Rackpad v1.8.7

This stable maintenance patch updates the dependencies affected by
CVE-2026-118773 and CVE-2026-118764 and adds a real healthcheck to the isolated
SNMP interoperability fixture. Docker on linux/amd64 and linux/arm64 remains
the supported deployment.

Security and maintenance

• Static serving uses the supported @fastify/static 10.1.10 dependency chain,
  with glob 14.0.4 and minimatch 11.0.5. Scoped minimatch overrides also cover the
  affected lint and TypeScript validation consumers. Regression checks exercise
  bounded pattern expansion, cancellation, ordinary matching and project-service
  behavior through the actual consuming packages.
• The SNMP fixture healthcheck performs a bounded authenticated SHA/AES query
  against its isolated agent. Interoperability checks retain all four protocol
  combinations and verify failure for invalid credentials and unavailable peers.
• Accessible stack-member action names, translated rack-picture empty states,
  and deterministic screenshot readiness include the maintenance changes already
  present on the stable branch.

No production route, listener, privilege, authentication setting or database
migration changes. MCP remains disabled by default.

Upgrade and rollback

Schema remains 55, matching 1.8.6. Retain a protected consistent database or
volume snapshot, configuration, the original RACKPAD_SECRET_KEY and matching
previous image together. After successful publication, pin RACKPAD_TAG=1.8.7,
pull the image and recreate the container. Verify administrator access, static
assets, monitoring and restart persistence.

Rollback uses the previous image with its paired pre-upgrade
database/configuration/key snapshot. Older installations must also follow the
existing upgrade precautions.

Validation and limits

Publication requires full repository quality, CodeQL and Trivy gates, plus
immutable AMD64 and ARM64 fresh-install, upgrade, restart and paired-rollback
checks. Both candidate and published smoke checks include the immediately
preceding 1.8.6 image by immutable digest, in addition to historical recovery
coverage. Automated checks do not establish private-provider or real-device
acceptance. Native Proxmox LXC remains experimental pending its real-guest gates.