Dependency majors, the upstream review's fixes, known-device sign-in and a security-scan pass

.env.example

@@ -75,6 +75,8 @@ DB_DEBUG=false
 # -----------------------------------------------------------------------------
 # Redis
 # -----------------------------------------------------------------------------
+# Local development default; a deployment points REDIS_URL at its own Redis (rediss:// for TLS).
+# nosemgrep: trailofbits.generic.redis-unencrypted-transport.redis-unencrypted-transport
 REDIS_URL=redis://localhost:6379
 
 # Redis authentication (REQUIRED for production)
@@ -94,10 +96,11 @@ REDIS_TLS_REJECT_UNAUTHORIZED=true
 # -----------------------------------------------------------------------------
 # Tracker Ports
 # -----------------------------------------------------------------------------
-TRACKER_PORT=8000
 TRACKER_HTTP_PORT=8080
-TRACKER_UDP_PORT=8081
-TRACKER_WS_PORT=8082
+# UDP (BEP 15) is off unless enabled. The production compose file serves it on
+# 6969/udp and hands the same flag to the API, which only then writes the UDP
+# tier into `.torrent` files.
+TRACKER_UDP_ENABLED=false
 
 # Debug mode for verbose tracker logging (logs raw announce params)
 TRACKER_DEBUG=false
@@ -107,8 +110,8 @@ TRACKER_DEBUG=false
 # image can be reused by anyone with their own domain (no rebuild needed).
 # ⚠️  PRODUCTION: Configure these with your actual domain
 NUXT_PUBLIC_TRACKER_HTTP_URL=https://tracker.your-domain.com/announce
-NUXT_PUBLIC_TRACKER_UDP_URL=udp://tracker.your-domain.com:8081/announce
-NUXT_PUBLIC_TRACKER_WS_URL=wss://tracker.your-domain.com/ws
+# Only used when TRACKER_UDP_ENABLED=true.
+NUXT_PUBLIC_TRACKER_UDP_URL=udp://tracker.your-domain.com:6969/announce
 
 # -----------------------------------------------------------------------------
 # Security

.github/workflows/api-ci.yml

@@ -64,17 +64,22 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          # Matches `node:24-alpine` in apps/api/Dockerfile, so CI checks the
+          # Matches `node:26-alpine` in apps/api/Dockerfile, so CI checks the
           # runtime we actually ship.
-          node-version: 24
+          node-version: 26
 
-      # corepack rather than a third-party setup action: the pinned pnpm
-      # version already lives in package.json's `packageManager` field, and the
-      # Dockerfiles activate it exactly this way.
-      - name: Enable corepack
-        run: corepack enable
+      # Still no third-party setup action, but no corepack either: Node 25
+      # stopped shipping it. The version is read from package.json's
+      # `packageManager` field, which stays the one place it is pinned — and
+      # pnpm 12 checks that pin against pnpm-lock.yaml on a frozen install.
+      # That pin is the lock zizmor's `adhoc-packages` cannot see, hence its
+      # ignore on each of these steps.
+      # `--allow-scripts`: pnpm's install script only hard-links its native
+      # binary, and npm is moving to blocking scripts it was not told about.
+      - name: Install pnpm
+        run: npm install --global --allow-scripts=pnpm "$(node -p 'require("./package.json").packageManager')" # zizmor: ignore[adhoc-packages]
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -105,7 +110,8 @@ jobs:
           POSTGRES_USER: parity
           POSTGRES_DB: postgres
         ports:
-          - 5432:5432
+          # Service containers of a throwaway runner.
+          - 5432:5432  # nosemgrep: trailofbits.yaml.docker-compose.port-all-interfaces.port-all-interfaces
         options: >-
           --health-cmd "pg_isready -U parity"
           --health-interval 5s
@@ -117,12 +123,12 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: 24
+          node-version: 26
 
