Extends this existing upgrade PR (its branch was at 0.4.5036) to the newest available bluesky-social/pds tag. abra recipe upgrade bluesky-pds -m reports candidates ["0.4.5037","0.4.5036","0.4.5034"]; this takes the newest, 0.4.5037. The branch is
fast-forwarded on top of the previous 0.4.5036 commit — no force-push, one evolving upgrade PR.
Cumulative PR window: 0.4.5027 → 0.4.5037.
service
image
current
new
app
ghcr.io/bluesky-social/pds
0.4.5036
0.4.5037
caddy
caddy
2
2 (unchanged)
Image-tag mapping: 0.4.5NNN == @atproto/pds0.5.NN, so this step is @atproto/pds0.5.36 → 0.5.37 (cumulative 0.5.27 → 0.5.37).
None. 0.5.37 is a non-breaking patch release: the recipe's env interface is unchanged
(same PDS_* set + the same three secrets), no data migration is required, and the health
endpoint GET /xrpc/_health is unchanged. Notable upstream items: since/startCursor added
to getTimeline/getListFeed, improved actor-store resource management, and MSTs referencing
the same node are now rejected (VisitedCidError; importRepo → InvalidRequest).
Advisory scan
Deterministic scanner (cc-ci-plan/advisory-scan.py bluesky-pds --from 0.4.5027 --to 0.4.5037): 0 CVEs fixed by this upgrade; 14 advisories seen but not version-classified (they belong to
other images / fall outside this window). --adjudicate produced no open cases, and the
release-note read found no CVEs either. Union count: 0.
Verification
abra recipe lint bluesky-pds -C -n: only pre-existing warnings (README metadata, caddy
healthcheck, long secret names), unrelated to this bump.
Direct --chaos deploy on cc-ci (dev-bluesky-pds.ci.commoninternet.net, --server default)
performed a live 0.4.5036 → 0.4.5037 upgrade: converged 1/1, healthcheck returned 200, and
public GET /xrpc/_health returned {"version":"0.4.5037"}. The dev deploy was torn down
afterwards (no stack, volumes, or secrets left behind).
!testme results are posted below.
Release
This PR deliberately does not bump the coop-cloud.${STACK_NAME}.version label. After
merge, the operator runs:
abra recipe release bluesky-pds -z
(no --dry-run; -z patch — a non-breaking upstream patch bump). The recipe version bump +
tag + publish are the operator's final step.
NOT merged — for operator review.
Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.
## Upgrade: bluesky-pds app `0.4.5036` → `0.4.5037`
Extends this existing upgrade PR (its branch was at `0.4.5036`) to the newest available
`bluesky-social/pds` tag. `abra recipe upgrade bluesky-pds -m` reports candidates
`["0.4.5037","0.4.5036","0.4.5034"]`; this takes the newest, `0.4.5037`. The branch is
fast-forwarded on top of the previous `0.4.5036` commit — no force-push, one evolving upgrade PR.
Cumulative PR window: `0.4.5027` → `0.4.5037`.
| service | image | current | new |
|---------|-------|---------|-----|
| app | `ghcr.io/bluesky-social/pds` | `0.4.5036` | `0.4.5037` |
| caddy | `caddy` | `2` | `2` (unchanged) |
Image-tag mapping: `0.4.5NNN` == `@atproto/pds` `0.5.NN`, so this step is
`@atproto/pds` **0.5.36 → 0.5.37** (cumulative **0.5.27 → 0.5.37**).
**Upstream release notes:** app 0.4.5036→0.4.5037 (`@atproto/pds` 0.5.36→0.5.37):
https://github.com/bluesky-social/atproto/blob/main/packages/pds/CHANGELOG.md
### Operator Action Required
None. `0.5.37` is a non-breaking patch release: the recipe's env interface is unchanged
(same `PDS_*` set + the same three secrets), no data migration is required, and the health
endpoint `GET /xrpc/_health` is unchanged. Notable upstream items: `since`/`startCursor` added
to `getTimeline`/`getListFeed`, improved actor-store resource management, and MSTs referencing
the same node are now rejected (`VisitedCidError`; `importRepo` → `InvalidRequest`).
### Advisory scan
Deterministic scanner (`cc-ci-plan/advisory-scan.py bluesky-pds --from 0.4.5027 --to 0.4.5037`):
**0 CVEs fixed by this upgrade**; 14 advisories seen but not version-classified (they belong to
other images / fall outside this window). `--adjudicate` produced no open cases, and the
release-note read found no CVEs either. Union count: **0**.
