recipe-maintainers/bluesky-pds
0
0
Fork 0
Code Issues Pull Requests 3 Actions Packages Projects Releases Wiki Activity

chore: upgrade app to 0.4.5046 #6

Open
autonomic-bot wants to merge 1 commits from upgrade-0.4.5046 into main
pull from: upgrade-0.4.5046
merge into: :main
Conversation 2 Commits 1 Files Changed 1
+1 -1
autonomic-bot commented 2026-10-23 02:24:53 +00:00
Owner
Copy Link
Copy Source

Upgrade: bluesky-pds app 0.4.5027 → 0.4.5046

Bump the app image to the newest available bluesky-social/pds tag. abra recipe upgrade bluesky-pds -m
reports candidates ["0.4.5046","0.4.5044","0.4.5043","0.4.5037","0.4.5036","0.4.5034"]; this takes
the newest, 0.4.5046. caddy is unchanged (abra confirms 2 is latest).

service image current new
app ghcr.io/bluesky-social/pds 0.4.5027 0.4.5046
caddy caddy 2 2 (unchanged)

Image-tag mapping: 0.4.5NNN == @atproto/pds 0.5.NN, so this step is @atproto/pds
0.5.27 → 0.5.46.

Upstream release notes: app 0.4.5027→0.4.5046 (@atproto/pds 0.5.27→0.5.46):
https://github.com/bluesky-social/atproto/blob/main/packages/pds/CHANGELOG.md
(app image tags: https://github.com/bluesky-social/pds/tags)

Upstream release notes: caddy 2→2: unchanged, no upgrade —
https://github.com/caddyserver/caddy/releases

Operator Action Required

None — no mandatory migration or config change.

  • The recipe env interface is unchanged (same PDS_* set + the same three secrets); upstream
    sample.env and compose.yaml are byte-identical between v0.4.5027 and v0.4.5046.
  • Entrypoint is unchanged: the image Cmd is still node --enable-source-maps index.ts, so the
    recipe's entrypoint.sh.tmpl (exec node ... index.ts) remains correct. Image is built on
    Node 24.22.1.
  • Health endpoint GET /xrpc/_health unchanged; no data migration required for this same-series re-pin.
  • Notable upstream items (all patch releases in the window): 0.5.36 adds optional email-based 2FA and
    fixes email-auth-factor toggles; 0.5.42 requires privileged app passwords for all chat.bsky RPC
    methods; 0.5.44 adds a strict access flag to report queues; 0.5.46 requires patched Undici versions
    for direct dependencies and versioned dispatchers. The 0.5.37 since/startCursor additions and the
    0.5.29 alt-field relaxations are additive client-facing changes.

Advisory scan

Deterministic scanner (cc-ci-plan/advisory-scan.py bluesky-pds --from 0.4.5027 --to 0.4.5046):

### Advisory scan (deterministic pre-step) — bluesky-pds 0.4.5027 → 0.4.5046

**CVEs fixed by this upgrade: 0 identified by the deterministic scan.**

Seen but not version-classified (15) — includes advisories from OTHER images in this recipe (sidecars), which this window cannot judge: CVE-2026-27585, CVE-2026-27586, CVE-2026-27587, CVE-2026-27588, CVE-2026-27589, CVE-2026-27590, CVE-2026-30851, CVE-2026-30852, CVE-2026-45135, CVE-2026-45692, CVE-2026-52844, CVE-2026-52845

_Sources checked: 7 (4 registry URLs + advisory APIs). This scan is ADDITIVE — it does not replace the release-note reading in the upgrade step._

--adjudicate re-run produced the same output (no open cases reached the adjudication pass). Union with
the release-note read: no CVE ids are named in the window's @atproto/pds entries, so the union count
is 0. No failed sources this run.

Verification

  • abra recipe lint bluesky-pds -C -n: only pre-existing warnings (R002 healthcheck, R007 README
    metadata, R015 secret-name length), unrelated to this bump.
  • Direct --chaos deploy on cc-ci (dev-bluesky-pds.ci.commoninternet.net, --server default) went
    green: NEW DEPLOYMENT 64002452, bluesky-social/pds: 0.4.5046 (new), both services 1/1. PDS logs
    starting→started; in-container and public GET /xrpc/_health both returned
    {"version":"0.4.5046"} (HTTP 200 via Caddy/Traefik TLS). The dev deploy was torn down — no stack,
    volumes, secrets, configs, network, containers or env file remain.
  • !testme results are posted below.

Release

This PR deliberately does not bump the coop-cloud.${STACK_NAME}.version label. After merge, the
operator runs:

abra recipe release bluesky-pds -z

(no --dry-run; -z patch — a non-breaking upstream patch bump). The recipe version bump + tag +
publish are the operator's final step.

Note: PR #5 (upgrade-589d490, 0.4.5027→0.4.5037) remains open and is untouched; this is a fresh
upgrade to the newer 0.4.5046.