-      - name: Enable corepack
-        run: corepack enable
+      - name: Install pnpm
+        run: npm install --global --allow-scripts=pnpm "$(node -p 'require("./package.json").packageManager')" # zizmor: ignore[adhoc-packages]
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -158,16 +164,17 @@ jobs:
           POSTGRES_PASSWORD: tracker
           POSTGRES_DB: trackarr
         ports:
-          - 5432:5432
+          # Service containers of a throwaway runner.
+          - 5432:5432  # nosemgrep: trailofbits.yaml.docker-compose.port-all-interfaces.port-all-interfaces
         options: >-
           --health-cmd "pg_isready -U tracker -d trackarr"
           --health-interval 5s
           --health-timeout 5s
           --health-retries 20
       redis:
-        image: redis:8.10.1-alpine
+        image: redis:8.10.2-alpine
         ports:
-          - 6379:6379
+          - 6379:6379  # nosemgrep: trailofbits.yaml.docker-compose.port-all-interfaces.port-all-interfaces
         options: >-
           --health-cmd "redis-cli ping"
           --health-interval 5s
@@ -177,26 +184,26 @@ jobs:
         # Pinned rather than `:latest`. The suite it serves asserts byte-exact
         # SigV4 behaviour, so a floating tag is a test that can start failing
         # for a reason that is not in this repository.
-        image: rustfs/rustfs:1.0.0-rc.3
+        image: rustfs/rustfs:1.0.3
         env:
           RUSTFS_ACCESS_KEY: trackarritest
           RUSTFS_SECRET_KEY: trackarritestsecret
           RUSTFS_VOLUMES: /data
           RUSTFS_ADDRESS: ':9000'
         ports:
-          - 9000:9000
+          - 9000:9000  # nosemgrep: trailofbits.yaml.docker-compose.port-all-interfaces.port-all-interfaces
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: 24
+          node-version: 26
 
-      - name: Enable corepack
-        run: corepack enable
+      - name: Install pnpm
+        run: npm install --global --allow-scripts=pnpm "$(node -p 'require("./package.json").packageManager')" # zizmor: ignore[adhoc-packages]
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -243,7 +250,8 @@ jobs:
         env:
           DATABASE_URL: postgres://tracker:tracker@localhost:5432/trackarr
           DB_SSL: 'false'
-          REDIS_URL: redis://localhost:6379
+          # The job's own Redis service container.
+          REDIS_URL: redis://localhost:6379  # nosemgrep: trailofbits.generic.redis-unencrypted-transport.redis-unencrypted-transport
           # Explicitly empty. A service container runs `redis-server` with no
           # `--requirepass`, and the integration vitest config defaults this to
           # a fake password when it is UNSET — which would make the client send
@@ -307,12 +315,12 @@ jobs:
           persist-credentials: false
 
       - name: Set up Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       # Single-arch and loaded into the local daemon: the check has to `docker
       # run` it, which a `--push`-only multi-arch build cannot do.
       - name: Build the API image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           file: apps/api/Dockerfile

.github/workflows/deploy-docs.yml

@@ -45,15 +45,15 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          # Node 24, comme `doc/Dockerfile` et comme les autres workflows.
+          # Node 26, comme `doc/Dockerfile` et comme les autres workflows.
           # Ce travail était resté sur 20, en fin de vie depuis avril 2026 :
           # la même documentation était donc construite sur deux runtimes,
           # et le déploiement — qui a `pages: write` — tournait sur celui
           # qui ne reçoit plus de correctif. Vérifié : `npm ci` puis
-          # `npm run build` passent en 24 (vitepress 1.6.4 demande >= 20).
-          node-version: 24
+          # `npm run build` passent en 26 (vitepress 1.6.4 demande >= 20).
+          node-version: 26
           cache: 'npm'
           cache-dependency-path: './doc/package-lock.json'
 
