Co-op Cloud Recipe CI · Weekly Edition

The Recipe Report

Week of June 22, 2026report.ci.commoninternet.net2026-06-23 02:07 UTC

A clean run: of 20 recipes considered, nine upgrades are !testme GREEN and merge-ready, discourse is stale-tested (its RED gates a different PR), and nothing failed. Address the nginx 1.31.2 security patch first — custom-html and lasuite-docs each ship three memory-safety CVEs (CVE-2026-42530/42055/48142) — then gitea's auth/LFS security patch (1.26.4), then reconcile discourse's four open PRs (bitnamilegacy is frozen at 3.5.0; PR #5 is the real upgrade path), and watch mattermost-lts's ESR deadline (10.11 support ends 2026-08-15) and matrix-synapse's telegram Python-to-Go rewrite before merging.

The full wire — every recipe, in priority order

Recipe	Change	TESTS	CVEs	CI	PR	STATUS	Notes
custom-html	1.13.0+1.31.1 → 1.13.1+1.31.2	GREEN	3	build 945 ✓	#5	…	nginx 1.31.2 security patch (CVE-2026-42530 HTTP/3 UAF, CVE-2026-42055 heap overflow, CVE-2026-48142 charset overread) + alpine/git v2.52.0→v2.54.0. Static-server use limits direct exposure (no HTTP/3, proxy_pass or charset_map) but patch anyway. Ready to merge.
lasuite-docs	0.3.5+v5.2.1 → 0.3.6+v5.3.0	GREEN	3	build 951 ✓	#7	…	impress v5.2.1→v5.3.0 (reactions limit, a11y, N+1 fix) + nginx 1.31.2 (same 3-CVE batch). AUTO_MIGRATIONS on backend startup; all four impress images move in lockstep. Ready to merge.
discourse	redis 7.4-alpine → 8.8-alpine	STALE	none	RED 948 · stale tests	#6	…	redis 7.4→8.8 only (app/sidekiq stay bitnamilegacy/discourse:3.5.0 — frozen). !testme RED on 2 assertions gating PR #5's official-image migration, not the redis bump (test_upgrade_reconverges PASSED). bitnamilegacy 9.0.x are Helm chart OCI artifacts, not images. Reconcile 4 open PRs (#5 official image = real path, #7 db, #6 redis, #1 re-pin).
gitea	1.26.2-rootless → 1.26.4-rootless	GREEN	none	build 949 ✓	#5	…	1.26.3+1.26.4 security fixes: hostmatcher private list, LFS cross-repo reuse, SSH LFS auth bypass, CODEOWNERS regex DoS, OIDC stale login links, OAuth2 disabled-user reactivation. Skips the 1.26.3 code-page regression. postgres 15.18 unchanged (plain postgres, no pgautoupgrade). Also open: PR #4 (app.ini config-volume fix). Ready to merge.
mattermost-lts	10.11.20 → 11.7.5 (ESR)	GREEN	none	build 953 ✓	#2	…	Jumps off 10.11 ESR (security support ends 2026-08-15) onto 11.7 ESR (through 2027-05-15). Avoid 11.7.0–11.7.2 (schemeid migration bug). Auto DB migrations + password re-hash bcrypt→PBKDF2. Restore fix folded in (pg_dump→reimport; was a silent no-op). Close duplicate PR #1. Major recipe bump (-x).
