chore: update release lockfile

CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## v1.7.64-alpha (2026-05-18)
+
+- Update apply rate limiting is relaxed for authenticated admins from 2 attempts per 10 minutes to 10 attempts per minute, preventing the System Update page from getting stuck behind `429 Too Many Requests` during legitimate OTA retry/troubleshooting flows.
+- The corrected backend artifact rebuild protection from `v1.7.63-alpha` remains in place, so this release is built from a fresh Rust backend binary before publishing.
+
 ## v1.7.63-alpha (2026-05-18)
 
 - Release automation now rebuilds the Rust backend after bumping the version and before hashing release artifacts, preventing OTA manifests from pointing at a stale backend binary.

core/Cargo.lock

@@ -80,7 +80,7 @@ checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
 
 [[package]]
 name = "archipelago"
-version = "1.7.63-alpha"
+version = "1.7.64-alpha"
 dependencies = [
  "anyhow",
  "archipelago-container",

core/archipelago/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "archipelago"
-version = "1.7.63-alpha"
+version = "1.7.64-alpha"
 edition = "2021"
 description = "Archipelago Bitcoin Node OS - Native backend"
 authors = ["Archipelago Team"]

core/archipelago/src/rate_limit.rs

@@ -80,7 +80,10 @@ impl EndpointRateLimiter {
         limits.insert("backup.upload-s3".to_string(), (3, 600));
         limits.insert("backup.download-s3".to_string(), (3, 600));
         // System operations
-        limits.insert("update.apply".to_string(), (2, 600));
+        // Update apply is an authenticated local admin action. Keep a guard
+        // against accidental button storms without locking operators out for
+        // ten minutes during OTA troubleshooting.
+        limits.insert("update.apply".to_string(), (10, 60));
         limits.insert("system.reboot".to_string(), (2, 300));
         limits.insert("system.shutdown".to_string(), (2, 300));
         // Password and TOTP changes

neode-ui/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "neode-ui",
-  "version": "1.7.63-alpha",
+  "version": "1.7.64-alpha",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "neode-ui",
-      "version": "1.7.63-alpha",
+      "version": "1.7.64-alpha",
       "dependencies": {
         "@types/dompurify": "^3.0.5",
         "@vue-leaflet/vue-leaflet": "^0.10.1",

neode-ui/package.json

@@ -1,7 +1,7 @@
 {
   "name": "neode-ui",
   "private": true,
-  "version": "1.7.63-alpha",
+  "version": "1.7.64-alpha",
   "type": "module",
   "scripts": {
     "start": "./start-dev.sh",

release-manifest.json

@@ -1,27 +1,26 @@
 {
-  "version": "1.7.63-alpha",
+  "version": "1.7.64-alpha",
   "release_date": "2026-05-17",
   "changelog": [
-    "Release automation now rebuilds the Rust backend after bumping the version and before hashing release artifacts, preventing OTA manifests from pointing at a stale backend binary.",
+    "Update apply rate limiting is relaxed for authenticated admins from 2 attempts per 10 minutes to 10 attempts per minute, preventing the System Update page from getting stuck behind `429 Too Many Requests` during legitimate OTA retry/troubleshooting flows.",
-    "This corrected release carries the Nginx Proxy Manager stale-port repair in an updated backend binary, so nodes running `1.7.61-alpha` can actually receive and execute the fix.",
+    "The corrected backend artifact rebuild protection from `v1.7.63-alpha` remains in place, so this release is built from a fresh Rust backend binary before publishing."
-    "Validation confirmed the previously published `v1.7.62-alpha` backend artifact still contained `1.7.61-alpha`, explaining why nodes did not advance after applying that update."
   ],
   "components": [
     {
       "name": "archipelago",
-      "current_version": "1.7.63-alpha",
+      "current_version": "1.7.64-alpha",
-      "new_version": "1.7.63-alpha",
+      "new_version": "1.7.64-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.63-alpha/archipelago",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.64-alpha/archipelago",
-      "sha256": "a542f69c36e08408d57b830d9899350b1df49e90bf7ce10e6de9db3c87c8ce3f",
+      "sha256": "158a3cb659f82110780b0549382a9ac71320b1cb530e6a31a314959bbabd6c6c",
-      "size_bytes": 42937768
+      "size_bytes": 42935024
     },
     {
-      "name": "archipelago-frontend-1.7.63-alpha.tar.gz",
+      "name": "archipelago-frontend-1.7.64-alpha.tar.gz",
-      "current_version": "1.7.63-alpha",
+      "current_version": "1.7.64-alpha",
-      "new_version": "1.7.63-alpha",
+      "new_version": "1.7.64-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.63-alpha/archipelago-frontend-1.7.63-alpha.tar.gz",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.64-alpha/archipelago-frontend-1.7.64-alpha.tar.gz",
-      "sha256": "f4144003aded49ec83f75452026e8503e260cd89778913f8438be1fd2138767e",
+      "sha256": "d9be64980eede352c0b18402c42cff3a98a1ca881514082319d126cf4c91dcc3",
-      "size_bytes": 166470032
+      "size_bytes": 166470643
     }
   ]
 }

