avoids exposing the password via the
+# process command line.
+if ! MYSQL_PWD="${MYSQL_PASS}" mysql \
+    --skip-ssl \
+    --host="${MYSQL_HOST_RESOLVED}" \
+    --port="${MYSQL_PORT}" \
+    --user="${MYSQL_USER}" \
+    --connect-timeout=10 \
+    -e "CREATE DATABASE IF NOT EXISTS \`${MYSQL_DATABASE}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"; then
+    bashio::log.error "Failed to create MariaDB database '${MYSQL_DATABASE}' — verify the MariaDB addon is running and the user has CREATE DATABASE privileges"
+    exit 1
+fi
+bashio::log.blue "Database '${MYSQL_DATABASE}' is ready"
+
 # Upstream config.go stores port as a string; pass it as such to match.
 # $host / $port / etc. are jq/yq variables, not shell expansions — the
 # single quotes around the filter are intentional.

birdnet-go/rootfs/etc/cont-init.d/33-mqtt.sh

@@ -8,6 +8,11 @@ set -e
 # way to auto-configure them. The behaviour is opt-in via the
 # mqtt_auto_config addon option. When the option is off but Mosquitto is
 # detected, we log a one-shot hint pointing users at the option.
+#
+# In addition to the broker credentials we enable BirdNET-Go's native Home
+# Assistant MQTT auto-discovery (realtime.mqtt.homeassistant.*). This makes
+# the detection sensors appear in Home Assistant automatically, so users no
+# longer have to hand-write the MQTT sensor YAML from HAINTEGRATION.md.
 
 CONFIG_LOCATION="/config/config.yaml"
 
@@ -23,7 +28,7 @@ MQTT_BROKER="tcp://${MQTT_HOST}:${MQTT_PORT}"
 
 if ! bashio::config.true 'mqtt_auto_config'; then
     bashio::log.green "---"
-    bashio::log.yellow "Home Assistant MQTT addon detected. Set 'mqtt_auto_config: true' in the addon options to wire it into BirdNET-Go automatically. Connection details:"
+    bashio::log.yellow "Home Assistant MQTT addon detected. Set 'mqtt_auto_config: true' in the addon options to wire it into BirdNET-Go automatically AND enable Home Assistant auto-discovery (sensors appear in HA with no manual YAML). Connection details:"
     bashio::log.blue "MQTT user    : ${MQTT_USER}"
     bashio::log.blue "MQTT password: ${MQTT_PASS}"
     bashio::log.blue "MQTT broker  : ${MQTT_BROKER}"
@@ -40,10 +45,21 @@ bashio::log.green "---"
 bashio::log.blue "mqtt_auto_config enabled; writing Home Assistant MQTT credentials into BirdNET-Go config"
 bashio::log.blue "Broker: ${MQTT_BROKER}"
 bashio::log.blue "User:   ${MQTT_USER}"
+bashio::log.blue "Home Assistant auto-discovery: enabled (sensors appear in HA automatically)"
 bashio::log.green "---"
 
 # $broker / $user / $pass / "birdnet" are jq/yq variables and literals,
 # not shell expansions, so the single quotes are intentional.
+#
+# Connection fields (enabled/broker/username/password) are force-set on every
+# start so they track the HA MQTT addon's rotating credentials. Topic and the
+# homeassistant.* discovery knobs use "//=" so they are only seeded when
+# missing. retain is seeded via an explicit has() check rather than "//=",
+# because jq treats a user-set "retain: false" as falsy and "//=" would wrongly
+# flip it back to true; has() seeds the default only when the key is truly
+# absent. Any value the user later changes in the BirdNET-Go UI or config.yaml
+# therefore survives restarts. homeassistant.enabled is force-set to true
+# because turning on discovery is the whole point of the auto-config option.
 # shellcheck disable=SC2016
 yq -i -y \
     --arg broker "$MQTT_BROKER" \
@@ -53,5 +69,9 @@ yq -i -y \
      | .realtime.mqtt.broker = $broker
      | .realtime.mqtt.username = $user
      | .realtime.mqtt.password = $pass
-     | .realtime.mqtt.topic //= "birdnet"' \
+     | .realtime.mqtt.topic //= "birdnet"
+     | (if (.realtime.mqtt | has("retain")) then . else .realtime.mqtt.retain = true end)
+     | .realtime.mqtt.homeassistant.enabled = true
+     | .realtime.mqtt.homeassistant.discovery_prefix //= "homeassistant"
+     | .realtime.mqtt.homeassistant.device_name //= "BirdNET-Go"' \
     "$CONFIG_LOCATION"

