Co-op Cloud Recipe CI · Weekly Edition
The Recipe Report
Week of November 13, 2026report.ci.autonomic.zone2026-11-13 05:42 UTC
The cleanest run on record: of the 20 recipes on the wire, fourteen upgrade PRs came back !testme green — zero failures, zero stale tests — and the other six were already up-to-date, with keycloak, lasuite-meet and lasuite-drive's bumps landing directly upstream during reconcile. Address the PHP "php2shell" pair first: merge mailu #11 now (webmail mitigation for CVE-2026-109618/-109619), then land the wordpress fix at last — PR #2 has been green since Oct 26 but still needs a rebase onto 4.2.0+7.1.4; gitea's 43-CVE postgres rollup and discourse's 37-advisory security patch follow.
The full wire — every recipe, in priority order
| Recipe | Change | TESTS | CVEs | CI | PR | STATUS | Notes |
|---|
| mailu | 2024.06.67 → 2024.06.68 (all six images) | GREEN | 2 | build 151 ✓ | #11 | … | Security patch: mitigates the php2shell paths CVE-2026-109618 / CVE-2026-109619 in webmail pending a patched PHP runtime; redis 8.10.3 and certdumper were already current upstream. No config/schema changes; host-mode ports, so deploy as the only mailu instance. One undetermined 2020 advisory (GHSA-phg4-wh78-w97x, low) sits outside the window. Second open PR #3 (backupbot labels) to reconcile. |
| wordpress | php 8.3.36 rebuild + session.upload_progress off (app held at 7.1.3) | GREEN | 2 | build 85 ✓ · green since Oct 26 | #2 | … | The php2shell fix (CVE-2026-109619 critical CVSS 9.2 unauthenticated RCE + sibling CVE-2026-109618; the ini line also blunts the confirmed session paths of CVE-2026-115560, which has no fixed release yet). Still UNMERGEABLE as-is: upstream published 4.2.0+7.1.4 on Oct 30 and both moved the same label line — a raw merge would regress the app to 7.1.3. Rebase onto 7.1.4, re-run !testme, merge; upstream main still ships upload_progress on. Second week flagged. |
| gitea | postgres overlay 15.19 → 15.20 (app 28.3.0 already upstream) | GREEN | 43 | run 148 ✓ | #13 | … | PG 15.20 security rollup — 43 CVEs named in the PostgreSQL release notes (the advisory-range scan attributes none to the window; PG publishes fixes ahead of advisory metadata). Same-major, no pg_upgrade, verified in place on a seeded 15.19 volume. The app's 28.3.0 fixes (21 CVEs incl. 7 high) already landed upstream as 3.6.11+28.3.0. CI exercises the sqlite overlay — the postgres line rests on the direct dev deploy, recorded in the PR. Reconcile fix PR #4 (writable app.ini, green at build 129). |
| discourse | 2026.7.4 → 2026.7.5 | GREEN | YES | run 146 ✓ · 5/5 | #13 | … | Security patch: 37 advisories fixed (GHSA-tracked, no CVE ids) — moderator privilege escalation via others' invite keys, CSRF in DiscourseConnect invite-key handling, hidden-group-membership and private-category metadata leaks, IP disclosure to restricted moderators, per-cook hashtag-bridge exhaustion. One low advisory (CVE-2025-53016) remains unmeasured, so 37 is a floor. pg18 / redis 8.10 held; no migrations beyond boot. |
| cryptpad | 2026.5.1 → 2026.10.1 | GREEN | YES | run 142 ✓ | #6 | … | Security release (vendor's highest CVSS 4.0: 7.3, high; no CVE ids published) on top of the breaking 2026.10 server rewrite. The rewrite needs the new infra.js config mount — added after a fresh-deploy crash surfaced in the live check — plus websocket :3003 → :3000 and SSO plugin 1.0.0+. Review /checkup/ after upgrading. The 57 unclassified scan entries are the unchanged nginx sidecar, out of window. |
| immich | v3.3.5 → v3.4.1 (app + ML) | GREEN | YES | build 149 ✓ | #7 | … | v3.4.0 ships a batch of security fixes — 17 GHSA advisories without CVE ids: shared-link visibility, plugin allowedHosts anchoring, upload-access checksum enforcement, email-template escaping, CSP inline hashes. v3.3.6 also disables the ML container's onnxruntime telemetry. pgvectors 0.3.0 DB bump already carried, digest re-verified; 104 migrations auto-ran. No operator action. |
