Bump the github-actions-dependencies group across 1 directory with 4 updates

Bumps the github-actions-dependencies group with 4 updates in the / directory: [docker/login-action](https://github.com/docker/login-action), [actions/setup-go](https://github.com/actions/setup-go), [actions/setup-node](https://github.com/actions/setup-node) and [actions/stale](https://github.com/actions/stale).


Updates `docker/login-action` from 4.2.0 to 4.4.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/650006c6eb7dba73a995cc03b0b2d7f5ca915bee...af1e73f918a031802d376d3c8bbc3fe56130a9b0)

Updates `actions/setup-go` from 6.4.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](https://github.com/actions/setup-go/compare/4a3601121dd01d1626a1e23e37211e3254c1c06c...b7ad1dad31e06c5925ef5d2fc7ad053ef454303e)

Updates `actions/setup-node` from 6.4.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e...820762786026740c76f36085b0efc47a31fe5020)

Updates `actions/stale` from 10.3.0 to 10.4.0
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/stale/compare/eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899...1e223db275d687790206a7acac4d1a11bd6fe629)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-dependencies
- dependency-name: actions/setup-go
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions-dependencies
- dependency-name: actions/setup-node
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions-dependencies
- dependency-name: actions/stale
  dependency-version: 10.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/cicd.yml

@@ -77,7 +77,7 @@ jobs:
                   fi
 
             - name: Log in to Docker Hub
-              uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+              uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
               with:
                   registry: docker.io
                   username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -149,7 +149,7 @@ jobs:
                   fi
 
             - name: Log in to Docker Hub
-              uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+              uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
               with:
                   registry: docker.io
                   username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -204,7 +204,7 @@ jobs:
               uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
             - name: Log in to Docker Hub
-              uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+              uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
               with:
                   registry: docker.io
                   username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -264,7 +264,7 @@ jobs:
               shell: bash
 
             - name: Install Go
-              uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+              uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
               with:
                   go-version: 1.25
 
@@ -407,7 +407,7 @@ jobs:
               shell: bash
 
             - name: Login to GitHub Container Registry (for cosign)
-              uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+              uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
               with:
                 registry: ghcr.io
                 username: ${{ github.actor }}

.github/workflows/linting.yml

@@ -24,7 +24,7 @@ jobs:
               uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
             - name: Set up Node.js
-              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
               with:
                 node-version: '24'
 

.github/workflows/stale-bot.yml

@@ -14,7 +14,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
+      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
         with:
           days-before-stale: 14
           days-before-close: 14

.github/workflows/test.yml

@@ -17,7 +17,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Install Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '24'
 

compose.example.yaml

@@ -41,7 +41,7 @@ services:
       - 80:80 # Port for traefik because of the network_mode
 
   traefik:
-    image: traefik:v3.6
+    image: traefik:v3.7
     container_name: traefik
     restart: unless-stopped
     network_mode: service:gerbil # Ports appear on the gerbil service

install/config/docker-compose.yml

@@ -50,7 +50,7 @@ services:
       - 80:80{{end}}
 
   traefik:
-    image: docker.io/traefik:v3.6
+    image: docker.io/traefik:v3.7
     container_name: traefik
     restart: unless-stopped
     {{if .InstallGerbil}}network_mode: service:gerbil # Ports appear on the gerbil service{{end}}{{if not .InstallGerbil}}

messages/en-US.json

@@ -1995,9 +1995,6 @@
     "domainPickerSubdomain": "Subdomain: {subdomain}",
     "domainPickerNamespace": "Namespace: {namespace}",
     "domainPickerShowMore": "Show More",
-    "domainPickerNoDomainsAvailableTitle": "No domains available",
-    "domainPickerNoDomainsAvailableDescription": "You don't have any domains set up yet. Create a domain to continue.",
-    "domainPickerNoDomainsAvailableAction": "Go to Domains",
     "regionSelectorTitle": "Select Region",
     "domainPickerRemoteExitNodeWarning": "Provided domains are not supported when sites connect to remote exit nodes. For resources to be available on remote nodes, use a custom domain instead.",
     "regionSelectorInfo": "Selecting a region helps us provide better performance for your location. You do not have to be in the same region as your server.",

