Co-op Cloud Recipe CI · Weekly Edition
The Recipe Report
Week of November 6, 2026report.ci.autonomic.zone2026-11-06 05:14 UTC
A healthy run: all ten fresh upgrade PRs went green on their first attempt, nothing failed, nothing went stale, no CI re-runs were needed, and lasuite-docs is finally unblocked (level 5/5 green). The urgency is in the leftovers: wordpress's php2shell fix (CVE-2026-109619, critical unauthenticated RCE with public exploit tooling) has been green since October 26 but now conflicts with upstream's 4.2.0+7.1.4 release — rebase it and merge first; then the two security batches, keycloak's 36-CVE patch and gitea's 21-CVE patch, both green and merge-ready. Quietly, mailu's restore fix also turned last week's RED green.
The full wire — every recipe, in priority order
| Recipe | Change | TESTS | CVEs | CI | PR | STATUS | Notes |
|---|
| wordpress | php 8.3.36 rebuild + session.upload_progress off (app held) | GREEN | 2 | build 85 ✓ | #2 | … | php2shell (CERT-EU 2026-018): CVE-2026-109619 (critical, CVSS 9.2, unauthenticated RCE via stale global state) + sibling CVE-2026-109618, both closed by the PHP 8.3.36 image rebuild; the new ini line also blocks the confirmed session paths of CVE-2026-115560 (no fixed release yet). Green since Oct 26 — but now UNMERGEABLE: upstream published 4.2.0+7.1.4 on Oct 30 and both moved the same label line (merging as-is would also regress the app to 7.1.3). Rebase onto 4.2.0+7.1.4, re-run !testme, merge; upstream main still ships upload_progress on. |
| keycloak | 26.8.1 → 26.8.2 | GREEN | 36 | build 133 ✓ | #14 | … | Security patch release, scan-adjudicated: 36 CVEs named in the release notes — unauthenticated SAML-endpoint DoS/OOM (CVE-2026-107123 / -107602 / -110931), stored XSS on the login page (CVE-2026-107889), OIDC DCR offline-token revocation bypass (CVE-2026-107623), MySQL/MariaDB login-failure upsert trust (CVE-2026-112201) — plus Quarkus 3.40.1.1. No config changes; Liquibase self-migrates. mariadb 13.0 already in main via the operator's upstreamed 10.9.7+26.8.1. In-place dev upgrade verified with realm + client survival. Highest-leverage merge of the week after wordpress. |
| gitea | 28.2.0-rootless → 28.3.0-rootless | GREEN | 21 | build 132 ✓ | #12 | … | Third 28-series maintenance/security release: 21 CVEs, seven GHSA-high — review-triggered Actions workflows ran without approval (CVE-2026-118386), three public-only token scope bypasses (CVE-2026-117635 / -119441 / -116289), stored XSS via Actions artifacts (CVE-2026-113429), OAuth2 account auto-link (CVE-2026-120263), CVE-2026-116296 / -117685 — plus private-visibility leaks across profiles/feeds/timeline/project boards, CVE-2026-111943 (Go 1.27.3 build no longer trusts certain intermediate certs on egress) and golang.org/x/net v0.62.0. No breaking changes, no DB migration; postgres 15.19 / mariadb 10.11.19 held. Reconcile with fix PR #4 (writable app.ini, green at build 129). |
| mailu | redis 8.10.2 → 8.10.3 + sqlite restore hook | GREEN | YES | build 122 ✓ | #9 | … | Last week's RED restore tier is fixed ON the PR: a new restore_sqlite post-hook integrity-checks the snapshot and copies it into the live sqlite inode — no admin restart needed. Re-verified GREEN at all five tiers on Nov 2 (build 122, clean teardown). redis 8.10.3 carries a cluster-bus heap-overflow fix with no CVE id (YES = advisory without an ID; single-node redis exposure nil). Upstream main still ships the broken restore, so this deserves an upstream push after merge. Second open PR #3 (backupbot labels) to reconcile. |
| hedgedoc | db 16-alpine → 18-alpine (app held at 1.12.0) | GREEN | ? | build 131 ✓ | #3 | … | PG 16.15 → 18.6 in place with the PG18 data-dir mount move, re-verified GREEN. App stays 1.12.0: upstream WITHDREW 1.12.1/1.12.2 ("DO NOT UPDATE — might break your instance"; 403s for authenticated users, email-registration login breakage) — and that withdrawn line carries at least 7 GHSA security fixes, so 1.12.0 runs with them unpatched until a clean release ships. The db sidecar has no advisory source of its own, hence the ? — not a clean scan. |
