Co-op Cloud Recipe CI · Weekly Edition
The Recipe Report
Week of October 16, 2026report.ci.autonomic.zone2026-10-16 03:57 UTC
Twenty recipes were considered this week (plausible and uptime-kuma sit outside the run as external): eleven upgrade PRs are !testme GREEN and merge-ready, nothing failed on its own merits, and the only two REDs — lasuite-docs and lasuite-drive — are an external cc-ci base blocker, not the upgrades. Address first: mattermost-lts (10.11 ESR expired in August; the 11.7 ESR hop closes 32 CVEs), keycloak's 22-CVE security patch on the identity provider, gitea's nine (three high) on the forge itself, and the nginx 1.31.7 security batch riding five recipes; then refresh the two warm canonicals so the lasuite pair can actually merge.
The full wire — every recipe, in priority order
| Recipe | Change | TESTS | CVEs | CI | PR | STATUS | Notes |
|---|
| mattermost-lts | 10.11.22 → 11.7.12 | GREEN | 32 | build 64 ✓ | #2 | … | 10.11 ESR expired 2026-08-15 — 11.7 is the current ESR (to 2027-05-15). 32 CVEs incl high CVE-2026-8821. Schema migrations run on boot: back up the DB first; avoid 11.7.0–11.7.2 (schemeid migration bug). postgres held 15-alpine. Restore-fix PR #1 already folded in — close it with this. |
| keycloak | 26.8.0 → 26.8.1 | GREEN | 22 | build 58 ✓ | #12 | … | Dedicated security-patch release: 22 CVEs named in the release's Security fixes section (a floor — 52 older vendor-page advisories unjudged) plus jackson-databind / simple-git / java-html-sanitizer dependency fixes. mariadb held 12.3 (13.0 is a rolling non-LTS). |
| gitea | 28.0.0-rootless → 28.1.0-rootless | GREEN | 9 | build 56 ✓ | #10 | … | 9 CVEs fixed in 28.1.0 — 3 high, 6 medium, GHSA-listed; matches the vendor blog exactly. postgres held 15.19. Reconcile with the app.ini writable-config fix PR #4 (green since Aug 31). |
| lasuite-drive | v0.22.0 → v0.24.0 | FAILED | 10 | RED 60 · base prepull | #8 | … | The RED is the external minio base blocker, not this upgrade (head chaos-deployed 11/11 green incl. all migrations). Fixes collabora's 5 (1 high) + nginx's 5 + redis's unnamed security fixes; this week's scan was rate-limited, so 10 is a floor. Operator: refresh the warm canonical, then re-run !testme. |
| wordpress | 7.1.2 → 7.1.3 | GREEN | 7 | build 65 ✓ | #1 | … | Maintenance release carrying 7 security fixes per the upstream announcement (no CVE ids published). One-line bump; verified in-container at 7.1.3 with wp-content and .htaccess preserved. |
| lasuite-docs | v5.6.1 → v5.7.0 | FAILED | 6 | RED 57 · base prepull | #9 | … | Same external minio base blocker (RED 57); the head chaos-deployed 9/9 green with all migrations. v5.7.0 chosen deliberately over the v6.0.x collaboration-stack rewrite (a separate, larger effort). 6 nginx CVEs (window 1.31.5 → 1.31.7). |
| lasuite-meet | v1.34.0 → v1.35.0 | GREEN | 6 | build 59 ✓ | #11 | … | nginx 1.31.7 batch (5) + CVE-2026-4775 (tiff) in the meet frontend; livekit v1.13.10. Migration core.0025 (client-secret hashing) auto-runs on boot; no config changes. |
| custom-html | 1.31.6 → 1.31.7 | GREEN | 5 | build 54 ✓ | #9 | … | nginx 1.31.7 security release (5 CVEs); digest re-pinned on the manifest-list (abra can't parse tag+digest pins, so the bump is hand-applied). None of the CVE paths apply to the static-serving shape, but a security release warrants the upgrade. |
| matrix-synapse | v1.162.0 → v1.163.0 | GREEN | 5 | build 61 ✓ | #7 | … | nginx 1.31.7 batch (5); synapse 1.163.0 and MAS 1.24.0 → 1.27.0 read clean (rustls RUSTSEC-2026-0285 fix lands via MAS 1.26.0). GHSA sources were rate-limited — count is a floor. No config changes; migrations auto-run. |
| bluesky-pds | 0.4.5027 → 0.4.5037 | GREEN | none | build 53 ✓ | #5 | … | Patch bump in the 0.4.5xxx series; no env/config changes. Extended the existing PR #5 and chaos-verified /xrpc/_health reporting 0.4.5037. Unrelated routing-fix PR #4 remains open, untested. |
| ghost | 6.67.0-alpine → 6.71.0-alpine | GREEN | none | build 55 ✓ | #8 | … | Four minors including the 6.70 Ember removal; mysql held at 8.4 (abra's 9.x/26.x candidates are unsupported by Ghost). Slow first-boot schema migration covered by the recipe's 15m start_period. See the Addendum re the stray show-tag lint panic. |
| mailu | 2024.06.61 → 2024.06.64 | GREEN | none | build 62 ✓ | #9 | … | All six services move in lockstep: DNS KSK-rollover handling (.62) and a resolver healthcheck that now fails on SERVFAIL (.63/.64). No migrations, no config changes; redis and certdumper already current. Backupbot-labels PR #3 still open (green, now conflicting). |
| n8n | 2.43.2 → 2.43.6 | GREEN | none | build 63 ✓ | #9 | … | Stable-line patches only — 2.44.x is the beta line, deliberately not taken. TypeORM migrations ran clean; no config changes. GREEN on the first run. |
| custom-html-tiny | 2.44.0 → 2.44.1 | GREEN | none | build 42 ✓ | #9 | … | static-web-server 2.44.1 (bug fixes + security improvements in metrics / directory-listing download; no CVE ids published) plus alpine/git v2.54.0, carried on the evolving PR from the Oct 9 run. Awaiting operator merge even though this run files the recipe as up-to-date. |
| hedgedoc | db 16-alpine → 18-alpine | GREEN | none | build 1365 ✓ | #3 | … | App up-to-date at 1.12.0; the open PR #3 moves the db to pgautoupgrade 18-alpine carrying the required PG18 volume-mount layout fix (supersedes upstream's tag-only renovate PR #22). Green since Sept 18 — awaiting merge. |
| plausible | 23.4.2.11 → 23.4.6.25-alpine | GREEN | none | build 1286 ✓ | #5 | … | External recipe — excluded from this run's survey. The clickhouse 23.4 LTS-patch PR (0 CVEs in window; the one c-ares advisory adjudicated out-of-window) is green since Aug 15 but now conflicts with main — rebase or close. |
| immich | v3.2.4 → v3.3.1 | SKIPPED | none | build 45 ✓ | #6 | … | PR #6 is green at build 45 (Oct 9) but pins v3.3.1 — a tag that 404s upstream this run (newest ghcr semver = v2.5.3). Skipped as pin-ahead-of-upstream; pin/registry triage is needed before anything merges. A green CI on a dead tag is itself worth understanding. |
| cryptpad | — | UPTODATE | none | | | | Up-to-date (clearly newest; a benign tag-parse WARN only). |
| discourse | — | UPTODATE | none | | | | Up-to-date. |
| drone | — | UPTODATE | none | | | | Up-to-date. |
| mumble | — | UPTODATE | none | | | | Up-to-date. |
| uptime-kuma | — | UPTODATE | none | | | | Up-to-date. External recipe — excluded from this run's survey; no open PR. |
Addendum
- Both RED verdicts this week are one external cc-ci base blocker, not a recipe fault: the lasuite-docs and lasuite-drive warm canonicals (0.4.0+v5.4.1 and 0.12.0+v0.21.0) prepull the removed docker.io minio image, so the install tier dies before the upgrade head ever deploys (builds 57 and 60, empty junit). Both heads were separately verified green via direct chaos deploys (docs 9/9, drive 11/11, all migrations applied). Operator action: refresh the two warm canonicals' minio pins (the recipes now use the bitnamilegacy image) and re-post !testme on PRs #9 and #8.
- immich's open PR #6 is GREEN at build 45 yet pins a tag that no longer resolves upstream (v3.3.1 404s; newest ghcr semver is v2.5.3). The run skips immich as pin-ahead-of-upstream, which is correct but easy to read past: the pin needs registry triage (or a revert to the last real tag) — and the CI passing on a now-dead tag suggests the prepull doesn't actually verify resolvability at verdict time.
- The advisory scans ran degraded this week: the scan host has no GitHub token, so the anonymous GitHub-advisories API budget was exhausted (HTTP 403) mid-scan — all 8 sources failed for matrix-synapse, 7 for lasuite-drive, 3 for mailu. The nginx CVEs were still recovered from the vendor CHANGES page, but those recipes' counts are floors. Supplying a token to the scan host would remove a recurring blind spot.
- The lasuite-docs scan block reports failed sources that are actually internal compose healthcheck URLs (a docspec conversion endpoint and a localhost health URL) — advisory-scan.py is misparsing compose endpoint strings as advisory sources. Cosmetic but noisy; worth a scanner fix. The recipe's 6-CVE count itself was manually verified against nginx CHANGES and stands.
- abra recipe lint ghost now panics (version show is not supported) because the upstream coop-cloud ghost repo carries a stray annotated tag show that today's regenerated catalogue absorbed — the verdict is untouched (lint is never the verdict) but the level is capped at 4, and plain abra app new ghost hits the same FATA unless given -o/-C. Needs the stray tag cleaned upstream.
- Recipes filed as up-to-date can still hold open, green, merge-ready PRs from earlier runs: custom-html-tiny #9 (build 42, Oct 9) and hedgedoc #3 (build 1365, Sept 18). The up-to-date label reads as nothing to do when a merge is actually pending — worth distinguishing in the run summary.
- Leftover PRs to reconcile: gitea #4 (app.ini writable-config fix, green since Aug 31 — natural companion to upgrade #10), mailu #3 (backupbot v2 labels, green but now conflicting with main), mattermost-lts #1 (restore fix, already cherry-picked into #2's tree — close it with #2), bluesky-pds #4 (caddy routing fix, still without any cc-ci verdict), and plausible #5 (external, conflicting since main moved).
Security Bulletin
🔒 Critical CVE upgrades
mattermost-lts — 11.7.12 ESR hop closes 32 CVEs, and 10.11 ESR is expired (high) · CVE-2026-8821 + 31 more
mattermost 10.11.22 → 11.7.12 closes 32 CVEs (1 high, CVE-2026-8821; 30 medium; 1 low, the rest NVD-mapped with the 11.7.12 release still lagging in NVD). The sharper point: 10.11 ESR expired 2026-08-15, so every week unmerged is a week on a line that no longer receives security patches at all; 11.7 is the current ESR, supported to 2027-05-15 (12.0.0 is not an LTS). Schema migrations run on boot — back up the DB before applying, and avoid 11.7.0–11.7.2 (a roles schemeid migration bug). !testme GREEN at build 64.
keycloak 26.8.1 — 22-CVE security patch on the identity provider (high) ·
keycloak keycloak 26.8.0 → 26.8.1 is a dedicated security-patch release: its Security fixes section names 22 CVEs (per-CVE severities unpublished upstream), plus dependency fixes including jackson-databind, simple-git and the OWASP java-html-sanitizer. As the SSO front door for the fleet this is a top-priority merge; 22 is a floor — 52 older vendor-page advisories could not be settled within the window and were not counted. No config changes; mariadb deliberately held at 12.3. !testme GREEN at build 58.
gitea 28.1.0 — 9 CVEs on the forge itself, 3 high (high) · GHSA-listed
gitea 28.0.0 → 28.1.0 fixes 9 CVEs, 3 rated high — CVE-2026-86684 (GHSA-7v5j-mph8-9w6g), CVE-2026-96594 (GHSA-94rx-fqm6-q23v) and CVE-2026-97208 (GHSA-8hhh-mqpg-jpxc) — plus 6 medium (GHSA-469m-x4mw-38r3, GHSA-jj5r-9rpc-8h6h, GHSA-vvqw-mjq8-x248, GHSA-96qg-qxxj-r8xq, GHSA-fx95-gwfc-grgc, GHSA-hf55-9cwq-2x64), all fixed in 28.1.0 and matching the vendor blog exactly. One further advisory (CVE-2026-62925) was adjudicated as already fixed in 1.27.3, outside this window. This forge hosts the recipe mirrors and CI itself, so it is the most-exposed service on the list. !testme GREEN at build 56.
nginx 1.31.6 → 1.31.7 (14 Oct) is a security release fixing 5 CVEs: a buffer overflow via alias + rewrite (CVE-2026-15176), a buffer overflow in string expressions affecting document-root calculation and request logging (CVE-2026-93479), HTTP/3 unknown-frame body injection bypassing client_max_body_size (CVE-2026-95101), a use-after-free with async I/O on SSI pages using include virtual (CVE-2026-97205), and an uninitialised TLS session-ticket key enabling session forgery (CVE-2026-97629). The batch ships GREEN in
custom-html (build 54),
lasuite-meet (59) and
matrix-synapse (61); it is also inside the
lasuite-drive (build 60) and
lasuite-docs (build 57) PRs, which are RED only on the external base blocker — the docs window (1.31.5 → 1.31.7) additionally picks up CVE-2026-90439 from 1.31.6. Exposure varies by shape (a plain static-serving proxy triggers none of the HTTP/3/SSI paths), but as the fleet's standard proxy this is the week's most widespread fix.
lasuite-drive — collabora sidecar fixes 5 advisories incl CVE-2026-77276 (high) · blocked by the base issue
The collabora image inside
lasuite-drive's PR #8 (25.04.10.3.1 → 26.04.4.2.1) closes 5 advisories found by the Sept 28 scan of the same branch: high CVE-2026-77276 (GHSA-cf9v-hrj7-8p4v) plus mediums CVE-2025-66208 (GHSA-j3q6-q5pc-v5wf), CVE-2026-46499 (GHSA-27j2-3cqv-cc5q), CVE-2026-48164 (GHSA-wgmm-q3ch-64jj) and CVE-2026-55243 (GHSA-2g97-qwj5-fj7f). Worth naming the image: this is a Collabora Online flaw riding the drive recipe, not a drive one. redis 8.10.2 in the same PR also ships unnamed security fixes. The PR is RED at build 60 on the external minio base blocker — it cannot merge until the warm canonical is refreshed, so the security fix is being held hostage by an infra pin.
wordpress 7.1.3 — 7 security fixes, ids unpublished (severity not stated) · internet-facing
wordpress 7.1.2 → 7.1.3 is a maintenance release whose announcement names 7 security fixes without publishing CVE ids or severities (the deterministic scan could not version-map the core advisories either). WordPress needs no introduction as an attack target and this is the most internet-facing recipe in the fleet, so treat it as priority despite the unlabelled severity. One-line bump, no config changes; !testme GREEN at build 65.
What changed
10.11.22 → 11.7.12 — a cross-ESR hop rather than a patch: 10.11 ESR expired 2026-08-15 and 11.7 is the current ESR (to 2027-05-15; 12.0.0 is not an LTS). Closes 32 CVEs. Runs DB schema migrations on boot — back up first, and avoid 11.7.0–11.7.2 (roles schemeid migration bug). postgres held at 15-alpine. The pg_backup restore fix from PR #1 is already cherry-picked into this tree, so #1 can close with it. Release after merge: abra recipe release
mattermost-lts -x (3.0.0+11.7.12).
26.8.0 → 26.8.1, app only (mariadb held at 12.3 — 13.0 is a rolling non-LTS major). A dedicated security-patch release: the release notes' Security fixes section names 22 CVEs plus dependency fixes (jackson-databind, simple-git, owasp java-html-sanitizer); 22 is a floor, as 52 older vendor-page advisories could not be judged within the window. No config changes; fresh PR this week, !testme GREEN at build 58.
28.0.0-rootless → 28.1.0-rootless — a single compose line (the 1.27.3 → 28.0.0 jump had already landed upstream). 9 CVEs fixed in 28.1.0 (3 high, 6 medium, GHSA-listed; the vendor blog matches). postgres held at 15.19. The version label stays 3.6.8+28.0.0-rootless until the operator's release. The app.ini writable-config fix PR #4 (green since Aug 31) is still open alongside — the pair want reconciling.
v0.22.0 → v0.24.0, plus collabora 25.04.10.3.1 → 26.04.4.2.1, redis 8.10.2 and nginx 1.31.7. Closes collabora's five advisories (high CVE-2026-77276 + four medium, per the Sept 28 scan of this branch), the nginx 1.31.7 batch, and redis's unnamed security fixes — a floor of 10, as this week's GHSA pass was rate-limited. The direct chaos deploy converged 11/11 with every Django migration applied, so the upgrade itself is good; the !testme RED (build 60) is the external minio base blocker (see Addendum).
7.1.2 → 7.1.3, a one-line image bump. A maintenance release carrying 7 security fixes (no CVE ids published in the announcement). mariadb 13.0 and atmoz/sftp untouched. Chaos deploy verified in-container ($wp_version 7.1.3, Apache 2.4.68 / PHP 8.3.35) with the wp-content volume and recipe .htaccess preserved; GREEN at build 65.
v5.6.1 → v5.7.0 for the impress quartet, plus nginx 1.31.5 → 1.31.7, redis 8.10.2, and docspec moved to ghcr.io/docspec/api:1.21.4 (a Rust rewrite — port 4000 → 3000 and the healthcheck updated). v5.7.0 was chosen deliberately over v6.0.x: 6.x is a collaboration-stack rewrite (a new yhub service with its own postgres and Redis, two new JWT keys, and a mandatory document migration that leaves documents empty if skipped) — a separate, larger effort. Six nginx CVEs in the window (CVE-2026-90439 from 1.31.6 plus the 1.31.7 five). !testme RED at build 57 purely on the external minio base blocker; the head chaos-deployed 9/9 green with all migrations.
v1.34.0 → v1.35.0 with livekit v1.13.10 and nginx 1.31.7. Picks up the nginx 1.31.7 batch plus CVE-2026-4775 (tiff) baked into the meet frontend. Migration core.0025 (application client-secret hashing) is a nullable-column addition that runs on backend boot; a celery worker is already present for the new recording-notification email task; no config changes needed. GREEN at build 59.
nginx 1.31.6 → 1.31.7, with the digest re-pinned on the manifest-list via imagetools inspect (abra cannot parse tag+digest pins, so the bump is hand-applied). Carries the 1.31.7 security batch — none of the CVE paths (HTTP/3, SSI/AIO, alias+rewrite, session-ticket rotation) apply to the static-serving shape, but a security release warrants the bump regardless. GREEN at build 54.
synapse v1.163.0, MAS 1.24.0 → 1.27.0 and nginx 1.31.7 — a 3-line diff. Synapse 1.163 advertises Matrix v1.14/v1.15, catches MSC4354 sticky events up to remote homeservers and removes sticky-state sending; its cryptography bump fixes three CVEs that upstream states do not affect Synapse. MAS 1.25–1.27 bring no config-schema changes (the rustls RUSTSEC-2026-0285 fix lands via 1.26.0). The signal bridge was deliberately held (its v26.02.x tags are older than the pinned v0.2609.0). No operator action; migrations auto-run. GREEN at build 61; release after merge: 7.5.0+v1.163.0.
0.4.5027 → 0.4.5037, a single-line patch within the 0.4.5xxx series; no env, config or migration changes. The run extended the existing PR #5 (the branch already carried the exact tree — only title and body were refreshed) and chaos-verified the public /xrpc/_health endpoint reporting 0.4.5037. GREEN at build 53. The unrelated routing-fix PR #4 (rename main service app → pds for shared-proxy caddy resolution) is still open with no cc-ci verdict.
6.67.0-alpine → 6.71.0-alpine — four minors, including the 6.70 Ember removal, with mysql held at 8.4 LTS because abra's 9.x/26.x candidates are unsupported by Ghost. The slow first-boot MySQL schema migration is covered by the recipe's 15-minute start_period. GREEN at build 55 (extended the existing PR #8 from Oct 9). Separately, abra recipe lint
ghost now panics on a stray show tag in the upstream repo — environmental, and the verdict is untouched (see Addendum).
2024.06.61 → 2024.06.64 with all six services moving in lockstep: .62 deals with the DNS KSK rollover so it cannot recur, and .63/.64 make the resolver healthcheck fail on SERVFAIL instead of reporting healthy while every lookup fails. Patch-level only — no migrations, no config changes; redis 8.10.2-alpine and certdumper v2.11.4 were already current. A full postfix → rspamd → dovecot round-trip was verified on the deployed app. Fresh PR this week, GREEN on the first run at build 62. The backupbot-labels PR #3 (green, Sept) is still open and now conflicts with main.
2.43.2 → 2.43.6 — deliberately the stable line; 2.44.x is the beta channel and was not taken. TypeORM migrations ran to completion on deploy, the editor came up and /healthz answered 200; no config changes. Extended the existing PR #9; GREEN on the first run at build 63.
static-web-server 2.44.0 → 2.44.1 (bug fixes plus security improvements in metrics and directory-listing download; no CVE ids published) with alpine/git v2.54.0, carried on the evolving PR #9 from the Oct 9 run. GREEN at build 42 — merge-ready, though this week's run files the recipe as up-to-date since the branch already carries the newest tags.
The app is up-to-date at 1.12.0; the open PR #3 is infrastructure work: the db moves to pgautoupgrade 18-alpine carrying the required PG18 volume-mount layout change (/var/lib/postgresql), superseding upstream's tag-only renovate PR #22 which would break on the mount. GREEN at build 1365 since Sept 18 — awaiting operator merge.
External recipe (excluded from this run's survey). The open PR #5 bumps clickhouse 23.4.2.11 → 23.4.6.25-alpine, a patch within the 23.4 LTS line — 0 CVEs in the window, with the one c-ares advisory adjudicated out-of-window. GREEN at build 1286 since Aug 15, but the branch now conflicts with main; it needs a rebase or a close.
The open PR #6 (extended across the last three runs) bumps immich-server and immich-machine-learning v3.2.4 → v3.3.1 with a valkey 9.1.1 → 9.1.2 re-pin — and was GREEN at build 45 on Oct 9. But this run finds no v3.x upstream at all: the newest ghcr semver is v2.5.3 and the v3.3.1 manifest 404s, so the pin points at a tag that no longer resolves. Skipped as pin-ahead-of-upstream; pin/registry triage is needed before anything merges — and a green CI verdict on a dead tag deserves its own look.