A clean run: all ten upgrade targets — gitea's line-jump to the new 28.0.0 stable included — passed their lifecycle tiers on the first `!testme` attempt, with zero genuine failures; the only reds are CI-infrastructure, not the upgrades (gitea's stale LFS test, and lasuite-docs' week-3 dead-minio base). The merge list is topped by keycloak (21 security fixes, a floor) and lasuite-meet (critical PyJWT CVE), with ghost's crafted-image heap overflow close behind.
| Recipe | Change | TESTS | CVEs | CI | PR | STATUS | Notes |
|---|
| keycloak | 26.7.4 → 26.8.0 | GREEN | 21 | build 25 ✓ | #11 | … | Identity provider — 26.8.0 Security-fixes section names jarckson-databind + netty CVEs; deterministic scan counts 16 (floor, advisories lack version data), union 21. mariadb 13.0 major declined. Release -y after merge. |
| lasuite-meet | v1.31.0 → v1.33.0 · redis 8.10.2 | GREEN | 11 | build 27 ✓ | #11 | … | Includes CRITICAL CVE-2026-102268 (PyJWT) + 5 high PyJWT CVE-2026-10226x, plus the v1.32.x DRF/libssl/libexpat fixes. Release -y after merge. |
| gitea | 1.27.3-rootless → 28.0.0-rootless | STALE | 1 | RED 31 · stale test | #10 | … | NEW upstream 28.0.0 stable line (2026-09-29). ≥1 CVE (critical CVE-2026-73802, GHSA-x4q3-gcj3-m6cf) — count is a floor (GHSA API rate-limited). All lifecycle tiers GREEN; only the fixed-timeout LFS restart-poll test times out on the 28.x restart. Operator: re-run with --with-tests, then merge. |
| discourse | 2026.7.3 (carried from 09-21) | GREEN | 8 | build 15 ✓ · carried | #11 | … | No new target this week — last week's 8-CVE (2 high) jump to 2026.7.3 is still open and merge-ready. Nothing re-ran; nothing changed. |
| mattermost-lts | 11.7.11 ESR (carried) | GREEN | 14 | build 7 ✓ · carried | #2 | … | ESR target unchanged (main's 10.11 patch line EOL; 14 CVEs is a floor, all medium). Awaiting merge, then release -x. |
| ghost | 6.65.0-alpine → 6.67.0-alpine | GREEN | 1 | build 24 ✓ | #7 | … | High CVSS 8.8 heap overflow via crafted image uploads (CVE-2026-84383, GHSA-cr6m-qrr6-q3j8); 6.66.0 never hit npm, fully contained in 6.67.0. mysql held 8.4. Release -y after merge. |
| mailu | 2024.06.58 → 2024.06.61 · redis 8.10.2 | GREEN | 1 | build 28 ✓ | #8 | … | High CVE-2024-49767: admin DoS halts all IMAP/POP3/SMTP auth (internet-facing). Roundcube 1.6.18; still-unknown roundcube CVEs likely superseded by it. Release -z. |
| lasuite-docs | v5.6.1 → v5.7.0 · nginx 1.31.6 · docspec 1.21.4 | FAILED | 1 | RED 26 · base prepull | #9 | … | Week 3 of the same EXTERNAL blocker — not the upgrade, not a test: the warm canonical base (0.4.0+v5.4.1) still pins the removed docker.io minio. Tree live-verified 9/9 green at v5.7.0 via --chaos. Operator: rebuild the warm canonical (comment 16130). |
| matrix-synapse | synapse v1.161.0 → v1.162.0 · MAS 1.26.0 | GREEN | none | build 29 ✓ | #7 | … | Patches only; room version 12 default (new rooms only); MAS rustls RUSTSEC-2026-0285. mautrix/signal downgrade-in-disguise declined again; bridge DBs held pg13. Release -y. |
| bluesky-pds | 0.4.5027 → 0.4.5036 | GREEN | none | build 23 ✓ | #5 | … | All-patch window (@atproto/pds 0.5.27→0.5.36: email 2FA, safeFetch proxying, pagination speedups); scan clean. Unrelated routing-fix PR #4 still open/pending. |
| immich | v3.2.2 → v3.2.4 | GREEN | none | build 30 ✓ | #6 | … | Memory-leak dependency patch; hardened ImageMagick policy in base image; valkey/postgres pins unchanged (v3.3.0-rc correctly not taken). Scan 0, all sources succeeded. Release -z. |
| n8n | 2.40.5 → 2.42.2 | GREEN | ? | build 32 ✓ | #9 | … | Comments/bugfix window. cve is '?' — GH Security-Advisories sources rate-limited, count incomplete; own release-note read found no CVEs named in 2.41/2.42. Release -y. Caught in a follow-up pass after the initial worklist missed it. |
| lasuite-drive | v0.23.0 · collabora 26.04 (carried) | GREEN | 4 | build 18 ✓ · carried | #8 | … | Last week's install-tier RED is now green on the re-run; the redis SECURITY + collabora-major PR sits merge-ready — but the recipe was dropped from this week's summary entirely (see Addendum). |
| custom-html-tiny | app 2.44.0 / git v2.54.0 (carried) | GREEN | none | build 1159 ✓ · awaiting merge | #9 | … | Up-to-date; unchanged PR #9 awaits upstream merge. |
| wordpress | 7.0.4 → 7.1.0 (carried) | GREEN | none | build 1375 ✓ · awaiting merge | #1 | … | Up-to-date (app 7.1.2 latest); survey notes the pre-existing unparseable sftp label. PR #1 awaiting operator review. |
| hedgedoc | pg 16-alpine → 18-alpine (carried) | GREEN | none | build 1365 ✓ · carried | #3 | … | No new target this week; the PG18 data-dir move PR has been green and awaiting operator review since 09-18. |
| plausible | clickhouse 23.4.6.25 (external) | UPTODATE | none | build 1286 ✓ · carried | #5 | … | External to the weekly set (not upgraded/assessed); its open clickhouse patch PR sits green. Listed for PR-visibility only. |
| custom-html | — | SKIPPED | none | | | | Up-to-date at nginx 1.31.6 — but abra FATA'd on the tag+digest pin; a direct check confirmed 1.31.6 is the newest plain tag and the digest matches. (Same tooling gap family that has dropped recipes before.) |
| cryptpad | — | UPTODATE | none | | | | Up-to-date — version-2026.5.1 is the newest version-* tag. |
| drone | — | UPTODATE | none | | | | Up-to-date. |
| mumble | — | UPTODATE | none | | | | Up-to-date — v1.6.870 server, mumble-web 0.5. |
Security Bulletin
🔒 Critical CVE upgrades
keycloak 26.8.0 — 21 security fixes on the identity provider (floor; jackson-databind + netty named) ·
keycloak 26.7.4 → 26.8.0 is a security-heavy minor: the release's Security-fixes section explicitly names CVE-2026-12388, CVE-2026-14781, CVE-2026-19608, CVE-2026-54515, CVE-2026-59889 (jackson-databind) and CVE-2026-59903 (netty-codec-http), on top of the 16 additional advisories the deterministic scan counted by version range. Since 53 vendor-page advisories lack structured version data, treat 21 as a floor — the union of evidence so far, not a proven-complete count. As an identity provider fronting other services this is the week's highest-value merge. Also note brute-force/login-failure data now persists in the database by default (in-memory store deprecated). !testme GREEN at build 25.
gitea 28.0.0 — critical SSH/crypto fix, count is a floor · plus a stale test keeping the PR red
The jump to the new 28.0.0 stable line (first 2-digit release, 2026-09-29) fixes ≥1 CVE: critical CVE-2026-73802 (GHSA-x4q3-gcj3-m6cf), plus security-class fixes for invalid/duplicate git-object rejection, SSH fingerprint keys, a fork-PR approval gate, a golang.org/x/crypto SSH DoS (#39219) and repo-scoped authorization — the GitHub-advisories API was rate-limited from the scan host, so the count is a floor, not 'none'. The recipe itself is green on every lifecycle tier (run 31); the only red is the cc-ci custom LFS test's hard-coded 20s restart poll, which times out on the slower 28.x restart (GREEN on the 1.27.3 base — a stale test, not a recipe regression). Operators: re-run
gitea with --with-tests to refresh that test, then merge; default recipe config is unaffected by the BREAKING git-egress rework.
ghost 6.67.0-alpine — crafted-image heap overflow CVE-2026-84383 (high, CVSS 8.8) ·
ghost Ghost 6.65.0 → 6.67.0 closes CVE-2026-84383 / GHSA-cr6m-qrr6-q3j8: a heap-based buffer overflow reachable by any staff user (incl. Contributors) uploading a crafted image to the bundled image library — crash and possible code execution. Affected ranges: ≥6.46.0 <6.67.0. 6.66.0 is moot (never published to npm; fully contained in 6.67.0). No config or migration steps; mysql held at 8.4. !testme GREEN at build 24.
v1.31.0 → v1.33.0 carries the v1.32.x security line (critical CVE-2026-63072/63073 in libssl, CVE-2026-73228/73229 in DRF, CVE-2026-93990 in libexpat) and, in v1.33.0, PyJWT 2.13.0 → 2.14.0 closing critical CVE-2026-102268 and five high CVE-2026-10226x siblings — finding the PyJWT set needed a CHANGELOG read since v1.33.0 is a tag-only release. redis patched to 8.10.2 on the cache sidecar. No operator action (purge_inactive_rooms off unless configured; new migration auto-runs). !testme GREEN at build 27.
mailu 2024.06.61 — admin DoS CVE-2024-49767 (high) · internet-facing
mailu 2024.06.58 → 2024.06.61 fixes CVE-2024-49767 (GHSA-53v4-wgj8-wpvp, high): a
mailu admin DoS that halts all IMAP/POP3/SMTP authentication — on an internet-facing mail host that means the whole mail service stops accepting logins until the admin restarts. Also rolls up roundcube → 1.6.18 (which likely supersedes the still-unknown roundcube CVEs from the scan), three boolean-setting fixes, and the redis 8.10.2 transaction-ACL hardening. No migrations; !testme GREEN at build 28.
nginx 1.31.5 → 1.31.6 closes CVE-2026-90439, a high-severity HTTP/3 heap-buffer-overflow. It ships this week inside
lasuite-docs PR #9 — which is green-live but CI-blocked before tests on the dead-minio canonical base, so operators should treat that PR's merge as the delivery path. Note CVE-2026-54515 (jackson-databind) and CVE-2026-59903 (netty) in
keycloak's batch are dependency-level but land in the same
keycloak bump listed above.
custom-html already runs 1.31.6.
26.7.4 → 26.8.0. Security-fix minor: 21 fixes (union, floor) spanning the release's named Security-fixes CVEs (jackson-databind, netty-codec-http, plus 15 more range-matched). Operator notes: brute-force/login-failure data now persists in the DB by default (single-node unaffected); KEYCLOAK_ADMIN* env vars deprecated → KC_BOOTSTRAP_ADMIN*; hostname-v1 proxy options still functional. mariadb 13.0 major declined; realm schema upgraded automatically. Release `-y` (expect 10.10.0+26.8.0).
6.65.0-alpine → 6.67.0-alpine. Security fix CVE-2026-84383 (crafted-image heap overflow) plus 6.66/6.67 feature/bugfix batch (integration-create with keyboard submit, post-history crash, Stripe portal retries). 6.66.0 was never published to npm — 6.67.0 contains it all. mysql held 8.4 (Ghost supports MySQL 8 only; 9.x/26.x declined). Release `-y`.
0.4.5027 → 0.4.5036 (@atproto/pds 0.5.27 → 0.5.36), all non-breaking patches: email-based 2FA for sign-in, outbound proxying via safeFetch with a decoded-response size bound, x-atproto-* header forwarding, InvalidRequest for taken/deactivated handles. Health endpoint unchanged; no config changes. Release `-z`. Unrelated routing-fix PR #4 remains open.
v3.2.2 → v3.2.4 (server + machine-learning only): a memory-leak dependency fix landed as v3.2.4; the base-image bump ships a hardened ImageMagick security policy (decode-time cap, scripting/network/file-disclosure coders denied) and restores curl for the healthcheck. valkey 9.1.1 and the vectorchord postgres digest verified unchanged against v3.2.4's own compose. v3.3.0-rc correctly not taken. Checkout healed again pre-run (stale local main reset). Release `-z`.
2.40.5 → 2.42.2 (spans 2.41.x and 2.42.x; features + bugfixes only). TypeORM migrations auto-run — verified live, 'Recorded version change: 2.40.5 -> 2.42.2', healthz/editor clean. No compose/env changes; sqlite default path unaffected. Release `-y`. Note: this bump was missed in the initial worklist and processed in a follow-up pass before the summary closed.