birdnet-go/updater.json

@@ -2,10 +2,10 @@
   "github_beta": true,
   "github_exclude": "-4",
   "github_fulltag": true,
-  "last_update": "2026-06-01",
+  "last_update": "2026-06-17",
   "repository": "alexbelgium/hassio-addons",
   "slug": "birdnet-go",
   "source": "github",
   "upstream_repo": "tphakala/birdnet-go",
-  "upstream_version": "nightly-20260601"
+  "upstream_version": "nightly-20260615"
 }

birdnet-pi/CHANGELOG.md

@@ -1,3 +1,5 @@
+## 2026.06.01 (19-06-2026)
+- Minor bugs fixed
 ## 2026.02.25 (25-02-2026)
 - Minor bugs fixed
 ## 2026.02.01 (01-02-2026)

birdnet-pi/apparmor.txt

@@ -9,6 +9,7 @@ profile birdnet-pi_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

birdnet-pi/config.yaml

@@ -116,5 +116,5 @@ tmpfs: true
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/birdnet-pi
 usb: true
-version: 2026.02.25
+version: 2026.06.01
 video: true

birdnet-pipy/apparmor.txt

@@ -8,6 +8,7 @@ profile birdnet-pipy_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

bitwarden/apparmor.txt

@@ -8,6 +8,7 @@ profile bitwarden_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

booksonic_air/apparmor.txt

@@ -9,6 +9,7 @@ profile booksonic-air_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

browser_brave/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## 1.91.175-ls106 (2026-06-20)
+- Update to latest version from linuxserver/docker-brave (changelog : https://github.com/linuxserver/docker-brave/releases)
+ 
 ## 1.91.172-ls105 (2026-06-13)
 - Update to latest version from linuxserver/docker-brave (changelog : https://github.com/linuxserver/docker-brave/releases)
  

browser_brave/apparmor.txt

@@ -1 +0,0 @@
-../browser_chromium/apparmor.txt

browser_brave/apparmor.txt

@@ -0,0 +1,72 @@
+#include <tunables/global>
+
+profile browser_brave_addon flags=(attach_disconnected,mediate_deleted) {
+  #include <abstractions/base>
+
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_chroot,
+  capability sys_admin,
+  file,
+  signal,
+  mount,
+  umount,
+  remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
+  network unix dgram,
+
+
+# S6-Overlay
+  /init ix,
+  /run/{s6,s6-rc*,service}/** ix,
+  /package/** ix,
+  /command/** ix,
+  /run/{,**} rwk,
+  /dev/tty rw,
+  /bin/** ix,
+  /usr/bin/** ix,
+  /usr/lib/bashio/** ix,
+  /etc/s6/** rix,
+  /run/s6/** rix,
+  /etc/services.d/** rwix,
+  /etc/cont-init.d/** rwix,
+  /etc/cont-finish.d/** rwix,
+  /init rix,
+  /var/run/** mrwkl,
+  /var/run/ mrwkl,
+  /dev/i2c-1 mrwkl,
+  # Files required
+  /dev/fuse mrwkl,
+  /dev/sda1 mrwkl,
+  /dev/sdb1 mrwkl,
+  /dev/nvme0 mrwkl,
+  /dev/nvme0n1 mrwkl,
+  /dev/nvme1 mrwkl,
+  /dev/mmcblk0p1 mrwkl,
+  /dev/* mrwkl,
+  /udev/* mrwkl,
+  /tmp/** mrkwl,
+  /dev/fuse/** mrkwl,
+  /dev/** mrkwl,
+  /sys/firmware/** mrkwl,
+
+  # Data access
+  /data/** rw,
+
+  # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
+  ptrace (trace,read) peer=docker-default,
+
+  # docker daemon confinement requires explict allow rule for signal
+  signal (receive) set=(kill,term) peer=/usr/bin/docker,
+
+}

browser_brave/config.yaml

@@ -69,5 +69,5 @@ slug: brave
 tmpfs: true
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "1.91.172-ls105"
+version: "1.91.175-ls106"
 video: true

browser_brave/updater.json

@@ -1,9 +1,9 @@
 {
   "github_fulltag": "true",
-  "last_update": "2026-06-13",
+  "last_update": "2026-06-20",
   "repository": "alexbelgium/hassio-addons",
   "slug": "brave",
   "source": "github",
   "upstream_repo": "linuxserver/docker-brave",
-  "upstream_version": "1.91.172-ls105"
+  "upstream_version": "1.91.175-ls106"
 }

