diff --git a/.github/workflows/build-docker-db.yml b/.github/workflows/build-docker-db.yml
index 23f16fe..66410b6 100644
--- a/.github/workflows/build-docker-db.yml
+++ b/.github/workflows/build-docker-db.yml
@@ -4,11 +4,9 @@ on:
   push:
     branches: [ "main" ]
     paths-ignore: [ "*.md" ]
-
   pull_request:
     branches: [ "main" ]
     paths-ignore: [ "*.md" ]
-
   workflow_dispatch:  # Allows you to run this workflow manually from the Actions tab
 
 concurrency:
@@ -19,6 +17,7 @@ permissions:
   contents: read
 
 env:
+  TZ: Asia/Shanghai
   BUILDKIT_PROGRESS: "plain"  # Full logs for CI build.
   REGISTRY_SRC: ${{ vars.REGISTRY_SRC || 'quay.io' }} # For BASE_NAMESPACE of images: where to pull base images from, docker.io or other source registry URL.
   REGISTRY_DST: ${{ vars.REGISTRY_DST || 'quay.io' }} # For tags of built images: where to push images to, docker.io or other destination registry URL.
@@ -29,16 +28,15 @@ env:
   DOCKER_MIRROR_REGISTRY_USERNAME: ${{ vars.DOCKER_MIRROR_REGISTRY_USERNAME }}
   DOCKER_MIRROR_REGISTRY_PASSWORD: ${{ secrets.DOCKER_MIRROR_REGISTRY_PASSWORD }}
   CI_PROJECT_NAME: ${{ vars.CI_PROJECT_NAME || 'LabNow/lab-foundation' }}
-  TZ: Asia/Shanghai
 
 jobs:
-  job-postgres-17:
-    name: 'postgres-17,postgres-17-ext'
+  job-postgres-16:
+    name: 'postgres-16,postgres-16-ext'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
       - run: |
-          source ./tool.sh && export PG_MAJOR=17
+          source ./tool.sh && export PG_MAJOR=16
           build_image_no_tag postgres-${PG_MAJOR} latest docker_atom/atom.Dockerfile --build-arg "BASE_IMG=postgres:${PG_MAJOR}-bookworm"
           export IMG_PREFIX_SRC="${IMG_PREFIX_DST}"
           build_image postgres-${PG_MAJOR}     latest docker_base/base.Dockerfile --build-arg "BASE_IMG=postgres-${PG_MAJOR}" --build-arg "PYTHON_VERSION=3.13"
@@ -46,13 +44,13 @@ jobs:
           build_image postgres-${PG_MAJOR}-ext latest docker_db_postgres/postgres-ext.Dockerfile --build-arg BASE_IMG=postgres-${PG_MAJOR}
           push_image  postgres-
 
-  job-postgres-16:
-    name: 'postgres-16,postgres-16-ext'
+  job-postgres-17:
+    name: 'postgres-17,postgres-17-ext'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
       - run: |
-          source ./tool.sh && export PG_MAJOR=16
+          source ./tool.sh && export PG_MAJOR=17
           build_image_no_tag postgres-${PG_MAJOR} latest docker_atom/atom.Dockerfile --build-arg "BASE_IMG=postgres:${PG_MAJOR}-bookworm"
           export IMG_PREFIX_SRC="${IMG_PREFIX_DST}"
           build_image postgres-${PG_MAJOR}     latest docker_base/base.Dockerfile --build-arg "BASE_IMG=postgres-${PG_MAJOR}" --build-arg "PYTHON_VERSION=3.13"
@@ -61,7 +59,7 @@ jobs:
           push_image  postgres-
 
   job-postgres-18:
-    name: 'postgres-18'
+    name: 'postgres-18,postgres-18-ext'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
@@ -71,11 +69,12 @@ jobs:
           export IMG_PREFIX_SRC="${IMG_PREFIX_DST}"
           build_image postgres-${PG_MAJOR}     latest docker_base/base.Dockerfile --build-arg "BASE_IMG=postgres-${PG_MAJOR}" --build-arg "PYTHON_VERSION=3.13"
           push_image  postgres-
-          echo "Skip PG 18-ext build as many extension are not yet available for PG 18..."
+          build_image postgres-${PG_MAJOR}-ext latest docker_db_postgres/postgres-ext.Dockerfile --build-arg BASE_IMG=postgres-${PG_MAJOR}
+          push_image  postgres-
 
