Prepare SysV tooling in install-script test containers

The netbird package postinstall registers a SysV service when systemd is
not running. The trixie and fedora images ship without /etc/init.d and
the service tool, failing the postinstall before the UI gating under test.

.github/workflows/install-script-test.yml

@@ -7,6 +7,7 @@ on:
   pull_request:
     paths:
       - "release_files/install.sh"
+      - ".github/workflows/install-script-test.yml"
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-${{ github.head_ref || github.actor_id }}
   cancel-in-progress: true
@@ -37,3 +38,64 @@ jobs:
 
       - name: check cli binary
         run: command -v netbird
+
+  test-install-script-distros:
+    name: UI gating on ${{ matrix.image }}${{ matrix.install_epel && ' (EPEL pre-confirmed)' || '' }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      max-parallel: 3
+      matrix:
+        include:
+          # GTK 4 below 4.10: desktop app must be skipped, CLI installed
+          - image: "ubuntu:22.04"
+            expect_ui: false
+          - image: "debian:12"
+            expect_ui: false
+          # GTK 4.10+ and WebKitGTK 6.0 available: desktop app installed
+          - image: "debian:13"
+            expect_ui: true
+          - image: "fedora:43"
+            expect_ui: true
+          # webkitgtk6.0 needs EPEL: skipped without confirmation,
+          # installed when NETBIRD_INSTALL_EPEL=true
+          - image: "almalinux:10"
+            expect_ui: false
+          - image: "almalinux:10"
+            expect_ui: true
+            install_epel: true
+    container:
+      image: ${{ matrix.image }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: prepare container
+        # The netbird package postinstall registers a SysV service when
+        # systemd is not running. The trixie and fedora images ship without
+        # the SysV directories and tools it needs, unlike the older images.
+        run: |
+          mkdir -p /etc/init.d
+          if command -v dnf >/dev/null 2>&1; then
+            dnf -y install initscripts-service || dnf -y install initscripts
+          fi
+
+      - name: run install script
+        env:
+          XDG_CURRENT_DESKTOP: GNOME
+          NETBIRD_INSTALL_EPEL: ${{ matrix.install_epel && 'true' || '' }}
+        run: sh -x release_files/install.sh
+
+      - name: check binaries
+        run: |
+          command -v netbird
+          if [ "${{ matrix.expect_ui }}" = "true" ]; then
+            command -v netbird-ui
+          else
+            if command -v netbird-ui; then
+              echo "netbird-ui should not have been installed on ${{ matrix.image }}"
+              exit 1
+            fi
+          fi

.goreleaser.yaml

@@ -273,8 +273,8 @@ dockers_v2:
        - netbirdio/netbird
        - ghcr.io/netbirdio/netbird
      tags:
-       - "v{{ .Version }}-rootless"
-       - "{{ if eq .Env.SKIP_PUBLISH \"false\" }}latest{{ end }}"
+       - "{{ .Version }}-rootless"
+       - "{{ if eq .Env.SKIP_PUBLISH \"false\" }}rootless-latest{{ end }}"
      dockerfile: client/Dockerfile-rootless
      extra_files:
        - client/netbird-entrypoint.sh

client/ios/NetBirdSDK/version.go

@@ -0,0 +1,12 @@
+//go:build ios
+
+package NetBirdSDK
+
+import "github.com/netbirdio/netbird/version"
+
+// GoClientVersion returns the NetBird Go client version that was baked into
+// the framework at compile time via
+// -ldflags "-X github.com/netbirdio/netbird/version.version=<version>".
+func GoClientVersion() string {
+	return version.NetbirdVersion()
+}

proxy/internal/llm/pricing/defaults_coverage_test.go

@@ -28,12 +28,12 @@ func TestDefaultTable_FirstPartyModelCoverage(t *testing.T) {
 			"ministral-8b-latest", "mistral-embed",
 		},
 		"anthropic": {
-			"claude-fable-5", "claude-opus-4-8", "claude-opus-4-7", "claude-opus-4-6",
+			"claude-fable-5", "claude-opus-5", "claude-opus-4-8", "claude-opus-4-7", "claude-opus-4-6",
 			"claude-opus-4-1", "claude-sonnet-4-6", "claude-sonnet-4-5", "claude-haiku-4-5",
 		},
 		// bedrock keys are the normalized ids the request parser emits.
 		"bedrock": {
-			"anthropic.claude-opus-4-8", "anthropic.claude-opus-4-7", "anthropic.claude-opus-4-6",
+			"anthropic.claude-opus-5", "anthropic.claude-opus-4-8", "anthropic.claude-opus-4-7", "anthropic.claude-opus-4-6",
 			"anthropic.claude-opus-4-1", "anthropic.claude-sonnet-4-6", "anthropic.claude-sonnet-4-5",
 			"anthropic.claude-haiku-4-5", "meta.llama3-3-70b-instruct",
 			"amazon.nova-pro", "amazon.nova-lite", "amazon.nova-micro", "amazon.nova-2-lite",

proxy/internal/llm/pricing/defaults_pricing.yaml

@@ -180,6 +180,11 @@ anthropic:
     output_per_1k: 0.050
     cache_read_per_1k: 0.001
     cache_creation_per_1k: 0.0125
+  claude-opus-5:
+    input_per_1k: 0.005
+    output_per_1k: 0.025
+    cache_read_per_1k: 0.0005
+    cache_creation_per_1k: 0.00625
   claude-opus-4-8:
     input_per_1k: 0.005
     output_per_1k: 0.025
@@ -236,6 +241,11 @@ bedrock:
   # eu.anthropic.claude-sonnet-4-5-20250929-v1:0 -> anthropic.claude-sonnet-4-5.
   # Anthropic-on-Bedrock keeps the additive cache buckets (read ≈0.1x input,
   # write ≈1.25x input); Nova / Llama report no cache, so cost is input+output.
+  anthropic.claude-opus-5:
+    input_per_1k: 0.005
+    output_per_1k: 0.025
+    cache_read_per_1k: 0.0005
+    cache_creation_per_1k: 0.00625
   anthropic.claude-opus-4-8:
     input_per_1k: 0.005
     output_per_1k: 0.025