matrix-synapse	bridges v0.8.7/v0.15.3 → v0.2606.0 + DBs pg13→pg14	GREEN	none	build 955 ✓	#5	…	signal+telegram bridges → v0.2606.0 (calver). telegram is a Python→Go rewrite (BREAKING: config template rewritten, permission renames relaybot→relay/user→commands, relaybot removed, supergroups needed for shared portals). Bridge DBs pg13→pg14 (plain postgres — dump/restore if data; PG13 EOL). Base synapse v1.155.0 untouched. CI tests base only.
bluesky-pds	0.3.0+v0.4.219 → 0.3.1+v0.4.5006	GREEN	none	build 946 ✓	#3	…	@atproto/pds 0.5.1→0.5.6 (account-status hardening, kysely bump). PR #3 already moved 0.4.219→0.4.5001 (Node 20→24). Also open: PR #4 (routing: app→pds service rename for shared proxy). Ready to merge.
n8n	3.4.0+2.27.2 → 3.4.1+2.27.3	GREEN	none	build 954 ✓	#5	…	n8n 2.27.2→2.27.3 (patch: Form Trigger auth default to stop crash on old workflows; hides preview on small screens). pg 18 unchanged. On the 2.27 beta track (recipe adopted deliberately). Ready to merge.
hedgedoc	pgautoupgrade 16-alpine → 17-alpine	GREEN	none	build 950 ✓	#3	…	Conservative one-major pgautoupgrade 16→17 (auto pg_upgrade on start; verified on dev swarm — schema intact). App 1.11.0 unchanged. CI uses sqlite backend (overlay not CI-covered). Also open: PR #1 (generic-suite probe, can close). Back up postgres volume before deploy.
custom-html-tiny	alpine/git v2.52.0 → v2.54.0	GREEN	none	build 947 ✓	#9	…	Optional git-pull sidecar overlay only (replicas:0 cron); app static-web-server 2.43.0 unchanged. Also open: PR #8 (regall sweep, can close). Ready to merge.
ghost	—	SKIPPED	none		#6	…	Skipped: app 6.45.0-alpine already latest; MySQL 9.x not supported by Ghost (docs: MySQL 8 only — 9.x removes mysql_native_password, enforces inline FKs, 9.0.0 pulled). Standing notes updated. PR #6 is a regall-sweep probe, not an upgrade.
immich	—	UPTODATE	none		#3	…	Up-to-date (v2.7.5 latest stable; v3.0.0 in RC, not auto-upgraded). Postgres 14-vectorchord pin is newest on its scheme. PR #3 is a regall-sweep probe.
lasuite-drive	—	UPTODATE	none		#3	…	Up-to-date (drive v0.19.0, collabora 25.04.9.4.1, nginx 1.31.2 all current). PR #3 is a regall-sweep probe.
mailu	—	UPTODATE	none		#3	…	Up-to-date (all images 2024.06.52). PR #3 adds backupbot v2 backup labels (admin sqlite /data + imap /mail) — a real feature PR, green at build 483, worth reviewing.
mumble	—	UPTODATE	none		#1	…	Up-to-date (mumble-server v1.6.870-0, mumble-web 0.5). PR #1 is a cfold-sweep probe.
cryptpad	—	UPTODATE	none				Up-to-date (cryptpad:version-2026.5.1 newest; nginx 1.31 current).
drone	—	UPTODATE	none				Up-to-date (default branch master; mirror synced).
keycloak	—	UPTODATE	none				Up-to-date (keycloak 26.6.3, mariadb 12.3 both latest).
lasuite-meet	—	UPTODATE	none				Up-to-date (meet v1.21.0, livekit v1.13.1, nginx 1.31.2 all current).
plausible	—	UPTODATE	none				Up-to-date (analytics v2.0.0 latest stable; clickhouse 23.4.2.11 deliberate compat pin — 26.x is a 3-major jump, operator's call).