 
   ## Sync all images in this build (listed by "names") to mirror registry.
-  sync_images:
+  job-sync-images:
     needs: ["job-postgres-17", "job-postgres-16", "job-postgres-18"]
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/build-docker-gpu.yml b/.github/workflows/build-docker-gpu.yml
index 2be30a2..1099b3e 100644
--- a/.github/workflows/build-docker-gpu.yml
+++ b/.github/workflows/build-docker-gpu.yml
@@ -4,11 +4,9 @@ on:
   push:
     branches: [ "main" ]
     paths-ignore: [ "*.md" ]
-
   pull_request:
     branches: [ "main" ]
     paths-ignore: [ "*.md" ]
-
   workflow_dispatch:  # Allows you to run this workflow manually from the Actions tab
 
 concurrency:
@@ -16,6 +14,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
+  TZ: Asia/Shanghai
   BUILDKIT_PROGRESS: "plain"  # Full logs for CI build.
   REGISTRY_SRC: ${{ vars.REGISTRY_SRC || 'quay.io' }} # For BASE_NAMESPACE of images: where to pull base images from, docker.io or other source registry URL.
   REGISTRY_DST: ${{ vars.REGISTRY_DST || 'quay.io' }} # For tags of built images: where to push images to, docker.io or other destination registry URL.
@@ -26,7 +25,6 @@ env:
   DOCKER_MIRROR_REGISTRY_USERNAME: ${{ vars.DOCKER_MIRROR_REGISTRY_USERNAME }}
   DOCKER_MIRROR_REGISTRY_PASSWORD: ${{ secrets.DOCKER_MIRROR_REGISTRY_PASSWORD }}
   CI_PROJECT_NAME: ${{ vars.CI_PROJECT_NAME || 'LabNow/lab-foundation' }}
-  TZ: Asia/Shanghai
 
 permissions:
   contents: read
@@ -155,7 +153,7 @@ jobs:
 
 
   ## Sync all images in this build (listed by "names") to mirror registry.
-  sync_images:
+  job-sync-images:
     needs: ["job-core-cuda", "job-py-cv", "job-py-nlp", "job-torch_cuda128", "job-nvidia-ctk"]
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/build-docker.yml b/.github/workflows/build-docker.yml
index 1223785..6dae72d 100644
--- a/.github/workflows/build-docker.yml
+++ b/.github/workflows/build-docker.yml
@@ -4,11 +4,9 @@ on:
   push:
     branches: [ "main" ]
     paths-ignore: [ "*.md" ]
-
   pull_request:
     branches: [ "main" ]
     paths-ignore: [ "*.md" ]
-
   workflow_dispatch:  # Allows you to run this workflow manually from the Actions tab
 
 concurrency:
@@ -19,6 +17,7 @@ permissions:
   contents: read
 
 env:
+  TZ: Asia/Shanghai
   BUILDKIT_PROGRESS: "plain"  # Full logs for CI build.
   REGISTRY_SRC: ${{ vars.REGISTRY_SRC || 'quay.io' }} # For BASE_NAMESPACE of images: where to pull base images from, docker.io or other source registry URL.
   REGISTRY_DST: ${{ vars.REGISTRY_DST || 'quay.io' }} # For tags of built images: where to push images to, docker.io or other destination registry URL.
@@ -29,7 +28,6 @@ env:
   DOCKER_MIRROR_REGISTRY_USERNAME: ${{ vars.DOCKER_MIRROR_REGISTRY_USERNAME }}
   DOCKER_MIRROR_REGISTRY_PASSWORD: ${{ secrets.DOCKER_MIRROR_REGISTRY_PASSWORD }}
   CI_PROJECT_NAME: ${{ vars.CI_PROJECT_NAME || 'LabNow/lab-foundation' }}
-  TZ: Asia/Shanghai
 
 jobs:
   job-base:
@@ -238,7 +236,7 @@ jobs:
             python /opt/utils/image-syncer/run_jobs.py --auth-file=/tmp/.github/workflows/auth.json
 
   ## Sync all images in this build (listed by "names") to mirror registry.
-  sync_images:
+  job-sync-images:
     needs: ["job-docker_kit", "job-full-stack", "job-core"]
     runs-on: ubuntu-latest
     steps:
diff --git a/docker_atom/atom.Dockerfile b/docker_atom/atom.Dockerfile
index 7bf4d2f..a0c2ece 100644
--- a/docker_atom/atom.Dockerfile
+++ b/docker_atom/atom.Dockerfile
@@ -1,7 +1,7 @@
 # Distributed under the terms of the Modified BSD License.
 
 # latest # default value: Latest LTS version of Ubuntu (https://hub.docker.com/_/ubuntu)
-ARG BASE_IMG="ubuntu:noble"
+ARG BASE_IMG="ubuntu:latest"
 FROM ${BASE_IMG}
 