browser_chromium/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## version-b9b82d3e (2026-06-20)
+- Update to latest version from linuxserver/docker-chromium (changelog : https://github.com/linuxserver/docker-chromium/releases)
+ 
 ## version-cca5154d (2026-06-11)
 - Update to latest version from linuxserver/docker-chromium (changelog : https://github.com/linuxserver/docker-chromium/releases)
 ## version-89f88890 (2026-06-05)

browser_chromium/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile chromium_addon flags=(attach_disconnected,mediate_deleted) {
+profile browser_chromium_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -9,6 +9,7 @@ profile chromium_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

browser_chromium/config.yaml

@@ -71,5 +71,5 @@ slug: chromium
 tmpfs: true
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "version-cca5154d"
+version: "version-b9b82d3e"
 video: true

browser_chromium/updater.json

@@ -1,9 +1,9 @@
 {
   "github_fulltag": "true",
-  "last_update": "2026-06-11",
+  "last_update": "2026-06-20",
   "repository": "alexbelgium/hassio-addons",
   "slug": "chromium",
   "source": "github",
   "upstream_repo": "linuxserver/docker-chromium",
-  "upstream_version": "version-cca5154d"
+  "upstream_version": "version-b9b82d3e"
 }

browserless_chrome/CHANGELOG.md

@@ -1,4 +1,10 @@
  
+## 2.54.0 (2026-06-20)
+- Update to latest version from browserless/chrome (changelog : https://github.com/browserless/chrome/releases)
+ 
+## 2.52.2 (2026-06-17)
+- Update to latest version from browserless/chrome (changelog : https://github.com/browserless/chrome/releases)
+ 
 ## 2.52.1 (2026-06-13)
 - Update to latest version from browserless/chrome (changelog : https://github.com/browserless/chrome/releases)
  

browserless_chrome/apparmor.txt

@@ -9,6 +9,7 @@ profile browserlesschrome_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

browserless_chrome/config.yaml

@@ -86,5 +86,5 @@ schema:
 slug: browserless_chrome
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/browserless_chrome
-version: "2.52.1"
+version: "2.54.0"
 webui: "[PROTO:ssl]://[HOST]:[PORT:3000]/docs"

browserless_chrome/updater.json

@@ -1,9 +1,9 @@
 {
   "github_tagfilter": "v",
-  "last_update": "2026-06-13",
+  "last_update": "2026-06-20",
   "repository": "alexbelgium/hassio-addons",
   "slug": "browserless_chrome",
   "source": "github",
   "upstream_repo": "browserless/chrome",
-  "upstream_version": "2.52.1"
+  "upstream_version": "2.54.0"
 }

calibre/apparmor.txt

@@ -10,6 +10,7 @@ profile calibre_addon flags=(attach_disconnected,mediate_deleted) {
   capability net_admin,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

calibre_web/apparmor.txt

@@ -10,6 +10,7 @@ profile calibre-web_addon flags=(attach_disconnected,mediate_deleted) {
   capability net_admin,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

changedetection.io/apparmor.txt

@@ -8,6 +8,7 @@ profile addon_db21ed7f_changedetection.io_nas flags=(attach_disconnected,mediate
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

cleanuparr/CHANGELOG.md

@@ -1,3 +1,6 @@
+ 
+## 2.9.14 (2026-06-20)
+- Update to latest version from Cleanuparr/Cleanuparr (changelog : https://github.com/Cleanuparr/Cleanuparr/releases)
 
 ## 2.9.13 (2026-05-16)
 - Update to latest version from Cleanuparr/Cleanuparr (changelog : https://github.com/Cleanuparr/Cleanuparr/releases)

cleanuparr/Dockerfile

@@ -11,7 +11,7 @@
 #=== Home Assistant Addon ===#
 
 # ARGs used in FROM must be declared before any FROM instruction
-ARG BUILD_UPSTREAM="2.9.13"
+ARG BUILD_UPSTREAM="2.9.14"
 