release_files/install.sh

@@ -134,6 +134,72 @@ repo_gpgcheck=1
 EOF
 }
 
+# The desktop app renders in a GTK 4 WebKit webview and needs GTK 4.10+ with
+# WebKitGTK 6.0. The netbird-ui packages do not declare these libraries, so
+# the installer resolves them and degrades to a CLI-only install when the
+# system cannot provide them.
+UI_MIN_GTK_VERSION="4.10"
+
+skip_ui_app() {
+    SKIP_UI_APP=true
+    echo "NetBird UI installation will be omitted: $1"
+}
+
+install_ui_apt() {
+    GTK_CANDIDATE="$(apt-cache policy libgtk-4-1 2>/dev/null | awk '/Candidate:/ {print $2}')"
+    if [ -z "$GTK_CANDIDATE" ] || [ "$GTK_CANDIDATE" = "(none)" ]; then
+        skip_ui_app "GTK 4 is not available in the configured APT repositories"
+        return 0
+    fi
+    if ! dpkg --compare-versions "$GTK_CANDIDATE" ge "$UI_MIN_GTK_VERSION"; then
+        skip_ui_app "the desktop app needs GTK ${UI_MIN_GTK_VERSION}+ and this release provides ${GTK_CANDIDATE} (Ubuntu 24.04+ or Debian 13+ required)"
+        return 0
+    fi
+    if ! ${SUDO} apt-get install netbird-ui libgtk-4-1 libwebkitgtk-6.0-4 xdg-utils -y; then
+        skip_ui_app "the desktop app dependencies could not be installed"
+    fi
+}
+
+# Enabling EPEL changes the system's repository configuration, so it needs
+# an explicit go-ahead: either NETBIRD_INSTALL_EPEL=true in the environment
+# or an interactive confirmation. Returns 0 when EPEL is available.
+confirm_epel() {
+    if rpm -q epel-release >/dev/null 2>&1; then
+        return 0
+    fi
+    if [ "${NETBIRD_INSTALL_EPEL:-}" = "true" ]; then
+        echo "NETBIRD_INSTALL_EPEL=true is set, enabling the EPEL repository"
+        ${SUDO} dnf -y install epel-release
+        return $?
+    fi
+    if (exec < /dev/tty) 2>/dev/null; then
+        printf "The desktop app needs WebKitGTK 6.0 from the EPEL repository (https://docs.fedoraproject.org/en-US/epel/). Enable EPEL and continue? [y/N] "
+        read -r EPEL_REPLY < /dev/tty
+        case "$EPEL_REPLY" in
+            y|Y|yes|YES)
+                ${SUDO} dnf -y install epel-release
+                return $?
+            ;;
+        esac
+    fi
+    return 1
+}
+
+install_ui_dnf() {
+    # webkitgtk6.0 comes from EPEL on RHEL, AlmaLinux and Rocky Linux 10.
+    case "$OS_NAME" in
+        rhel|almalinux|rocky|centos)
+            if ! confirm_epel; then
+                skip_ui_app "the desktop app needs WebKitGTK 6.0 from EPEL; re-run with NETBIRD_INSTALL_EPEL=true to enable it"
+                return 0
+            fi
+        ;;
+    esac
+    if ! ${SUDO} dnf -y install netbird-ui gtk4 webkitgtk6.0 xdg-utils; then
+        skip_ui_app "GTK 4.10+ and WebKitGTK 6.0 are not available on this system (Fedora 43+ or RHEL 10+ required)"
+    fi
+}
+
 prepare_tun_module() {
   # Create the necessary file structure for /dev/net/tun
   if [ ! -c /dev/net/tun ]; then
@@ -226,14 +292,16 @@ install_netbird() {
         ${SUDO} apt-get install netbird -y
 
         if ! $SKIP_UI_APP; then
-            ${SUDO} apt-get install netbird-ui -y
+            install_ui_apt
         fi
     ;;
     yum)
         add_rpm_repo
         ${SUDO} yum -y install netbird
         if ! $SKIP_UI_APP; then
-            ${SUDO} yum -y install netbird-ui
+            # Systems where dnf is absent (RHEL 9, Amazon Linux) do not
+            # provide GTK 4.10+ or WebKitGTK 6.0.
+            skip_ui_app "this system does not provide the desktop app dependencies (RHEL 10+ required)"
         fi
     ;;
     dnf)
@@ -241,7 +309,7 @@ install_netbird() {
         ${SUDO} dnf -y install netbird
 
         if ! $SKIP_UI_APP; then
-            ${SUDO} dnf -y install netbird-ui
+            install_ui_dnf
         fi
     ;;
     rpm-ostree)
@@ -401,9 +469,8 @@ if type uname >/dev/null 2>&1; then
               OS_NAME="$(. /etc/os-release && echo "$ID")"
               INSTALL_DIR="/usr/bin"
 
-              # Allow netbird UI installation for x64 arch only
-              if [ "$ARCH" != "amd64" ] && [ "$ARCH" != "arm64" ] \
-                  && [ "$ARCH" != "x86_64" ];then
+              # The netbird-ui Linux packages are built for x86_64 only
+              if [ "$ARCH" != "amd64" ] && [ "$ARCH" != "x86_64" ];then
                   SKIP_UI_APP=true
                   echo "NetBird UI installation will be omitted as $ARCH is not a compatible architecture"
               fi