| lasuite-docs | v6.0.1 → v6.0.4 | GREEN | none | build 135 ✓ · level 5 | #11 | … | Unblocked after weeks of warm-canonical REDs: the canonical now seeds v6 (cc-ci fix merged Nov 2), and run 135 passes all five tiers incl. the OIDC tests. v6 is breaking (SOFT_MIGRATION + migrate_documents); runtime RSA keys via the jwt-keys sidecar. Valkey 8→9 major deferred to the operator. Superseded PR #9 still open (RED at build 57) — close it. |
| lasuite-drive | v0.25.2 → v0.26.0 | GREEN | none | build 136 ✓ | #8 | … | Feature minor: new upload screen, share-link expiry/password, folder restrictions, admin tree browse. Gotcha: RESTRICT_UPLOAD_FILE_TYPE changed boolean → enum (off | allowlist | denylist) — an operator .env still carrying true/false stops the backend at startup (this recipe doesn't set it). OIDC email matching normalized; sidecar bumps (redis 8.10.3, collabora 26.04.5.2.1, onlyoffice 10.0.2.1) already carried by the PR. |
| matrix-synapse | v1.164.1 → v1.164.2 + bridges v0.2610.0 | GREEN | none | build 137 ✓ | #8 | … | Synapse patch restores the unstable MSC2965 /auth_metadata endpoint (Element X clients otherwise fail token refresh). Upstream already published 7.8.0+v1.164.2 on Nov 3, so the PR was rebased onto it — its remaining delta vs main is exactly the signal + telegram bridge bumps (v0.2610.0). Bridge postgres 13-alpine DBs deliberately held (migration-risk majors). |
| immich | v3.3.5 → v3.3.6 | GREEN | none | build 134 ✓ | #7 | … | Privacy patch: the ML container's onnxruntime telemetry (anonymous metrics to Microsoft) is disabled. pgvectors 0.3.0 DB bump already carried; in-place data-directory reuse verified live; no migration, no config change. |
| ghost | 6.67.0-alpine → 6.75.0-alpine | GREEN | none | build 130 ✓ | #8 | … | Spans 6.68–6.75: Ember removed from Admin, React editor/billing, editor fonts, automation triggers — migrations ran clean on deploy. mysql deliberately held at 8.4 (the 9.x/26.x candidates are a different product scheme Ghost doesn't support). A stray 'show' tag that crashed abra app new was removed from the mirror. |
| lasuite-meet | v1.36.3 → v1.37.0 | GREEN | none | build 138 ✓ | #13 | … | Crisp chat removed in favour of the La Suite support form (hidden unless FRONTEND_SUPPORT is configured); django-lasuite v1.0.0 and arm64 asset builds inside the images. No DB migration called out; no recipe-level nginx change needed. |
| n8n | 2.46.2 → 2.47.2 | GREEN | none | build 139 ✓ | #10 | … | Newest 2.x (Apps frontend + Assistant app building, agent publication timeline); 2.47.x is marked Pre-release upstream, so the operator may prefer to wait before publishing. The 3.x major (node removals incl. LangChain Code, v3 migration rules) deliberately left to the operator. Note: GHSA-365g-vjw2-grx8 (Execute Command node, high) has no patched version — mitigate with NODES_EXCLUDE where workflow authors are untrusted. |
| mumble | v1.6.870-0 → v1.6.870-5 | GREEN | none | build 140 ✓ | #2 | … | Same-shape image/distro rebuild (Ubuntu 24.04.5 base, built 2026-09-23) — not an app change; found by the independent resolver because abra can't parse the v<version>-<build> tag scheme. |
| cryptpad | 2026.5.1 → 2026.10.0 | GREEN | none | build 100 ✓ | #6 | … | Upstream's breaking "Autumn Release" server rewrite handled: full-scheme origins, single 3000 websocket/HTTP port, SSO plugin 1.0.0; E2E-encrypted pad roundtrip verified live. Release as a major (1.0.0+v2026.10.0). No CVEs named in the window. Ready to merge. |
| bluesky-pds | 0.4.5027 → 0.4.5051 | GREEN | none | build 99 ✓ | #6 | … | Eight-tag window (@atproto/pds 0.5.27 → 0.5.51): safer safeFetch egress with response-size bounds, patched Undici/body-parser deps, optional email 2FA. Three PRs open: #6 merge-ready; #5 superseded — close; routing-fix #4 (Caddy resolves the pds service by name on a shared proxy) now CI-verified GREEN (build 128, Nov 2) after weeks untested. |
| custom-html | digest re-pin (nginx 1.31.8) | GREEN | none | build 101 ✓ | #11 | … | Same-tag digest re-pin (nginx 1.31.8 + alpine/git v2.54.0 + openssh-server) after all three digests drifted stale; verified via direct registry checks. The openssh 'latest' floating tag is unverifiable by design. Version label left for the post-merge patch release. |
| discourse | — | UPTODATE | none | | | | Nothing to action: the operator upstreamed 1.1.3+2026.7.4 on Nov 2, so last week's five GHSA security fixes (MCP private-message read-scope gaps, onebox SSRF, regex DoS) are now released upstream; mirror re-synced clean. Deploy the release on instances. |
| custom-html-tiny | — | UPTODATE | none | | | | Up-to-date at 2.44.1 (static-web-server) + git v2.54.0. This week's mirror non-fast-forward FATA was cured via reconcile + hard reset before the survey completed. |
| drone | — | UPTODATE | none | | | | Up-to-date (drone/drone 2.28.2 current), all_resolved true. |
| rustdesk-server | — | UPTODATE | none | | | | Up-to-date (rustdesk-server 1.1.16 current) — first weekly run since enrollment (Oct 30); now covered by the survey and the security-source audit (1 advisory feed verified). |
Addendum
- wordpress #2 — the top-priority fix on the page — is currently unmergeable: it was opened against 4.1.1+7.1.3 (Oct 21), upstream published 4.2.0+7.1.4 on Oct 30, and both changed the same recipe-version label line (the branch also still pins the app at 7.1.3, so a raw merge would regress the app). It needs a rebase onto current main plus a fresh !testme; it has otherwise been green since Oct 26.
- Four recipes carry multiple open PRs to reconcile: bluesky-pds has three (#6 upgrade merge-ready; #5 superseded by #6 — close; #4 routing fix, now green at build 128 after weeks untested — merge or hand over), gitea has two (#12 upgrade + #4 writable app.ini fix, green since August and re-verified at build 129), lasuite-docs has two (#11 current + #9 superseded, RED at build 57 since Oct 23), and mailu has two (#9 upgrade + restore fix, #3 backupbot labels, green at build 483). Decide which of each pair lands.
- mailu drift between the run summary and reality: the summary says "the upstream restore-hook defect noted last week is unchanged" — true of coop-cloud main, but PR #9 itself now carries a working restore_sqlite post-hook and went GREEN at all five tiers on Nov 2 (run 122). The PR is a merge-ready data-safety fix; upstream still ships a restore that never actually restores the admin sqlite DB, so it is worth an upstream push after merge.
- hedgedoc's security picture is inverted this week: the releases that would fix at least 7 GHSAs (1.12.1/1.12.2) were withdrawn upstream as unsafe, leaving 1.12.0 exposed until a clean release ships. The scan renders this as ? — never 0. Note abra's tag-based resolver still offers 1.12.2 as an upgrade candidate (it cannot see withdrawals); the run correctly refused it, and the upstream registry now carries a standing withdrawal note. The CI suite would likely false-green the withdrawn releases — the SQLite tests would not catch the PostgreSQL auth/registration regressions.
- Two survey-infrastructure bugs were found and worked around this run, both capable of silently corrupting the weekly picture: (1) the reconcile-only mirror sync was silently dying — a prefixed GITEA_URL produced a doubled https:// API base and errexit swallowed the failure; after the fix all 20 mirrors re-synced, picking up four merged-upstream operator releases (incl. discourse 1.1.3+2026.7.4 and keycloak 10.9.7+26.8.1). (2) The on-host cc-ci clone used for candidate listing was stale and git-dead; a fresh clone was staged this run — restage before the next rebuild.
- n8n carries an unpatchable-by-upgrade advisory: GHSA-365g-vjw2-grx8 (high, Execute Command node, vulnerable range > 0.0.1 with no fixed version — "no code changes have been made to alter the behavior"). Where workflow authors are untrusted, mitigate via NODES_EXCLUDE=["n8n-nodes-base.executeCommand"]. Flagged in the PR body; nothing to merge fixes it.
Security Bulletin
🔒 Critical CVE upgrades
wordpress — CVE-2026-109619 / CVE-2026-109618, "php2shell" (critical · CVSS 9.2) · internet-facing
The PHP request-handling pair behind CERT-EU 2026-018 / Red Hat RHSB-2026-013: CVE-2026-109619 (critical, CVSS 4.0 9.2) is unauthenticated remote code execution via stale global state, with public exploit tooling circulating; CVE-2026-109618 is the sibling request-handling memory-corruption flaw (rated critical 9.8 by BSI). Both are fixed in PHP 8.3.36, the base the
wordpress image tag resolves to since the rebuild. PR #2 additionally sets session.upload_progress.enabled = Off — the single most effective mitigation, blocking the confirmed session paths and fully protecting against CVE-2026-115560, which still has no fixed release. It is GREEN at build 85 (Oct 26) but currently conflicts with upstream's 4.2.0+7.1.4 release: rebase, re-run !testme, and merge — the highest-value action on this page.
keycloak 26.8.2 — thirty-six-CVE security patch on the identity provider (high) ·
keycloak 26.8.1 → 26.8.2 is a pure security patch whose release notes name 36 CVEs (advisory scan adjudicated all 36 as counted). Highlights: stored XSS on the login page (CVE-2026-107889 — the SSO front door for every federated app), unauthenticated SAML-endpoint DoS/OOM (CVE-2026-107123 / -107602 / -110931 — any unauthenticated request can exhaust memory), OIDC Dynamic Client Registration offline-token revocation bypass (CVE-2026-107623), and login-failure upsert trust on MySQL/MariaDB (CVE-2026-112201), plus a bundled Quarkus 3.40.1.1. No config changes; Liquibase applies schema updates on boot. Verified by a live in-place dev upgrade (realm + client survived, discovery HTTP 200) and GREEN at build 133. As the identity provider, this is the highest-leverage merge after
wordpress.
gitea 28.3.0 — twenty-one CVEs incl. seven high on the git forge (high) ·
gitea 28.2.0-rootless → 28.3.0-rootless closes 21 CVEs: seven GHSA-high — review-triggered Actions workflows executed without approval (CVE-2026-118386: a pull-request review could fire privileged CI), three public-only token scope bypasses (CVE-2026-117635 / -119441 / -116289), stored XSS via Actions artifacts (CVE-2026-113429), OAuth2 account auto-link (CVE-2026-120263), and CVE-2026-116296 / -117685 — plus multiple private-visibility leaks (profiles, feeds, timeline, project boards), CVE-2026-111943 (binaries built with Go 1.27.3 no longer trust certain intermediate certificates on outgoing connections), and a golang.org/x/net v0.62.0 security bump. No breaking changes and no DB migration; postgres/mariadb overlays held at 15.19 / 10.11.19. GREEN at build 132 on an internet-facing forge — merge promptly.
hedgedoc — at least seven advisory fixes withheld by withdrawn releases (severity unassessed) ·
hedgedoc The only available
hedgedoc security line — 1.12.1/1.12.2, which fixes at least seven GHSAs (GHSA-2c27-4x43-jrm6, GHSA-3fwm-h59w-j268, GHSA-7p6g-mhrh-286p, GHSA-cqg6-86p6-77jm, GHSA-g5g7-gfr5-f89m, GHSA-jxrf-wfc5-w77h, GHSA-q9v8-vwgh-x2mc) — was withdrawn upstream with the words "DO NOT UPDATE TO THIS RELEASE, IT MIGHT BREAK YOUR INSTANCE" (authenticated-user 403s on limited notes, email-registration login breakage). Until a clean 1.12.x ships, the fleet stays on 1.12.0 with those advisories unpatched — this is a real, temporary exposure, which is why the table shows ? rather than none. The PG18 database fix on PR #3 is independent, green (build 131), and safe to merge meanwhile.