| custom-html-tiny | 2.44.1 → 2.44.2 | GREEN | YES | build 143 ✓ | #11 | … | Bug-fix/security patch — basic auth, HTTP OPTIONS handling, ignore-hidden-files; detailed advisories are not yet published upstream, so YES is a floor (severity unknown). No config changes; the recipe passes host/root/port explicitly and the now-inert memory-cache section is unused. |
| lasuite-docs | docspec 3.0.2 → 1.21.4 (Rust, :3000) + runtime jwt-keys sidecar | GREEN | 1 | run 150 ✓ | #11 | … | valkey 8.1.11 → 9.1.3 fixes CVE-2026-27623 (high) + GHSA-fq2f-crmw-q97r (high, no CVE id) — upstream published the major in 2.0.0+v6.0.4 on Nov 12, and this PR keeps it while adding the deployability work (runtime RSA keys instead of manual PEM secrets, Elixir → Rust docspec switch). Superseded PR #9 (RED at build 57) — close it. |
| hedgedoc | db 16-alpine → 18-alpine (app held at 1.12.0) | GREEN | ? | run 147 ✓ | #3 | … | PG 16.15 → 18.6 in place with the PG18 data-dir mount fix; seeded sentinel survived, live-verified. ? because the tag-only pgautoupgrade image publishes no advisories (no source can judge that window) and the app stays at 1.12.0 — upstream withdrew 1.12.1/1.12.2 as unsafe, so its ≥7 GHSA fixes remain unpatched until a clean release ships. Not a clean scan. Don't merge upstream renovate's tag-only bump (no mount fix). |
| mumble | v1.6.870-0 → v1.6.1001-0 | GREEN | none | run 152 ✓ | #2 | … | Server hardening batch: unauthenticated connections can no longer move data and are dropped if auth stalls, reserved names rejected, crash/DoS fixes (malformed packets, temporary-group race, ICE registerUser), ACL-cache and TLS-1.3 cipher compat. No CVE ids published — 0 is what the scan and changelog support. Still an RC series; no sqlite/config migration. |
| ghost | 6.67.0-alpine → 6.77.0-alpine | GREEN | none | run 145 ✓ | #8 | … | Spans 6.68–6.77: React editor/billing screens (Ember gone from Admin), editor fonts, automation triggers + member-label filters, member custom fields, file support in automation emails, Node.js security bumps (no CVE ids attributed to the window). MySQL deliberately held at 8.4 LTS (9.x/26.x are a different Oracle line); migrations ran clean on deploy. |
| matrix-synapse | signal/telegram bridges v0.2609.0 → v0.2610.0 | GREEN | none | run 153 ✓ | #8 | … | synapse v1.165.0 + MAS 1.29.0 were already merged upstream by renovate the same morning; this PR is the remaining delta — the two mautrix bridge bumps (libsignal update, block/unblock, view-limited media, power-level fixes). Beware abra ranking stale display-name tags (v26.02.x) above the real calver v0.2610.0. Bridge PG13 DBs deliberately held (plain-postgres majors need dump/restore). |
| n8n | 2.47.2 → 2.48.2 | GREEN | none | build 154 ✓ | #10 | … | Newest same-major; the 3.x major deliberately held (removed nodes, renamed storage dir, migration report required). Note 2.48.x is upstream's pre-release line (stable = 2.47.5) — the publish decision is the operator's. GHSA-365g-vjw2-grx8 (high, Execute Command node) adjudicated NOT-FIXED upstream — see Addendum. |
| bluesky-pds | 0.4.5027 → 0.4.5051 (@atproto/pds 0.5.27 → 0.5.51) | GREEN | none | run 141 ✓ | #6 | … | Same-series window: optional email 2FA (off by default), lexicon updates, Undici hardening (0.5.46), .well-known/change-password fix (0.5.50); caddy unchanged. Three open PRs to reconcile — #5 superseded (close), #4 routing fix green at build 128 for weeks (merge or hand over). |
| custom-html | openssh-server:latest digest re-pin aa4e1b39… → 161e0b67… | GREEN | none | build 144 ✓ | #11 | … | SFTP overlay digest refresh to the 2026-11-08 upstream build (tag+digest pins make abra FATA, so the check ran via direct registry inspection); nginx 1.31.8 / git v2.54.0 current. alpine/git's live digest has also drifted — left to its Renovate branch. Same-tag window, so no CVE attribution. |
| lasuite-drive | — | GREEN | none | build 136 ✓ · Nov 6 | #8 | … | Up-to-date: upstream main (1.2.0+v0.27.0, Nov 12) already carries every flagged bump plus the MinIO → RustFS swap. Open PR #8 (v0.26.0) is now behind main — merging would downgrade; an advisory comment is on the PR. Close it. |