NOT merged — for operator review.

cc @trav @notplants

## Upgrade: bluesky-pds app `0.4.5027` → `0.4.5046` Bump the `app` image to the newest available `bluesky-social/pds` tag. `abra recipe upgrade bluesky-pds -m` reports candidates `["0.4.5046","0.4.5044","0.4.5043","0.4.5037","0.4.5036","0.4.5034"]`; this takes the newest, `0.4.5046`. `caddy` is unchanged (abra confirms `2` is latest). | service | image | current | new | |---------|-------|---------|-----| | app | `ghcr.io/bluesky-social/pds` | `0.4.5027` | `0.4.5046` | | caddy | `caddy` | `2` | `2` (unchanged) | Image-tag mapping: `0.4.5NNN` == `@atproto/pds` `0.5.NN`, so this step is `@atproto/pds` **0.5.27 → 0.5.46**. **Upstream release notes:** app `0.4.5027`→`0.4.5046` (`@atproto/pds` `0.5.27`→`0.5.46`): https://github.com/bluesky-social/atproto/blob/main/packages/pds/CHANGELOG.md (app image tags: https://github.com/bluesky-social/pds/tags) **Upstream release notes:** caddy `2`→`2`: unchanged, no upgrade — https://github.com/caddyserver/caddy/releases ### Operator Action Required **None — no mandatory migration or config change.** - The recipe env interface is unchanged (same `PDS_*` set + the same three secrets); upstream `sample.env` and `compose.yaml` are byte-identical between `v0.4.5027` and `v0.4.5046`. - Entrypoint is unchanged: the image `Cmd` is still `node --enable-source-maps index.ts`, so the recipe's `entrypoint.sh.tmpl` (`exec node ... index.ts`) remains correct. Image is built on Node 24.22.1. - Health endpoint `GET /xrpc/_health` unchanged; no data migration required for this same-series re-pin. - Notable upstream items (all patch releases in the window): 0.5.36 adds optional email-based 2FA and fixes email-auth-factor toggles; 0.5.42 requires privileged app passwords for all `chat.bsky` RPC methods; 0.5.44 adds a strict access flag to report queues; 0.5.46 requires patched Undici versions for direct dependencies and versioned dispatchers. The 0.5.37 `since`/`startCursor` additions and the 0.5.29 `alt`-field relaxations are additive client-facing changes. ### Advisory scan Deterministic scanner (`cc-ci-plan/advisory-scan.py bluesky-pds --from 0.4.5027 --to 0.4.5046`): ``` ### Advisory scan (deterministic pre-step) — bluesky-pds 0.4.5027 → 0.4.5046 **CVEs fixed by this upgrade: 0 identified by the deterministic scan.** Seen but not version-classified (15) — includes advisories from OTHER images in this recipe (sidecars), which this window cannot judge: CVE-2026-27585, CVE-2026-27586, CVE-2026-27587, CVE-2026-27588, CVE-2026-27589, CVE-2026-27590, CVE-2026-30851, CVE-2026-30852, CVE-2026-45135, CVE-2026-45692, CVE-2026-52844, CVE-2026-52845 _Sources checked: 7 (4 registry URLs + advisory APIs). This scan is ADDITIVE — it does not replace the release-note reading in the upgrade step._ ``` `--adjudicate` re-run produced the same output (no open cases reached the adjudication pass). Union with the release-note read: no CVE ids are named in the window's `@atproto/pds` entries, so the union count is **0**. No failed sources this run. ### Verification - `abra recipe lint bluesky-pds -C -n`: only pre-existing warnings (R002 healthcheck, R007 README metadata, R015 secret-name length), unrelated to this bump. - Direct `--chaos` deploy on cc-ci (`dev-bluesky-pds.ci.commoninternet.net`, `--server default`) went green: `NEW DEPLOYMENT 64002452`, `bluesky-social/pds: 0.4.5046 (new)`, both services 1/1. PDS logs `starting`→`started`; in-container and public `GET /xrpc/_health` both returned `{"version":"0.4.5046"}` (HTTP 200 via Caddy/Traefik TLS). The dev deploy was torn down — no stack, volumes, secrets, configs, network, containers or env file remain. - `!testme` results are posted below. ### Release This PR deliberately does **not** bump the `coop-cloud.${STACK_NAME}.version` label. After merge, the operator runs: abra recipe release bluesky-pds -z (no `--dry-run`; `-z` patch — a non-breaking upstream patch bump). The recipe version bump + tag + publish are the operator's final step. Note: PR #5 (`upgrade-589d490`, `0.4.5027`→`0.4.5037`) remains open and is untouched; this is a fresh upgrade to the newer `0.4.5046`. NOT merged — for operator review. cc @trav @notplants
autonomic-bot added 1 commit 2026-10-23 02:24:53 +00:00
chore: upgrade app to 0.4.5046
cc-ci/testme cc-ci: success
Details
6400245224
autonomic-bot requested review from trav 2026-10-23 02:24:54 +00:00
autonomic-bot requested review from notplants 2026-10-23 02:24:54 +00:00
autonomic-bot commented 2026-10-23 02:25:01 +00:00
Author
Owner
Copy Link
Copy Source

!testme

!testme
autonomic-bot commented 2026-10-23 02:25:22 +00:00
Author
Owner
Copy Link
Copy Source

🌻 cc-ci — bluesky-pds @ 64002452 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `bluesky-pds` @ `64002452` ✅ **passed** [![cc-ci result card](https://ci.autonomic.zone/runs/73/summary.png)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/73) [![level](https://ci.autonomic.zone/runs/73/badge.svg)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/73) [full logs](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/73) · [dashboard](https://ci.autonomic.zone/)
All checks were successful
cc-ci/testme cc-ci: success
Details
You are not authorized to merge this pull request.
This pull request can be merged automatically.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin upgrade-0.4.5046:upgrade-0.4.5046
git checkout upgrade-0.4.5046
Sign in to join this conversation.
Reviewers
No Reviewers
trav
notplants
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
aadil (Aadil Ayub) autonomic autonomic-bot kawaiipunk (KawaiiPunk) notplants trav (Trav Fryer)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: recipe-maintainers/bluesky-pds#6