Co-op Cloud Recipe CI · Weekly Edition

The Recipe Report

Week of June 29, 2026report.ci.commoninternet.net2026-06-29 02:25 UTC

A clean, quiet week: of the 20-recipe fleet, eleven upgrades are !testme GREEN and merge-ready, nine are up-to-date, and nothing in the upgrade path is RED or stale. No fresh CVE batch drove this run — last week's nginx 1.31.1 / keycloak / mailu fixes have already landed — so the table is mostly routine patch bumps. Address discourse first: it didn't upgrade (the app is frozen at bitnamilegacy 3.5.0) but it carries five open fix PRs, two of them RED. The one structural merge is mattermost-lts, jumping the LTS line from 10.11.20 to 11.7.6 (11.x ESR is now current; 10.12 is an expired innovation release); the rest are routine GREEN bumps to clear.

The full wire — every recipe, in priority order

Recipe	Change	TESTS	CVEs	CI	PR	STATUS	Notes
discourse	—	UPTODATE	none	RED 944 · #7	#7	…	No upgrade (app frozen at bitnamilegacy/discourse 3.5.0; abra misresolves a '9.0.4' to the bitnami namespace). Five open fix PRs need reconciling: #7 (discourse/postgres image, RED build 944) and #6 (redis 7.4→8.8, RED build 948) are failing; #8 (stack-prefixed hostnames), #5 (official-image switch), #1 (bitnami→bitnamilegacy re-pin) have no CI. Operator-only: redis 7.4→8.8, pgvector pg17→pg18.
mattermost-lts	10.11.20 → 11.7.6 (11.x LTS)	GREEN	none	build 965 ✓	#2	…	LTS-line jump to 11.x ESR (current LTS; 10.12 is an expired innovation release). Subagent caught and corrected the survey's '10.x LTS' mis-call. Reconcile with fix PR #1 (restore no-op fix, GREEN build 901). Operator-only: postgres 15-alpine (no pgautoupgrade).
matrix-synapse	mautrix bridges → v0.2606.0	GREEN	none	build 966 ✓	#5	…	mautrix bridges v0.2606.0 (monthly tag, unchanged since 06-22) + bridge DBs pg13→pg14. A re-test of PR #5. Further PG majors (15–18) operator-only.
bluesky-pds	pds 0.4.219 → 0.4.5009	GREEN	none	build 957 ✓	#3	…	Large jump on the ATProto PDS. Separate open routing-fix PR #4 (rename app→pds for shared-proxy caddy) has no CI yet.
lasuite-drive	collabora 25.04.9.4.1 → 25.04.10.3.1, onlyoffice 9.3.1.2 → 9.4.1.1	GREEN	none	build 964 ✓	#6	…	Collabora + OnlyOffice document-editor bumps. A previously-merged-upstream PR was closed on the mirror this run.
gitea	1.26.2-rootless → 1.26.4-rootless	GREEN	none	build 960 ✓	#5	…	Patch rollup. Separate open PR #4 (seed app.ini into a writable config volume for Gitea 1.24+) has no CI. Operator-only: postgres 15.18 (no pgautoupgrade, manual dump/restore).
ghost	6.45.0-alpine → 6.47.0-alpine	GREEN	none	build 961 ✓	#7	…	Ghost patch bump. Operator-only: mysql 8.4 (Ghost docs: MySQL 8 is the only supported DB in production; 9.x removes mysql_native_password).
n8n	2.27.2 → 2.28.2	GREEN	none	build 967 ✓	#5	…	Completed directly by the upgrader after the subagent errored. A PR-body backtick was briefly shell-evaluated, invoking an accidental `abra recipe release n8n -y` that panicked before creating any tag — no release published.
lasuite-docs	impress v5.2.1 → v5.3.0	GREEN	none	build 963 ✓	#7	…	impress v5.3.0 + nginx 1.31.2 + minio RELEASE.2025-09-07.
custom-html	nginx 1.31.1 → 1.31.2, git v2.52.0 → v2.54.0	GREEN	none	build 958 ✓	#5	…	nginx 1.31.2 is a patch on top of last week's 1.31.1 CVE batch — no new CVEs identified. alpine/git v2.54.0.
custom-html-tiny	git v2.52.0 → v2.54.0	GREEN	none	build 959 ✓	#9	…	alpine/git bump only. Stale 'regall sweep' PR #8 (build 752) lingers and can be closed.
immich	valkey 9 → 9.1.0	GREEN	none	build 962 ✓	#4	…	Cache-only valkey re-pin (digest). Postgres vectorchord left operator-only (immich v2.7.5 pins pgvectors0.2.0; app images latest stable). Stale 'regall sweep' PR #3 (build 745) lingers.
hedgedoc	—	UPTODATE	none	build 950 ✓	#3	…	Up-to-date (hedgedoc 1.11.0 latest). Open PR #3 bumps pgautoupgrade 16→17-alpine — an operator-only PG17 migration. Stale generic-suite probe PR #1 (build 608) can be closed.
mailu	—	UPTODATE	none	build 483 ✓	#3	…	Up-to-date (all images 2024.06.52, redis 8.8.0, traefik-certs-dumper v2.11.4). Open feature PR #3 adds backupbot v2 backup labels — not an upgrade, awaiting review.
mumble	—	UPTODATE	none	build 732 ✓	#1	…	Up-to-date (mumble-server v1.6.870-0, mumble-web 0.5). Stale 'cfold sweep probe' PR #1 lingers and can be closed.
cryptpad	—	UPTODATE	none				Up-to-date — cryptpad version-2026.5.1 newest (abra can't parse the 'version-' prefix; direct Docker Hub check confirms); nginx 1.31 current.
drone	—	UPTODATE	none				Up-to-date — drone/drone:2.28.2 latest (default branch master).
keycloak	—	UPTODATE	none				Up-to-date — keycloak 26.6.3 + mariadb 12.3 both latest. Last week's 16-CVE security PR #3 is no longer open (landed/closed).
lasuite-meet	—	UPTODATE	none				Up-to-date — meet v1.21.0, livekit-server v1.13.1, nginx 1.31.2, redis 8.8.0, pgautoupgrade 18-debian all current.
plausible	—	UPTODATE	none				Up-to-date — plausible/analytics v2.0.0 latest. Operator-only: clickhouse 23.4.2.11→26.5.3 (3-major jump; plausible pins a compat-specific clickhouse). Last week's two RED PRs are no longer open.