server/emails/templates/NotifyTrialExpiring.tsx

@@ -30,14 +30,14 @@ export const NotifyTrialExpiring = ({
     const isLastDay = daysRemaining === 1;
 
     const previewText = hasEnded
-        ? `Your cloud trial for ${orgName} has ended.`
+        ? `Your trial for ${orgName} has ended.`
         : isLastDay
-          ? `Your cloud trial for ${orgName} ends tomorrow.`
+          ? `Your trial for ${orgName} ends tomorrow.`
-          : `Your cloud trial for ${orgName} ends in ${daysRemaining} days.`;
+          : `Your trial for ${orgName} ends in ${daysRemaining} days.`;
 
     const heading = hasEnded
-        ? "Your Cloud Trial Ended"
+        ? "Your Trial Ended"
-        : "Your Cloud Trial is Ending Soon";
+        : "Your Trial is Ending Soon";
 
     return (
         <Html>
@@ -55,7 +55,7 @@ export const NotifyTrialExpiring = ({
                         {hasEnded ? (
                             <>
                                 <EmailText>
-                                    Your cloud free trial for{" "}
+                                    Your free trial for{" "}
                                     <strong>{orgName}</strong> ended on{" "}
                                     <strong>{trialEndsAt}</strong>. Your account
                                     has been moved to the free plan, which
@@ -64,11 +64,10 @@ export const NotifyTrialExpiring = ({
 
                                 <EmailText>
                                     Some features and resources may now be
-                                    restricted. To restore full access and
+                                    restricted. To restore full
-                                    continue using all the features you had
+                                    access and continue using all the features
-                                    during your trial, please upgrade to a paid
+                                    you had during your trial, please upgrade to
-                                    plan. This does not effect any self hosted
+                                    a paid plan.
-                                    licenses.
                                 </EmailText>
 
                                 <EmailText>
@@ -94,8 +93,7 @@ export const NotifyTrialExpiring = ({
                                 <EmailText>
                                     After your trial ends, your account will be
                                     moved to the free plan and some
-                                    functionality may be restricted. This does
+                                    functionality may be restricted.
-                                    not effect any self hosted licenses.
                                 </EmailText>
 
                                 <EmailText>

server/lib/pathMatch.ts

@@ -15,41 +15,10 @@ function getSegmentRegex(patternPart: string): RegExp {
     return regex;
 }
 
-// Decodes percent-encoding (so an encoded slash like `%2F` is treated as a
-// real path separator, matching what most backends will do) and then
-// resolves `.` / `..` segments, so a request like `/public%2F..%2Fadmin/`
-// or `/public/../admin/` is matched as `/admin/`, not as a literal segment
-// or a wildcard-swallowed sequence under `/public/*`.
-function decodeAndResolvePath(p: string): string[] {
-    const rawParts = p.split("/").filter(Boolean);
-
-    const resolved: string[] = [];
-    for (const rawPart of rawParts) {
-        let part: string;
-        try {
-            part = decodeURIComponent(rawPart);
-        } catch {
-            part = rawPart;
-        }
-
-        // an encoded slash can turn one raw segment into several real ones
-        for (const segment of part.split("/").filter(Boolean)) {
-            if (segment === ".") {
-                continue;
-            } else if (segment === "..") {
-                resolved.pop();
-            } else {
-                resolved.push(segment);
-            }
-        }
-    }
-
-    return resolved;
-}
-
 export function isPathAllowed(pattern: string, path: string): boolean {
-    const patternParts = pattern.split("/").filter(Boolean);
+    const normalize = (p: string) => p.split("/").filter(Boolean);
-    const pathParts = decodeAndResolvePath(path);
+    const patternParts = normalize(pattern);
+    const pathParts = normalize(path);
 
     function matchSegments(
         patternIndex: number,

server/routers/badger/verifySession.test.ts

@@ -236,38 +236,6 @@ function runTests() {
         "Root path should not match non-root path"
     );
 
