@the-bearded-bear/claude-craft 8.22.0 → 8.23.0

package/Infra/i18n/en/FrankenPHP/agents/frankenphp-deployment.md

@@ -59,7 +59,7 @@ You are a **Senior FrankenPHP Deployment Engineer** specialized in `dunglas/fran
 # docker-compose.yml
 services:
   app:
-    image: dunglas/frankenphp:1.12-php8.5-bookworm
+    image: dunglas/frankenphp:1.13-php8.5-bookworm
     ports:
       - "80:80"
       - "443:443"
@@ -88,7 +88,7 @@ volumes:
 
 ```dockerfile
 # Stage 1: Dependencies
-FROM dunglas/frankenphp:1.12-php8.5-bookworm AS base
+FROM dunglas/frankenphp:1.13-php8.5-bookworm AS base
 
 # Install PHP extensions
 RUN install-php-extensions \

package/Infra/i18n/en/FrankenPHP/agents/frankenphp-security.md

@@ -185,7 +185,7 @@ example.com {
 
 ```dockerfile
 # Dockerfile - Non-root FrankenPHP
-FROM dunglas/frankenphp:1.12-php8.5-bookworm
+FROM dunglas/frankenphp:1.13-php8.5-bookworm
 
 # Install extensions
 RUN install-php-extensions pdo_pgsql intl opcache

package/Infra/i18n/en/FrankenPHP/commands/deploy-setup.md

@@ -53,7 +53,7 @@ DEPLOYMENT STRATEGY
 ──────────────────────────────────────────────────────────────
 
 Method: {Docker Compose / Kubernetes / Standalone Binary}
-Image: dunglas/frankenphp:1.12-php8.5-bookworm
+Image: dunglas/frankenphp:1.13-php8.5-bookworm
 Worker mode: {yes/no}
 
 | Decision | Choice | Rationale |

package/Infra/i18n/en/Hcloud/agents/hcloud-architect.md

@@ -5,7 +5,7 @@ description: Hetzner Cloud infrastructure architecture designer
 
 # Hcloud Architect
 
-> ⚠️ **Mandatory migration before 2026-07-01**: the `location` parameter is deprecated in favor of `location`. Hetzner Cloud Terraform provider >= 1.58.0. Source: https://github.com/hetznercloud/terraform-provider-hcloud/releases
+> ⚠️ **`datacenter` removed (2026-07-01)**: replaced by `location`; the `datacenter` endpoints return HTTP 410 since 2026-10-01. Use `location = "fsn1"` instead of `datacenter`. Hetzner Cloud Terraform provider >= 1.70.0. Source: https://docs.hetzner.cloud/changelog and https://github.com/hetznercloud/terraform-provider-hcloud/releases
 
 ## Identity
 
@@ -135,7 +135,7 @@ hcloud placement-group create --name web-spread --type spread
 # Servers
 hcloud server create \
   --name web-01 \
-  --type cx22 \
+  --type cx23 \
   --image ubuntu-24.04 \
   --location fsn1 \
   --ssh-key deploy-key \
@@ -199,13 +199,23 @@ hcloud network add-subnet primary-net --type cloud --network-zone eu-central --i
 
 # Servers in different locations with placement groups
 hcloud placement-group create --name pg-primary --type spread
-hcloud server create --name app-fsn-01 --type cpx31 --image ubuntu-24.04 \
+hcloud server create --name app-fsn-01 --type cpx32 --image ubuntu-24.04 \
   --location fsn1 --placement-group pg-primary --network primary-net
 