Addendum

discourse carries four open PRs to reconcile: #5 (switch to the official discourse/discourse image — the real app upgrade path, since bitnamilegacy is frozen at 3.5.0), #7 (db move to discourse/postgres:pg18, RED at build 944), #6 (this run's redis 7.4→8.8, stale-tested), and #1 (bitnami→bitnamilegacy re-pin). Suggested order: merge #5 first, then #7; #6 (redis) is independent and can merge anytime.
discourse's !testme is RED on build 948, but the two failures (test_head_runs_official_image_not_bitnamilegacy, test_sidekiq_service_dropped_by_head) assert PR #5's official-image migration, not the redis bump — test_upgrade_reconverges PASSED. The tests are genuinely stale for PR #6; re-run /recipe-upgrade discourse --with-tests, or merge #5 first so the assertions match.
abra proposed bitnamilegacy/discourse:9.0.4 and 9.0.3 as image upgrades, but a direct Docker Hub check confirms they are Helm chart OCI artifacts (application/vnd.cncf.helm.config.v1+json, ~186 KB, 0 images), not runnable containers — bitnamilegacy/discourse is frozen at 3.5.0. abra blindly parses OCI artifact tags as semver; a tooling guard would stop it offering non-images.
mattermost-lts has two open PRs with identical titles (PR #1 and #2, both 'fix(backup): reimport the postgres dump on restore'). #2 supersedes #1 — it folds the restore fix in alongside the 10.11→11.7 ESR jump. Close #1.
matrix-synapse's telegram bridge is a Python→Go rewrite (breaking) that the cc-ci tests do not exercise — tests deploy only the base compose, with no bridge overlays. The direct-deploy step also could not fully render the Go bridgev2 config because abra 0.13.0-beta does not render template_driver: golang configs in chaos mode (an abra limitation, not a recipe issue). Operators using the telegram overlay must migrate the config template + permission names manually.
Three real non-upgrade fix/feature PRs are worth a look alongside this run's upgrades: mailu #3 (backupbot v2 backup labels for admin sqlite /data + imap /mail, green at build 483), gitea #4 (seed app.ini into a writable config volume for Gitea 1.24+), and bluesky-pds #4 (rename main service app→pds so caddy resolves the stack on a shared proxy).
Several recipes carry lingering CI probe PRs unrelated to upgrades that can be closed: custom-html-tiny #8, ghost #6, immich #3, lasuite-drive #3, mumble #1 (regall/cfold sweeps), and hedgedoc #1 (generic-suite probe). None are upgrades.

Security Bulletin

🔒 Critical CVE upgrades

nginx 1.31.2 — memory-safety CVE batch (high) · custom-html, lasuite-docs

The nginx 1.31.1 → 1.31.2 patch (17 Jun 2026) closes three CVEs: CVE-2026-42530 (use-after-free with HTTP/3 + a crafted QUIC session — worker memory corruption/crash), CVE-2026-42055 (heap buffer overflow with ignore_invalid_headers off; + large large_client_header_buffers when proxying to HTTP/2 or gRPC backends), and CVE-2026-48142 (heap buffer overread decoding UTF-8 via charset_map). It ships GREEN this week in custom-html (1.31.1→1.31.2, also alpine/git v2.52.0→v2.54.0) and lasuite-docs (1.31.1→1.31.2, bundled with the impress v5.3.0 minor). custom-html is a static file server (no HTTP/3, proxy_pass, or charset_map), so its direct exposure is limited, but the patch is still the recommended merge; lasuite-docs runs nginx as a reverse proxy to the app. Highest-value merges of the week.

custom-html PR #5 (build 945) · lasuite-docs PR #7 (build 951)

What changed

custom-html

1.13.0+1.31.1 → 1.13.1+1.31.2. nginx 1.31.2 is a security patch closing CVE-2026-42530 (HTTP/3 QUIC use-after-free), CVE-2026-42055 (heap overflow proxying to HTTP/2/gRPC with ignore_invalid_headers off), and CVE-2026-48142 (charset_map UTF-8 overread); alpine/git sidecar bumped v2.52.0→v2.54.0. No migration steps — nginx is a static file server here, so none of the CVE preconditions apply directly, but patch anyway. Clean GREEN at build 945.

PR #5 (build 945)

lasuite-docs

0.3.5+v5.2.1 → 0.3.6+v5.3.0. The four impress images (app/backend/celery/y-provider) move v5.2.1→v5.3.0 (reactions-per-comment limit, leave-a-document, unauthenticated search, N+1 fix, a11y) and the web tier picks up nginx 1.31.2 (the same 3-CVE batch). DB migrations run automatically on backend startup (AUTO_MIGRATIONS). All four impress images share one monorepo tag and move in lockstep. Clean GREEN at build 951.