-    // Path traversal / encoded-slash bypass regression tests
-    assertEquals(
-        isPathAllowed("public/*", "public/../admin"),
-        false,
-        "Literal .. traversal out of an allowed prefix must not match"
-    );
-    assertEquals(
-        isPathAllowed("public/*", "public%2F..%2Fadmin"),
-        false,
-        "Encoded-slash traversal out of an allowed prefix must not match"
-    );
-    assertEquals(
-        isPathAllowed("public/*", "public%2f..%2fadmin%2ffile"),
-        false,
-        "Encoded-slash traversal is case-insensitively decoded before matching"
-    );
-    assertEquals(
-        isPathAllowed("admin/*", "public/../admin/secret"),
-        true,
-        ".. traversal INTO a restricted path should still be caught by its own rule"
-    );
-    assertEquals(
-        isPathAllowed("public/*", "public%2Ffoo"),
-        true,
-        "Encoded slash without traversal should still resolve and match normally"
-    );
-    assertEquals(
-        isPathAllowed("public/*", "public/./foo"),
-        true,
-        "Single-dot segments are a no-op and should not affect matching"
-    );
-
     console.log("All path matching tests passed!");
 }
 

server/routers/badger/verifySession.ts

@@ -418,7 +418,7 @@ export async function verifyResourceSession(
         }
 
         // check for HTTP Basic Auth header
-        const clientHeaderAuthKey = `headerAuth:${resource.resourceId}:${clientHeaderAuth}`;
+        const clientHeaderAuthKey = `headerAuth:${clientHeaderAuth}`;
         if (headerAuth && clientHeaderAuth) {
             if (localCache.get(clientHeaderAuthKey)) {
                 logger.debug(

src/components/DomainPicker.tsx

@@ -1,6 +1,6 @@
 "use client";
 
-import { Alert, AlertDescription, AlertTitle } from "@/components/ui/alert";
+import { Alert, AlertDescription } from "@/components/ui/alert";
 import { Button } from "@/components/ui/button";
 import { Card, CardContent } from "@/components/ui/card";
 import {
@@ -43,12 +43,10 @@ import {
     CheckCircle2,
     ChevronsUpDown,
     ExternalLink,
-    Globe,
     KeyRound,
     Zap
 } from "lucide-react";
 import { useTranslations } from "next-intl";
-import Link from "next/link";
 import { PaidFeaturesAlert } from "@app/components/PaidFeaturesAlert";
 import { usePaidStatus } from "@/hooks/usePaidStatus";
 import { TierFeature, tierMatrix } from "@server/lib/billing/tierMatrix";
@@ -496,28 +494,6 @@ export default function DomainPicker({
     const hasMoreProvided =
         sortedAvailableOptions.length > providedDomainsShown;
 
-    const noDomainsAvailable =
-        !loadingDomains &&
-        organizationDomains.length === 0 &&
-        (build === "oss" || hideFreeDomain || requiresPaywall);
-
-    if (noDomainsAvailable) {
-        return (
-            <Alert>
-                <Globe className="h-4 w-4" />
-                <AlertTitle>{t("domainPickerNoDomainsAvailableTitle")}</AlertTitle>
-                <AlertDescription className="space-y-3">
-                    <p>{t("domainPickerNoDomainsAvailableDescription")}</p>
-                    <Button asChild size="sm" variant="outline">
-                        <Link href={`/${orgId}/settings/domains`}>
-                            {t("domainPickerNoDomainsAvailableAction")}
-                        </Link>
-                    </Button>
-                </AlertDescription>
-            </Alert>
-        );
-    }
-
     return (
         <div className="space-y-4">
             <div className="grid grid-cols-1 sm:grid-cols-2 gap-4">

src/hooks/useOptimisticLabels.ts

@@ -95,10 +95,7 @@ export function useOptimisticLabels({
     }
 
     async function refresh() {
-        // Only refresh if the labels have been modified
+        router.refresh();
-        if (pendingActions.length > 0) {
-            router.refresh();
-        }
         setPendingActions([]);
     }