Merge branch 'main' into dependabot/npm_and_yarn/google-auth-library-10.5.0

Author: hardillb

.github/scripts/initial-setup.sh

@@ -184,7 +184,8 @@ curl -ks -w "\n" -XPOST \
   https://$FLOWFUSE_URL/api/v1/project-types/
 
 ### Create stacks
-create_stack "Default" "Default" 30 256 "flowfuse/node-red:$(get_latest_image_tag "4.0.x")"
+create_stack "Default" "Default (4.1.x)" 30 256 "flowfuse/node-red:$(get_latest_image_tag "4.1.x")"
+create_stack "NR-40x" "4.0.x" 30 256 "flowfuse/node-red:$(get_latest_image_tag "4.0.x")"
 create_stack "NR-30x" "3.0.x" 30 256 "flowfuse/node-red:latest"
 create_stack "NR-31x" "3.1.x" 30 256 "flowfuse/node-red:$(get_latest_image_tag "3.1.x")"
 

.github/workflows/branch-deploy.yaml

@@ -40,7 +40,7 @@ on:
       - 'docs/**'
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.number }}
+  group: ${{ github.workflow }}-${{ github.event.number || inputs.pr_number }}
   cancel-in-progress: false
 
 env:
@@ -89,7 +89,7 @@ jobs:
       needs.validate-user.outputs.is_org_member == 'true' &&
       github.event_name == 'workflow_dispatch' &&
       inputs.driver_k8s_branch != 'main'
-    uses: 'flowfuse/github-actions-workflows/.github/workflows/publish_node_package.yml@v0.47.0'
+    uses: 'flowfuse/github-actions-workflows/.github/workflows/publish_node_package.yml@v0.48.0'
     with:
       package_name: driver-k8s
       publish_package: true
@@ -106,7 +106,7 @@ jobs:
       needs.validate-user.outputs.is_org_member == 'true' &&
       github.event_name == 'workflow_dispatch' &&
       inputs.nr_project_nodes_branch != 'main'
-    uses: 'flowfuse/github-actions-workflows/.github/workflows/publish_node_package.yml@v0.47.0'
+    uses: 'flowfuse/github-actions-workflows/.github/workflows/publish_node_package.yml@v0.48.0'
     with:
       package_name: nr-project-nodes
       publish_package: true
@@ -123,7 +123,7 @@ jobs:
       needs.validate-user.outputs.is_org_member == 'true' &&
       github.event_name == 'workflow_dispatch' &&
       inputs.nr_file_nodes_branch != 'main'
-    uses: 'flowfuse/github-actions-workflows/.github/workflows/publish_node_package.yml@v0.47.0'
+    uses: 'flowfuse/github-actions-workflows/.github/workflows/publish_node_package.yml@v0.48.0'
     with:
       package_name: nr-file-nodes
       publish_package: true
@@ -140,7 +140,7 @@ jobs:
       needs.validate-user.outputs.is_org_member == 'true' &&
       github.event_name == 'workflow_dispatch' &&
       inputs.nr_assistant_branch != 'main'
-    uses: 'flowfuse/github-actions-workflows/.github/workflows/publish_node_package.yml@v0.47.0'
+    uses: 'flowfuse/github-actions-workflows/.github/workflows/publish_node_package.yml@v0.48.0'
     with:
       package_name: nr-assistant
       publish_package: true
@@ -157,7 +157,7 @@ jobs:
       needs.validate-user.outputs.is_org_member == 'true' &&
       github.event_name == 'workflow_dispatch' &&
       inputs.nr_tables_nodes_branch != 'main'
-    uses: 'flowfuse/github-actions-workflows/.github/workflows/publish_node_package.yml@v0.47.0'
+    uses: 'flowfuse/github-actions-workflows/.github/workflows/publish_node_package.yml@v0.48.0'
     with:
       package_name: nr-tables-nodes
       publish_package: true
@@ -179,7 +179,7 @@ jobs:
       needs.validate-user.outputs.is_org_member == 'true' &&
       github.event_name == 'workflow_dispatch' &&
       (always() && inputs.nr_launcher_branch != 'main') || needs.publish_nr_project_nodes.result == 'success' || needs.publish_nr_file_nodes.result == 'success' || needs.publish_nr_assistant.result == 'success' || needs.publish_nr_tables_nodes.result == 'success'
-    uses: 'flowfuse/github-actions-workflows/.github/workflows/publish_node_package.yml@v0.47.0'
+    uses: 'flowfuse/github-actions-workflows/.github/workflows/publish_node_package.yml@v0.48.0'
     with:
       package_name: flowfuse-nr-launcher
       publish_package: true
@@ -203,7 +203,7 @@ jobs:
       needs.validate-user.outputs.is_org_member == 'true' &&
       github.event_name == 'workflow_dispatch' &&
       (always() && needs.publish_nr_launcher.result == 'success')
-    uses: flowfuse/github-actions-workflows/.github/workflows/build_container_image.yml@v0.47.0
+    uses: flowfuse/github-actions-workflows/.github/workflows/build_container_image.yml@v0.48.0
     with:
       image_name: 'node-red'
       dockerfile_path: Dockerfile
@@ -247,7 +247,7 @@ jobs:
 