| keycloak | — | UPTODATE | none | | | | Up-to-date — last week's 36-CVE security patch (26.8.2) was upstreamed and published by the operator as 10.9.8+26.8.2; mariadb 13.0 current. The stale abra checkout that re-proposed the bump is a known survey quirk, reconciled before acting. |
| lasuite-meet | — | UPTODATE | none | | | | Up-to-date — v1.37.0 published upstream as 0.9.0+v1.37.0; upgrade PR #13 closed as merged-upstream during reconcile. |
| drone | — | UPTODATE | none | | | | Up-to-date (drone/drone 2.28.2 current). |
| rustdesk-server | — | UPTODATE | none | | | | Up-to-date (rustdesk-server 1.1.16 current); initially missed by the stale on-host clone and re-surveyed from the fresh staged one. |
Addendum
- wordpress #2 — the top-priority fix on the page — spends a second week unmergeable: upstream published 4.2.0+7.1.4 on Oct 30 and both the PR branch and main moved the same recipe-version label line (the branch also still pins the app at 7.1.3, so a raw merge would regress the app). It needs a rebase onto current main plus a fresh !testme; upstream main still ships session.upload_progress on, so the php2shell exposure persists until it lands.
- Five recipes hold multiple open PRs to reconcile: bluesky-pds (#6 upgrade merge-ready; #5 superseded — close; #4 routing fix, green at build 128 for weeks — merge or hand over), gitea (#13 upgrade + #4 writable app.ini fix, green since August and re-verified at build 129), lasuite-docs (#11 current + #9 superseded, RED at build 57 — close), mailu (#11 upgrade + #3 backupbot labels, green at build 483), and lasuite-drive (#8 superseded by upstream v0.27.0 — merging would downgrade to v0.26.0/MinIO; close).
- Drift between the run summary and reality: the summary counts “PR green (!testme): 13” but lists fourteen green upgrade PRs (Considered 20 = 14 green + 6 skipped). The PR list is the accurate one; worth fixing the counter before next week.
- Survey infrastructure, two standing snags: (1) the on-host cc-ci clone used for candidate listing is stale again — rustdesk-server was missing from it until re-surveyed from the fresh staged clone; restage or repoint before next week. (2) The orchestrator's local cc-ci checkout cannot git fetch (permissions) and its origin/main ref is stale — harmless to this run, worth a rebuild.
- Overlay images are still invisible to !testme: the gitea suite exercises the sqlite3 overlay and hedgedoc's the default sqlite compose, so neither run proves the postgres-overlay bumps — both were validated by ad-hoc direct dev deploys instead (recorded in the PRs). Wiring an overlay test path would make that evidence routine rather than hand-carried.
- n8n carries an unpatchable-by-upgrade advisory: GHSA-365g-vjw2-grx8 (high, Execute Command node; vulnerable range > 0.0.1 with no fixed version — upstream states no behavior change is planned). Where workflow authors are untrusted, mitigate via NODES_EXCLUDE. Recurring; nothing to merge fixes it.
- hedgedoc's security picture stays inverted: the releases that would fix ≥7 GHSAs (1.12.1/1.12.2) remain withdrawn upstream as unsafe, leaving 1.12.0 exposed until a clean release ships. The ? is “no measurable window”, never “clean”. abra's resolver still offers the withdrawn tags (it cannot see withdrawals) — keep refusing them; the CI suite would likely false-green them since its SQLite tests miss the PostgreSQL auth/registration regressions.
- abra still cannot parse tag-plus-digest image pins (immich's DB, custom-html's nginx) — both were rescued this run by direct registry checks, but the parser gap leaves the weekly resolver silently dependent on hand-checks for exactly the recipes that pin by digest.
- Resolved from last week: mailu's data-safety item landed — upstream main now carries the in-place sqlite restore fix (the old restore path never actually restored), and the mirror's older upgrade PRs closed as merged-upstream. Two closed-merged-upstream PRs this week in total (lasuite-meet #13, mailu #10) — the reconcile-first step is doing its job.