 LABEL maintainer="postmaster@labnow.ai"
@@ -12,8 +12,8 @@ COPY work /opt/utils/
 
 ENV SHELL=/bin/bash \
     DEBIAN_FRONTEND=noninteractive \
-    LC_ALL="" \
     LC_CTYPE="C.UTF-8" \
+    LC_ALL="en_US.UTF-8" \
     LC_TYPE="en_US.UTF-8" \
     LANG="en_US.UTF-8" \
     LANGUAGE="en_US.UTF-8" \
@@ -30,7 +30,7 @@ RUN set -eux && cd /tmp \
  && apt-get -qq update --fix-missing && apt-get -y -qq upgrade \
  && apt-get -qq install -y --no-install-recommends \
      apt-utils apt-transport-https ca-certificates gnupg2 dirmngr locales sudo lsb-release curl \
- && localedef -i en_US -c -f UTF-8 -A /usr/share/locale/locale.alias en_US.UTF-8 \
+ && localedef -i en_US -c -f UTF-8 en_US.UTF-8 \
  && echo "en_US.UTF-8 UTF-8"             >  /etc/locale.gen && locale-gen \
  && echo "ALL ALL=(ALL) NOPASSWD:ALL"    >> /etc/sudoers \
  && mv /root/.bashrc /etc/profile.d/bash.bashrc.sh \
diff --git a/docker_atom/work/script-setup-core.sh b/docker_atom/work/script-setup-core.sh
index 3e8f1e6..470d182 100644
--- a/docker_atom/work/script-setup-core.sh
+++ b/docker_atom/work/script-setup-core.sh
@@ -153,8 +153,7 @@ setup_node_base() {
      local VER_NODEJS_REQ="${1:-}" \
   && local UNAME=$(uname | tr '[:upper:]' '[:lower:]') \
   && local ARCH=$(uname -m | sed -e 's/x86_64/x64/' -e 's/aarch64/arm64/') \
-  && local ATOM_NODEJS=$(curl -sL https://github.com/nodejs/node/releases.atom | grep 'releases/tag' | sort -r) \
-  && local VERS_NODEJS=$(echo "${ATOM_NODEJS}" | grep -Po '\d[\d.]+' | sort -rV) \
+  && local VERS_NODEJS=$(curl -sL "https://api.github.com/repos/nodejs/node/releases?per_page=50" | grep -Po '(?<="tag_name": ")[^"]+' | grep -Po '\d[\d.]+' | sort -rV) \
   && if [ -n "${VER_NODEJS_REQ}" ]; then
           local VER_NODEJS_RE=${VER_NODEJS_REQ#v} && VER_NODEJS_RE=${VER_NODEJS_RE//./\\.} \
        && local VER_NODEJS=$(echo "${VERS_NODEJS}" | grep -m1 -E "^${VER_NODEJS_RE}([.-]|$)")
@@ -179,7 +178,7 @@ setup_node_pnpm() {
   local VER_PNPM_REQ="${1:-}" UNAME ARCH URL_PNPM TMPDIR ;
      UNAME=$(uname | tr '[:upper:]' '[:lower:]') \
   && ARCH=$(uname -m | sed -e 's/x86_64/x64/' -e 's/aarch64/arm64/' -e 's/armv7l/arm/') \
-  && local VERS_PNPM=$(curl -fsSL https://github.com/pnpm/pnpm/releases.atom | grep -Po '(?<=tag/v)\d[\d.]+' | grep -v alpha | sort -rV) \
+  && local VERS_PNPM=$(curl -fsSL "https://api.github.com/repos/pnpm/pnpm/releases?per_page=50" | grep -Po '(?<="tag_name": ")[^"]+' | grep -v alpha | grep -Po '\d[\d.]+' | sort -rV) \
   && if [ -n "${VER_PNPM_REQ}" ]; then
        local VER_PNPM_RE=${VER_PNPM_REQ#v} \
        && VER_PNPM_RE=${VER_PNPM_RE//./\\.} \
@@ -209,8 +208,7 @@ setup_node_bun() {
      local VER_BUN_REQ="${1:-}" \
   && local UNAME=$(uname | tr '[:upper:]' '[:lower:]') \
   && local ARCH=$(uname -m | sed -e 's/x86_64/x64/' ) \
-  && local ATOM_BUN=$(curl -sL https://github.com/oven-sh/bun/releases.atom | grep 'releases/tag' | sort -r) \
-  && local VERS_BUN=$(echo "${ATOM_BUN}" | grep -Po 'bun-v\K\d+\.\d+\.\d+' | sort -rV) \
+  && local VERS_BUN=$(curl -sL "https://api.github.com/repos/oven-sh/bun/releases?per_page=50" | grep -Po '(?<="tag_name": ")[^"]+' | grep -Po 'bun-v\K\d+\.\d+\.\d+' | sort -rV) \
   && if [ -n "${VER_BUN_REQ}" ]; then
        local VER_BUN_RE=${VER_BUN_REQ#v} \
        && VER_BUN_RE=${VER_BUN_RE//./\\.} \
@@ -234,8 +232,8 @@ setup_GO() {
      local VER_GO_REQ="${1:-}" \
   && local UNAME=$(uname | tr '[:upper:]' '[:lower:]') \
   && local ARCH=$(dpkg --print-architecture) \
-  && local ATOM_GO=$(curl -sL https://github.com/golang/go/releases.atom | grep 'releases/tag' | grep -v 'rc' | sort -r) \
-  && local VERS_GO=$(echo "${ATOM_GO}" | grep -Po '\d[\d.]+' | sort -rV) \
+  && local VERS_GO=$(curl -sL "https://api.github.com/repos/golang/go/releases?per_page=50" | grep -Po '(?<="tag_name": ")[^"]+' | grep -v 'rc' | grep -Po '\d[\d.]+' | sort -rV) \
+  && { [ -n "${VERS_GO}" ] || VERS_GO=$(curl -sL "https://go.dev/dl/?mode=json" | grep -Po '(?<="version": "go)\d[\d.]+' | sort -rV) ; } \
   && if [ -n "${VER_GO_REQ}" ]; then
        local VER_GO_RE=${VER_GO_REQ#v} \
        && VER_GO_RE=${VER_GO_RE//./\\.} \
@@ -289,8 +287,7 @@ setup_julia() {
   && local UNAME=$(uname | tr '[:upper:]' '[:lower:]') \
   && local ARCH_1=$(uname -m) \
   && local ARCH_2=$(uname -m | sed -e 's/x86_64/x64/') \
-  && local ATOM_JULIA=$(curl -sL https://github.com/JuliaLang/julia/releases.atom | grep -P 'releases/tag(?!.*(rc|alpha|beta))' | sort -r) \
-  && local VERS_JULIA=$(echo "${ATOM_JULIA}" | grep -Po '\d[\d.]+' | sort -rV) \
+  && local VERS_JULIA=$(curl -sL "https://api.github.com/repos/JuliaLang/julia/releases?per_page=50" | grep -Po '(?<="tag_name": ")[^"]+' | grep -P -v '(rc|alpha|beta)' | grep -Po '\d[\d.]+' | sort -rV) \
   && if [ -n "${VER_JULIA_REQ}" ]; then
        local VER_JULIA_RE=${VER_JULIA_REQ#v} \
        && VER_JULIA_RE=${VER_JULIA_RE//./\\.} \
@@ -361,7 +358,7 @@ setup_bazel() {
      local UNAME=$(uname | tr '[:upper:]' '[:lower:]') \
   && local ARCH=$(uname -m | sed -e 's/aarch64/arm64/') \
   && local VER_BAZEL_REQ="${1:-}" \
-  && local VERS_BAZEL=$(curl -sL https://github.com/bazelbuild/bazel/releases.atom | grep 'releases/tag' | grep -Po '\d[\d.]+' | sort -rV) \
+  && local VERS_BAZEL=$(curl -sL "https://api.github.com/repos/bazelbuild/bazel/releases?per_page=50" | grep -Po '(?<="tag_name": ")[^"]+' | grep -Po '\d[\d.]+' | sort -rV) \
   && if [ -n "${VER_BAZEL_REQ}" ]; then
        local VER_BAZEL_RE=${VER_BAZEL_REQ#v} \
        && VER_BAZEL_RE=${VER_BAZEL_RE//./\\.} \
@@ -379,7 +376,7 @@ setup_bazel() {
 
 setup_gradle() {
      local VER_GRADLE_REQ="${1:-}" \
-  && local VERS_GRADLE=$(curl -sL https://github.com/gradle/gradle/releases.atom | grep 'releases/tag' | grep -v 'M' | grep -Po '\d[\d.]+' | sort -rV) \
+  && local VERS_GRADLE=$(curl -sL "https://api.github.com/repos/gradle/gradle/releases?per_page=50" | grep -Po '(?<="tag_name": ")[^"]+' | grep -v 'M' | grep -Po '\d[\d.]+' | sort -rV) \
   && if [ -n "${VER_GRADLE_REQ}" ]; then
        local VER_GRADLE_RE=${VER_GRADLE_REQ#v} \
        && VER_GRADLE_RE=${VER_GRADLE_RE//./\\.} \
@@ -399,7 +396,7 @@ setup_yq() {
   local ARCH=$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/' -e 's/armv7l/arm/') ;
   [[ "$ARCH" =~ ^(amd64|arm64|arm)$ ]] || { echo "Unsupported architecture for yq: $(uname -m)"; return 1; }
      local VER_YQ="" VER_YQ_REQ="${1:-}" \
-  && local VERS_YQ=$(curl -sL https://github.com/mikefarah/yq/releases.atom | grep 'releases/tag' | grep -Po 'v\K[\d.]+' | sort -rV) \
+  && local VERS_YQ=$(curl -sL "https://api.github.com/repos/mikefarah/yq/releases?per_page=50" | grep -Po '(?<="tag_name": ")[^"]+' | grep -Po 'v\K[\d.]+' | sort -rV) \
   && if [ -n "${VER_YQ_REQ}" ]; then
        local VER_YQ_RE=${VER_YQ_REQ#v} && VER_YQ_RE=${VER_YQ_RE//./\\.} \
        && VER_YQ=$(echo "${VERS_YQ}" | grep -m1 -E "^${VER_YQ_RE}([.-]|$)")
diff --git a/docker_atom/work/script-setup-net.sh b/docker_atom/work/script-setup-net.sh
index d6c7901..412ec0e 100644
--- a/docker_atom/work/script-setup-net.sh
+++ b/docker_atom/work/script-setup-net.sh
@@ -1,6 +1,6 @@
 setup_traefik() {
      local VER_TRAEFIK_REQ="${1:-}" \
-  && local VERS_TRAEFIK=$(curl -sL https://github.com/traefik/traefik/releases.atom | grep 'releases/tag' | grep -Po '\d[\d.]+' | sort -rV) \
+  && local VERS_TRAEFIK=$(curl -sL "https://api.github.com/repos/traefik/traefik/releases?per_page=50" | grep -Po '(?<="tag_name": ")[^"]+' | grep -Po '\d[\d.]+' | sort -rV) \
   && if [ -n "${VER_TRAEFIK_REQ}" ]; then
        local VER_TRAEFIK_RE=${VER_TRAEFIK_REQ#v} \
        && VER_TRAEFIK_RE=${VER_TRAEFIK_RE//./\\.} \
@@ -20,7 +20,7 @@ setup_caddy() {
      UNAME=$(uname | tr '[:upper:]' '[:lower:]') \
   && ARCH=$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/') \
   && local VER_CADDY_REQ="${1:-}" \
-  && local VERS_CADDY=$(curl -sL https://github.com/caddyserver/caddy/releases.atom | grep "releases/tag" | grep -v 'beta' | grep -Po '(\d[\d|.]+)' | sort -rV) \
+  && local VERS_CADDY=$(curl -sL "https://api.github.com/repos/caddyserver/caddy/releases?per_page=50" | grep -Po '(?<="tag_name": ")[^"]+' | grep -v 'beta' | grep -Po '(\d[\d|.]+)' | sort -rV) \
   && if [ -n "${VER_CADDY_REQ}" ]; then
        local VER_CADDY_RE=${VER_CADDY_REQ#v} \
        && VER_CADDY_RE=${VER_CADDY_RE//./\\.} \
@@ -41,7 +41,7 @@ setup_oauth2_proxy() {
   [[ "$ARCH" =~ ^(amd64|arm64|armv7)$ ]] || { echo "Unsupported architecture for oauth2-proxy: $(uname -m)"; return 1; }
 
      local VER_OAUTH2_PROXY_REQ="${1:-}" \
-  && local VERS_OAUTH2_PROXY=$(curl -sL https://github.com/oauth2-proxy/oauth2-proxy/releases.atom | grep 'releases/tag' | grep -Po '(?<=tag/v)\d[\d.]+' | sort -rV) \
+  && local VERS_OAUTH2_PROXY=$(curl -sL "https://api.github.com/repos/oauth2-proxy/oauth2-proxy/releases?per_page=50" | grep -Po '(?<="tag_name": ")[^"]+' | grep -Po '(?<=v)?\d[\d.]+' | sort -rV) \
   && if [ -n "${VER_OAUTH2_PROXY_REQ}" ]; then
        local VER_OAUTH2_PROXY_RE=${VER_OAUTH2_PROXY_REQ#v} \
        && VER_OAUTH2_PROXY_RE=${VER_OAUTH2_PROXY_RE//./\\.} \
diff --git a/docker_atom/work/script-setup-sys.sh b/docker_atom/work/script-setup-sys.sh
index 4daf5ea..5766768 100644
--- a/docker_atom/work/script-setup-sys.sh
+++ b/docker_atom/work/script-setup-sys.sh
@@ -4,7 +4,7 @@ source /opt/utils/script-utils.sh
 setup_tini() {
      ARCH=$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/') \
   && local VER_TINI_REQ="${1:-}" \
-  && local VERS_TINI=$(curl -sL https://github.com/krallin/tini/releases.atom | grep 'releases/tag' | grep -Po '\d[\d.]+' | sort -rV) \
+  && local VERS_TINI=$(curl -sL "https://api.github.com/repos/krallin/tini/releases?per_page=50" | grep -Po '(?<="tag_name": ")[^"]+' | grep -Po '\d[\d.]+' | sort -rV) \
   && if [ -n "${VER_TINI_REQ}" ]; then
        local VER_TINI_RE=${VER_TINI_REQ#v} \
        && VER_TINI_RE=${VER_TINI_RE//./\\.} \
@@ -27,7 +27,7 @@ setup_supervisord() {
      UNAME=$(uname | tr '[:upper:]' '[:lower:]') \
   && ARCH=$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/') \
   && local VER_SUPERVISORD_REQ="${1:-}" \
-  && local VERS_SUPERVISORD=$(curl -sL https://github.com/LabNow-ai/supervisord/releases.atom | grep "releases/tag" | grep -Po '(\d[\d|.]+)' | sort -rV) \
+  && local VERS_SUPERVISORD=$(curl -sL "https://api.github.com/repos/LabNow-ai/supervisord/releases?per_page=50" | grep -Po '(?<="tag_name": ")[^"]+' | grep -Po '(\d[\d|.]+)' | sort -rV) \
   && if [ -n "${VER_SUPERVISORD_REQ}" ]; then
        local VER_SUPERVISORD_RE=${VER_SUPERVISORD_REQ#v} \
        && VER_SUPERVISORD_RE=${VER_SUPERVISORD_RE//./\\.} \
diff --git a/docker_db_postgres/postgres-ext.Dockerfile b/docker_db_postgres/postgres-ext.Dockerfile
index 3e2b443..1f60e2a 100644
--- a/docker_db_postgres/postgres-ext.Dockerfile
+++ b/docker_db_postgres/postgres-ext.Dockerfile
@@ -9,15 +9,15 @@ LABEL maintainer="haobibo@gmail.com"
 COPY rootfs /
 
 RUN set -eux && . /opt/utils/script-utils.sh && . /opt/utils/script-setup-pg-ext-mirror.sh \
- # PG extension managers: pgxman, pgxnclient
- && apt-get update && apt-get install -y postgresql-server-dev-${PG_MAJOR} pgxman \
+ # PG extension managers: pgxnclient
+ && apt-get update && apt-get install -y postgresql-server-dev-${PG_MAJOR} \
  && pip install --no-cache-dir --root-user-action=ignore -U pgxnclient && pgxn --version \
  ## Generate a package list based on PG_MAJOR version
  && apt-get update && apt-get install -y gettext \
  && envsubst < /opt/utils/install-list-pgext.tpl.apt > /opt/utils/install-list-pgext.apt \
  && rm -rf /opt/utils/install-list-pgext.tpl.apt \
  ## Install extensions: install by apt
- && echo "To install PG extensions: $(cat /opt/utils/install_list_pgext.apt)" \
+ && echo "To install PG extensions: $(cat /opt/utils/install-list-pgext.apt)" \
  && install_apt /opt/utils/install-list-pgext.apt \
  ## Install extensions: install ext that need to be installed manually
  && source /opt/utils/script-setup-pg-ext.sh \
@@ -27,7 +27,6 @@ RUN set -eux && . /opt/utils/script-utils.sh && . /opt/utils/script-setup-pg-ext
  && setup_apache_age \
  && setup_pg_duckdb \
  && setup_pg_net \
- ## && pgxman install -y --overwrite pgsodium \
  ## required to build some extensions and can be removed after install:
  && apt-get remove -y postgresql-server-dev-${PG_MAJOR} ninja-build \
  && ls -alh /usr/share/postgresql/*/extension/*.control | sort \
diff --git a/docker_db_postgres/rootfs/opt/utils/install-list-pgext.tpl.apt b/docker_db_postgres/rootfs/opt/utils/install-list-pgext.tpl.apt
index 6c60c58..714f41d 100644
--- a/docker_db_postgres/rootfs/opt/utils/install-list-pgext.tpl.apt
+++ b/docker_db_postgres/rootfs/opt/utils/install-list-pgext.tpl.apt
@@ -4,7 +4,7 @@ postgresql-${PG_MAJOR}-cron                  % job scheduler using background wo
 postgresql-${PG_MAJOR}-pgaudit               % SQL audit logging via executor hooks
 postgresql-${PG_MAJOR}-pg-stat-kcache        % OS-level CPU/IO stats for queries
 postgresql-${PG_MAJOR}-squeeze               % automatic table bloat reduction (bgworker)
-postgresql-${PG_MAJOR}-citus-13.0            % distributed PostgreSQL extension (planner hook)
+postgresql-${PG_MAJOR}-citus-14.1            % distributed PostgreSQL extension (planner hook)
 timescaledb-2-postgresql-${PG_MAJOR}         % time-series database extension (planner + bgworker)
 
 
@@ -26,7 +26,7 @@ postgresql-${PG_MAJOR}-prioritize            % query prioritization framework
 
 %% Vector, scientific, spatial, and domain-specific extensions (AI, GIS, chemistry, scientific computing)
 postgresql-${PG_MAJOR}-pgvector              % vector data type and similarity search
-postgresql-16-rdkit                          % cheminformatics cartridge (chemistry) % TODO: >16 not released yet
+postgresql-16-rdkit                          % cheminformatics cartridge (chemistry)
 postgresql-${PG_MAJOR}-postgis               % spatial types, indexes, and GIS functions
 postgis osm2pgrouting                        % OpenStreetMap routing tools for PostGIS
 postgresql-${PG_MAJOR}-pgrouting             % routing algorithms on PostGIS networks
@@ -46,7 +46,7 @@ postgresql-${PG_MAJOR}-rational              % rational number data type
 postgresql-${PG_MAJOR}-mysql-fdw             % foreign data wrapper for MySQL
 postgresql-${PG_MAJOR}-oracle-fdw            % foreign data wrapper for Oracle
 postgresql-${PG_MAJOR}-tds-fdw               % foreign data wrapper for MSSQL / Sybase
-postgresql-${PG_MAJOR}-ogr-fdw               % FDW for spatial data via GDAL
+% postgresql-${PG_MAJOR}-ogr-fdw             % FDW for spatial data via GDAL % TODO - fix deps
 