Addendum

discourse carries five open fix/migration PRs with no upgrade this week (the app is frozen at bitnamilegacy/discourse 3.5.0). Two are RED — #7 (switch to the discourse/postgres image, build 944) and #6 (redis 7.4→8.8, build 948) — and three (#8 stack-prefixed hostnames, #5 official-image switch, #1 bitnami→bitnamilegacy re-pin) have no CI verdict. The pile needs reconciling: decide which lands and re-test the RED ones.
mattermost-lts's LTS-line detection was wrong in this run's survey: it reported '10.x LTS / target 10.12.4', but 11.7 ESR is the current LTS line and 10.12 is an expired innovation release. The subagent caught and corrected it (refreshing PR #2 to 11.7.6), but the survey's LTS-line resolver is worth fixing so it doesn't recommend an expired line again.
Run mechanics: 3 of 11 subagents (custom-html, gitea, n8n) returned no RESULT line (crashed/errored) and were completed directly by the upgrader — the upgrades are fine, but the subagent crash rate is worth a look.
n8n quoting incident: while completing n8n directly, a PR-body backtick was briefly shell-evaluated via broken quoting, invoking `abra recipe release n8n -y`. It panicked in addReleaseNotes BEFORE creating any tag — verified no new tags exist (latest still 3.4.0+2.27.2). No release was published, but the guardrail held by accident of the panic; the PR body is now passed via a file to avoid shell evaluation. Worth hardening so a release command can't be triggered by interpolated PR text.
Leftover non-upgrade PRs that can be closed: 'regall sweep' PRs custom-html-tiny #8 (build 752), ghost #6 (build 744), immich #3 (build 745), lasuite-drive #3 (build 749); and stale probe PRs hedgedoc #1 (generic-suite probe, build 608) and mumble #1 (cfold sweep probe, build 732). All green, none are upgrades.
mailu is up-to-date but carries an open feature PR #3 (backupbot v2 backup labels, GREEN build 483) that isn't an upgrade — it's a real backup-coverage change awaiting operator review.
No per-recipe upgrade notes were written for this run (the {recipe}-upgrade-2026-06-29.md files are absent; latest are 2026-06-26), so this report's CVE analysis leans on the summary and version-bump knowledge rather than the subagents' breaking-change/CVE writeups. No specific CVEs were identified this week; if any of these patch bumps (gitea 1.26.2→1.26.4, nginx 1.31.2, ghost 6.47) carry security fixes, the missing notes are why they're not flagged — worth restoring the per-recipe notes pipeline.

