journal(upgrade-all): weekly run 2026-10-23 — 9 green, 2 pending warm-canonical minio fix

Only this event entry committed; pre-existing uncommitted orchestrator WIP left in the worktree untouched.

cc-ci-plan/JOURNAL.md

@@ -1331,3 +1331,15 @@ Weekly run 2026-10-02 complete: 20 considered · 9 upgraded (PRs opened/extended
 Key highlights: gitea upstream shipped its first 2-digit stable (28.0.0-rootless, 2026-09-29 — BREAKING git-egress/actions-retention notes documented in PR #10); ghost 6.67.0 fixes HIGH CVE-2026-84383; nulls held at mysql 8.4 / mariadb 12.3 / postgres 13/15 lines per precedent; matrix-synapse extended to synapse 1.162.0 + MAS 1.26.0; immich bumped v3.2.4 (rc.3.3 declined). Operational: recipe-maintainers/gitea mirror had LOST its master branch (abra whole-recipe FATA) — repaired both refs to upstream HEAD f167b73; reconcile-upstream.sh should learn to recreate a missing upstream-default branch ref, not only sync main. 2 targets (gitea, n8n 2.42.2) were caught in follow-up passes after the initial worklist mis-derivation — nothing left unprocessed. Sweep start: 4 leaked volumes + 46.3 GB images reclaimed (disk 70%->40%); end-of-run reap 0 leaked dev deploys; disk 65% (51G free).
 Per-recipe logs: .cc-ci-logs/upgrades/<recipe>-upgrade-2026-10-02.md (10 files incl. survey).
 NEVER MERGED anything; all PRs await operator review + the operator's `abra recipe release <recipe> -x/y/z` after each merge.
+
+### Event 2026-10-23 04:15 UTC — weekly /upgrade-all run complete (DEFAULT mode, nothing merged)
+Run 2026-10-23: 19 considered · 9 upgraded with !testme GREEN · 2 PRs open pending the warm-canonical
+minio-prepull fix (lasuite-docs PR #11, lasuite-drive PR #8 — !testme RED at the upgrade BASE prepull:
+warm canonicals 0.4.0+v5.4.1 / 0.12.0+v0.21.0 pin the REMOVED docker.io/minio/minio; PR comments
+explain; operator: advance those canonicals then re-post !testme) · 0 failed · 8 skipped up-to-date
+(cryptpad discourse drone hedgedoc keycloak mailu mumble wordpress — several had stale survey data;
+each re-verified against true upstream before skipping). GREEN PRs: bluesky-pds #6 · custom-html #10 ·
+custom-html-tiny #9 · ghost #8 · gitea #11 · immich #6 · lasuite-meet #12 · matrix-synapse #8 · n8n #9.
+Summary: .cc-ci-logs/upgrades/upgrade-all-2026-10-23.md (per-recipe logs alongside). Step-0 sweep
+reclaimed 19GB images (disk 61%->49%); end-of-run reap 0 leaked dev deploys.
+NEVER MERGED anything; PRs await operator review + `abra recipe release` after each merge.

cc-ci-plan/upstream/cryptpad.md

@@ -2,11 +2,21 @@
 
 | service | image | source repo | releases / changelog |
 |---------|-------|-------------|----------------------|
-| app     | cryptpad/cryptpad | https://github.com/cryptpad/cryptpad | https://github.com/cryptpad/cryptpad/releases |
+| app     | cryptpad/cryptpad | https://github.com/cryptpad/cryptpad | https://github.com/cryptpad/cryptpad/releases · https://hub.docker.com/r/cryptpad/cryptpad/tags |
 | web     | nginx             | https://github.com/nginx/nginx       | https://nginx.org/en/CHANGES |
 
 ## Standing notes
 - `abra recipe upgrade` cannot parse the `version-YYYY.M.D` tag format of the cryptpad/cryptpad image,
   so the app image is bumped by hand; the nginx sidecar is what `abra recipe upgrade` actually moves.
+- Only use tags in the canonical `version-YYYY.M.x` scheme. The `opendesk-YYYY.MM.DD` tags on
+  Docker Hub are openDesk-specific builds, not newer CryptPad releases — e.g. `opendesk-2026.08.04`
+  (built 2026-08-04) still contains CryptPad `2026.5.1` in `/cryptpad/package.json`.
+- CryptPad's GitHub releases and Docker Hub tags are not simultaneous: `2026.10.0` was released
+  2026-10-21 but `version-2026.10.0` was still absent from Docker Hub on 2026-10-23. Re-check the
+  Docker Hub tags page before treating a GitHub release as available for the recipe.
+- The 2026.10.0 release is a breaking one for the recipe: full server rewrite (separate
+  `cryptpad-server` package), split `config.js` → `config/infra.js` (public origin/ports move),
+  one proxy port for HTTP + websocket (no separate `3003` websocket port), and SSO plugin v1.0.0
+  required. Read its upgrade notes before attempting that bump.
 - nginx is HTTP/1.1-only here (sidecar on :8083, `proxy_http_version 1.1`), so HTTP/2/3 CVE changes in
   nginx releases generally don't affect this recipe — but still note them.