-hcloud server create --name app-hel-01 --type cpx31 --image ubuntu-24.04 \
+hcloud server create --name app-hel-01 --type cpx32 --image ubuntu-24.04 \
   --location hel1 --network primary-net
 ```
 
+## Hetzner API Changes to Account For (2026)
+
+- Load Balancers accept existing Primary IPs at creation (`public_net.ipv4` / `public_net.ipv6`; provider >= 1.70.0: `ipv4_id` / `ipv6_id`); the assignment cannot be changed afterwards (changelog 2026-10-05)
+- Primary and Floating IPs must be unassigned before deletion: the API returns `must_be_unassigned` (since 2026-05-01)
+- `dns_ptr` is required on change requests (Primary IPs, Floating IPs, Servers, Load Balancers) since 2026-09-30; `null` resets the pointer
+- The server type `deprecated` field is removed on 2026-11-02: read `locations[].deprecation` instead (`null` = not deprecated)
+- Terraform provider 1.69 drops Terraform 1.14 (1.16 added); keep `required_providers` hcloud at `>= 1.70.0`, hcloud CLI 1.70.1
+- Server types cx22/cx32/cx42/cx52 and cpx11-cpx51 are no longer orderable since 2026-01-01: use cx23/cx33/cx43/cx53 and cpx12/cpx22/cpx32/cpx42/cpx52/cpx62
+- Ansible: use the `hetzner.hcloud` collection (7.2.0, requires a recent ansible-core, e.g. 2.21.5) and pin it in `requirements.yml`
+
 ## Architecture Checklist
 
 ### Design

package/Infra/i18n/en/Hcloud/agents/hcloud-cost.md

@@ -5,7 +5,7 @@ description: Hetzner Cloud cost optimization and right-sizing specialist
 
 # Hcloud Cost Specialist
 
-> ⚠️ **Mandatory migration before 2026-07-01**: the `location` parameter is deprecated in favor of `location`. Hetzner Cloud Terraform provider >= 1.58.0. Source: https://github.com/hetznercloud/terraform-provider-hcloud/releases
+> ⚠️ **`datacenter` removed (2026-07-01)**: replaced by `location`; the `datacenter` endpoints return HTTP 410 since 2026-10-01. Use `location = "fsn1"` instead of `datacenter`. Hetzner Cloud Terraform provider >= 1.70.0. Source: https://docs.hetzner.cloud/changelog and https://github.com/hetznercloud/terraform-provider-hcloud/releases
 
 ## Identity
 

package/Infra/i18n/en/Hcloud/agents/hcloud-debug.md

@@ -5,7 +5,7 @@ description: Hetzner Cloud troubleshooting specialist
 
 # Hcloud Debug Specialist
 
-> ⚠️ **Mandatory migration before 2026-07-01**: the `location` parameter is deprecated in favor of `location`. Hetzner Cloud Terraform provider >= 1.58.0. Source: https://github.com/hetznercloud/terraform-provider-hcloud/releases
+> ⚠️ **`datacenter` removed (2026-07-01)**: replaced by `location`; the `datacenter` endpoints return HTTP 410 since 2026-10-01. Use `location = "fsn1"` instead of `datacenter`. Hetzner Cloud Terraform provider >= 1.70.0. Source: https://docs.hetzner.cloud/changelog and https://github.com/hetznercloud/terraform-provider-hcloud/releases
 
 ## Identity
 

package/Infra/i18n/en/Hcloud/agents/hcloud-deployment.md

@@ -137,7 +137,7 @@ You are a **Senior Hetzner Cloud Deployment Engineer** specialized in CI/CD pipe
              # Create new server from image
              hcloud server create \
                --name prod-blue-$(date +%s) \
-               --type cpx31 \
+               --type cpx32 \
                --image ${{ needs.build-image.outputs.image_id }} \
                --location fsn1 \
                --ssh-key deploy \
@@ -189,7 +189,7 @@ source "hcloud" "app" {
   token        = var.hcloud_token
   image        = "ubuntu-24.04"
   location     = "fsn1"
-  server_type  = "cx22"
+  server_type  = "cx23"
   server_name  = "packer-build-{{timestamp}}"
   ssh_username = "root"
   snapshot_name = "app-{{timestamp}}"

package/Infra/i18n/en/Hcloud/agents/hcloud-security.md

@@ -5,7 +5,7 @@ description: Hetzner Cloud security and firewall specialist
 
 # Hcloud Security Specialist
 
-> ⚠️ **Mandatory migration before 2026-07-01**: the `location` parameter is deprecated in favor of `location`. Hetzner Cloud Terraform provider >= 1.58.0. Source: https://github.com/hetznercloud/terraform-provider-hcloud/releases
+> ⚠️ **`datacenter` removed (2026-07-01)**: replaced by `location`; the `datacenter` endpoints return HTTP 410 since 2026-10-01. Use `location = "fsn1"` instead of `datacenter`. Hetzner Cloud Terraform provider >= 1.70.0. Source: https://docs.hetzner.cloud/changelog and https://github.com/hetznercloud/terraform-provider-hcloud/releases
 