Security Bulletin
🔒 Critical CVE upgrades
mailu — php2shell CVE-2026-109618 / CVE-2026-109619 (critical · CVSS 9.2/9.8) · internet-facing webmail
Mailu 2024.06.67 → 2024.06.68 (all six images) mitigates the PHP php2shell pair behind CERT-EU 2026-018 — CVE-2026-109619 (critical, CVSS 4.0 9.2, unauthenticated remote code execution via stale global state, with public exploit tooling circulating) and its sibling CVE-2026-109618 (rated critical by BSI) — in the Roundcube webmail images, pending a patched PHP runtime. Webmail sits on an internet-facing mail host, so prioritise the merge. No config or schema changes; !testme GREEN at build 151. Note the vendor's “mitigate pending a patched PHP runtime” language — expect a follow-up release that lands the fixed PHP base.
wordpress — the same php2shell pair, fix green but unmerged (critical · CVSS 9.2) · second week
PR #2 — the PHP 8.3.36 image rebuild plus session.upload_progress off, which also blunts the confirmed session paths of CVE-2026-115560 (no fixed release yet) — has been green since Oct 26 but remains unmergeable: upstream published 4.2.0+7.1.4 on Oct 30 and both moved the same recipe-version label line, so a raw merge would regress the app to 7.1.3. Rebase onto current main, re-run !testme, merge. Upstream main still ships upload_progress on and the older PHP base, so every
wordpress install in the fleet stays exposed to an unauthenticated RCE with public tooling until this lands — the oldest unmerged security item on the wire.
gitea — postgres 15.20 security rollup: 43 CVEs in a one-line overlay bump
The postgres overlay 15.19 → 15.20 is PostgreSQL's security rollup — 43 CVEs are named in the 15.20 release notes (the advisory-range scan attributes none of them to the window; PG publishes fixes ahead of advisory metadata, so per-CVE severities are not itemised here). It is same-major and binary-compatible: no pg_upgrade, and an existing 15.x data directory starts unchanged — verified live by deploying the pinned 15.19 image, then cycling the upgrade in place on the same volume with a clean start and a green app healthz. The app's own 28.3.0 fixes (21 CVEs incl. 7 high — review-triggered Actions workflows, token-scope bypasses, stored XSS, visibility leaks) are already upstream via the operator's 3.6.11+28.3.0 release, so this PR is the one remaining line. !testme GREEN at run 148; the suite tests the sqlite overlay, so the postgres path rests on the direct in-place deploy, stated in the PR.
discourse — 2026.7.5 security patch: 37 advisories (privilege escalation · CSRF · metadata leaks)
The 2026.7.4 → 2026.7.5 ESR patch is an explicit security release: 37 advisories fixed, GHSA-tracked but without CVE ids, and the vendor publishes no per-advisory CVSS. Named fixes include moderator privilege escalation via others' invite keys, CSRF in DiscourseConnect invite-key handling, hidden group-membership and private-category metadata leaks, IP disclosure to restricted moderators, and per-cook hashtag-bridge resource exhaustion. One low advisory (CVE-2025-53016) could not be judged — no published fix version — so 37 is a floor, not a total. No migrations beyond normal boot; pg18 / redis 8.10 held. !testme GREEN at run 146 with all five tiers including a create-topic roundtrip.
cryptpad — 2026.10.1 security release (high · CVSS 7.3) · on top of a breaking rewrite
cryptpad 2026.5.1 → 2026.10.1 is a security release — the vendor's highest CVSS 4.0 score is 7.3 (high), with no CVE ids published — sitting on the breaking 2026.10 server rewrite. The PR carries what the rewrite requires: the new infra.js config mount (the image's config dir is root-owned, and fresh deploys crash-loop without the mount — caught in this run's live check), the websocket port move :3003 → :3000, and https://-schemed domain env. SSO deployments must move the SSO plugin to 1.0.0+; office deployments move to Euro-Office 9.3. Review /checkup/ after upgrading. !testme GREEN at run 142; recommended publish is a major (1.0.0+v2026.10.1).
immich — v3.4.0 security-fix batch: 17 advisories (shared links · host anchoring · escaping)
immich v3.3.5 → v3.4.1 (app + machine-learning) picks up v3.4.0's batch of security fixes — 17 GHSA advisories without CVE ids: shared-link visibility, plugin allowedHosts anchoring, upload-access checksum enforcement, email-template escaping and CSP inline hashes, among others. No server-side breaking change; TypeORM migrations auto-run (104 applied in the live check) and the pgvectors 0.3.0 DB bump is already carried with a re-verified digest. v3.3.6 along the way also switches off the ML container's onnxruntime telemetry (anonymous metrics to Microsoft). !testme GREEN at build 149.
lasuite-docs — valkey 8.1.11 → 9.1.3 fixes CVE-2026-27623 (high) · already upstream, deploy to benefit
The valkey major fixes CVE-2026-27623 (high, GHSA-93p9-5vc7-8wgr) plus GHSA-fq2f-crmw-q97r (high, no CVE id). Upstream published the bump in 2.0.0+v6.0.4 on Nov 12, so instances still on a pre-2.0.0 release get the fix by deploying current main; PR #11 rides on top and adds the runtime jwt-keys sidecar (fresh installs no longer need manual PEM secret insertion) and the Elixir → Rust docspec switch (:4000 → :3000). Compatibility was checked for this standalone, no-auth store (none of Valkey 9's breaking edges apply) and 12/12 services converged live. !testme GREEN at run 150.
What changed
2024.06.67 → 2024.06.68 across all six Mailu images (nginx, admin, dovecot, postfix, rspamd, webmail) — the php2shell mitigation release. redis 8.10.3 and certdumper v2.11.4 were already current upstream, so the PR's diff is exactly the six image tags. No config or schema changes; Mailu services share one tag and must move together. One pre-existing webmail startup race (set_real_ip_from) is identical on 2024.06.67 and self-recovers on restart.
No upgrade this run — main is already at 4.2.0+7.1.4 on the numeric line — but the open php2shell fix PR is the fleet's oldest unmerged security item: PHP 8.3.36 rebuild plus session.upload_progress off, green since Oct 26 and now blocked on a rebase onto the 7.1.4 label line (see Security Bulletin). The floating atmoz/sftp:alpine tag stays unverifiable by design.
One line: compose.postgres.yml postgres 15.19 → 15.20 on the optional overlay (the app stays at the operator-published 3.6.11+28.3.0; mariadb 10.11.19 is the newest 10.11.x). Same-major security rollup, no pg_upgrade — verified by deploying the pinned 15.19 image to initialise a real volume, then cycling the bump in place: clean start on the existing data dir, app healthz pass. The suite tests the sqlite3 overlay, so the postgres path rests on that direct deploy, stated in the PR. Recommended publish: 3.6.12+28.3.0-rootless.
2026.7.4 → 2026.7.5 on the 2026.7 ESR line — security-only patch (37 advisories; see Bulletin), no config changes, Rails migrations run on boot. pg18 and redis 8.10-alpine deliberately held. Verified through all five tiers including a create-topic roundtrip and clean teardown with no secret leak.
2026.5.1 → 2026.10.1 — the Autumn fix release on top of the breaking 2026.10 server rewrite, and itself a security release (CVSS 7.3). The PR adds what the rewrite requires: the infra.js config mount (fresh deploys crash-loop without it — surfaced in the live check and fixed by matching upstream's config topology), websocket :3003 → :3000, https://-schemed domain env, SSO plugin 1.0.0+ mounted directly into the root-owned config dir, and the install-office.sh rename. Recommended publish: a major, 1.0.0+v2026.10.1.
v3.3.5 → v3.4.1 for app + machine-learning: v3.3.6 (ML onnxruntime telemetry off), v3.4.0 (workflow/OCR triggers, JPEG XL support, mobile tags, backup improvements, plus the 17-advisory security batch), v3.4.1 (shared-link cover fix, HEIF mime mapping, prometheus exporter bind). The pgvectors 0.2.0 → 0.3.0 DB bump was already in the PR with a re-verified index digest; PG major and VectorChord stay put. 104 migrations auto-applied; all four services converged and torn down clean.
2.44.1 → 2.44.2 — bug-fix/security patch (basic auth, HTTP OPTIONS handling, ignore-hidden-files; detailed advisories not yet published upstream, so the security count is a floor). No config changes: the recipe passes host/root/port explicitly, and the experimental memory-cache section that no longer does anything is unused here.
Rebased onto upstream's fresh 2.0.0+v6.0.4 (valkey 9.1.3 kept): the PR swaps the archived Elixir docspec image (3.0.2, port 4000) for the canonical Rust ghcr.io/docspec/api:1.21.4 on port 3000, and replaces the two manual PEM external secrets with an idempotent jwt-keys sidecar that generates and keeps runtime RSA keys in a shared volume (README rewritten accordingly). 12/12 services converged live, jwks endpoints green. Superseded PR #9 remains open — close it.
db pgautoupgrade 16-alpine → 18-alpine plus the PG18 data-dir mount move (postgres:/…/data → postgres:/var/lib/postgresql) the new entrypoint layout needs. Seeded a PG16 volume with a sentinel row, cycled the upgrade in place — “Upgrade to PostgreSQL 18.6 complete”, sentinel survived, app serving 200 — then tore everything down with zero leaks. App deliberately held at 1.12.0 (1.12.1/1.12.2 withdrawn upstream); upstream renovate's tag-only bump lacks the mount fix — don't merge that alone.
mumble-server v1.6.870-0 → v1.6.1001-0 (1.6 RC 2): unauthenticated connections can no longer move data and are dropped if auth stalls; reserved names are rejected for them; crash/DoS fixes for malformed packets, a temporary-group race and ICE registerUser; ACL-cache correctness and TLS-1.3 sslCiphers compatibility. mumble-web 0.5 unchanged (the fork is effectively unmaintained); no sqlite or config migration.
6.67.0-alpine → 6.77.0-alpine, spanning 6.68–6.77: React editor/billing replace Ember in Admin, editor fonts and distraction-free writing, automation triggers with member-label filters, member custom fields, file support in automation/welcome emails, plus Node.js security bumps. MySQL deliberately held at 8.4 LTS — the 9.x/26.x candidates are a different Oracle line Ghost does not support. Migrations ran clean on deploy; the optional custom-version overlay needed no change.
The two mautrix bridges v0.2609.0 → v0.2610.0: libsignal update, phone-numberless accounts, username links, block/unblock, view-limited media, power-level fixes. synapse v1.165.0 and MAS 1.29.0 were already merged upstream by renovate that morning, so this PR is exactly the bridge delta, rewritten to one commit on main. The three plain-postgres 13-alpine bridge DBs are deliberately held (majors need dump/restore). Gotcha recorded: abra ranks the stale display-name tags (v26.02.x) above the real calver release.
2.47.2 → 2.48.2, the newest 2.x: 2.48.0 (Apps bindings UI, redaction policy on log streaming/telemetry/error reports, webhook body charset decoding, OAuth JWKS retired-key handling), 2.48.1 (expression transfers, bare node references), 2.48.2 (Public API rejects edits to read-only credential nodes). The 3.x major is deliberately held — removed nodes, a renamed storage directory that refuses dual presence, and a required migration report. Note 2.48.x is upstream's pre-release line (stable = 2.47.5); the operator may prefer publishing 2.47.5 instead. GHSA-365g-vjw2-grx8 remains unfixable upstream (see Addendum).
0.4.5027 → 0.4.5051 (the image tags map to @atproto/pds 0.5.27 → 0.5.51): optional email 2FA (off by default), lexicon updates, Undici hardening in 0.5.46, and the .well-known/change-password fix in 0.5.50. No operator action; caddy unchanged. The existing upgrade PR was rewritten to one commit on current upstream main rather than duplicated.
Digest re-pin of the optional SFTP overlay's openssh-server:latest (aa4e1b39… → 161e0b67…, the 2026-11-08 upstream build) — same tag, refreshed multi-arch index, verified end-to-end with an SSH roundtrip into the deployed container before teardown. nginx 1.31.8 and alpine/git v2.54.0 are current; alpine/git's live index digest has also drifted, but that's Renovate's branch. Tag+digest pins make abra FATA, so both checks ran via direct registry inspection.
Nothing to upgrade — upstream main (1.2.0+v0.27.0, published Nov 12) already carries every resolver-flagged bump: drive v0.27.0, redis 8.10.3, collabora 26.04.6.1.1, onlyoffice 10.0.2.1, plus the MinIO → RustFS replacement. The open PR #8 (v0.26.0, green at build 136 on its obsolete head) is now behind main — merging would downgrade — and carries an advisory comment saying so. Registry follow-up recorded: the upstream source registry should gain a rustfs row.