Co-op Cloud Recipe CI · Weekly Edition
The Recipe Report
Week of October 30, 2026report.ci.autonomic.zone2026-11-02 19:41 UTC
A solid run: of 19 recipes considered, twelve upgrade PRs are !testme GREEN and merge-ready, one failed (mailu — a pre-existing upstream backup/restore defect, not its redis bump), and one is stale-blocked for a third week (lasuite-docs, on CI's own outdated warm canonical, with a new root cause each time). Address keycloak first: the MariaDB 12.3 → 13.0 major clears seven CVEs on the identity provider's database, including a critical. Then keep moving — wordpress 7.1.4 and discourse 2026.7.4 are security releases whose fixes carry no CVE ids yet (a WordPress upgrade-process RCE among them), so their YES cells in the CVEs column mark security fixes without assigned IDs. The table is ordered by what to address first.
The full wire — every recipe, in priority order
| Recipe | Change | TESTS | CVEs | CI | PR | STATUS | Notes |
|---|
| keycloak | db mariadb 12.3 → 13.0 (app 26.8.1 held) | GREEN | 7 | build 106 ✓ | #13 | … | Identity provider's db major — 7 MariaDB CVEs cleared (critical CVE-2026-49261 + 3 highs; fix line 12.3.2, so older cached 12.3.x images are the real exposure). MARIADB_AUTO_UPGRADE=1 added so system tables upgrade on first boot; in-place data survival verified live. Back up the DB before deploying. |
| wordpress | 7.1.3 → 7.1.4 | GREEN | YES | build 114 ✓ | #3 | … | Security release: upgrade-process RCE + stored-XSS/DoS batch + unauth discovery of unpublished changesets — no CVE ids assigned yet, so YES indicates security fixes without assigned CVE IDs. Also open: PR #2 (session.upload_progress off, CVE-2026-109619) — flagged last week as never !testme'd, now GREEN at build 85. Both merge-ready. |
| discourse | 2026.7.3 → 2026.7.4 | GREEN | YES | build 102 ✓ | #12 | … | 2026.7 ESR security/patch: 5 GHSA-only fixes (MCP private-message read-scope gaps high, Patreon group access, category-chat visibility, regex DoS, onebox SSRF) — no CVE IDs; YES indicates advisory fixes. 1 low advisory (CVE-2025-53016) unjudged — the count is a floor. Migrations auto-run on boot; sidecars held. |
| matrix-synapse | v1.164.0 → v1.164.1 | GREEN | ? | build 109 ✓ | #8 | … | msgpack memory-exhaustion fix (GHSA-j586-36cw-2gc2) on the public room-list API + mautrix signal/telegram bridges v0.2610.0. Scan's GitHub advisory sources were rate-limited (incl. synapse's own) — the ? is a floor, not a clean bill. |
| mailu | redis 8.10.2-alpine → 8.10.3-alpine | FAILED | YES | RED 112 · restore | #9 | … | RED 3× on the restore tier — pre-existing upstream defect (new backup support ships a pre-hook but no restore post-hook, so the admin sqlite DB is never restored). The redis bump itself (cluster-bus heap-overflow fix, no CVE id; mailu's single-node redis exposure nil) is deploy-verified. Full diagnosis + options in the PR comment. |
| lasuite-docs | v6.0.1 → v6.0.4 | STALE | none | RED 107 · base install | #11 | … | RED only at the base install rung: the warm canonical 0.4.0+v5.4.1 references removed secret collab_ss, so abra aborts before the PR head is exercised — third week blocked by the stale canonical, different root cause each time. Head linted + live-deployed 12/12 healthy. Operator: seed a v6 canonical, re-post !testme. v6 is breaking (SOFT_MIGRATION + migrate_documents). Supersedes #9. |
| cryptpad | 2026.5.1 → 2026.10.0 | GREEN | none | build 100 ✓ | #6 | … | Upstream's breaking "Autumn Release" server rewrite handled: full-scheme origins, single 3000 websocket/HTTP port, SSO plugin 1.0.0; E2E-encrypted pad roundtrip verified live. Release as a major (1.0.0+v2026.10.0). No CVEs named in the window. |
| hedgedoc | db pgautoupgrade 16-alpine → 18-alpine | GREEN | none | build 104 ✓ | #3 | … | In-place pg major via the auto-upgrade image + PG18 mount-path move: 16.15 → 18.6 verified live with pad content byte-identical; full !testme incl. backup/restore GREEN. App already latest at 1.12.0. |
| immich | postgres pgvectors 0.2.0 → 0.3.0 (app v3.3.5 held) | GREEN | none | build 105 ✓ | #7 | … | DB sidecar only (abra FATA'd on the tag+digest pin — direct ghcr check instead). immich uses vchord, not pgvecto.rs, so no server-side dependency; in-place data-directory reuse verified live. Last week's pin-404 PR #6 was merged upstream. |
| lasuite-drive | v0.25.2 → v0.25.3 | GREEN | none | build 108 ✓ | #8 | … | drive quartet v0.25.3 + redis 8.10.3 + collabora 26.04.5.2.1 + onlyoffice 10.0.2.1; the PR also carries last week's collabora 26.04 contract fix and nginx 1.31.8. Live deploy 11/11 converged; last week's minio base blocker did not recur. Ready to merge. |
| ghost | 6.67.0-alpine → 6.73.0-alpine | GREEN | none | build 103 ✓ | #8 | … | Spans 6.68–6.73 (the 6.70 Ember removal caused no deploy or migration issue); mysql deliberately held at 8.4 LTS — the 9.x/26.x candidates are a different product scheme Ghost doesn't support. No CVEs in window. Ready to merge. |
| n8n | 2.45.2 → 2.46.2 | GREEN | none | build 113 ✓ | #10 | … | Stable-line bump: TypeORM migrations ran clean, runtime deprecation notices warn-only and flagged in the PR. The 3.0.x major is deliberately left for the operator to schedule. Ready to merge. |
| custom-html | nginx 1.31.8 (digest re-pin) | GREEN | none | build 101 ✓ | #11 | … | Same-tag digest re-pin (nginx 1.31.8 + alpine/git v2.54.0 + openssh-server) after all three digests drifted stale — verified via direct registry checks. 1.31.8 is a non-security bugfix release (1.31.7 carried the CVE batch). Version label left for the post-merge patch release. |
| bluesky-pds | 0.4.5027 → 0.4.5051 | GREEN | none | build 99 ✓ | #6 | … | Eight-tag window (@atproto/pds 0.5.27 → 0.5.51): safer safeFetch egress with response-size bounds, patched Undici/body-parser deps, optional email 2FA — no CVE ids named. Supersedes #5; routing-fix #4 still never CI-tested. Ready to merge. |
| gitea | — | UPTODATE | none | build 1250 ✓ · fix PR #4 | #4 | … | Up-to-date — last week's 10-CVE 28.2.0-rootless PR was merged + released upstream (3.6.10+28.2.0-rootless, 2026-10-18); nothing to re-do here, just upgrade deployed instances. Still open: fix PR #4 (writable app.ini config volume for Gitea 1.24+), green since Aug — an operator decision. |
| lasuite-meet | — | UPTODATE | none | | | | Up-to-date: upstream renovate already published 0.8.2+v1.36.3 (app v1.36.3, livekit v1.13.11, redis 8.10.3, nginx 1.31.8); last week's 1.36.2 PR closed as merged-upstream. No open PR. |
| custom-html-tiny | — | UPTODATE | none | | | | Up-to-date at 2.44.1 (static-web-server) + git v2.54.0 — last week's PR #9 was merged upstream; no open PR. |
| drone | — | UPTODATE | none | | | | Up-to-date (drone/drone 2.28.2 current). |
| mumble | — | UPTODATE | none | | | | Up-to-date (mumble-server v1.6.870-0, mumble-web 0.5). |
Addendum
- lasuite-docs is blocked at the CI warm-canonical base for a third consecutive week, each time by a different external defect in the same stale canonical 0.4.0+v5.4.1 (minio image removed, then this week's removed collab_ss secret). The durable fix is seeding a v6 cold canonical — note upstream's v6 expects manually-inserted jwt_pk/yhub_jwt_pk secrets, so a cold seed may itself need PR #11's runtime-key sidecar (or a one-off secret insert). Until then this recipe re-blocks weekly.
- mailu's RED deserves a fix at the source: upstream main's new backup support (commit 77659e7) ships a sqlite backup pre-hook but no restore post-hook, so /data/main.db is never restored. The run's mumble-style hook attempt proved restore additionally needs an admin service restart (the running container keeps its SQLite connection to the pre-restore inode) — that is backup/restore design work, correctly left out of the redis PR. mailu also holds two open PRs to reconcile: #9 (this redis bump, RED) and #3 (backupbot labels, green at build 483) — upstream main now carries its own backup labels, so #3 may be partially superseded.
- Superseded PRs that can be closed: bluesky-pds #5 (0.4.5037, superseded by #6's 0.4.5051) and lasuite-docs #9 (v5.7.0 line, superseded by #11). bluesky-pds #4 (caddy routing fix, pending) has still never been CI-tested — it needs a verdict either way.
- Survey hygiene: the weekly survey flagged gitea 28.1.0 → 28.2.0 from a stale local checkout (master @ 28.1.0) instead of the reconciled mirror main (@ 28.2.0, already released) — reconcile caught it before a duplicate PR, but resetting the checkout to origin/main after reconcile would stop the re-flagging. Same family: abra FATA'd on tag+digest pins for custom-html and immich (worked around via direct registry checks) and a parse WARN hid cryptpad's version-2026.10.0 calver tag.
- Mirror drift needed mid-run repair: immich and n8n had stale diverged mirror mains (abra FATA "non-fast-forward"), fixed via reconcile force-sync + hard reset before their upgrades ran; 13 mirrors were reconciled during the survey in total. Without reconcile these recipes would silently drop out of the weekly run.
- External recipes still carry orphaned green PRs awaiting a merge-or-hand-over decision, unchanged since last week's weekly → external reclassification: mattermost-lts #2 (11.7.12 ESR upgrade) and #1 (backup restore no-op fix), and plausible #5 (clickhouse 23.4 LTS patch, green at build 1286 since Aug 15).
- Tooling state: cc-ci-plan carries an uncommitted ~Oct-05-era JOURNAL.md edit that would remove the committed 2026-10-23 entry while adding gitea PR #44/#45 events — deliberately left untouched this run; a future session should fold the 10-05 events in deliberately rather than lose either.
Security Bulletin
🔒 Critical CVE upgrades
keycloak — MariaDB 13.0 major clears 7 CVEs incl. a critical (CVE-2026-49261)
The db sidecar behind the identity provider moves MariaDB 12.3 → 13.0 with MARIADB_AUTO_UPGRADE=1, clearing seven MariaDB CVEs whose fix line is 12.3.2: critical CVE-2026-49261 (GHSA-3p3m-4x7c-p4pw), highs CVE-2026-44168 (GHSA-vwf7-w26c-9w5h), CVE-2026-48163 (GHSA-rpgv-q6gv-684r) and CVE-2026-48165 (GHSA-7v3p-h23x-8hwv), plus mediums CVE-2026-44170/44171/44173. The floating 12.3 tag resolves to 12.3.3 on a fresh pull — so newly-pulled images already carry the fixes, and the exposure is instances still running an older cached 12.3.x image; the major bump makes the fix explicit and adds the auto-upgrade path for system tables. In-place upgrade verified live on the same data volume (rows survived, OIDC discovery 200). Back up the DB before deploying. !testme GREEN at build 106.
wordpress — 7.1.4 security release: upgrade-process RCE + stored-XSS/DoS batch (no CVE ids yet)
WordPress 7.1.3 → 7.1.4 fixes an RCE in the upgrade process (exploitable during the upgrade window); stored XSS in crafted block markup, privacy data-removal requests, the Interactivity API, customizer selective refresh, the Categories block, crafted user logins and playlist/image blocks; a stored DoS in the Interactivity API; unauthenticated discovery of unpublished customizer changesets; a note-read authorization weakness for privileged users; and a bundled root-CA refresh (eMudhra revocation). No CVE ids were assigned at release — the table's 0 is "no ids", not "no fixes". Backported to 4.7+, but only 7.1.x is mainstream-supported; internet-facing sites should merge promptly. !testme GREEN at build 114. The separate session.upload_progress fix (PR #2, CVE-2026-109619 / CERT-EU 2026-018) is also green at build 85 and merge-ready.
discourse — 2026.7.4 ships five GHSA security fixes, one high (MCP private-message read-scope)
The 2026.7.3 → 2026.7.4 patch on the 2026.7 ESR line carries five security fixes, all GHSA-only with no CVE ids: MCP private-message read-scope gaps (high), Patreon group access (medium), category chat reviewable visibility (medium), staff-initiated regex DoS (medium), and onebox SSRF via disallowed ports (low). One further low advisory (CVE-2025-53016) could not be judged — no published fix version — so any count is a floor. The official image runs Rails migrations automatically on boot; sidecars unchanged (pg18, redis 8.10-alpine). !testme GREEN at build 102.
matrix-synapse — GHSA-j586-36cw-2gc2: msgpack memory exhaustion on the public room-list API (count incomplete)
synapse v1.164.0 → v1.164.1 bumps msgpack 1.2.1 → 1.2.4 to fix GHSA-j586-36cw-2gc2 — memory exhaustion via malformed tokens reachable through the public room-list API. The advisory scan's GitHub sources (including synapse's own) were rate-limited this run, so the CVE count is a floor and renders "?" — not a clean bill. Riding along: mautrix signal/telegram bridges v0.2609.0 → v0.2610.0. !testme GREEN at build 109.
What changed
App stays at 26.8.1 (current); the db sidecar moves MariaDB 12.3 → 13.0 with MARIADB_AUTO_UPGRADE=1 so system tables upgrade on first boot — a config gap the run caught by deploying the major without the flag first (mariadb-upgrade was skipped) and then fixing. Verified live as a genuine in-place upgrade on the same data volume: 12.3.3 → 13.0.2, pre-upgrade rows survived, OIDC discovery 200. Seven MariaDB CVEs cleared (see bulletin); back up the DB before deploying the major.
7.1.3 → 7.1.4 — a one-line image bump carrying the full 7.1.4 security release (upgrade-process RCE, stored-XSS/DoS batch, unauth changeset discovery; no CVE ids yet — see bulletin). mariadb:13.0 held (current), atmoz/sftp:alpine left as-is (no versioned tag exists to pin — verified directly on Docker Hub). Separately, PR #2 (disable session.upload_progress, CERT-EU 2026-018 / CVE-2026-109619, PHP 8.3.36 rebuild) — flagged last week as never !testme'd — is now GREEN at build 85; both PRs are merge-ready.
2026.7.3 → 2026.7.4, the security/patch release on the 2026.7 ESR line: five GHSA security fixes (one high — see bulletin) plus performance/fix backports, 47 commits total. Rails migrations run automatically on boot; sidecars held at pg18 / redis 8.10-alpine. Recommended release: patch (1.1.3+2026.7.4).
synapse v1.164.0 → v1.164.1 (the msgpack memory-exhaustion fix, GHSA-j586-36cw-2gc2) and mautrix signal/telegram bridges v0.2609.0 → v0.2610.0 (block/unblock, view-limited media; the removed legacy Python migration path doesn't affect this recipe's bridgev2 line). MAS 1.28.0 and nginx 1.31.8 were already in upstream's 7.7.0+v1.164.0 release — this PR only takes the remaining bumps, resolving the survey's stale display-tag candidates (v26.02.x) against GitHub's actual release list.
A one-line redis 8.10.2-alpine → 8.10.3-alpine bump — the cluster-bus heap-overflow security fix (no CVE id assigned;
mailu runs single-node redis, so exposure is nil) — deploy-verified in place on the same volume. !testme is RED 3× (builds 110/111/112) on the restore tier from a pre-existing upstream defect: main's new backup support ships a sqlite backup pre-hook but no restore post-hook, so /data/main.db is never restored. A mumble-style restore hook was tried at build 112: the mailbox assertion then passed but the custom tier failed — the running admin container keeps its SQLite connection to the pre-restore inode, so a service restart is also required. The hook was reverted; the PR is exactly the verified redis change, with the full diagnosis and operator options in the PR comment.
impress v6.0.1 → v6.0.4 in lockstep, rebased onto upstream's own 1.0.1+v6.0.4 (keeping cc-ci's runtime RSA-key sidecar and Rust docspec, taking upstream's valkey 8.1.11), plus redis 8.10.3 and nginx 1.31.8. !testme run 107 is RED only at the base install rung — the stale warm canonical 0.4.0+v5.4.1 references the removed collab_ss secret, so abra aborts before the PR head is ever exercised; the head itself linted and live-deployed 12/12 healthy (yhub ready, jwks 200, auth gate intact). v6 is breaking for operators: deploy with SOFT_MIGRATION=true, run backend migrate_documents, then set it false.