 ## Identity
 

package/Infra/i18n/en/Hcloud/commands/architecture.md

@@ -5,7 +5,7 @@ argument-hint: <Project> [constraints]
 
 # Hcloud Architecture
 
-> ⚠️ **Mandatory migration before 2026-07-01**: the `datacenter` parameter is deprecated in favor of `location`. Hetzner Cloud Terraform provider >= 1.58.0. Source: https://github.com/hetznercloud/terraform-provider-hcloud/releases
+> ⚠️ **`datacenter` removed (2026-07-01)**: replaced by `location`; the `datacenter` endpoints return HTTP 410 since 2026-10-01. Use `location = "fsn1"` instead of `datacenter`. Hetzner Cloud Terraform provider >= 1.70.0. Source: https://docs.hetzner.cloud/changelog and https://github.com/hetznercloud/terraform-provider-hcloud/releases
 
 You are a senior Hetzner Cloud architect. You must design a complete cloud infrastructure architecture from project specifications.
 
@@ -83,8 +83,8 @@ SERVER TYPE SELECTION
 
 | Role | Server Type | Count | Justification |
 |------|-------------|-------|---------------|
-| Web | {cax21/cx22} | {n} | {reason} |
-| App | {cpx31/cax31} | {n} | {reason} |
+| Web | {cax21/cx23} | {n} | {reason} |
+| App | {cpx32/cax31} | {n} | {reason} |
 | DB | {ccx23/ccx33} | {n} | {reason} |
 
 ──────────────────────────────────────────────────────────────

package/Infra/i18n/en/Hcloud/commands/debug.md

@@ -5,7 +5,7 @@ argument-hint: <Symptom> [resource]
 
 # Hcloud Debug
 
-> ⚠️ **Mandatory migration before 2026-07-01**: the `datacenter` parameter is deprecated in favor of `location`. Hetzner Cloud Terraform provider >= 1.58.0. Source: https://github.com/hetznercloud/terraform-provider-hcloud/releases
+> ⚠️ **`datacenter` removed (2026-07-01)**: replaced by `location`; the `datacenter` endpoints return HTTP 410 since 2026-10-01. Use `location = "fsn1"` instead of `datacenter`. Hetzner Cloud Terraform provider >= 1.70.0. Source: https://docs.hetzner.cloud/changelog and https://github.com/hetznercloud/terraform-provider-hcloud/releases
 
 You are a Hetzner Cloud troubleshooting specialist. You must systematically diagnose and resolve infrastructure issues from the given symptoms.
 

package/Infra/i18n/en/Kubernetes/agents/kubernetes-architect.md

@@ -67,8 +67,8 @@ Extract and clarify:
    ┌─────────────────────────────────────────────────────────┐
    │                    INGRESS LAYER                         │
    │  ┌──────────────┐         ┌──────────────┐              │
-   │  │ Ingress NGINX│─────────│  Cert-Manager│              │
-   │  │ / Traefik    │         │  (Let's Enc.)│              │
+   │  │ Gateway API  │─────────│  Cert-Manager│              │
+   │  │ (HTTPRoute)  │         │  (Let's Enc.)│              │
    │  └──────┬───────┘         └──────────────┘              │
    └─────────┼───────────────────────────────────────────────┘
              │
@@ -95,7 +95,7 @@ Extract and clarify:
    - Resource quotas and limit ranges per namespace
 
 3. **Networking**
-   - Ingress controller selection (NGINX, Traefik, Istio Gateway)
+   - Gateway API (HTTPRoute) as first choice (implementations: Envoy Gateway, Traefik, Istio, Cilium); Ingress NGINX is retired since March 2026 (no more security fixes), migrate with `ingress2gateway`
    - NetworkPolicies for inter-namespace isolation
    - DNS strategy (internal service discovery)
    - TLS termination and certificate management

package/Infra/i18n/en/Kubernetes/commands/architecture.md

@@ -68,7 +68,7 @@ NAMESPACE TOPOLOGY
 ┌─────────────────────────────────────────────────────────────┐
 │                      INGRESS LAYER                           │
 │  ┌───────────────┐         ┌───────────────┐                │
-│  │ Ingress NGINX │─────────│  Cert-Manager │                │
+│  │ Gateway API   │─────────│  Cert-Manager │                │
 │  └───────┬───────┘         └───────────────┘                │
 └──────────┼──────────────────────────────────────────────────┘
            │

package/Infra/i18n/en/OpenTofu/agents/opentofu-architect.md

@@ -143,7 +143,7 @@ Produce all necessary configurations:
 ```hcl
 # versions.tf
 terraform {
-  required_version = ">= 1.7.0"
+  required_version = ">= 1.13.0"
   required_providers {
     aws = {
       source  = "hashicorp/aws"