 
 %% Procedural languages and language tooling (user-defined functions and language runtimes)
@@ -77,7 +77,7 @@ postgresql-${PG_MAJOR}-pgmp                  % management and monitoring utiliti
 %% Query planning, optimization, and execution control (query behavior analysis and tuning)
 postgresql-${PG_MAJOR}-show-plans            % display cached execution plans
 postgresql-${PG_MAJOR}-hypopg                % hypothetical indexes for query planning
-% postgresql-${PG_MAJOR}-pgfincore           % inspect shared buffer / OS cache residency % TODO: >17 not released yet
+% postgresql-${PG_MAJOR}-pgfincore           % inspect shared buffer / OS cache residency
 
 
 %% Indexing, access methods, and physical data layout (storage, partitioning, and index structures)
diff --git a/docker_db_postgres/rootfs/opt/utils/script-setup-pg-ext-mirror.sh b/docker_db_postgres/rootfs/opt/utils/script-setup-pg-ext-mirror.sh
index ca0774b..b1ac4f3 100644
--- a/docker_db_postgres/rootfs/opt/utils/script-setup-pg-ext-mirror.sh
+++ b/docker_db_postgres/rootfs/opt/utils/script-setup-pg-ext-mirror.sh
@@ -16,11 +16,6 @@ add_apt_source() {
   curl -fsSL "$list_url" > "$list_path"
 }
 
-# pgxman-cli
-ARCH=$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/')
-curl -fsSL https://apt.pgxman.com/pgxman-keyring.gpg | gpg --dearmor | sudo tee ${APT_KEYRING_DIR}/pgxman-cli.gpg > /dev/null
-echo "deb [arch=${ARCH} signed-by=${APT_KEYRING_DIR}/pgxman-cli.gpg] https://apt.pgxman.com/cli stable main" | sudo tee ${APT_SOURCE_DIR}/pgxman-cli.list >/dev/null
-
 
 # apt source for: https://www.citusdata.com/download/
 add_apt_source \
diff --git a/docker_db_postgres/rootfs/opt/utils/script-setup-pg-ext.sh b/docker_db_postgres/rootfs/opt/utils/script-setup-pg-ext.sh
index 153098d..890f526 100644
--- a/docker_db_postgres/rootfs/opt/utils/script-setup-pg-ext.sh
+++ b/docker_db_postgres/rootfs/opt/utils/script-setup-pg-ext.sh
@@ -18,7 +18,7 @@ setup_pg_search() {
  ## ref1: https://docs.paradedb.com/deploy/self-hosted/extension
  ## ref2: https://github.com/paradedb/paradedb
     ARCH="amd64" \
- && VER_PG_SEARCH=$(curl -sL https://github.com/paradedb/paradedb/releases.atom | grep 'releases/tag' | head -1 | grep -Po '\d[\d.]+' ) \
+ && VER_PG_SEARCH=$(curl -sL "https://api.github.com/repos/paradedb/paradedb/releases?per_page=50" | grep -Po '(?<="tag_name": ")[^"]+' | head -1 | grep -Po '\d[\d.]+' ) \
  && URL_PG_SEARCH="https://github.com/paradedb/paradedb/releases/download/v${VER_PG_SEARCH}/postgresql-${PG_MAJOR}-pg-search_${VER_PG_SEARCH}-1PARADEDB-$(lsb_release -cs)_amd64.deb" \
  && echo "Downloading pg_search ${VER_PG_SEARCH} from: ${URL_PG_SEARCH}" \
  && mkdir -pv /tmp/pg_search/ && cd /tmp/pg_search \
@@ -38,7 +38,7 @@ setup_apache_age() {
 setup_pgvectorscale() {
  ## ref: https://github.com/timescale/pgvectorscale
     ARCH="amd64" \
- && VER_PGVS=$(curl -sL https://github.com/timescale/pgvectorscale/releases.atom | grep 'releases/tag' | head -1 | grep -Po '\d[\d.]+' ) \
+ && VER_PGVS=$(curl -sL "https://api.github.com/repos/timescale/pgvectorscale/releases?per_page=50" | grep -Po '(?<="tag_name": ")[^"]+' | head -1 | grep -Po '\d[\d.]+' ) \
  && URL_PGVS="https://github.com/timescale/pgvectorscale/releases/download/${VER_PGVS}/pgvectorscale-${VER_PGVS}-pg${PG_MAJOR}-${ARCH}.zip" \
  && mkdir -pv /tmp/pgvectorscale/ && cd /tmp/pgvectorscale \
  && install_zip ${URL_PGVS} && mv /opt/pgvectorscal* /tmp/pgvectorscale/ \
diff --git a/docker_docker_kit/work/script-setup-docker.sh b/docker_docker_kit/work/script-setup-docker.sh
index a745971..94b692d 100644
--- a/docker_docker_kit/work/script-setup-docker.sh
+++ b/docker_docker_kit/work/script-setup-docker.sh
@@ -3,7 +3,7 @@ source /opt/utils/script-utils.sh
 
