recipe-maintainers/cc-ci-orchestrator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

upstream(mattermost-lts): 2026-09-18 re-check — 11.7.11 newest ESR patch; PR #2 extended 11.7.10→11.7.11, GREEN (drone 1373); CVE-2026-13426 re-adjudicated FIXED (window count 14)

Browse Source
This commit is contained in:
autonomic-bot
2026-09-18 07:54:13 +00:00
parent 6f63214d30
commit e29b5b4101
1 changed files with 17 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cc-ci-plan/upstream/mattermost-lts.md
+17
View File
@@ -6,6 +6,23 @@
| postgres | postgres | https://github.com/postgres/postgres | https://www.postgresql.org/docs/release/ | | postgres | postgres | https://github.com/postgres/postgres | https://www.postgresql.org/docs/release/ |
## Standing notes ## Standing notes
- **2026-09-18 re-check** (Mattermost release-policy docs; GitHub release; Docker Hub; vendor
security feed): **11.7 ESR line UNCHANGED** — newest patch **11.7.11** (released 2026-09-15,
"Low to High severity level security fixes"; Docker Hub tag pushed 2026-09-15). v10.11 ESR
remains EXPIRED (2026-08-15); 10.11.24 sits on the dead line — do NOT target. This run
extended open PR #2 **11.7.10 → 11.7.11** (branch tip 5696f0b4). Direct `--chaos` deploy on
cc-ci exercised the full operator path (deploy at 10.11.22 → seed admin user via API →
upgrade to 11.7.11): schema migrations ran on boot, **seeded user data survived** (same
id/roles, login 200), ping 200 with x-version-id 11.7.11; `!testme` **GREEN**, drone 1373
(level 5: install/upgrade/backup/restore/custom all pass, clean teardown). Vendor feed: **6
server advisories fixed in 11.7.11** (MMSA-2026-00711 Low; -00761/-00763/-00764/-00765/-00773
Medium, all affecting 11.7.x <= 11.7.10; CVE ids pending 30-day disclosure, due 2026-10-15).
**CVE-2026-13426 re-adjudicated FIXED** for the 10.11.22 → 11.7.11 window (fresh GitHub
compare: fix commit 3321db82 is an ancestor of v11.7.11 — ahead/behind 0 — and diverged from
v10.11.22) → window CVE count **14** (13 deterministic + 1 adjudicated). postgres **15-alpine
HELD** (DB-major out of scope). Gotchas learned: `abra app new` RESETS the recipe checkout to
main (re-checkout the branch before a `--chaos` deploy), and `abra app new --domain` does NOT
write DOMAIN into the app .env (edit the .env + redeploy to fix traefik routing).
- **2026-09-11 re-check** (Mattermost Server Releases docs; endoflife.date/api/mattermost.json; - **2026-09-11 re-check** (Mattermost Server Releases docs; endoflife.date/api/mattermost.json;
GitHub releases + module tags): **11.7 ESR line UNCHANGED** — newest patch still **11.7.10** GitHub releases + module tags): **11.7 ESR line UNCHANGED** — newest patch still **11.7.10**
(2026-08-26; no 11.7.11; v11.11.0 is still a GitHub **prerelease**, innovation). **10.11 ESR (2026-08-26; no 11.7.11; v11.11.0 is still a GitHub **prerelease**, innovation). **10.11 ESR