package/Infra/i18n/en/OpenTofu/agents/opentofu-deployment.md

@@ -65,7 +65,7 @@ You are a **Senior OpenTofu Deployment Engineer** specialized in CI/CD pipelines
        branches: [main]
 
    env:
-     TOFU_VERSION: "1.9.0"
+     TOFU_VERSION: "1.13.1"
 
    jobs:
      plan:
@@ -114,7 +114,7 @@ You are a **Senior OpenTofu Deployment Engineer** specialized in CI/CD pipelines
      - apply
 
    variables:
-     TOFU_VERSION: "1.9.0"
+     TOFU_VERSION: "1.13.1"
 
    .tofu-base:
      image: ghcr.io/opentofu/opentofu:$TOFU_VERSION

package/Infra/i18n/en/PgBouncer/agents/pgbouncer-architect.md

@@ -68,7 +68,8 @@ Extract and clarify:
    ```
    Application uses prepared statements?
    ├── Yes, cannot disable → Session mode
-   ├── Yes, can use DEALLOCATE ALL → Transaction mode + server_reset_query
+   ├── Yes, protocol-level (extended protocol) → Transaction mode + max_prepared_statements (default 200 since 1.24)
+   ├── Yes, SQL-level PREPARE, can use DEALLOCATE ALL → Transaction mode + server_reset_query
    └── No
        ├── Uses SET/session variables? → Session mode (or transaction + reset_query)
        ├── Uses LISTEN/NOTIFY? → Session mode
@@ -264,7 +265,15 @@ default_pool_size = 20
 | No reserve pool | Bursts cause connection failures | Set reserve_pool_size = 25% of default |
 | PgBouncer per app instance | Multiplied pools, no sharing | Shared PgBouncer instance(s) |
 | No server_reset_query | Session state leaks between clients | DISCARD ALL for transaction mode |
-| Ignoring prepared statements | Errors in transaction mode | Test with app, use DEALLOCATE ALL or session mode |
+| Ignoring prepared statements | Errors in transaction mode | Test with app, use max_prepared_statements, DEALLOCATE ALL or session mode |
+
+## PgBouncer 1.26 Notes
+
+- **Security**: 1.26.0 fixes CVE-2026-19888 (SCRAM client-final-message without nonce crashes PgBouncer, unauthenticated), CVE-2026-6668 (packet buffer integer overflow causing an infinite loop) and CVE-2026-6669 (unbounded SCRAM iteration count accepted from a server); upgrade from any 1.25.x.
+- **Prepared statements**: `max_prepared_statements` is 200 by default since 1.24, so protocol-level prepared statements work in transaction mode; `DEALLOCATE ALL` only matters for SQL-level `PREPARE`.
+- **Tracked parameters**: `search_path` (PostgreSQL 18+) and `default_transaction_read_only` are tracked by default, so `SET` no longer leaks between clients in transaction mode.
+- **New settings**: `pool_idle_timeout` (disabled by default) removes unused pools; `query_wait_timeout` can be set per user and per database; `SHOW STATS` exposes `client_login_count`.
+- **Removed**: online restart (`-R`), `SHOW FDS` and `SUSPEND`; use rolling restarts with `so_reuseport`.
 
 ## Documentation Template
 

package/Infra/i18n/en/PgBouncer/agents/pgbouncer-debug.md

@@ -167,6 +167,7 @@ psql -h localhost -p 6432 -U app_user -d app_production
 -- In PgBouncer logs, look for:
 -- "prepared statement X does not exist"
 
+-- Fix 0: protocol-level prepared statements need max_prepared_statements > 0 (200 by default since 1.24)
 -- Fix 1: Add DEALLOCATE ALL to server_reset_query
 -- In pgbouncer.ini:
 -- server_reset_query = DISCARD ALL

package/Infra/i18n/en/PgBouncer/agents/pgbouncer-deployment.md

@@ -7,7 +7,7 @@ description: PgBouncer deployment and CI/CD pipeline specialist
 
 ## Identity
 
-You are a **Senior PgBouncer Deployment Engineer** specialized in Docker/Bitnami container deployments, Kubernetes sidecar and standalone patterns, Helm chart configuration, systemd service management, and zero-downtime reload strategies. You design deployment pipelines for reliable PgBouncer rollouts across all environments.
+You are a **Senior PgBouncer Deployment Engineer** specialized in Docker container deployments, Kubernetes sidecar and standalone patterns, Helm chart configuration, systemd service management, and zero-downtime reload strategies. You design deployment pipelines for reliable PgBouncer rollouts across all environments.
 
 ## Technical Expertise
 
@@ -15,7 +15,7 @@ You are a **Senior PgBouncer Deployment Engineer** specialized in Docker/Bitnami
 
 | Domain | Expertise | Scope |
 |--------|-----------|-------|
-| Docker deployment | Expert | Bitnami image, custom Dockerfile, health checks |
+| Docker deployment | Expert | community image, custom Dockerfile, health checks |
 | Kubernetes patterns | Expert | Sidecar per pod, standalone Deployment, Helm |
 | Systemd management | Expert | Unit files, reload, journald logging |
 | Zero-downtime reload | Expert | SIGHUP, RELOAD command, graceful drain |
@@ -55,25 +55,28 @@ You are a **Senior PgBouncer Deployment Engineer** specialized in Docker/Bitnami
 
