keycloak — 26.6.3 → 26.6.4 (patch, security-relevant)
Identity-provider patch release; the upgrade run flagged roughly 8 security fixes. Because keycloak is internet-facing, review the 26.6.4 release notes and merge promptly.
A recovered run: of 20 enrolled recipes, sixteen upgrades are !testme GREEN and merge-ready, three are up to date, and two are red — plausible (a major v2→v3 jump) and lasuite-drive. keycloak's security patch is the one to merge first; then the two failures need a real diagnosis, and discourse's five tangled PRs need reconciling. Note: the Thursday run hit a host disk-full mid-way and was recovered after reclaiming ~93 GB — now guarded by a pre-run image sweep.
| Recipe | Change | TESTS | CVEs | CI | PR | STATUS | Notes |
|---|---|---|---|---|---|---|---|
| keycloak | 26.6.3 → 26.6.4 | GREEN | 8 | build 976 ✓ | #4 | … | Identity provider patch release — the run flagged ~8 security fixes; merge first (internet-facing IdP). |
| plausible | app v2.0.0 → v3.2.1, clickhouse 23.4 → 26.6 | FAILED | none | build 968 ✗ | #5 | … | Major two-version jump incl. a ClickHouse 23→26 migration — CI RED. Needs a real migration diagnosis, not a merge. |
| lasuite-drive | collabora → 26.04.2.1.1, onlyoffice → 9.4.1.2 | FAILED | none | build 984 ✗ | #6 | … | First failure was the transient host disk-full; disk since reclaimed but the latest run is still RED — diagnose before merge. |
| discourse | redis 7.4 → 8.8-alpine (+ image/db reconcile) | FAILED | none | build 972 ✗ | #6 | … | FIVE open PRs (#1/#5/#6/#7/#8) — mirror reconcile needed; #6 redis and #7 postgres both CI-red. See addendum. |
| bluesky-pds | pds 0.4.219 → 0.4.5009 | GREEN | none | build 970 ✓ | #3 | … | PDS image bump, CI green. A second PR #4 (service-name routing fix) is also open — reconcile. |
| custom-html | nginx 1.31.1 → 1.31.2, git v2.52.0 → v2.54.0 | GREEN | none | build 969 ✓ | #5 | … | nginx patch + git sidecar bump. openssh-server stays latest-pinned (abra can't parse). Ready to merge. |
| custom-html-tiny | git v2.52.0 → v2.54.0 | GREEN | none | build 971 ✓ | #9 | … | git sidecar bump, CI green. Ready to merge. |
| ghost | app 6.47.0 → 6.50.0-alpine | GREEN | none | build 974 ✓ | #7 | … | Ghost 6.x-alpine bump. db mysql held at 8.4 (Ghost does not support mysql 9.x). Ready to merge. |
| gitea | app 1.26.2 → 1.26.4-rootless | GREEN | none | build 973 ✓ | #5 | … | Patch bump on the 1.26-rootless line. postgres 15 major bump deliberately deferred (needs migration tooling). |
| hedgedoc | db pgautoupgrade 17 → 18-alpine | GREEN | none | build 977 ✓ | #3 | … | Postgres 17→18 in-place major (pgautoupgrade) + PGDATA pinned to avoid a fresh-init data loss. Verified HTTP 200. |
| immich | server+ml v2.7.5 → v3.0.1 | GREEN | none | build 975 ✓ | #4 | … | MAJOR bump (released 2026-07-02). Tag+digest pins hand-bumped (abra can't parse them). CI green. |
| lasuite-docs | impress v5.3.0, nginx 1.31.2 | GREEN | none | build 963 ✓ | #7 | … | impress + nginx bump, CI green. Ready to merge. |
| lasuite-meet | livekit v1.13.1 → v1.13.2 | GREEN | none | build 980 ✓ | #8 | … | livekit patch bump; all other images up to date. Ready to merge. |
| mailu | all components 2024.06.52 → 2024.06.53 | GREEN | none | build 985 ✓ | #5 | … | All six mailu components, patch bump on the 2024.06 stable series. Ready to merge. |
| matrix-synapse | signal/telegram bridges + bridge DBs | GREEN | none | build 966 ✓ | #5 | … | Bridge images + their postgres sidecars bumped, CI green. Ready to merge. |
| mattermost-lts | app → 11.7.6 (ESR) | GREEN | none | build 965 ✓ | #2 | … | Mattermost 11.7.6 ESR line. CI green. Ready to merge. |
| n8n | app bump (PR #5) | GREEN | none | build 967 ✓ | #5 | … | App image bump, CI green. PR title reads 2.28.2 — confirm the intended target (survey expected 2.29.3). |
| cryptpad | on latest (2026.5.1) | UPTODATE | none | — | Up to date. | ||
| drone | — | UPTODATE | none | — | Up to date. | ||
| mumble | — | UPTODATE | none | — | Up to date. |
Addendum