2026.5.1 → 2026.10.0 — upstream's breaking "Autumn Release" server rewrite, handled in the recipe: CPAD_MAIN_DOMAIN/SANDBOX_DOMAIN now take full-scheme origin values, the websocket consolidates to a single app:3000 port proxied at /cryptpad_websocket, the config/nginx/sso entrypoint versions are bumped so changed templates re-mount, and the SSO plugin moves to 1.0.0 (required by 2026.10). The E2E-encrypted pad roundtrip was verified live on the dev deploy, including an in-place redeploy over a running 2026.5.1 stack (the one FATA was the pre-existing nginx↔app start race, not a regression). Recommended release: major (1.0.0+v2026.10.0).
Same-tag digest re-pin: nginx 1.31.8, alpine/git v2.54.0 and openssh-server latest had all drifted to stale digests (each verified directly upstream after abra FATA'd on the tag+digest pins). No version change — 1.31.8 is a non-security bugfix release (the CVE batch was 1.31.7). Both overlay pins re-verified resolvable via imagetools; version label deliberately left for the post-merge patch release (-z).
6.67.0-alpine → 6.73.0-alpine, spanning 6.68–6.73 (the 6.70 Ember removal caused no deploy or migration issue on a fresh install;
ghost booted clean and the admin API reports 6.73). mysql deliberately held at 8.4 LTS — the 9.x/26.x lines abra proposes are a different product scheme Ghost does not support. No CVEs in window.
App unchanged at 1.12.0 (latest); the db sidecar moves pgautoupgrade 16-alpine → 18-alpine with the required PG18 volume-mount change (postgres:/var/lib/postgresql). Verified live as an in-place major on the same volume: PostgreSQL 16.15 → 18.6 upgrade completed, data auto-moved to the 18 layout, pad content byte-identical, row counts unchanged, app HTTP 200 — and the full !testme suite including the backup/restore data-survival tier is GREEN.
App already latest at v3.3.5; the postgres sidecar moves ghcr.io/immich-app/postgres 14-vectorchord0.4.3-pgvectors0.2.0 → …pgvectors0.3.0 (a one-line diff; abra can't parse the tag+digest pin, so the check was made directly against ghcr).
immich doesn't use pgvecto.rs (vchord/vector only), so there's no server-side dependency; the live deploy exercised the 0.2.0 → 0.3.0 data-directory reuse cleanly on PG 14.19 with extensions confirmed. Last week's pin-404 PR #6 was merged upstream — this is the follow-on sidecar bump.
drive v0.25.2 → v0.25.3 (app/backend/celery/celery-beat lockstep), redis 8.10.2 → 8.10.3, collabora 26.04.5.1.1 → 26.04.5.2.1 and onlyoffice 10.0.0.1 → 10.0.2.1 — the last two via direct registry checks (abra can't parse their tags). The PR also still carries last week's collabora 26.04 entrypoint contract fix and nginx 1.31.8. Live deploy 11/11 converged (Django migrations done, WOPI discovery reachable); last week's warm-canonical minio blocker did not recur. Recommended release: minor (-y).
2.45.2 → 2.46.2 on the stable line (the 3.0.x major is deliberately left for the operator to schedule — release notes linked in the PR for context). TypeORM migrations ran clean (agent/MCP/type-policy tables); runtime deprecation notices are warn-only and flagged in the PR. /healthz 200 and the editor served on the live deploy; clean teardown.
0.4.5027 → 0.4.5051 — an eight-tag window mapping @atproto/pds 0.5.27 → 0.5.51: safer safeFetch egress with response-size bounds, patched Undici/body-parser dependencies, optional email-based 2FA, privileged app passwords for chat.bsky, strict report-queue access. No CVE ids named in the window's changelog. Env interface, entrypoint and health endpoint unchanged; 0.5.52 (Node >=22.15 requirement) is not in this window. Supersedes PR #5 (0.4.5037).
No upgrade this week — last week's 28.2.0-rootless PR (#11, the 10-CVE window) was merged upstream and published as recipe 3.6.10+28.2.0-rootless on 2026-10-18; postgres stays 15.19 (majors 16–18 out of weekly scope) and mariadb 10.11.19 is current. Still open: fix PR #4 (seed app.ini into a writable config volume for Gitea 1.24+, which keeps warning on the read-only app.ini) — green at build 1250 since Aug and awaiting an operator decision; a natural companion to the now-landed 28.2.0.