 setup_docker_compose() {
      ARCH=$(uname -m) \
-  && VER_COMPOSE=$(curl -sL https://github.com/docker/compose/releases.atom | grep 'releases/tag' | head -1 | grep -Po '\d[.\d]+') \
+  && VER_COMPOSE=$(curl -sL "https://api.github.com/repos/docker/compose/releases?per_page=50" | grep -Po '(?<="tag_name": ")[^"]+' | head -1 | grep -Po '\d[.\d]+') \
   && URL_COMPOSE="https://github.com/docker/compose/releases/download/v${VER_COMPOSE}/docker-compose-linux-${ARCH}" \
   && echo "Downloading Compose from: ${URL_COMPOSE}" \
   && sudo curl -o /usr/bin/docker-compose -sL ${URL_COMPOSE} \
@@ -14,7 +14,7 @@ setup_docker_compose() {
 
 setup_docker_syncer() {
      ARCH=$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/') \
-  && VER_SYNCER="$(curl -sL https://github.com/AliyunContainerService/image-syncer/releases.atom | grep 'releases/tag' | head -1 | grep -Po '\d[.\d]+')" \
+  && VER_SYNCER="$(curl -sL "https://api.github.com/repos/AliyunContainerService/image-syncer/releases?per_page=50" | grep -Po '(?<="tag_name": ")[^"]+' | head -1 | grep -Po '\d[.\d]+')" \
   && URL_SYNCER="https://github.com/AliyunContainerService/image-syncer/releases/download/v${VER_SYNCER}/image-syncer-v${VER_SYNCER}-linux-${ARCH}.tar.gz" \
   && echo "Downloading image-syncer from: ${URL_SYNCER}" \
   && curl -o /tmp/image_syncer.tgz -sL ${URL_SYNCER} \
diff --git a/tool.sh b/tool.sh
index eb59a99..2fb0a37 100755
--- a/tool.sh
+++ b/tool.sh
@@ -1,8 +1,13 @@
 #!/bin/bash
 set -eux
 
+# If not executed in GitHub Action, run script in project root, and export the following 3 variables manually:
+# export REGISTRY_SRC='quay.io'            # For BASE_NAMESPACE of images: where to pull base images from, docker.io or other source registry URL.
+# export REGISTRY_DST='quay.io'            # For tags of built images: where to push images to, docker.io or other destination registry URL.
+# export CI_PROJECT_NAME='LabNow/lab-foundation'
+
 CI_PROJECT_NAME=${CI_PROJECT_NAME:-$GITHUB_REPOSITORY}
-CI_PROJECT_BRANCH=${GITHUB_HEAD_REF:-"main"}
+CI_PROJECT_BRANCH=${GITHUB_HEAD_REF:-$(git branch --show-current)}
 CI_PROJECT_SPACE=$(echo "${CI_PROJECT_BRANCH}" | cut -f1 -d'/')
 
 # If on the main branch, image namespace will be same as CI_PROJECT_NAME's name space;
@@ -11,7 +16,7 @@ CI_PROJECT_SPACE=$(echo "${CI_PROJECT_BRANCH}" | cut -f1 -d'/')
 export CI_PROJECT_NAMESPACE="$(dirname ${CI_PROJECT_NAME})${NAMESPACE_SUFFIX}" ;
 
 export IMG_NAMESPACE=$(echo "${CI_PROJECT_NAMESPACE}" | awk '{print tolower($0)}')
-export IMG_PREFIX_SRC=$(echo "${REGISTRY_SRC:-"docker.io"}/${IMG_NAMESPACE}" | awk '{print tolower($0)}')
+export IMG_PREFIX_SRC=$(echo "${REGISTRY_SRC:-"quay.io"}/${IMG_NAMESPACE}"   | awk '{print tolower($0)}')
 export IMG_PREFIX_DST=$(echo "${REGISTRY_DST:-"docker.io"}/${IMG_NAMESPACE}" | awk '{print tolower($0)}')
 export TAG_SUFFIX="-$(git rev-parse --short HEAD)"
 
@@ -91,4 +96,4 @@ setup_github_actions() {
     jq '.experimental=true | ."data-root"="/mnt/docker"' /etc/docker/daemon.json > /tmp/daemon.json && sudo mv /tmp/daemon.json /etc/docker/ ;
     ( sudo service docker restart || true ) && cat /etc/docker/daemon.json && docker info ;
 }
-[ "$GITHUB_ACTIONS" = "true" ] && echo "Running in GitHub Actions and Setup Env: $(setup_github_actions)"
+[ ${GITHUB_ACTIONS:-"false"} = "true" ] && echo "Running in GitHub Actions and Setup Env: $(setup_github_actions)" || echo "Not running in GitHub Action." ;