recipe-maintainers/cc-ci-orchestrator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

merge origin/main

Browse Source 
# Conflicts:
#	cc-ci-plan/JOURNAL.md
This commit is contained in:
autonomic-bot
2026-09-28 20:03:33 +00:00
parent aaaec02f93 71e3d0e852
commit bf84f7f300
26 changed files with 792 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cc-ci-plan/upstream/mattermost-lts.md
+31
View File
@@ -6,6 +6,37 @@
| postgres | postgres | https://github.com/postgres/postgres | https://www.postgresql.org/docs/release/ |
## Standing notes
- **2026-09-18 re-check** (Mattermost release-policy docs; GitHub release; Docker Hub; vendor
security feed): **11.7 ESR line UNCHANGED** — newest patch **11.7.11** (released 2026-09-15,
"Low to High severity level security fixes"; Docker Hub tag pushed 2026-09-15). v10.11 ESR
remains EXPIRED (2026-08-15); 10.11.24 sits on the dead line — do NOT target. This run
extended open PR #2 **11.7.10 → 11.7.11** (branch tip 5696f0b4). Direct `--chaos` deploy on
cc-ci exercised the full operator path (deploy at 10.11.22 → seed admin user via API →
upgrade to 11.7.11): schema migrations ran on boot, **seeded user data survived** (same
id/roles, login 200), ping 200 with x-version-id 11.7.11; `!testme` **GREEN**, drone 1373
(level 5: install/upgrade/backup/restore/custom all pass, clean teardown). Vendor feed: **6
server advisories fixed in 11.7.11** (MMSA-2026-00711 Low; -00761/-00763/-00764/-00765/-00773
Medium, all affecting 11.7.x <= 11.7.10; CVE ids pending 30-day disclosure, due 2026-10-15).
**CVE-2026-13426 re-adjudicated FIXED** for the 10.11.22 → 11.7.11 window (fresh GitHub
compare: fix commit 3321db82 is an ancestor of v11.7.11 — ahead/behind 0 — and diverged from
v10.11.22) → window CVE count **14** (13 deterministic + 1 adjudicated). postgres **15-alpine
HELD** (DB-major out of scope). Gotchas learned: `abra app new` RESETS the recipe checkout to
main (re-checkout the branch before a `--chaos` deploy), and `abra app new --domain` does NOT
write DOMAIN into the app .env (edit the .env + redeploy to fix traefik routing).
- **2026-09-11 re-check** (Mattermost Server Releases docs; endoflife.date/api/mattermost.json;
GitHub releases + module tags): **11.7 ESR line UNCHANGED** — newest patch still **11.7.10**
(2026-08-26; no 11.7.11; v11.11.0 is still a GitHub **prerelease**, innovation). **10.11 ESR
expired 2026-08-15; 10.11.23 (2026-08-13) was its FINAL patch** — the "10.x is LTS, never
11.x" survey hint appeared a THIRD time (2026-06-26, 2026-08-07, 2026-09-11) and was again
NOT followed: no supported 10.x LTS exists (10.12 = innovation, expired 2025-12-15). PR #2
re-verified unchanged (tree 59e8c2c0; direct `--chaos` deploy converged + ping 200;
`!testme` GREEN, drone 1355). **Adjudicated CVE-2026-13426 (MMSA-2025-00532, medium) FIXED by
the 10.11.22 → 11.7.10 window**: module fix `server/public` v0.1.22 (commit 3321db82, tag cut
2026-01-30 from the 11.4.0 cycle) is an ancestor of v11.7.10 but NOT of v10.11.22/v10.11.23
(GitHub compare evidence) → CVE count for the ESR move = **14** (13 deterministic + 1
adjudicated). postgres **15-alpine HELD** (recipe has no compose overlays beyond compose.yml;
no pg_upgrade/pgautoupgrade support in recipe or cc-ci tests; the floating 15-alpine tag picks
up 15.x patches on re-pull — pg 15.19 fixes CVE-2026-14662/14663/14664).
- **2026-08-28 re-check** (endoflife.date/api/mattermost.json 2026-08-28; Docker Hub; GitHub
releases): **11.7.10** (released 2026-08-26, "various bug fixes", not prerelease) is the newest
11.7.x ESR patch — the ESR/LTS line has NOT moved, still **11.7** (EOL **2027-05-15**). This run