 #### Docker Compose
 
+> **Image note:** `bitnami/pgbouncer` is no longer maintained on Docker Hub (Bitnami restricted its public catalog in 2025; `bitnamilegacy/pgbouncer` is frozen at 1.24.1, affected by the CVEs fixed in 1.26.0). The examples use the community image `edoburu/pgbouncer` (`DB_*` variables, listens on 5432 unless `LISTEN_PORT` is set). Pin the tag and audit the image before production use.
+
 ```yaml
 # docker-compose.yml
 services:
   pgbouncer:
-    image: bitnami/pgbouncer:1.25.1
+    image: edoburu/pgbouncer:v1.26.0-p0
     ports:
       - "6432:6432"
     environment:
-      - POSTGRESQL_HOST=postgresql
-      - POSTGRESQL_PORT=5432
-      - POSTGRESQL_USERNAME=app_user
-      - POSTGRESQL_PASSWORD=${DB_PASSWORD}
-      - POSTGRESQL_DATABASE=app_production
-      - PGBOUNCER_POOL_MODE=transaction
-      - PGBOUNCER_MAX_CLIENT_CONN=200
-      - PGBOUNCER_DEFAULT_POOL_SIZE=20
-      - PGBOUNCER_MIN_POOL_SIZE=5
-      - PGBOUNCER_SERVER_RESET_QUERY=DISCARD ALL
-      - PGBOUNCER_AUTH_TYPE=scram-sha-256
+      - DB_HOST=postgresql
+      - DB_PORT=5432
+      - DB_USER=app_user
+      - DB_PASSWORD=${DB_PASSWORD}
+      - DB_NAME=app_production
+      - LISTEN_PORT=6432
+      - POOL_MODE=transaction
+      - MAX_CLIENT_CONN=200
+      - DEFAULT_POOL_SIZE=20
+      - MIN_POOL_SIZE=5
+      - SERVER_RESET_QUERY=DISCARD ALL
+      - AUTH_TYPE=scram-sha-256
     healthcheck:
       test: ["CMD", "pg_isready", "-h", "localhost", "-p", "6432"]
       interval: 10s
@@ -85,13 +88,14 @@ services:
     restart: unless-stopped
 
   postgresql:
-    image: postgres:17
+    image: postgres:18
     environment:
       - POSTGRES_DB=app_production
       - POSTGRES_USER=app_user
       - POSTGRES_PASSWORD=${DB_PASSWORD}
     volumes:
-      - pgdata:/var/lib/postgresql/data
+      # PostgreSQL 18+ images keep data under /var/lib/postgresql/<major>/
+      - pgdata:/var/lib/postgresql
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U app_user"]
       interval: 10s
@@ -124,31 +128,33 @@ spec:
     spec:
       containers:
         - name: pgbouncer
-          image: bitnami/pgbouncer:1.25.1
+          image: edoburu/pgbouncer:v1.26.0-p0
           ports:
             - containerPort: 6432
           env:
-            - name: POSTGRESQL_HOST
+            - name: DB_HOST
               value: postgresql.database.svc.cluster.local
-            - name: POSTGRESQL_PORT
+            - name: DB_PORT
               value: "5432"
-            - name: POSTGRESQL_DATABASE
+            - name: DB_NAME
               value: app_production
-            - name: POSTGRESQL_USERNAME
+            - name: DB_USER
               valueFrom:
                 secretKeyRef:
                   name: pgbouncer-secrets
                   key: db-username
-            - name: POSTGRESQL_PASSWORD
+            - name: DB_PASSWORD
               valueFrom:
                 secretKeyRef:
                   name: pgbouncer-secrets
                   key: db-password
-            - name: PGBOUNCER_POOL_MODE
+            - name: LISTEN_PORT
+              value: "6432"
+            - name: POOL_MODE
               value: transaction
-            - name: PGBOUNCER_MAX_CLIENT_CONN
+            - name: MAX_CLIENT_CONN
               value: "200"
-            - name: PGBOUNCER_DEFAULT_POOL_SIZE
+            - name: DEFAULT_POOL_SIZE
               value: "20"
           livenessProbe:
             tcpSocket:
@@ -204,17 +210,19 @@ spec:
             - name: DATABASE_URL
               value: "postgresql://app_user:$(DB_PASSWORD)@localhost:6432/app_production"
         - name: pgbouncer
-          image: bitnami/pgbouncer:1.25.1
+          image: edoburu/pgbouncer:v1.26.0-p0
           ports:
             - containerPort: 6432
           env:
-            - name: POSTGRESQL_HOST
+            - name: DB_HOST
               value: postgresql.database.svc.cluster.local
-            - name: PGBOUNCER_POOL_MODE
+            - name: LISTEN_PORT
+              value: "6432"
+            - name: POOL_MODE
               value: transaction
-            - name: PGBOUNCER_MAX_CLIENT_CONN
+            - name: MAX_CLIENT_CONN
               value: "100"
-            - name: PGBOUNCER_DEFAULT_POOL_SIZE
+            - name: DEFAULT_POOL_SIZE
               value: "10"
           resources:
             requests:

package/Infra/i18n/en/PgBouncer/commands/deploy-setup.md

@@ -54,7 +54,7 @@ DEPLOYMENT STRATEGY
 
 Method: {Docker Compose / K8s Standalone / K8s Sidecar / Systemd}
 HA: {Active-passive / Multiple replicas / Single instance}
-Image: bitnami/pgbouncer:1.25.1
+Image: edoburu/pgbouncer:v1.26.0-p0
 
 | Decision | Choice | Rationale |
 |----------|--------|-----------|

package/Infra/i18n/es/Ansible/agents/ansible-architect.md

@@ -32,6 +32,8 @@ Eres un **Arquitecto Ansible Senior** capaz de disenar arquitecturas de automati
 | Multi-entorno | Separacion dev / staging / produccion | Alta |
 | Jerarquico (Landscape/Type/Function) | Gestion de datacenter empresarial | Alta |
 
+> Hetzner Cloud: usar la colección `hetzner.hcloud` (7.2.0) con ansible-core 2.21.5, fijada en `requirements.yml`.
+
 ## Metodologia
 
 ### Fase 1 -- Descubrimiento

package/Infra/i18n/es/Docker/commands/docker-architecture.md

@@ -142,8 +142,6 @@ proyecto/
 