cc-ci-plan/upstream/gitea.md

@@ -41,3 +41,7 @@ in this file, so keep vendor security pages listed here.
 - **1.26.3**: carries a regression (#38177 "context deadline exceeded" opening repo code pages) — upstream says upgrade straight to 1.26.4, skip 1.26.3.
 - **1.27.0** (released 2026-07-13, MINOR with BREAKING changes): `Feat(actions)!: improve support for reusable workflows` (#37478) and `Use Content-Security-Policy: script nonce` (#37232, may break custom inline JS / reverse-proxy CSP). Many security + feature additions. A dedicated minor-bump run should evaluate CSP / reusable-workflow impact before adopting.
 - **1.27.1** (released 2026-07-27, PATCH): security fix (oauth2 mandatory 2FA enforcement on authorize/grant endpoints, #38606), API swagger alignment, diff-contrast enhancement, and many bugfixes (actions reusable-workflow/job-stranding, OIDC end-session, repo-deletion cleanup, webhook/mail). No breaking changes; safe patch bump from 1.27.0. Release notes: https://github.com/go-gitea/gitea/releases/tag/v1.27.1
+- **28.0.0** (released 2026-09-29, NEW MAJOR, BREAKING): git network operations now route through an internal proxy and egress settings changed (`Fix(git)!`, #39426) — outbound Git may need `[egress]` allow-listing; Actions adds `RUN_RETENTION_DAYS` (#38855). Also a large SECURITY batch (SSH key fingerprint identification, rejected invalid/duplicate Git objects, repo-scoped team authz, x/crypto DoS). GitHub notes: https://github.com/go-gitea/gitea/releases/tag/v28.0.0 — vendor post: https://blog.gitea.com/release-of-28.0.0/
+- **28.1.0** (released 2026-10-06, MINOR): 9 security fixes (push-mirror permission/`DISABLE_NEW_PUSH`, local-path import authz, repository media stored XSS, OAuth2 refresh-token kind, issue-attachment authz, `FORCE_PRIVATE` push-to-create, private RSS/Atom feed leak, tag-delete deleting releases, migration page-size DoS), plus MySQL/MariaDB `READ COMMITTED` and go-git repack fixes. No breaking changes. GitHub notes: https://github.com/go-gitea/gitea/releases/tag/v28.1.0 — vendor post (CVE list): https://blog.gitea.com/release-of-28.1.0/
+- **28.2.0** (released 2026-10-18, MINOR): 9 newly-fixed Gitea CVEs (SSH cert principal confusion, OpenID linking `state`, locked-issue reactions authz, release-attachment metadata leak, `/{username}/-/repositories` panic, draft-release attachment disclosure, Actions artifact v4 body limit, CSRF on repo topics, cross-org label deletion) plus dependency CVE-2026-78659 (`golang.org/x/net` v0.60.0). Three more CVEs are disclosed here but were already fixed in ≤28.1 (CVE-2026-110324, CVE-2026-109844, CVE-2026-97859). No breaking changes and no Postgres requirement. GitHub notes: https://github.com/go-gitea/gitea/releases/tag/v28.2.0 — vendor post (CVE list): https://blog.gitea.com/release-of-28.2.0/
+- **app.ini writability**: Gitea 1.24+ writes runtime config (e.g. `WORK_PATH`) back to `app.ini`; mounting it directly from a read-only swarm config makes that write fail (non-fatal but warned). The unmerged mirror PR #4 (`fix-app-ini-writable`) seeds a writable copy in the `config` volume. Image bumps must not change the config mount / `docker-setup.sh` handling on their own.