 #################
 # 1 Build Image #

cleanuparr/apparmor.txt

@@ -8,6 +8,7 @@ profile cleanuparr_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

cleanuparr/config.yaml

@@ -91,5 +91,5 @@ schema:
   TZ: str?
 slug: cleanuparr
 url: https://github.com/alexbelgium/hassio-addons/tree/master/cleanuparr
-version: "2.9.13"
+version: "2.9.14"
 webui: "[PROTO:ssl]://[HOST]:[PORT:11011]"

cleanuparr/updater.json

@@ -1,8 +1,8 @@
 {
-  "last_update": "2026-05-16",
+  "last_update": "2026-06-20",
   "repository": "alexbelgium/hassio-addons",
   "slug": "cleanuparr",
   "source": "github",
   "upstream_repo": "Cleanuparr/Cleanuparr",
-  "upstream_version": "2.9.13"
+  "upstream_version": "2.9.14"
 }

cloudcommander/CHANGELOG.md

@@ -1,3 +1,6 @@
+ 
+## 19.19.1 (2026-06-17)
+- Update to latest version from coderaiser/cloudcmd (changelog : https://github.com/coderaiser/cloudcmd/releases)
 
 ## 19.19.0 (2026-05-30)
 - Update to latest version from coderaiser/cloudcmd (changelog : https://github.com/coderaiser/cloudcmd/releases)

cloudcommander/apparmor.txt

@@ -9,6 +9,7 @@ profile cloudcommander_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

cloudcommander/config.yaml

@@ -104,4 +104,4 @@ schema:
 slug: cloudcommander
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/cloudcommander
-version: "19.19.0"
+version: "19.19.1"

cloudcommander/updater.json

@@ -1,8 +1,8 @@
 {
-  "last_update": "2026-05-30",
+  "last_update": "2026-06-17",
   "repository": "alexbelgium/hassio-addons",
   "slug": "cloudcommander",
   "source": "github",
   "upstream_repo": "coderaiser/cloudcmd",
-  "upstream_version": "19.19.0"
+  "upstream_version": "19.19.1"
 }

codex/CHANGELOG.md

@@ -1,3 +1,9 @@
+ 
+## 2.0.0 (2026-06-20)
+- Update to latest version from ajslater/codex (changelog : https://github.com/ajslater/codex/releases)
+ 
+## 1.12.8 (2026-06-17)
+- Update to latest version from ajslater/codex (changelog : https://github.com/ajslater/codex/releases)
 
 ## 1.12.7 (2026-05-30)
 - Update to latest version from ajslater/codex (changelog : https://github.com/ajslater/codex/releases)

codex/apparmor.txt

@@ -9,6 +9,7 @@ profile db21ed7f_codex flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

codex/config.yaml

@@ -101,4 +101,4 @@ schema:
 slug: codex
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "1.12.7"
+version: "2.0.0"

codex/updater.json

@@ -1,9 +1,9 @@
 {
   "github_beta": "true",
-  "last_update": "2026-05-30",
+  "last_update": "2026-06-20",
   "repository": "alexbelgium/hassio-addons",
   "slug": "codex",
   "source": "github",
   "upstream_repo": "ajslater/codex",
-  "upstream_version": "1.12.7"
+  "upstream_version": "2.0.0"
 }

collabora/apparmor.txt

@@ -8,6 +8,7 @@ profile collabora_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

comixed/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
+profile comixed_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -9,6 +9,7 @@ profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

elasticsearch/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 8.14.3-3 (2026-06-19)
+- Fix startup failing with `chroot: cannot change root directory` by allowing `capability sys_chroot` in the AppArmor profile (#2709)
+- Fix AppArmor profile name (was `inadyn_addon`, colliding with several other add-ons); renamed to `elasticsearch_addon`
+
 ## 8.14.3-2 (2025-11-18)
 - 8.14.3-1 (2025-11-18)
   - Added `env_vars` option to support custom environment variables from the add-on configuration.

elasticsearch/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
+profile elasticsearch_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -8,6 +8,7 @@ profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

elasticsearch/config.yaml

@@ -90,4 +90,4 @@ slug: elasticsearch
 startup: services
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/elasticsearch
-version: 8.14.3-1
+version: 8.14.3-3

emby/apparmor.txt

@@ -9,6 +9,7 @@ profile addon_db21ed7f_emby_nas flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

emby_beta/CHANGELOG.md

@@ -1,3 +1,6 @@
+ 
+## 4.10.0.15 (2026-06-20)
+- Update to latest version from linuxserver/docker-emby (changelog : https://github.com/linuxserver/docker-emby/releases)
 ## 4.10.0.14 (2026-06-05)
 - Update to latest version from linuxserver/docker-emby (changelog : https://github.com/linuxserver/docker-emby/releases)
 