 ```yaml
 # docker-compose.yml
-version: "3.8"
-
 services:
   # ═══════════════════════════════════════════════════════════
   # REVERSE PROXY

package/Infra/i18n/es/Docker/commands/docker-compose-setup.md

@@ -51,8 +51,6 @@ Stack: {stack}
 
 ```yaml
 # docker-compose.yml - Base común
-version: "3.8"
-
 services:
   app:
     build:

package/Infra/i18n/es/FrankenPHP/agents/frankenphp-architect.md

@@ -7,7 +7,7 @@ description: FrankenPHP Caddyfile design, worker topology, and framework integra
 
 ## Identidad
 
-Usted es un **Arquitecto Senior de FrankenPHP** capaz de disenar topologias completas de servicio de aplicaciones PHP usando FrankenPHP 1.12+. Coordina las decisiones de worker mode vs classic mode, dimensionamiento de threads, diseno de Caddyfile, integracion con frameworks (Symfony, Laravel), configuracion de Mercure real-time y Early Hints (103) para entregar despliegues de FrankenPHP listos para produccion.
+Usted es un **Arquitecto Senior de FrankenPHP** capaz de disenar topologias completas de servicio de aplicaciones PHP usando FrankenPHP 1.13+. Coordina las decisiones de worker mode vs classic mode, dimensionamiento de threads, diseno de Caddyfile, integracion con frameworks (Symfony, Laravel), configuracion de Mercure real-time y Early Hints (103) para entregar despliegues de FrankenPHP listos para produccion.
 
 ## Experiencia Tecnica
 
@@ -120,6 +120,9 @@ Extraer y clarificar:
    - `max_requests = 500` para prevenir acumulacion de memoria
    - Benchmark con `wrk` o `k6`, ajustar hacia arriba/abajo
    - Monitorear: memoria RSS por worker, tiempo de respuesta p99
+   - Usar FrankenPHP 1.13.0+: la 1.12.4 es vulnerable (correcciones de seguridad en 1.12.5: phpinfo en la imagen por defecto, fuga de ID de sesión en worker mode, timeout del body; 5 advisories, 2 de ellos high, en 1.13.0)
+   - FrankenPHP 1.13+: `num_threads` solo cuenta los threads para las peticiones que ningún worker atiende; los threads de worker se suman, y el arranque falla si `max_threads` < `num_threads` + threads de worker
+   - El hot reload en desarrollo pasa por Mercure 1.0: `$_SERVER['FRANKENPHP_HOT_RELOAD']` ahora anuncia `/.well-known/mercure?match=<topic>` (no fijar `?topic=` en el código)
 
 ### Fase 3 -- Plan de Implementacion
 

package/Infra/i18n/es/FrankenPHP/agents/frankenphp-deployment.md

@@ -59,7 +59,7 @@ Usted es un **Ingeniero Senior de Despliegue FrankenPHP** especializado en despl
 # docker-compose.yml
 services:
   app:
-    image: dunglas/frankenphp:1.12-php8.5-bookworm
+    image: dunglas/frankenphp:1.13-php8.5-bookworm
     ports:
       - "80:80"
       - "443:443"
@@ -88,7 +88,7 @@ volumes:
 
 ```dockerfile
 # Stage 1: Dependencies
-FROM dunglas/frankenphp:1.12-php8.5-bookworm AS base
+FROM dunglas/frankenphp:1.13-php8.5-bookworm AS base
 
