registry auth survives an http to https token realm redirect behind a TLS proxy

src/routes/api/containers/[id]/version-notes/+server.ts

@@ -15,7 +15,7 @@ import { fetchReleaseNotes } from '$lib/server/semver/release-notes';
  * path: id:string! Container ID or name (from GET /api/containers)
  * query: env:integer The target environment ID (omit for the local/default Docker host) (from GET /api/environments)
  * query: versions:string! Comma-separated version tags to fetch notes for (target + skipped), e.g. "16.3-alpine,16.4-alpine"
- * resp-200: {changelogUrl:string, source:string, notes:array<{version:string!, name:string, githubTag:string, body:string, publishedAt:string, url:string!}>!}
+ * resp-200: {changelogUrl:string, source:string, rateLimited:boolean, notes:array<{version:string!, name:string, githubTag:string, body:string, publishedAt:string, url:string!}>!}
  * resp-200-example: {"changelogUrl":"https://github.com/go-gitea/gitea/releases","source":"go-gitea/gitea","notes":[{"version":"1.22.0","name":"v1.22.0","githubTag":"v1.22.0","body":"## Changes...","publishedAt":"2024-05-01T00:00:00Z","url":"https://github.com/go-gitea/gitea/releases/tag/v1.22.0"}]}
  * resp-403: Permission denied
  * resp-500: Failed to resolve release notes
@@ -45,12 +45,16 @@ export const GET: RequestHandler = async ({ params, url, cookies }) => {
 
 		const src = resolveReleaseSource(imageName, labels);
 		// Prefer the label-based changelog URL; fall back to the forge's releases page.
-		const changelogUrl = resolveChangelogUrl(imageName, labels) ?? src?.releasesUrl ?? null;
+		// `versions` is ordered oldest->newest (the semver path), so the LAST entry is
+		// the target tag - feed it to the label so a `{{version}}` template resolves to
+		// the version being offered.
+		const targetVersion = versions.length ? versions[versions.length - 1] : null;
+		const changelogUrl = resolveChangelogUrl(imageName, labels, targetVersion) ?? src?.releasesUrl ?? null;
 
 		// No recognizable forge -> no per-version notes, just the changelog link (if any).
-		const notes = src ? await fetchReleaseNotes(src, versions) : [];
+		const result = src ? await fetchReleaseNotes(src, versions) : { notes: [], rateLimited: false };
 
-		return json({ changelogUrl, source: src?.slug ?? null, notes });
+		return json({ changelogUrl, source: src?.slug ?? null, notes: result.notes, rateLimited: result.rateLimited });
 	} catch (error) {
 		console.error('Failed to resolve version notes:', error);
 		return json({ error: 'Failed to resolve release notes' }, { status: 500 });