Release 1.11.0

Highlights

• Release-pinned image tags now make generated compose files, helper commands, installs, pulls, backups, restores, and upgrades resolve to the same Demyx release instead of drifting to latest.

• Daily telemetry now uses a local TOFU identity with Ed25519 signatures and registration, replacing shared-secret HMAC usage in the send path.

• Host upgrade handling now regenerates pinned compose config, force-recreates core services from the target release image, and avoids empty dangling-image cleanup runs.

• Update checks now track WordPress CLI versions and preserve full OpenSSH portable versions such as 10.0p2.

Added

• Added ca-certificates and openssl to the Demyx image for signed telemetry requests.

• Added WordPress CLI version tracking to the update system.

• Added TOFU telemetry identity bootstrap in daily cron: auto-creates /demyx/.telemetry, generates Ed25519 keypair when missing, and creates /demyx/.telemetry/identity.json for install_id and key_id.

• Added TOFU telemetry registration flow to POST /wp-json/demyx/v1/telemetry/register when local identity is not yet registered.

Changed

• Updated Demyx stack and app compose YAML generation to use direct demyx/:${DEMYX_VERSION} tags instead of runtime Docker Hub tag resolution.

• Updated Docker run, pull, backup, restore, utility, install, host, and version-check commands to use release-pinned Demyx image tags.

• Updated code-server image references to use release-pinned variant tags such as ${DEMYX_VERSION}-wp, ${DEMYX_VERSION}-browse, and ${DEMYX_VERSION}-bedrock.

• Updated Redis compose image from redis:alpine3.18 to redis:alpine3.22.

• Added v1 moving tag to build and push steps in GitHub Actions workflow.

• Updated GitHub Actions dependencies to actions/checkout@v6 and docker/login-action@v4.

• Changed scheduled GitHub Actions build day from Friday to Thursday.

• Pinned generated host helper and install-time helper commands to the release version.

• Simplified HAProxy and MariaDB version extraction using regex patterns with grep.

• Removed duplicate version checks and consolidated LSPHP/PHP version detection using environment variables.

• Refactored awk commands in the update workflow for better efficiency and consistency.

• Standardized changelog section headers to align with Keep a Changelog formatting.

• Replaced shared-secret HMAC telemetry signing in cron with TOFU Ed25519 signed request flow against POST /wp-json/demyx/v1/telemetry.

• Telemetry request headers now use install identity metadata (X-Demyx-Install-Id, X-Demyx-Key-Id, X-Demyx-Request-Id, X-Demyx-Signature-Alg) instead of HMAC-only auth headers.

• Updated install --no-ping handling to pass telemetry-disabled state into the helper container.

Fixed

• Fixed demyx host upgrade repeatedly re-running after helper updates by regenerating pinned compose config and force-recreating core services from the target release image.

• Fixed demyx host upgrade dangling image cleanup to skip docker rmi when no dangling images exist.

• Fixed single-image demyx pull commands for Demyx images to use release-pinned tags instead of falling back to latest.

• Fixed version comparisons for OpenSSH portable versions such as 10.0p1 and 10.0p2.

• Fixed SSH update cache parsing to preserve full OpenSSH portable versions such as 10.0p2.

• Fixed regex escaping in the HAProxy version extraction pattern.

Removed

• Removed Docker Compose version metadata from the generated VERSION file.

• Removed DEMYX_TELEMETRY_SECRET usage from the daily telemetry send path in function/cron.sh.

Security

• Replaced shared-secret telemetry authentication with per-install Ed25519 signed telemetry requests.