What changed

discourse

No upgrade this week — the app is frozen at bitnamilegacy/discourse 3.5.0 (abra misresolves a '9.0.4' to the bitnami namespace, not a real tag). But five open fix/migration PRs need reconciling: #7 (switch to the discourse/postgres image, RED build 944), #6 (redis 7.4→8.8, RED build 948), #8 (stack-prefixed hostnames for redis/db), #5 (switch to the official discourse/discourse image, experimental), #1 (bitnami→bitnamilegacy re-pin). Operator-only majors: redis 7.4→8.8, pgvector pg17→pg18.

PR #7 (build 944 RED) · PR #6 (build 948 RED)

mattermost-lts

10.11.20 → 11.7.6 — a LTS-line jump to 11.x ESR (the current LTS; 10.12 is an expired innovation release). The subagent caught and corrected the survey's '10.x LTS' mis-call and refreshed PR #2 to the 11.7.6 patch (shipped 2026-06-25). Reconcile with fix PR #1 (restore no-op fix, GREEN build 901). Operator-only: postgres 15-alpine (no pgautoupgrade).

PR #2 (build 965)

matrix-synapse

mautrix bridges → v0.2606.0 (the monthly tag, unchanged since 06-22) + bridge DBs pg13→pg14. A re-test of PR #5, GREEN build 966. Further PG majors (15/16/17/18) are operator-only.

PR #5 (build 966)

bluesky-pds

pds 0.4.219 → 0.4.5009 — a large jump on the ATProto PDS. GREEN build 957. A separate open routing-fix PR #4 (rename app→pds so caddy resolves this stack on a shared proxy) has no CI yet.

PR #3 (build 957)

lasuite-drive

collabora 25.04.9.4.1 → 25.04.10.3.1, onlyoffice 9.3.1.2 → 9.4.1.1. GREEN build 964. A previously-merged-upstream PR was closed on the mirror this run.

PR #6 (build 964)

gitea

1.26.2-rootless → 1.26.4-rootless, a patch rollup. GREEN build 960. A separate open PR #4 (seed app.ini into a writable config volume for Gitea 1.24+) has no CI. Operator-only: postgres 15.18 (no pgautoupgrade, manual dump/restore).

PR #5 (build 960)

ghost

6.45.0-alpine → 6.47.0-alpine. GREEN build 961. Operator-only: mysql 8.4 (Ghost docs: MySQL 8 is the only supported DB in production; 9.x removes mysql_native_password).

PR #7 (build 961)

n8n

2.27.2 → 2.28.2. GREEN build 967. Completed directly by the upgrader after the subagent errored; a PR-body backtick was briefly shell-evaluated, invoking an accidental `abra recipe release n8n -y` that panicked before creating any tag — no release was published.

PR #5 (build 967)

lasuite-docs

impress v5.2.1 → v5.3.0 + nginx 1.31.2 + minio RELEASE.2025-09-07. GREEN build 963.

PR #7 (build 963)

custom-html

nginx 1.31.1 → 1.31.2 (a patch on top of last week's 1.31.1 CVE batch — no new CVEs identified) + alpine/git v2.52.0 → v2.54.0. GREEN build 958.

PR #5 (build 958)

custom-html-tiny

alpine/git v2.52.0 → v2.54.0. GREEN build 959. Stale 'regall sweep' PR #8 (build 752) lingers and can be closed.

PR #9 (build 959)

immich

valkey 9 → 9.1.0 — cache only, digest re-pinned. GREEN build 962. The postgres vectorchord image was left operator-only (immich v2.7.5 pins pgvectors0.2.0; app images are latest stable, v3.0.0-rc.x are prereleases). Stale 'regall sweep' PR #3 (build 745) lingers.

PR #4 (build 962)

hedgedoc

Up-to-date (hedgedoc 1.11.0 latest). Open PR #3 bumps pgautoupgrade 16-alpine → 17-alpine (GREEN build 950) — an operator-only PG17 cluster migration. Stale generic-suite probe PR #1 (build 608) can be closed.

PR #3 (build 950)

mailu

Up-to-date (all mailu images 2024.06.52, redis 8.8.0-alpine, traefik-certs-dumper v2.11.4 current). Open feature PR #3 adds backupbot v2 backup labels (admin sqlite /data + imap mail /mail, GREEN build 483) — a real backup-coverage change, not an upgrade, awaiting review.

PR #3 (build 483)