[remcoros]

Summary

-cloudflared 2026.10.0:0
+cloudflared 2026.10.3:0
-debian:13-slim (floating)
+debian:13-slim@sha256:62bd423aeee912639ca8ee681c2b762cb3e25137e0a92b20be455898a9f034ad (Debian 13.7)
-StartOS SDK 3.0.6
+StartOS SDK 3.1.0

Uses the latest stable cloudflared release, including Go security updates and the fix for messages truncated beyond the read buffer. The Dockerfile retains the shell required by the login helper. Updates release notes in all five locales and documents how to refresh the base image digest.

Evidence

• Before: origin/main packages cloudflared 2026.10.0:0, SDK 3.0.6, and an unpinned Debian base.
  After: make x86 passes TypeScript, SDK lint, formatting, bundling, image build, and S9PK packing. The packed manifest reports 2026.10.3:0, SDK 3.1.0, and minimum StartOS 0.4.0.2.
• Verified published cloudflared and Debian images for both amd64 and arm64. The selected Debian 13-slim digest is also the current 13.7-slim digest.
• Local x86_64 container smoke checks pass: cloudflared --version, required daemon/action flags, ingress validation and hostname matching, shell and CA bundle, and login-helper syntax and required-session validation. The packaged binary's SHA-256 matches the tested container; the packaged root filesystem reports Debian 13.7.
• Dependency installation stabilizes the lockfile, leaves one SDK version, and reports zero npm vulnerabilities.
• GitHub Actions passes both x86_64 and ARM64 package builds for commit 3816299e0a54f0be9b5544e562c448fbdd0b503a.
• Live upgrade on simple-strip.local (StartOS 0.4.0.2, x86_64) passed: installed 2026.10.3:0 / SDK 3.1.0 from exact commit 3816299e0a54f0be9b5544e562c448fbdd0b503a. The service resumed running with a successful primary health check, no service error, and no outstanding tasks. Container checks report cloudflared 2026.10.3 and Debian 13.7; the tunnel configuration file's SHA-256 is unchanged across the upgrade.
• After installation, a cache-bypassing GET to https://registry.testnet4.info/ returned HTTP 200 in approximately 0.11s, with valid TLS, server: cloudflare, cf-cache-status: DYNAMIC, and the expected Start9 Marketplace HTML (13,248 bytes).
• Used a checksum-verified start-cli 2.4.2 for server management because CLI 2.5.0 request signatures require StartOS 0.4.0.3 or later. The system CLI installation was unchanged.
• Local ARM64 execution was not tested.

Merge Danger

Door: two-way

No data migration is added. Reverting restores the previous package source pins.

Blast Radius: service

Changes the cloudflared binary, Debian runtime, and SDK used by Cloudflare Tunnel.