### Verification
- `abra recipe lint bluesky-pds -C -n`: only pre-existing warnings (README metadata, caddy
healthcheck, long secret names), unrelated to this bump.
- Direct `--chaos` deploy on cc-ci (`dev-bluesky-pds.ci.commoninternet.net`, `--server default`)
performed a live **0.4.5036 → 0.4.5037** upgrade: converged `1/1`, healthcheck returned 200, and
public `GET /xrpc/_health` returned `{"version":"0.4.5037"}`. The dev deploy was torn down
afterwards (no stack, volumes, or secrets left behind).
- `!testme` results are posted below.
### Release
This PR deliberately does **not** bump the `coop-cloud.${STACK_NAME}.version` label. After
merge, the operator runs:
abra recipe release bluesky-pds -z
(no `--dry-run`; `-z` patch — a non-breaking upstream patch bump). The recipe version bump +
tag + publish are the operator's final step.
NOT merged — for operator review.
Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.
cc @trav @notplants
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Upgrade: bluesky-pds app
0.4.5036→0.4.5037Extends this existing upgrade PR (its branch was at
0.4.5036) to the newest availablebluesky-social/pdstag.abra recipe upgrade bluesky-pds -mreports candidates["0.4.5037","0.4.5036","0.4.5034"]; this takes the newest,0.4.5037. The branch isfast-forwarded on top of the previous
0.4.5036commit — no force-push, one evolving upgrade PR.Cumulative PR window:
0.4.5027→0.4.5037.ghcr.io/bluesky-social/pds0.4.50360.4.5037caddy22(unchanged)Image-tag mapping:
0.4.5NNN==@atproto/pds0.5.NN, so this step is@atproto/pds0.5.36 → 0.5.37 (cumulative 0.5.27 → 0.5.37).Upstream release notes: app 0.4.5036→0.4.5037 (
@atproto/pds0.5.36→0.5.37):https://github.com/bluesky-social/atproto/blob/main/packages/pds/CHANGELOG.md
Operator Action Required
None.
0.5.37is a non-breaking patch release: the recipe's env interface is unchanged(same
PDS_*set + the same three secrets), no data migration is required, and the healthendpoint
GET /xrpc/_healthis unchanged. Notable upstream items:since/startCursoraddedto
getTimeline/getListFeed, improved actor-store resource management, and MSTs referencingthe same node are now rejected (
VisitedCidError;importRepo→InvalidRequest).Advisory scan
Deterministic scanner (
cc-ci-plan/advisory-scan.py bluesky-pds --from 0.4.5027 --to 0.4.5037):0 CVEs fixed by this upgrade; 14 advisories seen but not version-classified (they belong to
other images / fall outside this window).
--adjudicateproduced no open cases, and therelease-note read found no CVEs either. Union count: 0.
Verification
abra recipe lint bluesky-pds -C -n: only pre-existing warnings (README metadata, caddyhealthcheck, long secret names), unrelated to this bump.
--chaosdeploy on cc-ci (dev-bluesky-pds.ci.commoninternet.net,--server default)performed a live 0.4.5036 → 0.4.5037 upgrade: converged
1/1, healthcheck returned 200, andpublic
GET /xrpc/_healthreturned{"version":"0.4.5037"}. The dev deploy was torn downafterwards (no stack, volumes, or secrets left behind).
!testmeresults are posted below.Release
This PR deliberately does not bump the
coop-cloud.${STACK_NAME}.versionlabel. Aftermerge, the operator runs:
(no
--dry-run;-zpatch — a non-breaking upstream patch bump). The recipe version bump +tag + publish are the operator's final step.
NOT merged — for operator review.
Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.
cc @trav @notplants
!testme
🌻 cc-ci —
bluesky-pds@589d490b✅ passedfull logs · dashboard
!testme
🌻 cc-ci —
bluesky-pds@589d490b✅ passedfull logs · dashboard
!testme
🌻 cc-ci —
bluesky-pds@589d490b✅ passedfull logs · dashboard
chore: upgrade app to 0.4.5034to chore: upgrade bluesky-social/pds to 0.4.5034!testme
🌻 cc-ci —
bluesky-pds@589d490b✅ passedfull logs · dashboard
chore: upgrade bluesky-social/pds to 0.4.5034to chore: upgrade app to 0.4.5036!testme
🌻 cc-ci —
bluesky-pds@1a51596f✅ passedfull logs · dashboard
chore: upgrade app to 0.4.5036to chore: upgrade app to 0.4.5037!testme
🌻 cc-ci —
bluesky-pds@7ed391b9✅ passedfull logs · dashboard
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.