v1.8.0-rc.4

Full Changelog: v1.8.0-rc.3...v1.8.0-rc.4

[1.8.0-rc.4] - 2026-10-21

This candidate includes the v1.8.0-rc.1 features, the v1.8.0-rc.2 fixes and the v1.8.0-rc.3 changes, and retains their upgrade warnings. Supplementary groups added with group_add now survive the privilege drop to node (#1440), and the container update views finish moving to the operations store (DR-89, slices 2 to 4). CI test jobs now run in parallel shards, pull requests into main are checked for closing keywords, the website changelog renders alert callouts, and the vitest dev dependency moves to 4.1.12 for two advisories. v1.8 GA is not released; v1.7.0 (GA 2026-10-19) is the latest stable release. RC4 has its own publication-based soak.

Security

• Bump vitest and @vitest/coverage-v8 to 4.1.12 in app, ui and the demo for GHSA-qxg6-89mg-rqv8 and GHSA-xp26-3454-mjgp in @vitest/mocker (dev dependency only, not in the image).

Fixed

• Keep the supplementary groups Docker adds with group_add after the entrypoint drops from root to node. su-exec rebuilt the group list from /etc/group and lost them, so Compose files writable only through that group (a NAS share GID, or "0") failed with permission denied, even though the Compose trigger's own warning recommends group_add. The image now removes root from every /etc/group member list, so the entrypoint can treat the groups on the process as the group_add entries and add node to them. Without group_add, node gains no groups it didn't have before. A group_add of "0" is detected by GID 0 appearing twice in the list, so a runtime that dedupes the list still needs user: "1000:1000" with group_add. (#1440)
• Fail a pull request into main when its title, body or any commit message holds a GitHub closing keyword (Fixes: #N, closes #N, resolved owner/repo#N), so a dev to main sync can no longer re-close an issue that was reopened on purpose (DR-100). The check is the new Closing Keywords Guard workflow and scripts/closing-keywords.mjs; it is not a required status check.
• Website changelog alerts: the versioned changelog page on the website now renders GitHub alert blocks such as > [!WARNING] as callouts instead of showing the marker as literal text inside a blockquote.
• Pin musl-dev to 1.2.6-r3 in the healthcheck build stage. Alpine 3.24 retired 1.2.6-r2, so the image build failed at apk add.

Changed

• Split the CI test job into parallel app, ui and repo-check shard jobs, so the app and ui coverage runs no longer queue behind each other (CI-5). Quality: Test & Coverage stays the required check: it now aggregates the shards, merges their coverage reports for Codecov and .coverage-gaps.json, and fails unless every shard succeeded. The per-workspace coverage thresholds are unchanged and still enforced inside each shard.
• Read update progress in the container list rows, the side and full-page container panels from the operations store instead of the container's updateOperation prop (DR-89, slices 2 to 4). Row badges, the cancel control, and the update status panel now follow the same store the rest of the UI uses. The dashboard's Recent Updates widget (status, queue labels, from and to versions) reads the same store, and its own operation-event patching is gone; display holds are reconciled after each container-list fetch (slice 3), and a retry's hold no longer inherits the batch ID or queue position from a stale list-seeded row. The Containers view and its actions (cancel, bulk and group update guards, pending-update settling) read the same store too, and the display hold is reconciled against it, so a refresh mid-update keeps the row Updating and a terminal event missed during a disconnect clears within the usual 1.5 s settle window after the next list load (slice 4). Behavior is unchanged.