What changed
Not an app bump: PR #2 adds one ini line — session.upload_progress.enabled = Off (with a test asserting it) — on top of the PHP 8.3.36 image rebuild, taking the recipe from 4.1.1+7.1.3 to 4.1.2+7.1.3 as opened. It closes the php2shell pair (CVE-2026-109619 critical 9.2 unauthenticated RCE via stale global state; CVE-2026-109618 request-handling memory corruption) and blocks the confirmed session paths of CVE-2026-115560, which has no fixed release yet. Green at build 85 (Oct 26); needs a rebase onto upstream's 4.2.0+7.1.4 before it can merge.
26.8.1 → 26.8.2, a one-line image bump that is entirely a security patch: 36 CVEs named in the release notes — unauthenticated SAML-endpoint DoS/OOM (CVE-2026-107123 / -107602 / -110931), stored XSS on the login page (CVE-2026-107889), OIDC DCR offline-token revocation bypass (CVE-2026-107623), MySQL/MariaDB login-failure upsert trust (CVE-2026-112201) — plus Quarkus 3.40.1.1. No config changes; mariadb stays at 13.0 (already in main via the operator's upstreamed 10.9.7+26.8.1, with MARIADB_AUTO_UPGRADE=1). Live in-place upgrade verified with realm + client survival.
28.2.0-rootless → 28.3.0-rootless — exactly one compose line. 21 CVEs: seven GHSA-high (Actions approval bypass CVE-2026-118386; token scope bypasses CVE-2026-117635 / -119441 / -116289; stored XSS via Actions artifacts CVE-2026-113429; OAuth2 auto-link CVE-2026-120263; CVE-2026-116296 / -117685), private-visibility leaks across profiles/feeds/timeline/project boards, CVE-2026-111943 from the Go 1.27.3 build, and golang.org/x/net v0.62.0. No breaking changes, no DB migration; postgres 15.19 / mariadb 10.11.19 held. The unrelated app.ini fix stays on PR #4.
redis 8.10.2 → 8.10.3 (cluster-bus heap-overflow fix, no CVE id) plus the restore fix: a new restore_sqlite post-hook integrity-checks the snapshot and copies it into the live sqlite inode, so restore actually restores the admin DB without an admin-container restart — closing last week's RED, where the snapshot landed back under /data/backup and the live DB was never replaced. All five tiers green on Nov 2 (build 122, clean teardown, no secret leak). Label 4.0.1+2024.06.67; upstream main still ships the broken restore, so this one deserves an upstream push.
No app bump — upstream withdrew 1.12.1 and 1.12.2 ("DO NOT UPDATE — might break your instance"; open regressions: 403s for authenticated users on limited notes, email-registration login breakage), so the app deliberately stays at 1.12.0. Those withdrawn releases carry at least 7 GHSA fixes the fleet now waits on. The valid change remains on PR #3: pgautoupgrade 16-alpine → 18-alpine with the PG18 data-dir mount move, re-verified GREEN (build 131) — 16.15 → 18.6 verified live with pad content byte-identical.
Re-verification, no new work: PR #11 (impress v6.0.4 stack + docspec 1.21.4 + runtime RSA keys sidecar, on top of upstream 1.0.1+v6.0.4) passed level 5/5 at build 135 once the warm canonical was advanced to the v6 seed (cc-ci fix merged Nov 2) — the base now deploys and the head passes install/upgrade/backup/restore plus all custom tests incl. OIDC via
keycloak. v6 is breaking (SOFT_MIGRATION + migrate_documents); the valkey 8.1.11 → 9.1.3 major was found and deliberately deferred to the operator.
v0.25.2 → v0.26.0 on the four drive images (frontend/backend/celery/celery-beat in lockstep), riding on PR #8's already-carried sidecar bumps (redis 8.10.3, collabora 26.04.5.2.1, onlyoffice 10.0.2.1). Feature minor: new upload screen, share-link expiry/password, folder restrictions, admin tree browse; Django migrations auto-run. One operator gotcha: RESTRICT_UPLOAD_FILE_TYPE is now an enum (off | allowlist | denylist) — a leftover true/false in .env stops the backend at startup. Email matching for OIDC identities was normalized. Advisory scan + adjudication: 0 CVEs in the window (the one flagged high, GHSA-2r7g-8hpc-rpq9, is scoped to redis <= 8.0 — outside this window).
Synapse v1.164.1 → v1.164.2 — a single bugfix restoring the unstable MSC2965 /auth_metadata endpoint that Element X clients (upgraded from ≤ 1.162) need for token refresh. Mid-run the mirror reconcile revealed upstream had already published 7.8.0+v1.164.2 (Nov 3), so the PR branch was rebased onto it: the PR's remaining delta vs main is exactly the mautrix signal + telegram bridge bumps to v0.2610.0 (libsignal v0.105.0, block/unblock, view-limited media). Bridge DBs stay at postgres 13-alpine — deliberate hold.
v3.3.5 → v3.3.6 on immich-server + immich-machine-learning: a single privacy patch disabling onnxruntime telemetry in the ML container (it had been sending anonymous metrics to Microsoft). No server-side change, no migration. The pgvectors 0.2.0 → 0.3.0 postgres bump already on PR #7 was re-verified in place against the existing data directory (extensions vchord 0.4.3 + vector 0.8.1 present).
6.67.0-alpine → 6.75.0-alpine, spanning 6.68–6.75: Ember removed from Admin with the React editor/billing released (6.70), self-hosted Portal/Search/Comments fixes (6.71), editor fonts (6.72), automation triggers + member-label filters (6.74/6.75). Schema migrations all ran clean on the live deploy. mysql deliberately held at 8.4 LTS — Ghost documents MySQL 8 as the only supported production DB, and 9.x removes mysql_native_password. Housekeeping: a stray 'show' tag that crashed abra app new was removed from the mirror.
v1.36.3 → v1.37.0 on the three meet images: Crisp chat is removed in favour of the La Suite support form (hidden unless FRONTEND_SUPPORT sets widget_script_url/widget_api_url/widget_channel — this recipe never exposed Crisp, so no action), django-lasuite v1.0.0, ffmpeg 8.1.3 and arm64 asset builds inside the images. The upstream noindex hardening lives in the app image's own nginx config; the recipe's reverse proxy needs no change. No DB migration called out.
2.46.2 → 2.47.2, the newest 2.x tag (2.47.0: Apps frontend + Assistant app building, agent version history/publication timeline, Mailchimp/Venafi webhook-signature verification, Sentry v11/OTel set up once at startup; 2.47.1/2.47.2 follow-ups). TypeORM migrations ran clean; deprecation notices remain warn-only. Two deliberate holds: 2.47.x is marked Pre-release on GitHub, and the 3.x major (NODES_API_VERSION 3, removed nodes incl. LangChain Code) is left to the operator. GHSA-365g-vjw2-grx8 (Execute Command node, high, no fix version) is documented in the PR body with the NODES_EXCLUDE mitigation.
mumble-server v1.6.870-0 → v1.6.870-5: the trailing -5 is an image/distro rebuild (Ubuntu 24.04.5 base, built 2026-09-23), not an app change — same Mumble 1.6.870 release. abra's semver view can't parse the v<version>-<build> tag scheme, so the independent resolver found it. Packaging-only; no config/schema change; mumble-web stays at 0.5.
2026.5.1 → 2026.10.0 (PR #6, green at build 100 since Oct 30): upstream's breaking "Autumn Release" server rewrite — full-scheme origins, single port 3000 for websocket + HTTP, SSO plugin 1.0.0. Verified live with an E2E-encrypted pad roundtrip; SSO users must move the plugin to 1.0.0+. Should be released as a major (1.0.0+v2026.10.0). No CVEs named in the window; still awaiting operator merge.
PR #6 (green at build 99) moves 0.4.5027 → 0.4.5051 across an eight-tag window: safer safeFetch egress with response-size bounds, patched Undici/body-parser deps, optional email 2FA — no CVE ids named. Meanwhile the routing fix on PR #4 (rename the main service app → pds so Caddy resolves THIS stack's app on a shared proxy, via {$APP_HOST}) was finally CI-verified GREEN at build 128 on Nov 2, after sitting untested since it opened. PR #5 (0.4.5037) is superseded by #6 and can be closed.
PR #11 (green at build 101 since Oct 30) re-pins drifted same-tag digests: nginx 1.31.8 (a non-security bugfix release — 1.31.7 carried the CVE batch), alpine/git v2.54.0, and openssh-server. The openssh sidecar floats on 'latest' by design (digest shipped sidecar-side), so it is unverifiable by the resolver — recorded as a caveat rather than folded into up-to-date. Version label left for the post-merge patch release.