chore: release 0.66.0

[magrhino]

🤖 I have created a release beep boop

0.66.0 (2026-10-16)

⚠ BREAKING CHANGES

• wudup: POST /api/v1/pending/cleanup, /api/v1/pending/removal-plan and /api/v1/pending/removal are removed, and plan responses no longer include cleanup.cleanup_id or cleanup.can_remove_unmatched.
• wudup: POST /api/v1/pending/cleanup, /api/v1/pending/removal-plan and /api/v1/pending/removal are removed, and plan responses no longer include cleanup.cleanup_id or cleanup.can_remove_unmatched.
• wudup: the updates, sync-wud-scripts, and truenas-status-export container commands, wudup updates, wudup init --profile host, bin/updates, install.sh, the WUD shell scripts, and TrueNAS status checks are removed. The legacy-file-mode tag marks the last release (v0.65.2) that shipped them.

refactor

• wudup: make the WUD API the WebUI's only pending source (#826) (0c0bf55)
• wudup: remove shell callbacks, script sync, host CLI, and TrueNAS status (#822) (3bd758d)
• wudup: remove WebUI pending cleanup and removal actions (#825) (b76b871)

Features

• edge: delete edge images older than the newest 50 builds (#848) (85f05c1), closes #844
• release: publish an edge image channel from main (#843) (f64d490)
• webui: show only decision-relevant lines in pending plan review (#859) (b12e4ca)

Bug Fixes

• compose: order stack services deterministically so plans stay stable (#885) (b7e3d62)
• compose: refuse duplicate labels and keep comments on digest unpin (#837) (9e8fb14)
• compose: sync Compose rewrites and remove updater backups (#838) (0ea0f37)
• db: make schema migrations all-or-nothing (#866) (6f01bb7)
• maintainability: keep --policy-file inside the --repo directory (#886) (f6201db)
• release: publish each stable release's images once (#849) (dd617df)
• retag: block retags that would stop WUDup or its Docker endpoint (#889) (2a61857), closes #887
• retag: check approved Compose hash and keep stopped services stopped on rollback (#835) (5e4cfc9)
• security: patch open dependency, CodeQL, and Scorecard alerts (#830) (c9a65fd)
• security: unblock image scans and catch new CVEs daily (#860) (ef133f1)
• tag-streams: let suffixed tracking rules follow version part-count changes (#884) (067d9fa)
• terminate interrupted streaming commands (#869) (82c2b74)
• updater: block updates that would stop WUDup's Docker endpoint (#888) (f59014f)
• updater: clean up Compose, WUD entries and audit when a run is interrupted (#872) (4937323)
• updater: fail health gate when a selected service has no container (#836) (cef9b6d)
• updater: keep tag exclusions from breaking variables or starting services (#839) (3d7013f)
• updater: recognize published-port and network_mode Docker endpoints (#890) (734fee8)
• updater: recreate or start containers on retry after a failed recreate (#841) (b5156ab)
• updater: refuse to recreate override-file Compose projects (#840) (a72a705)
• web-scheduler: hold blocked auto-update slots and record missed runs (#870) (6414152)
• webui: correct documentation links (#865) (05c42ed)
• webui: drop duplicate image change and unscanned security noise from plan review (#863) (8c5a69b)
• webui: explain stale plan rejections and offer a rebuild (#883) (27846bc)
• webui: keep WUD API credentials off redirects and redact webhook errors (#833) (96cb759)
• webui: prefer proxy X-Forwarded-* headers and keep /readyz local (#831) (7f6f036)
• webui: reserve login attempts and throttle bearer token guesses (#832) (d11adf0)
• webui: reserve the mutation gate for container restarts (#834) (43bfdf4)

Performance Improvements

• web: time WebUI requests and stop repeating Docker reads per request (#845) (0a2158d)

Dependencies

• deps-dev: bump the npm-development group across 1 directory with 2 updates (#877) (87b417b)
• deps-dev: bump the npm-development group across 1 directory with 6 updates (#862) (fd22796)
• deps-dev: bump the python-development group across 1 directory with 2 updates (#852) (5913ff5)
• deps-dev: bump the python-development group across 1 directory with 2 updates (#879) (7d16719)
• deps: bump @lucide/vue (#853) (7670d6e)
• deps: bump @vueuse/core from 14.4.0 to 15.0.0 in /webui (#855) (99cca59)
• deps: bump source-map-js from 1.2.1 to 1.2.2 in /webui (#857) (c86ab68)
• deps: bump the github-actions group across 1 directory with 2 updates (#880) (4630c30)
• deps: bump the github-actions group across 1 directory with 3 updates (#856) (3d603e6)
• deps: bump the npm-production group in /webui with 2 updates (#875) (4ca3f6b)
• deps: bump the python-production group with 2 updates (#851) (6977030)
• deps: bump the python-production group with 2 updates (#873) (56a1bb9)
• deps: update aquasec/trivy docker tag to v0.75.0 (#847) (388bc41)

---

@coderabbitai ignore

[github-actions]

Danger maintainability review skipped for release automation or dependency bot PR.

Generated by 🚫 dangerJS against e7a102b

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud