Co-op Cloud Recipe CI · Weekly Edition
The Recipe Report
Week of October 9, 2026report.ci.autonomic.zone2026-10-09 03:42 UTC
A green sweep and a clearing ledger: all nine upgrades of the week went !testme GREEN on their first run — no failures, no stale tests, zero retry spend — while last week's heavy security queue landed upstream in the background (keycloak's 21-fix 26.8.0, mailu's DoS-fixing 2024.06.61, discourse 2026.7.3, ghost 6.67.0). Address lasuite-meet first: its week-old PR still carries the critical PyJWT CVE-2026-102268 batch (11 CVEs) and now adds meet v1.34.0 + livekit v1.13.9; then gitea's nine-CVE 28.1.0 and mattermost-lts's 31-CVE ESR jump. The only red on the board is lasuite-docs — a fourth week blocked on the operator's warm-canonical minio rebuild, which also gates the last un-landed nginx 1.31.6 fix.
The full wire — every recipe, in priority order
| Recipe | Change | TESTS | CVEs | CI | PR | STATUS | Notes |
|---|
| lasuite-meet | v1.31.0 → v1.34.0 · livekit v1.13.9 · redis 8.10.2 | GREEN | 11 | build 46 ✓ | #11 | … | Meet monorepo + livekit: v1.34.0 (signed-out visitors can start meetings, link throttling, daily room-creation cap), livekit 1.13.9 (deliberate — reverts 1.13.8's egress-start regression), redis 8.10.2. Still carries the critical PyJWT CVE-2026-102268 batch (11 CVEs incl. 5 high) from the v1.32/v1.33 window — the fleet's top merge. No operator action (removed BREVO_/RECORDING_ENCODING_ envs unset here). |
| gitea | 28.0.0-rootless → 28.1.0-rootless | GREEN | 9 | build 43 ✓ | #10 | … | Forge: 28.1.0 (first maintenance release of the 28 line) closes 9 CVEs — 3 high (CVE-2026-86684, -96594, -97208) + 6 medium, GHSAs on the PR. PR #10 was closed upstream-side (content landed via release 3.6.8), then reopened + re-pointed at main; last week's stale LFS test is green again now that the cc-ci fix is live on the runner. Reconcile with app.ini-writable fix PR #4 (green since build 1250). |
| mattermost-lts | 10.11.22 → 11.7.12 (ESR) | GREEN | 31 | build 47 ✓ | #2 | … | ESR adjudication held: 11.11.x is innovation (lts:false, EOL 2026-12-15) — correctly declined; 11.7.12 (2026-10-08) is the newest ESR patch. Whole 10.11.22→11.7.12 window = 31 CVEs (1 high CVE-2026-8821 + 30 medium), while main still pins the EOL'd 10.11.22. 10→11 migrations verified live with seeded-user survival; postgres held 15-alpine. Reconcile with restore-fix PR #1. |
| lasuite-drive | v0.23.0 · collabora 26.04.4.2.1 · redis 8.10.2 (carried) | GREEN | 4 | build 18 ✓ · carried | #8 | … | Redis SECURITY patch (8.10.2 — no CVE ids published) + collabora 25.04→26.04 major (CVE-2026-77276 high + 3 medium; entrypoint migration, admin panel locked until COLLABORA_ADMIN_PASSWORD set). Green since last week cleared the 09-21 install-tier RED — the longest-waiting green security PR on the board. |
| lasuite-docs | v5.6.1 → v5.7.0 (carried) | FAILED | 1 | RED 26 · base prepull | #9 | … | Week 4 of the same external blocker: the warm-canonical base pins the removed docker.io minio, so CI dies before any test. Tree is live-verified green (9/9 at v5.7.0) and carries the nginx 1.31.6 HTTP/3 fix (CVE-2026-90439) — the only un-landed path for it. Operator: rebuild the warm canonical, then merge + release 0.5.0+v5.7.0. |
| wordpress | 7.1.2 → 7.1.3 | GREEN | 7 | build 49 ✓ | #1 | … | Maintenance + security release (2026-10-06): 7 security fixes — unauthenticated disclosure of comments on private/unpublished posts (CVE-2026-66666, CVSS 6.9), stored XSS on the pending-Comments admin page, second-order SQLi in the WXR export, DoS in WP_Http::make_absolute_url() — plus 4 bug fixes. PR #1 found stale at 7.1.0, fast-forwarded onto main + bumped; mariadb held 13.0. |
| immich | v3.2.2 → v3.3.1 | GREEN | none | build 45 ✓ | #6 | … | Feature release (people sharing/cluster groups, birthday memories, OAuth claims synced every login, PP-OCRv6 OCR); v3.3.1 patches the people-sharing bugs; migrations auto-ran live. valkey re-pinned to immich's tested 9.1.2 (CVE-2026-25243 still unjudged — vendor page lacks fix versions); DB digest unchanged. Release -y after merge. |
| ghost | 6.67.0-alpine → 6.69.0-alpine | GREEN | none | build 44 ✓ | #8 | … | Fresh PR #8 after #7 closed upstream-side — its 6.67.0 content (incl. the CVE-2026-84383 heap-overflow fix) landed via the 1.5.1 release publish. 6.68/6.69: member location maps, React posts list, automation analytics, self-serve site exports; no breaking changes, no migrations. mysql held 8.4 (Ghost supports MySQL 8 only). |
| bluesky-pds | 0.4.5027 → 0.4.5037 | GREEN | none | build 41 ✓ | #5 | … | All-patch window (@atproto/pds 0.5.27 → 0.5.37): since/startCursor pagination on getTimeline/getListFeed, actor-store resource management, rejection of MSTs referencing the same node twice. No config/env changes; health endpoint unchanged. Release -z after merge. Unrelated routing-fix PR #4 still open/pending beside it. |
| custom-html-tiny | app 2.43.0 → 2.44.1 · git v2.54.0 | GREEN | none | build 42 ✓ | #9 | … | static-web-server 2.44.1: security improvements in metrics + directory-listing download (upstream CVE details not yet published — 0 identified so far), file-type cache-header fixes, Accept-Encoding quality-value rounding, nested {**} glob captures, RUSTSEC-2025-0052 dep update. git sidecar already at v2.54.0 on the PR. Release -y after merge. |
| n8n | 2.40.5 → 2.43.2 | GREEN | none | build 48 ✓ | #9 | … | 2.43 feature line: agent guardrails + persisted budget spend, resumable executions, inbound-auth-core module (its TypeORM migration verified clean on boot live), durable Cron scheduler, ~90 fixes. No env renames. Last week's '?' resolved: the full-window scan (2.40.5→2.43.2, all sources reachable) finds 0. 2.43.x is marked pre-release upstream (standing newest-tag precedent). Release -y after merge. |
| matrix-synapse | v1.162.0 · MAS 1.26.0 (carried) | GREEN | none | build 29 ✓ · carried | #7 | … | Patches only; room version 12 default applies to new rooms; MAS rustls RUSTSEC-2026-0285. The mautrix/signal 'upgrade' declined again as a downgrade-in-disguise; bridge DBs held pg13. Awaiting merge, then release -y. |
| hedgedoc | pg 16-alpine → 18-alpine (carried) | GREEN | none | build 1365 ✓ · carried | #3 | … | PG18 data-dir move (volume mount to /var/lib/postgresql included), live-verified with byte-identical data. Green and awaiting operator review since 09-18. |
| mailu | — | UPTODATE | none | build 483 ✓ · backup PR | #3 | … | Up-to-date: 2024.06.61 landed upstream via this week's mirror sync (last week's CVE-2024-49767 admin-DoS fix included) — the upgrade PR closed as merged-upstream. Backupbot-v2 labels PR #3 (admin sqlite /data + imap mail /mail) still open, green — worth landing so mail data joins the backup regime. |
| plausible | — | UPTODATE | none | build 1286 ✓ · carried | #5 | … | External to the weekly set (per used-recipes.md — not upgraded/assessed); its clickhouse 23.4 LTS-patch PR sits green for the owner's review. Listed for PR-visibility only. |
| keycloak | — | UPTODATE | none | | | | Up-to-date: 26.8.0 — last week's 21-fix security batch (jackson-databind/netty named) — landed upstream and is in main now; the upgrade PR closed as merged-upstream. Nothing to action. |
| discourse | — | UPTODATE | none | | | | Up-to-date: 2026.7.3 (last week's 8-CVE, 2-high security jump) landed upstream via the mirror sync; main pins 2026.7.3 + redis 8.10-alpine. Nothing to action. |
| custom-html | — | SKIPPED | none | | | | Up-to-date at nginx 1.31.6 — but abra FATAs on the tag+digest pin (standing tooling gap); a direct Hub check confirmed 1.31.6 is the newest plain tag. Dropped from abra's view, not from the fleet (see Addendum). |
| cryptpad | — | UPTODATE | none | | | | Up-to-date — version-2026.5.1 is the newest version-* tag; nginx 1.31 latest. |
| drone | — | UPTODATE | none | | | | Up-to-date — 2.28.2 latest. |
| mumble | — | UPTODATE | none | | | | Up-to-date — v1.6.870-0 server, mumble-web 0.5. |
Addendum
- lasuite-docs hits week 4 of the same external blocker: the upgrade PR is live-verified green but !testme dies before any test because the warm-canonical base (0.4.0+v5.4.1) pins the removed docker.io minio. This needs an operator canonical rebuild, not recipe work — and it also gates the last un-landed delivery of the nginx 1.31.6 HTTP/3 fix (CVE-2026-90439). Merge + release 0.5.0+v5.7.0 retires the whole saga.
- Three recipes hold two open PRs each to reconcile: gitea (#10 upgrade, reopened + re-pointed, and #4 app.ini-writable-volume fix, green since build 1250), mattermost-lts (#2 upgrade and #1 pg-restore fix, green since build 901), and bluesky-pds (#5 upgrade and #4 shared-proxy routing fix, CI pending since before 09-21). Decide what lands in what order.
- PR-lifecycle churn from upstream-side closes worth watching when a green PR vanishes: gitea #10 was closed (not merged) 15 minutes after its second GREEN run once its content landed upstream via release 3.6.8 — it then needed manual reopening + re-pointing at the upstream tip to carry the 28.1.0 bump; ghost #7 closed the same way (fresh #8 carries 6.69.0); wordpress #1 sat stale at 7.1.0 behind a main that had moved to 7.1.2 until it was fast-forwarded + bumped to 7.1.3.
- A CI-adjacent oddity on the reopened gitea PR: Gitea served its cached patch (still showing the old 1.27.3→28.0.0 diff) until a no-op push forced a recompute — expect stale diffs on any re-pointed branch until pushed.
- immich's survey needed a second attempt — Docker Hub/ghcr returned 429 (rate-limit) on the first enumeration at survey time. The retry + direct ghcr check handled it cleanly, but a rate-limited survey window can silently starve a recipe of its upgrade check.
- custom-html remains invisible to abra (FATA on the nginx tag+digest pin) — up-to-date by direct Hub check again this week, but the tooling gap keeps it out of every abra-driven check (the same family that has silently dropped recipes before).
- recipe-maintainer PR #1 (a WIP 'Rename Claude sandbox to Assistant' probe, CI pending) still lingers — it is not part of the weekly fleet; close or action it.
Security Bulletin
🔒 Critical CVE upgrades
lasuite-meet v1.34.0 — critical PyJWT CVE-2026-102268 + 5 high siblings (11 total) · still un-merged
PR #11's cumulative window (v1.31.0 → v1.34.0) carries the v1.32.x security line — critical CVE-2026-63072/63073 in libssl, CVE-2026-73228/73229 in DRF, CVE-2026-93990 in libexpat — plus v1.33.0's PyJWT 2.13.0 → 2.14.0 closing critical CVE-2026-102268 and five high CVE-2026-10226x siblings. This week's v1.34.0 increment adds no new CVEs (scan clean, all sources reached), but the critical batch has now been sitting un-merged for a week — the fleet's top merge. No operator action on the v1.34.0 changes themselves (removed BREVO_/RECORDING_ENCODING_ envs are unset here). !testme GREEN at build 46.
gitea 28.1.0 — nine CVEs on the forge, three high (GHSA-backed) ·
gitea 28.0.0 → 28.1.0 (first maintenance release of the 28 line, 2026-10-06) closes 9 CVEs: high CVE-2026-86684 (GHSA-7v5j-mph8-9w6g), CVE-2026-96594 (GHSA-94rx-fqm6-q23v), CVE-2026-97208 (GHSA-8hhh-mqpg-jpxc), plus six medium (CVE-2026-101023, -104633, -105267, -105268, -89182, -97626) — matching the vendor blog exactly (the one undetermined case, CVE-2026-62925, was adjudicated as already fixed in 1.27.3, outside this window). No breaking changes; the recipe sets none of the affected egress/DB config. The PR itself took a journey — closed upstream-side once its 28.0.0 content landed, then reopened and re-pointed — and last week's stale LFS test is green again now that the cc-ci fix is live. !testme GREEN at build 43, all tiers incl. test_lfs_roundtrip.
The PR's whole 10.11.22 → 11.7.12 window fixes 31 CVEs — high CVE-2026-8821 plus thirty medium (NVD-mapped, all fixed in 11.7.x/11.8.x lines). Meanwhile upstream main still pins 10.11.22, on the 10.11 ESR line that ended 2026-08-15 — unsupported. The ESR adjudication held this week: 11.11.x is innovation (lts:false, EOL 2026-12-15) and was deliberately not taken; 11.7.12 is the 2026-10-08 ESR patch. The 10→11 schema migrations were verified live with a seeded admin user surviving (same id/roles, login 200). Back up before applying — the PR ships the pg_backup.sh hooks that fix the previously-silent no-op restore. !testme GREEN at build 47.
lasuite-drive — collabora CVE-2026-77276 (high) + 3 medium, redis 8.10.2 SECURITY · green and waiting since 09-21
PR #8 moves collabora/code 25.04.10.3.1 → 26.04.4.2.1, closing CVE-2026-77276 (high, GHSA-cf9v-hrj7-8p4v) plus CVE-2025-66208, CVE-2026-46499 and CVE-2026-48164 (medium) — all four affect the pinned 25.04 image — and patches redis 8.10.1 → 8.10.2 (SECURITY release: transaction ACL-revocation bypass, unauthenticated cluster-bus join; no CVE ids published). The 26.04 image ships no shell, so the entrypoint migrates and the Collabora admin panel stays locked until COLLABORA_ADMIN_PASSWORD is set. The install-tier RED from 09-21 was cleared last week; the PR has been green and merge-ready since — the longest wait on a high-CVE fix on the board.
lasuite-docs — nginx 1.31.6 CVE-2026-90439 (high, HTTP/3 heap overflow) · delivery blocked a 4th week
nginx 1.31.5 → 1.31.6 closes CVE-2026-90439, a high-severity HTTP/3 heap-buffer-overflow. Upstream
lasuite-docs main still pins 1.31.5, and the only delivery path — PR #9 (v5.7.0 quartet + nginx 1.31.6) — is deterministically RED before any test because the warm-canonical CI base pins the removed docker.io minio image. The tree itself is live-verified green. This needs the operator's canonical rebuild (from the PR head or the bitnamilegacy pin), then merge + release 0.5.0+v5.7.0. Every other nginx fronting recipe already runs 1.31.6 (
custom-html,
cryptpad,
lasuite-meet main,
lasuite-drive).
wordpress 7.1.3 — security release: 7 fixes, CVE-2026-66666 named (medium, CVSS 6.9) · internet-facing
7.1.2 → 7.1.3 (2026-10-06) is a maintenance-and-security release with 7 security fixes: unauthenticated disclosure of comments on private & unpublished posts (CVE-2026-66666, CVSS 6.9 — the only one with a published id so far; the deterministic scan could not version-map the WordPress core advisories, so its 0 is a floor), stored XSS on the pending-Comments admin page, second-order SQL injection in the WXR export, DoS in WP_Http::make_absolute_url(), author-role users could make posts sticky, XSS via Imgur embeds, and forgeable {status}_{type} hook params. No migrations, no config changes. !testme GREEN at build 49.
What changed
v1.31.0 → v1.34.0 (+ livekit v1.13.7 → v1.13.9, redis 8.10.2). v1.34.0: signed-out visitors can start a meeting, meeting-link generation throttled, daily cap on room creation, allow_unregistered_rooms exposed to the frontend; marketing moved to django-lasuite (removed BREVO_* envs — unset in this recipe; the new dummy backend is a no-op and signup-to-marketing now runs as an async Celery task — a worker is present); recording encoding replaced by a resolution/profile model (removed RECORDING_ENCODING_* envs — unset here; shipped defaults match LiveKit's H264_720P_30 preset, so output is unchanged where nothing was tuned). livekit 1.13.9 is chosen deliberately over 1.13.8, which introduced an egress start-failure regression that 1.13.9 reverts. Migration core.0024_room_last_started_at auto-runs. Release -y after merge.
28.0.0-rootless → 28.1.0-rootless (first maintenance release of the 28 line, 2026-10-06). No breaking changes; behaviour notes: MySQL/MariaDB sessions move to READ COMMITTED, and git egress reclassifies private/link-local/CGNAT/doc ranges as restricted — this recipe sets none of the affected config, so no operator action. Fixes 9 CVEs (3 high, 6 medium — GHSA ids on the PR). The PR rode a twist: #10 was closed upstream-side once its content landed via the 3.6.8+28.0.0 release, then reopened, fast-forwarded onto main and re-pointed, so the diff is now exactly the one-line 28.0.0 → 28.1.0 bump. Last week's stale LFS-roundtrip test is green again now that the cc-ci fix (120 s deadline) is live on the runner. Release -y after merge; app.ini-writable fix PR #4 (green since build 1250) still open beside it.
10.11.22 → 11.7.12 (ESR). The weekly prompt asked whether the ESR had moved to 11.11.x — it had not: endoflife.date and the vendor release-policy gantt mark 11.11.x as an innovation release (lts:false, EOL 2026-12-15) while 11.7 remains the designated ESR (supported to 2027-05-15); 11.7.12 (2026-10-08) is its newest patch. The whole 10.11.22 → 11.7.12 window fixes 31 CVEs (1 high + 30 medium, NVD-mapped). The 10 → 11 ESR jump runs DB schema migrations on boot — exercised live: deploy at 10.11.22, seed an admin user, upgrade, and the user survives with the same id/roles. Back up before applying (the PR ships the pg_backup.sh hooks that fix the previously-silent no-op restore — reconcile with PR #1). postgres held at 15-alpine (majors need an operator-guided pg_upgrade). Release -x after merge.
7.1.2 → 7.1.3, a maintenance-and-security release (2026-10-06): 7 security fixes (CVE-2026-66666 unauthenticated disclosure of comments on private/unpublished posts, stored XSS on the pending-Comments admin page, second-order SQLi in the WXR export, DoS in WP_Http::make_absolute_url(), author-role sticky posts, XSS via Imgur embeds, forgeable hook params) + 4 bug fixes; no migrations, no config changes. Found stale: PR #1 still carried the 7.1.0 bump from September while upstream main had moved to 7.1.2 — the branch was fast-forwarded onto main, re-parented, and bumped to 7.1.3; the PR diff vs main is now exactly the one-line image tag. mariadb held at 13.0; the pre-existing atmoz/sftp:alpine floating tag left as-is (unparseable, verified current). Release -z after merge.
v3.2.2 → v3.3.1 (server + machine-learning move together from the monorepo). v3.3.0: people sharing with cluster groups, birthday memories, auto-stacked mobile edits, OAuth claims synced on every login, higher-quality thumbnails, PP-OCRv6 OCR models, ML perf work; v3.3.1 patches the people-sharing bugs. No server-side breaking changes; TypeORM migrations auto-ran live (ConvertUserOAuthIdEmptyStringToNull, RenameGeoNamesCountries, PersonSharing, AddPersonUserTableSharedBySharedWithConstraint). redis re-pinned 9.1.1 → 9.1.2 to
immich's own tested digest (valkey CVE-2026-25243 — RESTORE zipmap — remains unjudged, vendor page carries no fix versions); the vectorchord/postgres digest is byte-identical to v3.3.1's compose. Opt-in: MACHINE_LEARNING_MODEL_REVISION=v2 enables the optimized ML models (numerically equivalent). Release -y after merge.
6.67.0-alpine → 6.69.0-alpine, on a fresh PR #8: last week's #7 was closed upstream-side after its 6.67.0 content (including the CVE-2026-84383 crafted-image heap-overflow fix) landed via the 1.5.1+6.67.0 release publish — so this week starts from upstream main and bumps onward. v6.68.0: member location maps, React posts list + member activity screens, automation actions 20→50, scheduled-post race fix, tag-picker >100 tags fix; v6.69.0: automation analytics, self-serve site exports, uploads/Unsplash/Portal fixes. No breaking changes, no migrations, no new config; mysql held at 8.4 (Ghost supports MySQL 8 only — 9.x/26.x declined). Release -y after merge.
0.4.5027 → 0.4.5037 (@atproto/pds 0.5.27 → 0.5.37), extending the all-patch PR #5 with the 0.4.5036 → 0.4.5037 increment: since/startCursor on getTimeline/getListFeed (read strictly newer than a previously returned position), actor-store resource-management improvements, rejection of MSTs that reference the same node more than once (VisitedCidError; importRepo returns InvalidRequest), atproto dependency bumps. No config/env/secret changes; the /xrpc/_health endpoint is unchanged. Chaos-verified live (health 200, version 0.4.5037). Release -z after merge. The unrelated routing-fix PR #4 (rename main service app→pds so caddy resolves this stack on a shared proxy) still waits beside it, CI pending since before 09-21.
app 2.43.0 → 2.44.1 (static-web-server; the alpine/git sidecar is already at v2.54.0 on the same PR). 2.44.1: security improvements in the metrics and directory-listing download features (upstream says CVE details will be published in the following days — nothing identified yet; the deterministic scan is clean), file-type cache headers only on 2xx/304, Accept-Encoding quality-value rounding fix, nested {**} glob captures restored in rewrites, dependency updates incl. async-std (RUSTSEC-2025-0052), HTTP/2 restricted to TLS. No breaking changes; no recipe config change. Recommended release -y after merge (the PR aggregates the 2.43.0 → 2.44.1 minor plus the git bump).
2.40.5 → 2.43.2, spanning the 2.43 feature minor: agent guardrail runner + opt-in budget guardrails with persisted budget spend, engine suspension at node boundaries for resumable executions, a new inbound-auth-core module with trusted-source entities (its TypeORM migration ran clean on boot live), a durable scheduler for the legacy Cron node, a Databricks Job resource, Crypto RSA-OAEP hash option, ~90 core/editor/node fixes. No BREAKING CHANGE, no N8N_* env renames, no required manual migration. Last week's '?' CVE count is resolved: the full-window scan (2.40.5 → 2.43.2) now completes with all 9 sources reachable and finds 0. Note the 2.43.x line is marked pre-release on GitHub — consistent with the standing newest-tag precedent for this recipe. Release -y after merge.
Carried, unchanged this week: synapse v1.161.0 → v1.162.0 + MAS 1.25.1 → 1.26.0 (rustls RUSTSEC-2026-0285, device-code-link rate limiting). Synapse's new default room version 12 applies to newly created rooms only; no migrations or config removals. The mautrix/signal 'upgrade' to v26.02.2 was declined again — a February 2026 tag, ~7 months older than the pinned v0.2609.0 (a downgrade-in-disguise); bridge DBs held at pg13-alpine. Release -y → 7.4.0+v1.162.0 after merge.
Carried, green, unchanged this week: PR #8 bundles
lasuite-drive v0.23.0 (drive monorepo), collabora 25.04.10.3.1 → 26.04.4.2.1, redis 8.10.1 → 8.10.2 (SECURITY release — transaction ACL-revocation bypass + unauthenticated cluster-bus join hardening; no CVE ids published), and a minio_initialize config v2 bump. The collabora major migrates the entrypoint (the 26.04 image ships no shell) and the Collabora admin panel stays locked until COLLABORA_ADMIN_PASSWORD is set in the .env (empty = locked, verified). Fixes collabora CVE-2026-77276 (high) + 3 medium. Awaiting merge — the longest-waiting green security PR on the board.
Carried, unchanged this week: PR #9 bundles the impress v5.6.1 → v5.7.0 quartet, nginx 1.31.5 → 1.31.6 (CVE-2026-90439), redis 8.10.2, the docspec switch to ghcr.io/docspecio/api (port 4000 → 3000), on top of upstream's bitnamilegacy/minio repoint. AUTO_MIGRATIONS applies the new malware_detection migration set; the favorites endpoint moves to /documents/favorites/ (breaking for external API consumers only). The tree is live-verified green (9/9 services, docspec healthy); CI stays deterministically RED before any test — week 4 now, all on the warm-canonical base pinning the removed docker.io minio. Unblock: operator rebuild of the warm canonical from the PR head, then merge + release 0.5.0+v5.7.0.
Carried, unchanged since 09-18: pgautoupgrade 16 → 18-alpine with the PG18 data-dir layout move (the volume mount moves to /var/lib/postgresql — included in the PR). Live-verified at the time with byte-identical data. Green at build 1365, awaiting operator review.
No recipe work this week — 2024.06.61 (last week's admin-DoS CVE-2024-49767 fix + roundcube 1.6.18) landed upstream via the fleet-wide mirror sync, and the upgrade PR closed as merged-upstream; main now pins 2024.06.61 across all six
mailu services. Still open: the backupbot-v2 labels PR #3 (admin sqlite /data + imap mail /mail), green since build 483 — worth landing so mail data finally joins the backup regime.
No new work (external to the weekly set per used-recipes.md — not upgraded or assessed): the open clickhouse 23.4.6.25-alpine LTS-patch PR sits green at build 1286, awaiting the owner's review.