After the tag-repositioning attacks that hit tj-actions and 23,000 repositories, GitHub is rolling out a security roadmap for Actions: dependency lockfiles, scoped secrets, and an egress firewall. Two measures are available today: SHA pinning and OIDC.

On August 9, 2026 Planka shipped version 2.2.0, which removes OIDC/SSO from the community edition and deactivates the accounts that depended on it. Before you upgrade, create a local admin account or you risk locking yourself out of your own instance.

Docker Hub now supports OpenID Connect for GitHub Actions. Workflows authenticate with short-lived, per-run tokens instead of storing PATs or OATs in GitHub secrets. Manual credential rotation is officially obsolete.

Immich 3.1 adds EXIF metadata workflow filters, screen wakelock during web upload, and OIDC role synchronization. The self-hosted Google Photos alternative now ships enterprise-grade identity management.