       - name: Configure AWS credentials for ECR interaction
         id: aws-config
-        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1
+        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
         with:
           role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ env.AWS_ECR_PUSH_ROLE }}
           role-session-name: GithubActionsRoleSession
@@ -262,7 +262,7 @@ jobs:
           mask-password: true
 
       - name: Login to GHCR
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -386,7 +386,7 @@ jobs:
 
       - name: Configure AWS credentials for ECR interaction
         id: aws-config
-        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1
+        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
         with:
           role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ env.AWS_ECR_PUSH_ROLE }}
           role-session-name: GithubActionsRoleSession
@@ -406,7 +406,7 @@ jobs:
           docker push ${{ steps.aws-config.outputs.aws-account-id }}.dkr.ecr.eu-west-1.amazonaws.com/flowforge/${{ env.tagged_image }}-${{ env.timestamp }}
 
       - name: Configure AWS credentials for EKS interaction
-        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1
+        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
         with:
           role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ env.AWS_EKS_DEPLOY_ROLE }}
           role-session-name: GithubActionsRoleSessio
@@ -617,7 +617,7 @@ jobs:
       id-token: write
     steps:
       - name: Configure AWS credentials for EKS interaction
-        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1
+        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
         with:
           role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ env.AWS_EKS_DEPLOY_ROLE }}
           role-session-name: GithubActionsRoleSession

.github/workflows/docs.yml

@@ -49,7 +49,7 @@ jobs:
           path: 'blueprint-library'
           token: ${{ steps.generate_token.outputs.token }}
       - name: Cache image pipeline output
-        uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7 # v5.0.2
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           key: img-pipeline-cache
           path: website/_site/img         

.github/workflows/publish.yml

@@ -97,7 +97,7 @@ jobs:
     if: |
       needs.check-tests-status.outputs.tests_status == 'success' && github.ref == 'refs/heads/main'
     needs: check-tests-status
-    uses: 'flowfuse/github-actions-workflows/.github/workflows/publish_node_package.yml@v0.47.0'
+    uses: 'flowfuse/github-actions-workflows/.github/workflows/publish_node_package.yml@v0.48.0'
     with:
       package_name: flowfuse
       build_package: true

.github/workflows/release-publish.yml

@@ -18,6 +18,6 @@ jobs:
       - run: npm ci
       - run: npm run build
       # - run: npm run test
-      - uses: JS-DevTools/npm-publish@4ce4bd0f334d5316473155078da1955d42148494 # v4.1.4
+      - uses: JS-DevTools/npm-publish@0fd2f4369c5d6bcfcde6091a7c527d810b9b5c3f # v4.1.5
         with:
           token: ${{ secrets.NPM_PUBLISH_TOKEN }}

.github/workflows/tests.yml

@@ -140,7 +140,7 @@ jobs:
       - name: Install Dependencies
         run: npm ci
       - name: Run UI E2E (Cypress) Tests - OS
-        uses: cypress-io/github-action@8a35f965fbd13e3b18d9fb3bdc5f50ae2f4a5e76 # v7.1.0
+        uses: cypress-io/github-action@84d178e4bbce871e23f2ffa3085898cde0e4f0ec # v7.1.2
         with:
           install: false
           config-file: config/cypress-os.config.js
@@ -180,7 +180,7 @@ jobs:
       - name: Install Dependencies
         run: npm ci
       - name: Run UI E2E (Cypress) Tests - EE
-        uses: cypress-io/github-action@8a35f965fbd13e3b18d9fb3bdc5f50ae2f4a5e76 # v7.1.0
+        uses: cypress-io/github-action@84d178e4bbce871e23f2ffa3085898cde0e4f0ec # v7.1.2
         with:
             install: false
             config-file: config/cypress-ee.config.js