releases/manifest.json

@@ -1,27 +1,26 @@
 {
-  "version": "1.7.63-alpha",
+  "version": "1.7.64-alpha",
   "release_date": "2026-05-17",
   "changelog": [
-    "Release automation now rebuilds the Rust backend after bumping the version and before hashing release artifacts, preventing OTA manifests from pointing at a stale backend binary.",
+    "Update apply rate limiting is relaxed for authenticated admins from 2 attempts per 10 minutes to 10 attempts per minute, preventing the System Update page from getting stuck behind `429 Too Many Requests` during legitimate OTA retry/troubleshooting flows.",
-    "This corrected release carries the Nginx Proxy Manager stale-port repair in an updated backend binary, so nodes running `1.7.61-alpha` can actually receive and execute the fix.",
+    "The corrected backend artifact rebuild protection from `v1.7.63-alpha` remains in place, so this release is built from a fresh Rust backend binary before publishing."
-    "Validation confirmed the previously published `v1.7.62-alpha` backend artifact still contained `1.7.61-alpha`, explaining why nodes did not advance after applying that update."
   ],
   "components": [
     {
       "name": "archipelago",
-      "current_version": "1.7.63-alpha",
+      "current_version": "1.7.64-alpha",
-      "new_version": "1.7.63-alpha",
+      "new_version": "1.7.64-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.63-alpha/archipelago",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.64-alpha/archipelago",
-      "sha256": "a542f69c36e08408d57b830d9899350b1df49e90bf7ce10e6de9db3c87c8ce3f",
+      "sha256": "158a3cb659f82110780b0549382a9ac71320b1cb530e6a31a314959bbabd6c6c",
-      "size_bytes": 42937768
+      "size_bytes": 42935024
     },
     {
-      "name": "archipelago-frontend-1.7.63-alpha.tar.gz",
+      "name": "archipelago-frontend-1.7.64-alpha.tar.gz",
-      "current_version": "1.7.63-alpha",
+      "current_version": "1.7.64-alpha",
-      "new_version": "1.7.63-alpha",
+      "new_version": "1.7.64-alpha",
-      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.63-alpha/archipelago-frontend-1.7.63-alpha.tar.gz",
+      "download_url": "http://146.59.87.168:3000/lfg2025/archy/releases/download/v1.7.64-alpha/archipelago-frontend-1.7.64-alpha.tar.gz",
-      "sha256": "f4144003aded49ec83f75452026e8503e260cd89778913f8438be1fd2138767e",
+      "sha256": "d9be64980eede352c0b18402c42cff3a98a1ca881514082319d126cf4c91dcc3",
-      "size_bytes": 166470032
+      "size_bytes": 166470643
     }
   ]
 }