emby_beta/Dockerfile

@@ -16,7 +16,7 @@
 
 ARG BUILD_FROM
 ARG BUILD_VERSION
-ARG BUILD_UPSTREAM="4.10.0.14"
+ARG BUILD_UPSTREAM="4.10.0.15"
 FROM ${BUILD_FROM}
 
 ##################

emby_beta/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile addon_db21ed7f_emby_nas flags=(attach_disconnected,mediate_deleted) {
+profile emby_beta_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -9,6 +9,7 @@ profile addon_db21ed7f_emby_nas flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

emby_beta/config.yaml

@@ -122,5 +122,5 @@ schema:
 slug: emby_nas
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/emby
-version: "4.10.0.14"
+version: "4.10.0.15"
 video: true

emby_beta/updater.json

@@ -1,9 +1,9 @@
 {
   "github_beta": "true",
-  "last_update": "2026-06-05",
+  "last_update": "2026-06-20",
   "repository": "alexbelgium/hassio-addons",
   "slug": "emby",
   "source": "github",
   "upstream_repo": "linuxserver/docker-emby",
-  "upstream_version": "4.10.0.14"
+  "upstream_version": "4.10.0.15"
 }

enedisgateway2mqtt/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
+profile enedisgateway2mqtt_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -8,6 +8,7 @@ profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

enedisgateway2mqtt_dev/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
+profile enedisgateway2mqtt_dev_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -8,6 +8,7 @@ profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

ente/apparmor.txt

@@ -9,6 +9,7 @@ profile ente_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

epicgamesfree/apparmor.txt

@@ -8,6 +8,7 @@ profile epicgamesfree_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,

filebrowser/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## 2.63.15 (2026-06-17)
+- Update to latest version from filebrowser/filebrowser (changelog : https://github.com/filebrowser/filebrowser/releases)
+ 
 ## 2.63.14 (2026-06-11)
 - Update to latest version from filebrowser/filebrowser (changelog : https://github.com/filebrowser/filebrowser/releases)
 ## 2.63.12 (2026-06-05)

filebrowser/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
+profile filebrowser_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -9,6 +9,7 @@ profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

filebrowser/config.yaml

@@ -124,4 +124,4 @@ schema:
 slug: filebrowser
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "2.63.14"
+version: "2.63.15"

filebrowser/updater.json

@@ -1,10 +1,10 @@
 {
   "github_beta": "true",
-  "last_update": "2026-06-11",
+  "last_update": "2026-06-17",
   "paused": false,
   "repository": "alexbelgium/hassio-addons",
   "slug": "filebrowser",
   "source": "github",
   "upstream_repo": "filebrowser/filebrowser",
-  "upstream_version": "2.63.14"
+  "upstream_version": "2.63.15"
 }

filebrowser_quantum/CHANGELOG.md

@@ -1,3 +1,6 @@
+ 
+## 1.4.0 (2026-06-20)
+- Update to latest version from gtsteffaniak/filebrowser (changelog : https://github.com/gtsteffaniak/filebrowser/releases)
 ## 1.3.3-8 (2026-06-03)
 - Add `default_user_scope` option: sets the FileBrowser source path and default user scope (must be an existing absolute directory path, defaults to `/`)
 

filebrowser_quantum/apparmor.txt

@@ -1,6 +1,6 @@
 #include <tunables/global>
 
-profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
+profile filebrowser_quantum_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   capability chown,
@@ -9,6 +9,7 @@ profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_admin,
   file,
   signal,

filebrowser_quantum/config.yaml

@@ -114,4 +114,4 @@ schema:
 slug: filebrowser_quantum
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "1.3.3-8"
+version: "1.4.0"

filebrowser_quantum/updater.json

@@ -1,10 +1,10 @@
 {
   "github_beta": "false",
-  "last_update": "2026-05-19",
+  "last_update": "2026-06-20",
   "paused": false,
   "repository": "alexbelgium/hassio-addons",
   "slug": "filebrowser_quantum",
   "source": "github",
   "upstream_repo": "gtsteffaniak/filebrowser",
-  "upstream_version": "1.3.3"
+  "upstream_version": "1.4.0"
 }

fireflyiii/apparmor.txt

@@ -8,6 +8,7 @@ profile fireflyiii_addon flags=(attach_disconnected,mediate_deleted) {
   capability fowner,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   file,
   signal,
   mount,