github-starred/pangolin
2
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-05-07 21:30:36 -05:00
Code Issues 564 Packages Projects Releases 72 Wiki Activity

[GH-ISSUE #2848] newtUpdateAvailable shows false for outdated sites due to v-prefixed duplicate tags #9022

New Issue
Closed
opened 2026-04-30 05:16:16 -05:00 by GiteaMirror · 1 comment
GiteaMirror commented 2026-04-30 05:16:16 -05:00
Owner
Copy Link

Originally created by @strausmann on GitHub (Apr 13, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/2848

Describe the Bug

The newtUpdateAvailable field in the Sites API response (GET /org/{orgId}/sites) incorrectly shows false for sites running outdated Newt versions. Two root causes were identified:

Bug 1 (primary): Tag sorting + duplicate tags

The code in server/routers/site/listSites.ts fetches /repos/fosrl/newt/tags and takes tags[0].name as the latest version. However, the Newt repo has duplicate tags with and without v prefix for versions 1.8.0–1.10.3. The GitHub Tags API returns v-prefixed tags before unprefixed ones:

# Actual order from GET /repos/fosrl/newt/tags:
v1.10.3    ← tags[0] — taken as "latest"!
v1.10.2
v1.10.1
...
1.11.0     ← the ACTUAL latest version (never reached)
1.10.4
1.10.3     ← same version as v1.10.3

Result: latestNewtVersion = "v1.10.3" instead of "1.11.0"

  • semver.lt("1.10.1", "v1.10.3") → true (correct for 1.10.1 sites)
  • semver.lt("1.10.3", "v1.10.3") → false (wrong — 1.11.0 is available)

Bug 2 (secondary): Cache invalidation without fallback

The cached version has a 1-hour TTL. After expiry, if the GitHub fetch times out (1.5s limit), the cache returns null and ALL sites default to newtUpdateAvailable: false. A stale-while-revalidate pattern would preserve the last known value until a successful fetch.

Suggested fixes:

  1. Sort fetched tags by semver.rcompare() and deduplicate before selecting tags[0]
  2. Use /repos/fosrl/newt/releases/latest instead of /tags (returns the actual latest release, not affected by tag ordering)
  3. Persist cached version until next successful fetch (stale-while-revalidate)
  4. Clean up duplicate v-prefixed tags in the Newt repo

Environment

  • OS Type & Version: Ubuntu 24.04 (Hetzner Cloud)
  • Pangolin Version: 1.17.0 (Enterprise Edition)
  • Gerbil Version: 1.17.0
  • Traefik Version: 3.6.13
  • Newt Version: Mix of 1.10.1, 1.10.3, 1.11.0 across 10 sites
  • Olm Version: n/a

To Reproduce

  1. Have sites running Newt 1.10.3 and 1.11.0
  2. Call GET /org/{orgId}/sites
  3. Observe that sites on 1.10.3 show newtUpdateAvailable: false
  4. Verify with curl https://api.github.com/repos/fosrl/newt/tags | jq '.[0].name' — returns v1.10.3 not 1.11.0

Expected Behavior

All sites running Newt < 1.11.0 should show newtUpdateAvailable: true, since 1.11.0 is the latest release.

Originally created by @strausmann on GitHub (Apr 13, 2026). Original GitHub issue: https://github.com/fosrl/pangolin/issues/2848 ### Describe the Bug The `newtUpdateAvailable` field in the Sites API response (`GET /org/{orgId}/sites`) incorrectly shows `false` for sites running outdated Newt versions. Two root causes were identified: **Bug 1 (primary): Tag sorting + duplicate tags** The code in `server/routers/site/listSites.ts` fetches `/repos/fosrl/newt/tags` and takes `tags[0].name` as the latest version. However, the Newt repo has **duplicate tags** with and without `v` prefix for versions 1.8.0–1.10.3. The GitHub Tags API returns `v`-prefixed tags before unprefixed ones: ``` # Actual order from GET /repos/fosrl/newt/tags: v1.10.3 ← tags[0] — taken as "latest"! v1.10.2 v1.10.1 ... 1.11.0 ← the ACTUAL latest version (never reached) 1.10.4 1.10.3 ← same version as v1.10.3 ``` Result: `latestNewtVersion = "v1.10.3"` instead of `"1.11.0"` - `semver.lt("1.10.1", "v1.10.3")` → true (correct for 1.10.1 sites) - `semver.lt("1.10.3", "v1.10.3")` → false (wrong — 1.11.0 is available) **Bug 2 (secondary): Cache invalidation without fallback** The cached version has a 1-hour TTL. After expiry, if the GitHub fetch times out (1.5s limit), the cache returns `null` and ALL sites default to `newtUpdateAvailable: false`. A stale-while-revalidate pattern would preserve the last known value until a successful fetch. **Suggested fixes:** 1. Sort fetched tags by `semver.rcompare()` and deduplicate before selecting `tags[0]` 2. Use `/repos/fosrl/newt/releases/latest` instead of `/tags` (returns the actual latest release, not affected by tag ordering) 3. Persist cached version until next successful fetch (stale-while-revalidate) 4. Clean up duplicate `v`-prefixed tags in the Newt repo ### Environment - OS Type & Version: Ubuntu 24.04 (Hetzner Cloud) - Pangolin Version: 1.17.0 (Enterprise Edition) - Gerbil Version: 1.17.0 - Traefik Version: 3.6.13 - Newt Version: Mix of 1.10.1, 1.10.3, 1.11.0 across 10 sites - Olm Version: n/a ### To Reproduce 1. Have sites running Newt 1.10.3 and 1.11.0 2. Call `GET /org/{orgId}/sites` 3. Observe that sites on 1.10.3 show `newtUpdateAvailable: false` 4. Verify with `curl https://api.github.com/repos/fosrl/newt/tags | jq '.[0].name'` — returns `v1.10.3` not `1.11.0` ### Expected Behavior All sites running Newt < 1.11.0 should show `newtUpdateAvailable: true`, since 1.11.0 is the latest release.
GiteaMirror added the bug label 2026-04-30 05:16:16 -05:00
GiteaMirror commented 2026-04-30 05:16:17 -05:00
Author
Owner
Copy Link

@strausmann commented on GitHub (Apr 13, 2026):

Related discussion with additional analysis and code suggestions: https://github.com/fosrl/pangolin/discussions/2847

<!-- gh-comment-id:4237957279 --> @strausmann commented on GitHub (Apr 13, 2026): Related discussion with additional analysis and code suggestions: https://github.com/fosrl/pangolin/discussions/2847
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
authentication
bug
config
dependencies
docker
documentation
enhancement
good first issue
help wanted
Improvement
Look Into
needs investigating
networking
new feature
non-critical bug
potential bug
pull-request
Mirrored from GitHub Pull Request
 question
reverse proxy
Security
stale
ui
wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/pangolin#9022
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?