cc-ci-plan/upstream/immich.md

@@ -112,6 +112,17 @@
   Opt-in only: `MACHINE_LEARNING_MODEL_REVISION=v2` (optimized models, numerically equivalent, no job
   re-run) and the people-sharing feature (user-triggered button, not a deploy migration). Done in the
   2026-10-09 upgrade (v3.2.4→v3.3.1, app+ML+valkey, extending PR #6; fresh `!testme` GREEN — build #45).
+- **immich-server v3.3.3 (2026-10-14) + v3.3.4 (2026-10-20) + v3.3.5 (2026-10-21, latest stable) pins** (from
+  `docker/docker-compose.yml` @ the v3.3.5 tag): `postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357…`
+  (UNCHANGED since v3.3.0) and `valkey:9@sha256:c123e371…` (immich's tested 9.1.2, also unchanged). Upstream
+  coopcloud published v3.3.4 as `1.12.0+v3.3.4` (`6b294fce`) and moved the recipe's `redis` pin to the then-live
+  `418652cf…`; that divergence is left as upstream has it (no reason to churn a sidecar in an app bump).
+  `docker/docker-compose.yml` and `docker/example.env` are byte-identical between v3.3.4 and v3.3.5.
+  v3.3.3 = bug fixes (mobile memories date, people-query perf); v3.3.4 = further people-query perf + translation;
+  **v3.3.5 = security patch** (certifi CA-trust fix + October 2026 Node.js security patches). No schema
+  migration, no config/env change, no breaking server-side change. Done in the 2026-10-23 upgrade
+  (v3.3.4→v3.3.5, app+ML only, extending PR #6; live v3.3.4→v3.3.5 dev deploy healthy — migrations finished,
+  `vector`/`vchord` present, no pgvectors drop; `!testme` GREEN first run — build #78).
 - **2026-08-07 INFRA note: cc-ci runner's gitea clone-token is STALE (HTTP 401).** `!testme` build
   #1210 died at the recipe `git clone` step (~5s, before any deploy) with `could not read Username for
   'https://git.autonomic.zone'` — the runner's mounted gitea token `13e299f2…` is rejected (verified

cc-ci-plan/upstream/lasuite-docs.md

@@ -6,6 +6,9 @@
 | backend | lasuite/impress-backend | https://github.com/suitenumerique/docs | https://github.com/suitenumerique/docs/releases |
 | celery | lasuite/impress-backend | https://github.com/suitenumerique/docs | https://github.com/suitenumerique/docs/releases |
 | y-provider | lasuite/impress-y-provider | https://github.com/suitenumerique/docs | https://github.com/suitenumerique/docs/releases |
+| yhub | lasuite/impress-yhub | https://github.com/suitenumerique/docs | https://github.com/suitenumerique/docs/releases |
+| yhub-valkey | valkey/valkey | https://github.com/valkey-io/valkey | https://github.com/valkey-io/valkey/releases |
+| jwt-keys | lasuite/impress-yhub (Node crypto sidecar) | https://github.com/suitenumerique/docs | https://github.com/suitenumerique/docs/blob/main/UPGRADE.md |
 | docspec | ghcr.io/docspec/api | https://github.com/docspec/docspec | https://github.com/docspec/docspec/releases |
 | db | pgautoupgrade/pgautoupgrade | https://github.com/pgautoupgrade/docker-pgautoupgrade | https://github.com/pgautoupgrade/docker-pgautoupgrade/releases |
 | redis | redis | https://github.com/redis/redis | https://hub.docker.com/_/redis/tags |
@@ -13,8 +16,20 @@
 | web | nginx | https://github.com/nginx/nginx | https://nginx.org/en/CHANGES |
 
 ## Standing notes
-- impress-frontend, impress-backend (used for both backend + celery services), impress-y-provider all
-  share the same version tag from the suitenumerique/docs monorepo. Upgrade all four in lockstep.
+- **v6.0.x replaces the collaboration server**: hocuspocus/y-provider collaboration is gone; a new
+  `yhub` service (port 3002) serves `/collaboration/*`, with its own `yhub` PostgreSQL database and a
+  Valkey store. `y-provider` is conversion-only. New RSA keys (`JWT_PRIVATE_KEY_FILE` backend,
+  `YHUB_JWT_PRIVATE_KEY_FILE` yhub), `COLLABORATION_SERVER_SECRET` removed. Docs must be migrated into
+  yhub (`SOFT_MIGRATION=true` + `backend migrate_documents`). See UPGRADE.md `[6.0.0]`.
+- **v6.0.2** moves yhub to `@y/hub 0.10.1`, adding the `yhub_ydoc_versions_v1` table/indexes: re-run the
+  yhub schema script (`init-db`) — the recipe does it on every yhub start.
+- **The recipe generates the two RSA keys at runtime** into a `jwt_keys` volume (`jwt-keys` sidecar)
+  because abra cannot generate PEM secrets (`generate=false`) and Swarm secrets must pre-exist.
+- **docspec**: since Docs v5.7.0 the Rust `ghcr.io/docspec/api` (port 3000) replaces the archived Elixir
+  `ghcr.io/docspecio/api` (port 4000); Docs v6.0.2 expects `DOCSPEC_API_URL=http://docspec:3000/conversion`.
+- impress-frontend, impress-backend (used for both backend + celery services), impress-y-provider,
+  impress-yhub (and the jwt-keys sidecar image) all share the same version tag from the
+  suitenumerique/docs monorepo. Upgrade all of them in lockstep.
 - AUTO_MIGRATIONS=true means DB migrations run automatically on backend startup. No manual step needed.
 - Minio tag uses a date-based RELEASE.YYYY-MM-DDTHH-MM-SSZ format — abra cannot parse it for upgrades;
   check manually on https://github.com/minio/minio/releases.

