[vpetersson-bot]

Bumps package.json, pyproject.toml and the anthias entry in uv.lock to 2026.11.0, per the cut-release runbook. uv.lock was regenerated with uv lock; only the anthias version line moved.

What ships since v2026.10.0

23 commits, mostly fixes, but three change how a device behaves in the field and are worth a look before publishing:

• feat: sign images with cosign and verify them, including wifi-connect, on upgrade #3401 — image signature verification on upgrade. Images are now cosign-signed in docker-build.yaml, and upgrade_containers.sh refuses to start any image (including wifi-connect) that fails verification, leaving the device on its current release. A release whose images weren't signed by the master build, or a device that can't fetch cosign, will stop upgrading rather than upgrade. Confirm the master Docker build for this bump signs every board before publishing.
• feat: bring back WiFi captive-portal setup on Screenly-Labs/wifi-connect #3399 — WiFi captive-portal setup returns, on Screenly-Labs/wifi-connect, as a new anthias-wifi-connect service in all three compose templates plus a host unit gated on manage_network.
• fix(server): bound connection concurrency so a scan cannot exhaust the fd table #3394 — connection concurrency is now capped (--limit-concurrency, default 256, ANTHIAS_LIMIT_CONCURRENCY overrides). Bursts past that get a 503 instead of exhausting file descriptors.

Also worth knowing:

• fix(ws): make /ws credential revocation fail closed #3336 makes /ws revocation fail closed: sockets accepted under rotated credentials go silent.
• fix(upgrade): don't leave the device empty when a reboot is pending #3420 fixes devices left with no containers when a reboot is pending after upgrade, and fix(compose): stop a crash filling the card with core dumps #3418 stops core dumps filling the card.
• filelock 3.29 → 4.2.1 (chore(deps): bump filelock from 3.29.0 to 4.2.1 #3413) is a major bump, but an indirect dependency.
• The rest: viewer fixes (fix(viewer): ship an emoji font so web assets stop rendering tofu #3407, fix(viewer): show the splash page once a WiFi setup portal ends #3412), error handling (fix(errors): serve a 500 page when the disk can't supply one #3396, fix(ws): refuse a handshake for an unrouted path instead of crashing #3398), Sentry quota and environment fixes (fix(sentry): stop a development stack reporting into the production project #3395, fix(sentry): thin a device's retry loop so it can't spend the quota #3400), an ansible DNS fix (fix(ansible): seed resolved's fallback DNS before the x86 resolver switch #3409), website pages (website: fix site audit findings (structured data, redirects, internal links) #3422, website: add an agent-facing page on driving Anthias over the API #3426), CI and dependency bumps.

Release once merged

Per .claude/skills/cut-release: wait for the full master docker-build.yaml matrix on the merge commit, then:

SHA=$(git rev-parse origin/master)
gh release create v2026.11.0 --draft --generate-notes --title 2026.11.0 --target "$SHA"
# testbed burn-in, then:
gh release edit v2026.11.0 --draft=false --latest

🤖 Generated with Claude Code

[Copilot]

Copilot encountered an error: Your billing is not configured or you have Copilot licenses from multiple standalone organizations or enterprises. To use premium requests, select a billing entity via the GitHub site, under Settings > Copilot > Features.

[Copilot]

Copilot encountered an error: Your billing is not configured or you have Copilot licenses from multiple standalone organizations or enterprises. To use premium requests, select a billing entity via the GitHub site, under Settings > Copilot > Features.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud