Co-op Cloud Recipe CI · Weekly Edition
The Recipe Report
Week of October 23, 2026report.ci.autonomic.zone2026-10-23 04:14 UTC
A steady run: of 19 recipes considered, nine upgrade PRs are !testme GREEN and merge-ready, none failed, and the only REDs (lasuite-docs, lasuite-drive) are blocked by a removed minio image inside the CI warm-canonicals — both upgrades verified live, 12/12 and 11/11 services converged. Address gitea first: PR #11 ships 28.2.0 with ten CVE fixes including two highs. And mind keycloak's quiet 'up-to-date' — upstream's 26.8.1 is a large security batch on the identity provider, already published to recipe main, so upgrade deployed instances rather than waiting on a PR. The table is ordered by what to address first; immich and n8n read '?' because the advisory scan's GitHub sources were rate-limited this run — unknown, not clean.
The full wire — every recipe, in priority order
| Recipe | Change | TESTS | CVEs | CI | PR | STATUS | Notes |
|---|
| gitea | 28.1.0-rootless → 28.2.0-rootless | GREEN | 10 | build 77 ✓ | #11 | … | Git forge — 28.2.0 maintenance/security release: 10 CVEs, incl. CVE-2026-109553 (high, SSH cert principals matched against all stored keys) and CVE-2026-104627 (high, OpenID callback missing state) + golang.org/x/net CVE-2026-78659. No breaking changes; postgres held 15.19. Separate app.ini fix PR #4 also open. |
| matrix-synapse | v1.163.0 → v1.163.1 | GREEN | 1 | build 83 ✓ | #8 | … | MAS 1.27.1 removes compromised TLS CAs from trust roots (CVE-2026-111943); synapse 1.163.1 hardens certifi/rustls-webpki against the same eMudhra intermediates. mautrix signal/telegram v0.2610.0, nginx 1.31.8. Count is a floor — eight GitHub advisory sources rate-limited during the scan. |
| wordpress | — | SKIPPED | 1 | | #2 | … | Up-to-date (7.1.3 current; upgrade PR #1 merged 2026-10-19). Open PR #2 is a separate security fix, not from this run: disables session.upload_progress (CERT-EU 2026-018 / CVE-2026-109619) + PHP 8.3.36 rebuild, label 4.1.1+7.1.3 → 4.1.2+7.1.3. No !testme run yet — post one. |
| custom-html-tiny | 2.43.0 → 2.44.1 | GREEN | 1 | build 74 ✓ | #9 | … | static-web-server 2.44.1 fixes CVE-2026-75601 (medium, GHSA-97q6-jph8-rxgm, fixed in 2.44.0); alpine/git v2.52.0 → v2.54.0. (TARmageddon CVE-2025-62518 was already fixed in v2.39.0 — not this window.) Ready to merge. |
| lasuite-meet | v1.36.0 → v1.36.2 | GREEN | 1 | build 81 ✓ | #12 | … | v1.36.1 bumps pillow to 13.0.0 for CVE-2026-112403; also un-numbered Node 22.23.4/24.22.1 security fixes. nginx 1.31.8 (no CVEs — 1.31.7 carried that batch); livekit held. Ready to merge. |
| immich | v3.3.4 → v3.3.5 | GREEN | ? | build 78 ✓ | #6 | … | Upstream bills v3.3.5 as a security patch (certifi 2026.10.19 CA-trust fix + October 2026 Node.js security patches); no schema migration, and the dev deploy verified no pgvectors database drop. CVE count unknown (?) — the scan's GitHub advisory sources were rate-limited; last week's pin-404 anomaly is gone. |
| n8n | 2.40.5 → 2.45.2 | GREEN | ? | build 84 ✓ | #9 | … | Five-release jump on the stable line (2.44.x was the beta line); TypeORM migrations ran clean (agent/MCP/type-policy tables). Runtime deprecation notices are warn-only, flagged in the PR. CVE count unknown (?) — the scan's n8n advisory source was rate-limited, so this is not a clean bill. |
| lasuite-docs | v6.0.1 → v6.0.2 | STALE | none | RED 79 · base prepull | #11 | … | RED only at the CI upgrade BASE prepull: the warm canonical 0.4.0+v5.4.1 pins docker.io/minio/minio, removed from Docker Hub — external infra, not the upgrade (12/12 services converged on a live chaos deploy). Fresh PR supersedes #9 (v5.7.0 line). Operator: refresh the canonical's minio pin, re-post !testme. |
| lasuite-drive | v0.25.0 → v0.25.2 | STALE | none | RED 82 · base prepull | #8 | … | Same external minio blocker at the base prepull (warm canonical 0.12.0+v0.21.0); the upgrade itself verified live, 11/11 services. PR also fixes upstream main's broken collabora 26.04 entrypoint (crashloop on first deploy). Operator: refresh the canonical, re-post !testme. |
| bluesky-pds | 0.4.5027 → 0.4.5046 | GREEN | none | build 73 ✓ | #6 | … | One-line PDS bump; chaos deploy verified /xrpc/_health reporting 0.4.5046. Supersedes older upgrade PR #5 (0.4.5037); routing-fix PR #4 still open and never CI-tested. Ready to merge. |
| custom-html | 1.31.7 → 1.31.8 | GREEN | none | build 75 ✓ | #10 | … | nginx digest re-pin; 1.31.8 is a non-security bugfix release (1.31.7 carried the CVE batch). Recipe version label intentionally left for the post-merge patch release. Ready to merge. |
| ghost | 6.67.0-alpine → 6.72.0-alpine | GREEN | none | build 76 ✓ | #8 | … | Spans 6.68–6.72 (the 6.70 Ember removal caused no deploy or migration issue); mysql held at 8.4 LTS — no requirement, and abra's 9.x/26.x candidates are unsupported by Ghost. No CVEs in window. Ready to merge. |
| cryptpad | — | UPTODATE | none | | | | version-2026.5.1 remains the newest published image; the 2026.10.0 release was announced on GitHub (2026-10-21) but is not yet on Docker Hub. |
| discourse | — | UPTODATE | none | | | | Official 2026.7.3 ESR + postgres pg18 + redis 8.10-alpine all current; the survey's bitnami 2.8.1 line was stale fallback data (superseded since recipe v1.0.0+3.5.3). |
| drone | — | UPTODATE | none | | | | drone/drone 2.28.2 (recipe 1.9.1+2.28.2) is current upstream main; no PR needed. |
| hedgedoc | — | UPTODATE | none | build 1365 ✓ · db PR #3 | #3 | … | App 1.12.0 current (newest pullable quay tag); db 16→18 is not required by the app. Open db-upgrade PR #3 (pgautoupgrade 18-alpine + PG18 /var/lib/postgresql volume move) left for an operator decision. |
| keycloak | — | UPTODATE | none | | | | Upstream already published 10.9.6+26.8.1 on 2026-10-19 — and 26.8.1 is a large security batch (43 CVEs floor, severities unlisted: delegated-admin escalation, 2FA bypass, broker logout, token exchange). Nothing to merge; run abra app upgrade on deployed instances. mariadb 13.0 major deliberately not bumped. |
| mailu | — | UPTODATE | none | build 62 ✓ · PR #9 | #9 | … | Main already pins 2024.06.66 (released 2026-10-22), which includes the CVE-2026-109618/619 webmail fixes; redis 8.10.2 + certdumper v2.11.4 also latest. Superseded PR #9 (targets .64) can be closed; backup-labels PR #3 also open. |
| mumble | — | UPTODATE | none | | | | mumble-server v1.6.870-0 and mumble-web 0.5 are the newest tags. |
Addendum
- The warm-canonical minio blocker is now in its second week: lasuite-docs PR #11 (RED 79) and lasuite-drive PR #8 (RED 82) both die at the upgrade BASE prepull because the canonicals pin docker.io/minio/minio, which Docker Hub has removed (the recipes themselves moved to bitnamilegacy). It is infra, not the upgrades and not the tests — both upgrades converged live (12/12 and 11/11 services). Repoint the two canonicals to a resolvable minio pin and re-post !testme; a harness-side fix would stop this recurring every week.
- The advisory scan's GitHub sources were rate-limited this run (anonymous API, 60/hr; no token configured) — immich and n8n therefore carry '?' CVE counts, matrix-synapse's 1 is a floor, and keycloak's for-the-record scan is incomplete. Configuring a token for advisory-scan.py would make the weekly CVE numbers authoritative again.
- mattermost-lts was reclassified weekly → external on 2026-10-19 (used-recipes.md, one day after the 10-16 run upgraded it to 11.7.12). Its two GREEN PRs — #2 (11.7.12 ESR; a 31-CVE window when last surveyed) and #1 (backup restore was a no-op fix) — are now orphaned with no weekly driver. Reconcile them: merge upstream, or close and hand over to whoever maintains it now.
- Superseded PRs that can be closed: mailu #9 (targets 2024.06.64 — main already pins .66; supersede comment posted), bluesky-pds #5 (0.4.5037, superseded by #6's 0.4.5046), and lasuite-docs #9 (v5.7.0 line, superseded by fresh #11; comment posted). bluesky-pds #4 (caddy routing fix, pending) has never been CI-tested — it needs a verdict either way.
- Unrelated open fix PRs awaiting operator decisions: gitea #4 (writable app.ini config volume for Gitea 1.24+; still relevant — 28.2.0 keeps the read-only app.ini warning; green at build 1250), hedgedoc #3 (db 16→18, green at build 1365, not required by the app), mailu #3 (backupbot v2 labels, green at build 483), and plausible #5 (external recipe; clickhouse 23.4 LTS patch, green at build 1286).
- wordpress PR #2 — the session.upload_progress security fix (CVE-2026-109619) opened 2026-10-21 — has never had a !testme run. Post one so the fix can be verified, reviewed and merged.
- Survey hygiene: abra recipe upgrade -m -n re-emitted {} false-negatives for drone, keycloak, mailu and wordpress while their upstream mains were already current (each was re-verified against the live checkout — no false skips shipped), and stale mirror master refs (only main is synced) made keycloak look pinned at 26.7.3. Both quirks are worth remembering when reading the weekly survey output.
Security Bulletin
🔒 Critical CVE upgrades
gitea 28.2.0 — ten CVEs, two high, on the git forge (high) ·
gitea gitea 28.1.0 → 28.2.0 (2026-10-18) fixes ten CVEs: CVE-2026-109553 (high, GHSA-vcp6-2qc6-gvq3) — SSH certificate principals were matched against all of a user's stored keys; CVE-2026-104627 (high, GHSA-mf69-7pqq-86vx) — the OpenID association callback omitted state validation; six further Gitea CVEs rated medium/low (GHSA-c3cr-qq9g-666c, GHSA-wx44-9m3m-rjqx, GHSA-6f9g-7jgm-m5ph, GHSA-8j56-f865-gqq2, GHSA-cwq7-782w-pxcc, GHSA-4jmf-h2cm-hg7w, GHSA-fxq4-gr55-7x5g); plus dependency CVE-2026-78659 (golang.org/x/net v0.60.0). No breaking changes, no migration, no new config; postgres held at 15.19. Highest-value merge of the week — !testme GREEN at build 77. One medium advisory (CVE-2026-62925) was already fixed in 1.27.3 and is not part of this window.
keycloak 26.8.1 — large security batch already published upstream (severities unlisted) · act on deployments
keycloak 26.8.1 (2026-10-13) is a security patch release spanning identity brokering, OIDC broker backchannel logout, FGAP delegated-admin escalation, 2FA enforcement bypass, token exchange, and Jackson/jackson-databind dependency CVEs. The deterministic scan counts at least 43 CVEs in the 26.7.3 → 26.8.1 window (GitHub advisory sources rate-limited, severities unlisted — treat 43 as a floor, not a total). There is no PR this week because upstream already published recipe 10.9.6+26.8.1 on 2026-10-19: the operator action is abra app upgrade on every deployed instance. Crossing from older versions also picks up 26.8.0's changes — login-failure state now persists in the DB by default, and the redesigned IdP login buttons deserve a look if you run custom themes.
MAS 1.27.1 (2026-10-22) removes compromised TLS CAs from its trust roots (CVE-2026-111943 / RUSTSEC-2026-0383 — the eMudhra intermediate certificates), applying to Docker-image TLS connections. The same PR's synapse 1.163.1 distrusts the same CA via rustls-webpki 0.103.16 and updates certifi (GHSA-6q48-6c7w-9gw2) — same-batch hardening, not separate CVE ids. Severity is unrated in the advisory, and the count of 1 is a floor: eight GitHub advisory sources failed (rate limit) during the scan. !testme GREEN at build 83.
static-web-server 2.44.0 fixes CVE-2026-75601 (medium, GHSA-97q6-jph8-rxgm); PR #9 ships 2.44.1 together with alpine/git v2.54.0. The older TARmageddon flaw CVE-2025-62518 was already fixed in v2.39.0 and is not part of this window. No config changes; !testme GREEN at build 74.
wordpress — CVE-2026-109619 / CERT-EU 2026-018: session.upload_progress disabled (severity unstated) · fix untested
PR #2 (opened 2026-10-21, not from this run) disables session.upload_progress per CERT-EU 2026-018 / CVE-2026-109619 and rebuilds the image on the PHP 8.3.36 base (recipe label 4.1.1+7.1.3 → 4.1.2+7.1.3). The advisory states no severity; session.upload_progress is the classic session-data exposure lever on PHP hosts, and
wordpress deployments are internet-facing. It has had no !testme run yet — post one, then review and merge.
meet v1.36.1 upgrades pillow to 13.0.0 to fix CVE-2026-112403 (adjudicated from the upstream CHANGELOG; no GHSA listed), and v1.36.2 additionally picks up the un-numbered Node.js 22.23.4/24.22.1 security fixes. nginx moves to 1.31.8 — no CVEs there; 1.31.7 carried that batch and is already the base. livekit held (no requirement). Severity unrated; !testme GREEN at build 81.
What changed
28.1.0-rootless → 28.2.0-rootless. A maintenance/security release: ten CVEs fixed (two high — SSH cert principal matching and the OpenID callback's missing state — six medium/low, plus golang.org/x/net CVE-2026-78659). No breaking changes, no migration; the 28.0.0 breaking changes (internal Git proxy, RUN_RETENTION_DAYS) are already in the base. postgres offered 16/17/18 majors but held at 15.19 — no requirement, and the recipe has no pg_upgrade tooling. The pre-existing read-only app.ini warning persists (that is PR #4's domain, untouched here). Release after merge: abra recipe release
gitea -z.
v1.163.0 → v1.163.1. Synapse hardens certifi (GHSA-6q48-6c7w-9gw2) and rustls-webpki 0.103.16 against the compromised eMudhra intermediate CAs; MAS 1.27.1 removes them from its trust roots (CVE-2026-111943). mautrix signal/telegram bridges move to v0.2610.0 — note the v0.YYMM.P tag scheme, where abra's v26.02.2 'candidate' is a display-name mis-sort, not a newer release; nginx 1.31.8. No config or DB migration. The CVE count is a floor (rate-limited advisory sources).
No upgrade this run — 7.1.3 is current and the 7.1.2 → 7.1.3 PR #1 was merged upstream on 2026-10-19. Separately, open PR #2 (opened 2026-10-21) disables session.upload_progress per CERT-EU 2026-018 / CVE-2026-109619, rebuilds on PHP 8.3.36, and bumps the label to 4.1.2+7.1.3. It has never been !testme-tested.
2.43.0 → 2.44.1. static-web-server fixes CVE-2026-75601 (medium, GHSA-97q6-jph8-rxgm); alpine/git moves v2.52.0 → v2.54.0. TARmageddon (CVE-2025-62518) was already fixed back in v2.39.0. Extended the existing evolving PR #9; clean GREEN on the first run.
v1.36.0 → v1.36.2. v1.36.1 bumps pillow to 13.0.0 (CVE-2026-112403); v1.36.2 brings the un-numbered Node 22.23.4/24.22.1 security fixes; nginx 1.31.7 → 1.31.8 (non-security). livekit held — no requirement. Extended the evolving upgrade line as fresh PR #12; GREEN on the first run.
v3.3.4 → v3.3.5. A security-only patch: dependency digest updates (certifi 2026.10.19 CA-trust fix) plus the October 2026 Node.js security patches. No schema migration, no new config. The dev deploy re-verified the ops-history gotcha does not bite: postgres 14.19 healthy, vector/vchord extensions present, 72 tables — no pgvectors database drop. Last week's v3.x manifest-404 anomaly is gone (tags resolve again). CVE count unknown (?) — the scan's GitHub advisory sources were rate-limited.
2.40.5 → 2.45.2. A five-release jump, staying on the stable line (2.44.x was the beta line). TypeORM migrations ran to completion on the live deploy — the new agent/MCP/type-policy tables (CreatePromotionRunAndReviewTables) created with zero backfilled rows; /healthz 200, auth gate intact. Runtime deprecation notices are warn-only and flagged in the PR body. CVE count unknown (?) — the
n8n advisory source was rate-limited, so treat this as unmeasured rather than clean.
v6.0.1 → v6.0.2, as a fresh PR #11 (supersedes #9's v5.7.0 line — different target). Upstream main carried v6.0.1 image tags but not the v6 adaptation, so this PR adds the whole collaboration-stack migration: a new yhub service (own postgres DB + valkey store) taking over the collaboration half of y-provider, RSA JWT keys for backend and yhub (COLLABORATION_SERVER_SECRET removed), /collaboration/* routes moved to yhub, and a required document migration (SOFT_MIGRATION lazy seed + migrate_documents backfill — without it, pre-v6 documents open empty). On top: impress v6.0.2 (yhub @y/hub 0.10.1 schema script — covered by the idempotent init-db — plus backend security fixes), nginx 1.31.8, docspec 1.21.4. CI is RED only at the base prepull (the canonical's removed minio image); the live deploy converged 12/12 with all health probes green.
v0.25.0 → v0.25.2 (the drive quartet) + nginx 1.31.8. Bugfix-only window, no CVEs named. The PR also fixes upstream main's broken collabora 26.04 runtime contract — the first chaos deploy crashlooped with exec: 'sh' not found until the entrypoint was corrected; redeploy converged 11/11 with collabora healthy. collabora 26.04.5.1.1 and onlyoffice 10.0.0.1 confirmed newest by direct registry checks (5-part/4-part tags abra cannot parse). CI is RED only at the base prepull (the canonical's removed minio image).
0.4.5027 → 0.4.5046. Exactly a one-line image bump; caddy untouched. The chaos deploy verified /xrpc/_health serving 0.4.5046 through the full TLS chain, and teardown leaked nothing. Older PR #5 (0.4.5037) is superseded by this one; routing-fix PR #4 remains open, untested.
nginx 1.31.7 → 1.31.8 — a digest re-pin of the manifest list, hand-edited because abra cannot parse tag+digest pins. 1.31.8 is a non-security bugfix release; 1.31.7 already carried the CVE batch. The recipe version label (1.14.2+1.31.7) is intentionally left untouched in the PR — run abra recipe release
custom-html -z after merge.
6.67.0-alpine → 6.72.0-alpine, extended onto the existing PR #8 (its branch tracks upstream main + the app pin). Spans 6.68–6.72; the 6.70 Ember removal caused no deploy or migration issue on the live deploy (fresh schema init, Ghost 6.72 booted clean, API reporting version 6.72). mysql deliberately held at 8.4 LTS — Ghost does not support abra's 9.x/26.x candidates. No CVEs in the window.
No upgrade this run — 1.12.0 is the newest pullable tag and db 16→18 is not required by the app. The open db-upgrade PR #3 (pgautoupgrade 16-alpine → 18-alpine plus the PG18 /var/lib/postgresql volume-mount move) was left untouched for an operator decision; it is green at build 1365 on the older CI host.
No upgrade PR — mirror main already pins 2024.06.66 (published 2026-10-22, the newest release), which includes the CVE-2026-109618/619 webmail fixes; redis 8.10.2-alpine and certdumper v2.11.4 are also latest. Two open PRs remain: #9 (an older upgrade to 2024.06.64, now superseded by main — a close candidate) and #3 (backupbot v2 backup labels, green at build 483).