PR #7 (build 951)

discourse

redis 7.4-alpine → 8.8-alpine only. The app/sidekiq stay on bitnamilegacy/discourse:3.5.0 — that image is frozen (abra's 9.0.4/9.0.3 suggestions are Helm chart OCI artifacts, not runnable images), so the real app upgrade is PR #5's official-image migration, left untouched here. Redis 8 loads 7.x RDBs transparently; the chaos deploy reconverged and served. !testme is RED at build 948, but the two failures assert PR #5's official-image migration (not the redis bump) — genuinely stale tests; re-run --with-tests or merge #5 first.

upgrade PR #6 (build 948, stale) · official-image PR #5

gitea

1.26.2-rootless → 1.26.4-rootless. 1.26.3 carried multiple security fixes (hostmatcher private list, LFS cross-repo reuse, SSH LFS auth bypass, CODEOWNERS regex DoS, OIDC stale login links) plus a regression (context deadline on code pages); 1.26.4 fixes that regression and adds an OAuth2 fix (do not auto-reactivate disabled users on callback). Targeting 1.26.4 directly skips the bad 1.26.3. postgres 15.18 is deliberately not bumped — the recipe uses plain postgres (no pgautoupgrade), so a major jump needs a manual dump/restore. Clean GREEN at build 949.

PR #5 (build 949)

mattermost-lts

10.11.20 → 11.7.5 (ESR). Jumps off the 10.11 ESR line — security support ends 2026-08-15 — onto 11.7 ESR (supported through 2027-05-15). Avoid 11.7.0–11.7.2 (a schemeid roles-table migration bug upgrading from 10.11.17+); 11.7.5 is safe. DB migrations + password re-hash (bcrypt→PBKDF2) run automatically. The backup/restore bug is fixed in the same PR (raw-PGDATA restore was a silent no-op; now pg_dump→DROP DATABASE WITH (FORCE)→reimport). Close the duplicate PR #1. Major recipe bump (-x).

PR #2 (build 953)

matrix-synapse

Bridges + bridge DBs only; the base (synapse v1.155.0, pgautoupgrade 18, nginx 1.31.2, MAS) is untouched. signal v0.8.7→v0.2606.0 (calver re-versioning, already Go-based, config schema unchanged). telegram v0.15.3→v0.2606.0 is a Python→Go rewrite — BREAKING: telegram_bridge.yaml.tmpl rewritten to bridgev2, permissions renamed (relaybot→relay, user→commands, puppeting→user, full→user), relaybot removed, non-supergroup portals no longer shared. The three bridge DBs move pg13→pg14 (plain postgres — operators with data must dump/restore; PG13 is EOL). cc-ci tests deploy the base only, so the bridges are not CI-covered. GREEN at build 955.

PR #5 (build 955)

bluesky-pds

0.4.219 → 0.4.5006 (@atproto/pds 0.5.1→0.5.6). PR #3 already moved 0.4.219→0.4.5001 (index.js→index.ts, Node 20→24); this run re-pins to 0.4.5006 (account-status hardening on re-activating takendown accounts, kysely 0.22→0.29). Same image base/entrypoint, no new env vars or migration. Recipe minor bump (0.3.0→0.3.1). Clean GREEN at build 946.

PR #3 (build 946)

n8n

3.4.0+2.27.2 → 3.4.1+2.27.3. A patch on the 2.27.x beta track the recipe already follows: Form Trigger node gets a default authentication parameter to stop a crash on old workflows (#32628), and preview suggestions are hidden on small screens. No DB migrations beyond the automatic on-startup ones, no config/env changes. Clean GREEN at build 954.

PR #5 (build 954)

hedgedoc

pgautoupgrade 16-alpine → 17-alpine (conservative one-major bump; 17→18 next cycle). pgautoupgrade runs pg_upgrade automatically on next deploy — verified on the dev swarm by deploying pg16 on a fresh volume, then redeploying pg17 on the same volume: 'Upgrade to PostgreSQL 17.10 complete', schema intact. App 1.11.0 unchanged. CI tests use the sqlite backend, so the overlay bump is not CI-covered. Back up the postgres volume before deploying. Clean GREEN at build 950.

PR #3 (build 950)

custom-html-tiny

alpine/git v2.52.0 → v2.54.0 on the optional git-pull sidecar overlay (compose.git-pull.yml, replicas:0, cron-triggered). The app (static-web-server 2.43.0) is unchanged. Two minor versions of upstream git, backward-compatible for the clone/pull usage. Patch recipe bump. Clean GREEN at build 947.

PR #9 (build 947)