CHANGELOG.md

@@ -1,3 +1,63 @@
+#### 2.27.0: Release
+
+ - Bump JS-DevTools/npm-publish from 4.1.4 to 4.1.5 (#6614)
+ - Bump aws-actions/configure-aws-credentials from 5.1.1 to 6.0.0 (#6673)
+ - Bump cypress-io/github-action from 7.1.1 to 7.1.2 (#6674)
+ - Bump flowfuse/github-actions-workflows/.github/workflows/build_container_image.yml (#6676)
+ - Bump flowfuse/github-actions-workflows/.github/workflows/publish_node_package.yml (#6675)
+ - Fix concurrency group setting in `Create pre-staging environment` workflow (#6656)
+ - Add X-Forwarded headers to nginx ingress docs (#6630)
+ - Ensure UI honors TeamType Enable All flag (#6686) @hardillb
+ - Bump @modelcontextprotocol/sdk from 1.25.3 to 1.26.0 (#6632) @app/dependabot
+ - Update device editor navigation to use named route configuration (#6690) @cstns
+ - Add 4.1.5 to Device Agent Node-RED versions (#6688) @hardillb
+ - Improve clarity of instance assignment in docs (#6554) @sumitshinde-84
+ - Allow snapshot to be restored to a remote instance in dev mode (#6679) @knolleary
+ - Hide billing selector when billing is disabled (#6671) @cstns
+ - fix(ui): wrap DialogBox in Teleport to fix positioning in drawer cont… (#6255) @dimitrieh
+ - Reenable immersive mode for remote instances (#6684) @cstns
+ - Use correct favicon and use provided link to package (#6678) @Steve-Mcl
+ - Ensure consistent Open Editor behavior — always default to immersive experience (#6670) @dimitrieh
+ - FlowFuse Expert context UI (#6631) @Steve-Mcl
+ - Remove WebSocket communication handling and associated methods from the immersive device editor (#6668) @cstns
+ - Add WebSocket disconnection details by logging event details (#6667) @cstns
+ - Enhance remote instance editor with connection polling, communication… (#6647) @cstns
+ - Add the drawer sub routes and the FF Expert to the immersive remote instance (#6629) @cstns
+ - Add the embedded remote instance editor route (#6628) @cstns
+ - Relocate immersive editor components to a common namespace (#6624) @cstns
+ - ci: Update NR versions on pre-staging stacks (#6641) @ppawlowski
+ - Refactor device routes and update references to use consistent naming convention (#6623) @cstns
+ - Chore: extract common immersive styling (#6622) @cstns
+ - Refactor drawer: extract reusable functionality into composable (#6621) @cstns
+ - Chore/use the resizing helper to resize the instance immersive drawer (#6610) @cstns
+ - Bump @isaacs/brace-expansion from 5.0.0 to 5.0.1 (#6627) @app/dependabot
+ - Bump dompurify from 3.3.0 to 3.3.1 (#6612) @app/dependabot
+
+#### 2.26.2: Release
+
+ - Bump cypress-io/github-action from 7.1.0 to 7.1.1 (#6616)
+ - Bump docker/login-action from 3.6.0 to 3.7.0 (#6617)
+ - Bump actions/cache from 5.0.2 to 5.0.3 (#6615)
+ - Bump flowfuse/github-actions-workflows/.github/workflows/build_container_image.yml (#6574)
+ - Bump flowfuse/github-actions-workflows/.github/workflows/publish_node_package.yml (#6575)
+ - Bump flowfuse/github-actions-workflows/.github/workflows/sast_scan.yaml (#6576)
+ - Bump fastify from 5.6.2 to 5.7.4 (#6620) @app/dependabot
+ - chore: Update features for teams on pre-staging (#6595) @ppawlowski
+ - Add issues and suggestions display to `ExpertChatMessage` component with icon support (#6607) @cstns
+ - Allow team owners to edit their application roles (#6555) @cstns
+ - Update Assistant Link (#6596) @sumitshinde-84
+ - Rename FlowFuse Assistant and related references to FlowFuse Expert (#6571) @sumitshinde-84
+ - Alter the expert's chat input (#6581) @cstns
+ - Create UI component to include selected flows (#6580) @cstns
+ - Add confirmation dialog for administrator privilege grant (#6548) @dimitrieh
+ - Fix Device based MCP error log in app log (#6587) @Steve-Mcl
+ - Fix Expert errors when device are present in MCPRegistrations (#6584) @cstns
+ - docs: add hosted vs remote instance comparison table (#6481) @dgatti0213
+ - Bump jsonwebtoken from 9.0.2 to 9.0.3 (#6469) @app/dependabot
+ - Bump @node-red/util from 4.0.2 to 4.1.2 (#6468) @app/dependabot
+ - Bump nodemailer from 7.0.11 to 7.0.12 (#6467) @app/dependabot
+ - Bump lodash from 4.17.21 to 4.17.23 (#6550) @app/dependabot
+
 #### 2.26.1: Release
 
  - Bump cypress-io/github-action from 6.10.8 to 7.1.0 (#6577)

docs/device-agent/register.md

@@ -147,7 +147,6 @@ flowfuse-device-agent
 You will see the Device Agent start and perform a 'call-home' where it connects back
 to the platform to check what it should be running.
 