cc-ci-plan/upstream/n8n.md

@@ -354,3 +354,35 @@
   converged. Advisory scan 2.43.2→2.43.6: 0 CVEs fixed (9 sources, none failed). Recommended
   release: `-y` (relative to the published label app tag 2.40.5 the delta spans feature minors
   2.41/2.42/2.43).
+- 2.43.7 (2026-10-16, patch): core suspend in-flight production executions at worker shutdown.
+- 2.43.8 (2026-10-19, patch): core turn off expression spans by default (backport of 2.44.4).
+- 2.44.3 (2026-10-16, patch): core keep Observer detail lines instead of discarding the response.
+- 2.44.4 (2026-10-19, patch): core reuse connections in the log-streaming webhook destination; turn
+  off expression spans by default.
+- 2.44.5 (2026-10-21, patch): core key queue job outcomes by job on shutdown resume; editor load
+  credential types on startup.
+- 2.44.6 (2026-10-22, patch; **`stable` floating tag points here**): Postgres Node prevent global
+  pgtypes overwrite.
+- 2.45.0 (2026-10-20, Pre-release; the 2.45 feature minor): automated migrations for removed nodes;
+  node and credential type policies enabled by default; durable scheduler enabled by default;
+  Idempotency-Key on Public API POSTs; workflow migration-findings endpoints/notifications; Kafka v2
+  default for new nodes; Monday.com V2 default; AI Agent/Assistant, editor and node fixes; UI rebrand.
+  **No breaking compose/env/volume/label changes; no `N8N_*` renames.**
+- 2.45.1 (2026-10-21, Pre-release): core claim an idle worker's next queue job and its lock atomically;
+  Microsoft Teams Trigger Graph subscription renewal via lifecycle notifications; editors can triage
+  migration findings.
+- 2.45.2 (2026-10-22, Pre-release; **`beta` floating tag points here — newest numeric tag**): core read
+  type-availability policies from memory at enforcement points; Postgres Node prevent global pgtypes
+  overwrite; migration report CSV export; OAuth-confirmation/email logo update.
+- 2026-10-23 run: reconcile confirmed coopcloud upstream main moved to `c834df2` ("NODE_FUNCTION_ALLOW_EXTERNAL
+  in env file", on top of 3.5.1+2.40.5) and PR #9 (branch `upgrade-a144baf`, at 2.43.6) still
+  open/unmerged. Per the one-evolving-PR contract, PR #9 extended **2.40.5 → 2.45.2** (explicit target
+  = highest tag abra lists). 2.45.x is the current Pre-release/beta line; **stable = 2.44.6** (verified
+  live via Docker Hub floating tags), flagged to the operator. Window spans feature minors 2.41–2.45,
+  but release notes show **no breaking compose/env/volume/label changes and no `N8N_*` renames**.
+  Live-deployed on cc-ci `dev-n8n`: TypeORM migrations completed cleanly through
+  `CreatePromotionRunAndReviewTables1792139680417`, editor accessible, `/healthz` 200, `/rest/login`
+  401; runtime deprecation warnings only (`WEBHOOK_URL`→`N8N_WEBHOOK_URL`, internal runner mode,
+  unverified-packages default, runner-timeout/compression-limit default reductions). Advisory scan
+  2.40.5→2.45.2: 0 CVEs identified, BUT the GitHub advisory sources failed (unauthenticated rate
+  limit) — scan incomplete, not to be read as clean. Recommended release: `-y`.