@@ -86,4 +86,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

.github/workflows/docker.yml

@@ -112,11 +112,11 @@ jobs:
       # que sur `release`, `workflow_call` et `workflow_dispatch`, jamais sur une
       # pull request. `web-ci.yml` et `api-ci.yml` montent bien buildx de leur
       # côté, ce qui rendait leurs propres builds verts et masquait le manque.
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Build and push api image
         id: build-and-push
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: ./
           file: ./apps/api/Dockerfile
@@ -192,11 +192,11 @@ jobs:
       # que sur `release`, `workflow_call` et `workflow_dispatch`, jamais sur une
       # pull request. `web-ci.yml` et `api-ci.yml` montent bien buildx de leur
       # côté, ce qui rendait leurs propres builds verts et masquait le manque.
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Build and push tracker image
         id: build-and-push
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: ./
           file: ./apps/tracker/Dockerfile
@@ -278,11 +278,11 @@ jobs:
       # que sur `release`, `workflow_call` et `workflow_dispatch`, jamais sur une
       # pull request. `web-ci.yml` et `api-ci.yml` montent bien buildx de leur
       # côté, ce qui rendait leurs propres builds verts et masquait le manque.
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Build and push relay image
         id: build-and-push
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: ./
           file: ./apps/relay/Dockerfile
@@ -358,11 +358,11 @@ jobs:
       # que sur `release`, `workflow_call` et `workflow_dispatch`, jamais sur une
       # pull request. `web-ci.yml` et `api-ci.yml` montent bien buildx de leur
       # côté, ce qui rendait leurs propres builds verts et masquait le manque.
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Build and push front-ssr image
         id: build-and-push
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: ./
           file: ./apps/web/Dockerfile
@@ -437,11 +437,11 @@ jobs:
       # que sur `release`, `workflow_call` et `workflow_dispatch`, jamais sur une
       # pull request. `web-ci.yml` et `api-ci.yml` montent bien buildx de leur
       # côté, ce qui rendait leurs propres builds verts et masquait le manque.
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Build and push front image
         id: build-and-push
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: ./
           file: ./apps/web/Dockerfile.static
@@ -520,11 +520,11 @@ jobs:
       # que sur `release`, `workflow_call` et `workflow_dispatch`, jamais sur une
       # pull request. `web-ci.yml` et `api-ci.yml` montent bien buildx de leur
       # côté, ce qui rendait leurs propres builds verts et masquait le manque.
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Build and push docs image
         id: build-and-push
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           # The doc bundle is a self-contained npm project; scope
           # the build context to ./doc so the COPY in Dockerfile

.github/workflows/docs-ci.yml

@@ -43,15 +43,15 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          # Node 24, comme `doc/Dockerfile` et comme les autres workflows.
+          # Node 26, comme `doc/Dockerfile` et comme les autres workflows.
           # Ce travail était resté sur 20, en fin de vie depuis avril 2026 :
           # la même documentation était donc construite sur deux runtimes,
           # et le déploiement — qui a `pages: write` — tournait sur celui
           # qui ne reçoit plus de correctif. Vérifié : `npm ci` puis
-          # `npm run build` passent en 24 (vitepress 1.6.4 demande >= 20).
-          node-version: 24
+          # `npm run build` passent en 26 (vitepress 1.6.4 demande >= 20).
+          node-version: 26
           cache: 'npm'
           cache-dependency-path: './doc/package-lock.json'
 

.github/workflows/relay-ci.yml

@@ -59,12 +59,12 @@ jobs:
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           # The minor, not `go-version-file`. The `go` directive in go.mod is a
-          # minimum language version (`go 1.26.0`) and setup-go treats a full
-          # x.y.z as an exact pin — which on the tracker built CI on go1.26.0
-          # and failed govulncheck on 19 stdlib vulnerabilities fixed in
-          # 1.26.1. Tracking the minor matches `golang:1.26-alpine` in the
+          # minimum language version (`go 1.27.0`) and setup-go treats a full
+          # x.y.z as an exact pin — which on the tracker once built CI on
+          # go1.26.0 and failed govulncheck on 19 stdlib vulnerabilities fixed
+          # in 1.26.1. Tracking the minor matches `golang:1.27-alpine` in the
           # Dockerfile. Bump alongside the Dockerfile and the go.mod directive.
-          go-version: '1.26'
+          go-version: '1.27'
           check-latest: true
           cache-dependency-path: apps/relay/go.sum
 
@@ -113,7 +113,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
-          go-version: '1.26'
+          go-version: '1.27'
           check-latest: true
           cache-dependency-path: apps/relay/go.sum