 # Install PHP extensions
 RUN install-php-extensions \

package/Infra/i18n/es/FrankenPHP/agents/frankenphp-security.md

@@ -185,7 +185,7 @@ example.com {
 
 ```dockerfile
 # Dockerfile - Non-root FrankenPHP
-FROM dunglas/frankenphp:1.12-php8.5-bookworm
+FROM dunglas/frankenphp:1.13-php8.5-bookworm
 
 # Install extensions
 RUN install-php-extensions pdo_pgsql intl opcache

package/Infra/i18n/es/FrankenPHP/commands/deploy-setup.md

@@ -53,7 +53,7 @@ ESTRATEGIA DE DESPLIEGUE
 ──────────────────────────────────────────────────────────────
 
 Metodo: {Docker Compose / Kubernetes / Standalone Binary}
-Imagen: dunglas/frankenphp:1.12-php8.5-bookworm
+Imagen: dunglas/frankenphp:1.13-php8.5-bookworm
 Worker mode: {si/no}
 
 | Decision | Eleccion | Justificacion |

package/Infra/i18n/es/Hcloud/agents/hcloud-architect.md

@@ -5,7 +5,7 @@ description: Hetzner Cloud infrastructure architecture designer
 
 # Hcloud Architect
 
-> ⚠️ **Migración obligatoria antes de 2026-07-01**: el parámetro `datacenter` está deprecado en favor de `location`. Proveedor Terraform de Hetzner Cloud >= 1.58.0. Fuente: https://github.com/hetznercloud/terraform-provider-hcloud/releases
+> ⚠️ **`datacenter` eliminado (2026-07-01)**: reemplazado por `location`; los endpoints `datacenter` devuelven HTTP 410 desde 2026-10-01. Usar `location = "fsn1"` en lugar de `datacenter`. Provider Terraform de Hetzner Cloud >= 1.70.0. Fuente: https://docs.hetzner.cloud/changelog y https://github.com/hetznercloud/terraform-provider-hcloud/releases
 
 ## Identidad
 
@@ -135,7 +135,7 @@ hcloud placement-group create --name web-spread --type spread
 # Servidores
 hcloud server create \
   --name web-01 \
-  --type cx22 \
+  --type cx23 \
   --image ubuntu-24.04 \
   --location fsn1 \
   --ssh-key deploy-key \
@@ -199,13 +199,23 @@ hcloud network add-subnet primary-net --type cloud --network-zone eu-central --i
 
 # Servidores en diferentes ubicaciones con grupos de ubicación
 hcloud placement-group create --name pg-primary --type spread
-hcloud server create --name app-fsn-01 --type cpx31 --image ubuntu-24.04 \
+hcloud server create --name app-fsn-01 --type cpx32 --image ubuntu-24.04 \
   --location fsn1 --placement-group pg-primary --network primary-net
 
-hcloud server create --name app-hel-01 --type cpx31 --image ubuntu-24.04 \
+hcloud server create --name app-hel-01 --type cpx32 --image ubuntu-24.04 \
   --location hel1 --network primary-net
 ```
 
+## Cambios de la API de Hetzner a tener en cuenta (2026)
+
+- Los Load Balancers aceptan Primary IPs existentes al crearse (`public_net.ipv4` / `public_net.ipv6`; provider >= 1.70.0: `ipv4_id` / `ipv6_id`); la asignación no puede cambiarse después (changelog 2026-10-05)
+- Las Primary IP y Floating IP deben desasignarse antes de eliminarse: la API devuelve `must_be_unassigned` (desde 2026-05-01)
+- `dns_ptr` es obligatorio en las peticiones de modificación (Primary IPs, Floating IPs, Servers, Load Balancers) desde 2026-09-30; `null` restablece el puntero
+- El campo `deprecated` de los server types se elimina el 2026-11-02: leer `locations[].deprecation` en su lugar (`null` = no obsoleto)
+- El provider Terraform 1.69 abandona Terraform 1.14 (se añade 1.16); mantener el provider hcloud en `>= 1.70.0`, CLI hcloud 1.70.1
+- Los server types cx22/cx32/cx42/cx52 y cpx11-cpx51 ya no se pueden pedir desde 2026-01-01: usar cx23/cx33/cx43/cx53 y cpx12/cpx22/cpx32/cpx42/cpx52/cpx62
+- Ansible: usar la colección `hetzner.hcloud` (7.2.0, requiere un ansible-core reciente, p. ej. 2.21.5) y fijar su versión en `requirements.yml`
+
 ## Lista de Verificación de Arquitectura
 
 ### Diseño

package/Infra/i18n/es/Hcloud/agents/hcloud-cost.md

@@ -5,7 +5,7 @@ description: Hetzner Cloud cost optimization and right-sizing specialist
 
 # Hcloud Cost Specialist
 
-> ⚠️ **Migración obligatoria antes de 2026-07-01**: el parámetro `location` está deprecado en favor de `location`. Proveedor Terraform de Hetzner Cloud >= 1.58.0. Fuente: https://github.com/hetznercloud/terraform-provider-hcloud/releases
+> ⚠️ **`datacenter` eliminado (2026-07-01)**: reemplazado por `location`; los endpoints `datacenter` devuelven HTTP 410 desde 2026-10-01. Usar `location = "fsn1"` en lugar de `datacenter`. Provider Terraform de Hetzner Cloud >= 1.70.0. Fuente: https://docs.hetzner.cloud/changelog y https://github.com/hetznercloud/terraform-provider-hcloud/releases
 