-
 #### Additional Information
 
 If you copy or download a **Device Provisioning Configuration** file to your hardware,
@@ -164,12 +163,12 @@ you've followed [Single Device Registration](#single-remote-instance-registratio
 [Bulk Registration](#bulk-registration) to register your device, it will
 automatically be assigned to an Application or Instance.
 
-### Applications (Recommended)
-
-#### Assign to Application
+### Applications
 
 This step will permit you to push Snapshots to your Remote Instance via [DevOps Pipelines](/docs/user/devops-pipelines.md), or via a [Target Snapshot](/docs/user/snapshots/#application-owned-devices) from the Application.
 
+#### Assign to Application
+
 1. Go to your teams's **Remote Instances** page.
 2. Open the dropdown menu to the right of the Remote Instance you want to assign and
    select the **Add to Application** option.
@@ -206,14 +205,17 @@ NOTE: If you wish to keep the flows currently running on the Remote Instance, it
 
 ### Hosted Instances
 
-This method permits you to set a [Target Snapshot](/docs/user/snapshots/#instance-owned-devices) from the Hosted Instance to the Remote Instance. Note though, you can only push nodes and flows that are supported by _both_ Hosted and Remote Instances. The best use case for Remote Instances are generally to be assigned by an Application instead.
+This method establishes a deployment relationship where a Hosted Instance becomes the source for snapshot deployments to your Remote Instance(s).
+
+**Important:** This is a legacy feature; [assigning to Applications](./register.md#applications) is the recommended approach as it provides better fleet management and DevOps Pipeline capabilities. For guidance, see [when to use each approach](/docs/user/concepts.md#when-to-use-instance-assignment-vs-devops-pipelines).
 
 #### Assign to Hosted Instance
 
-1. Go to your teams's **Remote Instances** page.
-2. Open the dropdown menu to the right of the Remote Instance you want to assign and
-   select the **Add to Hosted Instance** option.
-3. Select the instance in the dialog and click **Add** to continue.
+1. Go to your team's **Remote Instances** page.
+2. Open the dropdown menu to the right of the Remote Instance you want to assign and select the **Add to Instance** option.
+3. Select the Hosted Instance in the dialog and click **Add** to continue.
+
+**Note:** There are constraints on which instances can be assigned to each other. For detailed information, refer to [Assignment Rules and Constraints](/docs/user/concepts.md#assignment-rules).
 
 ### Remove from Hosted Instance
 

docs/device-agent/running.md

@@ -51,6 +51,7 @@ Options
   -i, --interval secs
   -p, --port number
   -m, --moduleCache     Use local npm module cache rather than install
+  --node-options        Adds NodeJS command line arguments, can be specified multiple times
 
 Web UI Options
 
@@ -89,6 +90,12 @@ _Start the agent with a different working directory and the Web UI enabled_
 flowfuse-device-agent -d /path/to/working/directory -w --ui-user admin --ui-pass password --ui-port 8081
 ```
 
+_Start the agent with a larger NodeJS memory space and using the openssl CA certs_
+
+```bash
+flowfuse-device-agent -d /path/to/working/directory --node-options='--max_old_space_size=1024' --node_options='--use-openssl-ca'
+```
+
 ## Running behind a HTTP Proxy
 
 If the Remote Instance is behind a HTTP proxy, the agent can be configured to use the proxy by setting the `http_proxy`, `https_proxy` or `all_proxy` environment variables.
@@ -146,4 +153,4 @@ OS and Architecture as your target device, and then copy the modules on to your
 2. Place this file in an empty directory on your local device.
 3. Run `npm install` to install the modules. This will create a `node_modules` directory.
 4. On your target Remote Instance, create a directory called `module_cache` inside the Device Agent Configuration directory.
-5. Copy the `node_modules` directory from your local instance to the target instance so that it is under the `module_cache` directory.
+5. Copy the `node_modules` directory from your local instance to the target instance so that it is under the `module_cache` directory.

docs/install/kubernetes/aws.md

@@ -125,7 +125,13 @@ controller:
     configNameSpace: $(POD_NAMESPACE)/udp-services
   config:
     proxy-body-size: "0"
+    annotations-risk-level: "Critical"
+    use-gzip: true
     use-proxy-protocol: true
+    enable-real-ip: true
+    use-forwarded-headers: true
+    server-snippet: |
+      real_ip_header X-Forwarded-For;
   service:
     # AWS Annotations for LoadBalaner with Certificate ARN
     annotations:
@@ -141,6 +147,7 @@ controller:
     externalTrafficPolicy: Cluster
   ingressClassResource:
     default: true
+  allowSnippetAnnotations: true
 ```
 
 > The `proxy-body-size: "0"` removes the `1m` nginx default limit, you can set this to a