Crash when clicking on 'Updates'

[robindbe]

Describe the bug
When clicking on the Updates tab in the RESTAPI setting, or by polling /system/restapi/version, the UI crashes.

Not always, we have a larger install base, all running the same version and about 10% has this behavior. We already tried rebooting or reinstalling the RESTAPI package but it keeps happening, from what I can tell only on 2.8.0. Rolling back to 2.7.7 (or reinstalling since the revert command won't work, it throws the same error) solves the issue.

To Reproduce
Steps to reproduce the behavior:

1. Go to 'RESTAPI'
2. Click on 'Updates
3. See error

Expected behavior
Not crashing.

Screenshots or Response

Crash report begins.  Anonymous machine information:

amd64
16.0-CURRENT
FreeBSD 16.0-CURRENT #7 plus-RELENG_25_11_1-n256519-3d5e07ee0abe: Mon Jan 19 17:34:47 UTC 2026     root@pfsense-build-release-amd64-1.eng.atx.netgate.com:/var/jenkins/workspace/pfSense-Plus-snapshots-25_11_1-main/obj/amd64/8uazGBdh/var/jenkins/workspace/p

Crash report details:

PHP Errors:
[22-May-2026 11:25:34 Europe/Brussels] PHP Fatal error:  Uncaught TypeError: Cannot access offset of type string on string in /usr/local/pkg/RESTAPI/Models/RESTAPIVersion.inc:194
Stack trace:
#0 /usr/local/pkg/RESTAPI/Models/RESTAPIVersion.inc(140): RESTAPI\Models\RESTAPIVersion->get_all_available_versions()
#1 /usr/local/pkg/RESTAPI/Models/RESTAPIVersion.inc(73): RESTAPI\Models\RESTAPIVersion->get_latest_api_version()
#2 /usr/local/pkg/RESTAPI/Core/Model.inc(950): RESTAPI\Models\RESTAPIVersion->get_api_version_details()
#3 /usr/local/pkg/RESTAPI/Core/Model.inc(988): RESTAPI\Core\Model->get_internal_objects()
#4 /usr/local/pkg/RESTAPI/Core/Model.inc(459): RESTAPI\Core\Model->from_internal()
#5 /usr/local/pkg/RESTAPI/Core/Model.inc(359): RESTAPI\Core\Model->construct_from_internal()
#6 /usr/local/pkg/RESTAPI/Models/RESTAPIVersion.inc(63): RESTAPI\Core\Model->__construct()
#7 /usr/local/pkg/RESTAPI/Core/Form.inc(142): RESTAPI\Models\RESTAPIVersion->__construct()
#8 /usr/local/www/system_restapi_updates.php(10): RESTAPI\Core\Form->__construct()
#9 {main}
  thrown in /usr/local/pkg/RESTAPI/Models/RESTAPIVersion.inc on line 194



No FreeBSD crash data found.

pfSense Version & Package Version:

• pfSense Version: 25.11.1
• Package Version 2.8.0

Affected Endpoints:

• URL: /api/v2/system/restapi/version

[jaredhendrickson13]

This typically happens when GitHub returns an unexpected response from the releases API. There is a cache job the package runs about hourly to update available versions which is what this crash report points to. While a system is having this issue, can you capture the contents of /usr/local/pkg/RESTAPI/.resources/cache/RESTAPIVersionReleasesCache.json and provide it to me?

[robindbe]

This is the content:
{"message":"API rate limit exceeded for w.x.y.z. (But here's the good news: Authenticated requests get a higher rate limit. Check out the documentation for more details.)","documentation_url":"https://docs.github.com/rest/overview/resources-in-the-rest-api#rate-limiting"}

I obscured the IP, but I checked around a bit and this is a special setup where some pfSenses (like 50 or so) use another firewall for internet access and we all hide them behind the same public IP address. So I assume we are just hitting Github rate limits because all those devices make the same call with the same address? Its just surprising it doesn't error on 2.7.7.