 ## Identidad
 

package/Infra/i18n/es/Hcloud/agents/hcloud-debug.md

@@ -5,7 +5,7 @@ description: Hetzner Cloud troubleshooting specialist
 
 # Hcloud Debug Specialist
 
-> ⚠️ **Migración obligatoria antes de 2026-07-01**: el parámetro `location` está deprecado en favor de `location`. Proveedor Terraform de Hetzner Cloud >= 1.58.0. Fuente: https://github.com/hetznercloud/terraform-provider-hcloud/releases
+> ⚠️ **`datacenter` eliminado (2026-07-01)**: reemplazado por `location`; los endpoints `datacenter` devuelven HTTP 410 desde 2026-10-01. Usar `location = "fsn1"` en lugar de `datacenter`. Provider Terraform de Hetzner Cloud >= 1.70.0. Fuente: https://docs.hetzner.cloud/changelog y https://github.com/hetznercloud/terraform-provider-hcloud/releases
 
 ## Identidad
 

package/Infra/i18n/es/Hcloud/agents/hcloud-deployment.md

@@ -137,7 +137,7 @@ Eres un **Ingeniero Senior de Despliegue en Hetzner Cloud** especializado en int
              # Crear nuevo servidor desde imagen
              hcloud server create \
                --name prod-blue-$(date +%s) \
-               --type cpx31 \
+               --type cpx32 \
                --image ${{ needs.build-image.outputs.image_id }} \
                --location fsn1 \
                --ssh-key deploy \
@@ -189,7 +189,7 @@ source "hcloud" "app" {
   token        = var.hcloud_token
   image        = "ubuntu-24.04"
   location     = "fsn1"
-  server_type  = "cx22"
+  server_type  = "cx23"
   server_name  = "packer-build-{{timestamp}}"
   ssh_username = "root"
   snapshot_name = "app-{{timestamp}}"

package/Infra/i18n/es/Hcloud/agents/hcloud-security.md

@@ -5,7 +5,7 @@ description: Hetzner Cloud security and firewall specialist
 
 # Hcloud Security Specialist
 
-> ⚠️ **Migración obligatoria antes de 2026-07-01**: el parámetro `location` está deprecado en favor de `location`. Proveedor Terraform de Hetzner Cloud >= 1.58.0. Fuente: https://github.com/hetznercloud/terraform-provider-hcloud/releases
+> ⚠️ **`datacenter` eliminado (2026-07-01)**: reemplazado por `location`; los endpoints `datacenter` devuelven HTTP 410 desde 2026-10-01. Usar `location = "fsn1"` en lugar de `datacenter`. Provider Terraform de Hetzner Cloud >= 1.70.0. Fuente: https://docs.hetzner.cloud/changelog y https://github.com/hetznercloud/terraform-provider-hcloud/releases
 
 ## Identidad
 

package/Infra/i18n/es/Hcloud/commands/architecture.md

@@ -5,7 +5,7 @@ argument-hint: <Project> [constraints]
 
 # Hcloud Architecture
 
-> ⚠️ **Migración obligatoria antes de 2026-07-01**: el parámetro `datacenter` está deprecado en favor de `location`. Proveedor Terraform de Hetzner Cloud >= 1.58.0. Fuente: https://github.com/hetznercloud/terraform-provider-hcloud/releases
+> ⚠️ **`datacenter` eliminado (2026-07-01)**: reemplazado por `location`; los endpoints `datacenter` devuelven HTTP 410 desde 2026-10-01. Usar `location = "fsn1"` en lugar de `datacenter`. Provider Terraform de Hetzner Cloud >= 1.70.0. Fuente: https://docs.hetzner.cloud/changelog y https://github.com/hetznercloud/terraform-provider-hcloud/releases
 
 Eres un arquitecto senior de Hetzner Cloud. Debes diseñar una arquitectura completa de infraestructura en la nube a partir de las especificaciones del proyecto.
 
@@ -83,8 +83,8 @@ SELECCIÓN DE TIPOS DE SERVIDOR
 
 | Rol | Tipo de Servidor | Cantidad | Justificación |
 |-----|-----------------|----------|---------------|
-| Web | {cax21/cx22} | {n} | {razón} |
-| App | {cpx31/cax31} | {n} | {razón} |
+| Web | {cax21/cx23} | {n} | {razón} |
+| App | {cpx32/cax31} | {n} | {razón} |
 | DB | {ccx23/ccx33} | {n} | {razón} |
 
 ──────────────────────────────────────────────────────────────