[remcoros]

Summary

Please merge using “Create a merge commit” (gh pr merge --merge). This PR branches from remcoros/main at 460a64e2be31fd76ca1f48c30eab5e4b726c936f. Preserving that commit as an ancestor of Community main lets us fast-forward remcoros/main to the Community merge afterward.

-cloudflared 2026.10.0:0
+cloudflared 2026.10.3:0
-debian:13-slim (floating)
+debian:13-slim@sha256:62bd423aeee912639ca8ee681c2b762cb3e25137e0a92b20be455898a9f034ad (Debian 13.7)
-StartOS SDK 3.0.6
+StartOS SDK 3.1.0

Uses the published cloudflared release, including Go security updates and the fix for messages truncated beyond the read buffer. The Dockerfile retains the shell required by the login helper. Updates release notes in all five locales and documents how to refresh the base image digest.

Evidence

The source is unchanged from remcoros/cloudflared-startos#31. Its squash-merge commit 460a64e has the same source tree as the tested and installed commit 3816299.

• Before: Community main packages cloudflared 2026.10.0:0, SDK 3.0.6, and an unpinned Debian base.
  After: make x86 passes TypeScript, SDK lint, formatting, bundling, image build, and S9PK packing. The packed manifest reports 2026.10.3:0, SDK 3.1.0, and minimum StartOS 0.4.0.2.
• Verified published cloudflared and Debian images for both amd64 and arm64. The selected Debian 13-slim digest is also the current 13.7-slim digest.
• Local x86_64 container smoke checks pass: cloudflared --version, required daemon/action flags, ingress validation and hostname matching, shell and CA bundle, and login-helper syntax and required-session validation. The packaged binary's SHA-256 matches the tested container; the packaged root filesystem reports Debian 13.7.
• Dependency installation stabilizes the lockfile, leaves one SDK version, and reports zero npm vulnerabilities.
• GitHub Actions passes both x86_64 and ARM64 package builds for commit 3816299e0a54f0be9b5544e562c448fbdd0b503a.
• Live upgrade on simple-strip.local (StartOS 0.4.0.2, x86_64) passed: installed 2026.10.3:0 / SDK 3.1.0 from exact commit 3816299e0a54f0be9b5544e562c448fbdd0b503a. The service resumed running with a successful primary health check, no service error, and no outstanding tasks. Container checks report cloudflared 2026.10.3 and Debian 13.7; the tunnel configuration file's SHA-256 is unchanged across the upgrade.
• After installation, a cache-bypassing GET to https://registry.testnet4.info/ returned HTTP 200 in approximately 0.11s, with valid TLS, server: cloudflare, cf-cache-status: DYNAMIC, and the expected Start9 Marketplace HTML (13,248 bytes).
• Used a checksum-verified start-cli 2.4.2 for server management because CLI 2.5.0 request signatures require StartOS 0.4.0.3 or later. The system CLI installation was unchanged.
• Local ARM64 execution was not tested.

Merge Danger

Door: two-way

No data migration is added. Reverting restores the previous package source pins.

Blast Radius: service

Changes the cloudflared binary, Debian runtime, and SDK used by Cloudflare Tunnel.

[MattDHill]

Approved: refreshes the CA bundle past the eMudhra distrust, plus the dependency and base updates described. Thanks!