Updates & Security
Update checks
How VitNode tells administrators about new versions and security updates for core and plugins, using public JSON manifests checked once a day.
VitNode checks once a day whether a newer version of core or any installed plugin is published, and whether the version you run is affected by a published security update. The results appear in AdminCP ā System ā Plugins, as a count next to that menu item, as a security alert in the AdminCP header and in the System updates dashboard widget.
Each package says where its update manifest lives - a public JSON file on GitHub Raw or any other HTTPS host. VitNode reads those files from the server. It does not ask npm, and it does not install, download or change anything.
Pick a guide
| You want to... | Read |
|---|---|
| See updates and security warnings, run a check, choose a channel | Check for updates in the AdminCP |
| Understand the update count, security alert and dashboard widget | Update alerts in the AdminCP |
| Learn how checks stay exclusive across API instances | How update checks share one lease |
| Make your own plugin report updates | Publish updates for your plugin |
| Look up every field of the JSON format | Update manifest reference |
| Warn installations about a vulnerability | Publish a security update |
| Understand how VitNode's own release workflow updates the official feed | Official release feed |
What the checks can and cannot tell you
- Informational only. A check never installs an update or edits your dependencies. You upgrade the way you always do, then rebuild and redeploy.
- Only what publishers declare. A package without an update source shows a No update source badge. Private and local plugins work exactly as before.
- Not a vulnerability scanner. A security warning means a publisher listed your installed version in a security update. No warning is not proof a version is secure, and dependencies of your plugins are not checked at all. Keep using
pnpm auditor your usual scanner for those.