upstream(mattermost-lts): 2026-09-04 re-check note (ESR still 11.7/11.7.10, PR #2 re-verify)

cc-ci-plan/JOURNAL.md

@@ -976,3 +976,20 @@ certificate. The operator-managed public gateway at `143.244.213.108` currently
 closes TLS before presenting a certificate, so its passthrough to cc-ci needs repair/verification.
 The cc-ci plan explicitly marks the gateway as operator infrastructure; do not change the DNS
 delegation or add a Gandi token to work around it.
+
+## Session 2026-08-31 20:45 UTC — weekly DeepSeek Flash run and report complete
+
+**Completed:** Started the weekly upgrader explicitly on `opencode/deepseek-v4-flash`; its parent
+and every recipe subagent were confirmed with that persisted model. All nine eligible recipe PRs
+completed `!testme` successfully. The public report was then restarted before publication when the
+first handoff was found to use the old GLM model; the replacement report session was confirmed
+`opencode/deepseek-v4-flash` and published successfully at
+`https://report.ci.commoninternet.net/week-2026-08-31.html` (HTTP 200).
+
+**Follow-up fixes:** Orchestrator PR #17 (`1b75d98`) made `testme-on-pr.sh` apply the documented
+public Gitea-host default. cc-ci PR #31 (`769fd29`) adds that public hostname to `.env.public`.
+Both commits were scanned clean and contain no coauthor trailers. No recipe PR was merged.
+
+**Security note:** A subagent briefly enabled shell tracing while debugging the verifier, exposing
+runtime credentials in its private agent trace. No values were committed or put in this journal,
+but rotate the affected `/srv/cc-ci/.testenv` credentials as a precaution.

cc-ci-plan/upstream/mattermost-lts.md

@@ -103,6 +103,18 @@
     2026-08-15 (upstream main still pins 10.11.22 = EXPIRED ESR → the 10→11 ESR move PR #2 carries
     remains required; Mattermost docs: ESR→ESR is "fully supported and tested"). postgres 15-alpine
     still HELD (DB-major out of scope, operator dump/pg_upgrade).
+  - **2026-09-04 re-check** (endoflife.date/api/mattermost.json 2026-09-04; Mattermost release-policy
+    docs `https://docs.mattermost.com/product-overview/release-policy.html`; `mattermost-server-releases.html`;
+    GitHub releases `v11.7.10`): **11.7 ESR is STILL the current supported ESR/LTS line** — "v11.7 &
+    Desktop App v6.2 Extended Support: 2026-05-15 → 2027-05-15" (the chart on the release-policy page;
+    ESR cadence = every 9 months, supported 12 months). Latest 11.7.x patch **11.7.10** (2026-08-26,
+    "Mattermost Platform Extended Support Release 11.7.10 contains various bug fixes") — NOT a
+    prerelease; target confirmed. 11.8/11.9/11.10 remain Feature/innovation releases (EOL 2026-09-15 /
+    10-15 / 11-15, `lts:false`), NOT ESR — do NOT target; wait for the NEXT official ESR (expected
+    ~Feb 2027 on the 9-month cadence). No newer 11.7.x ESR patch exists as of this week, so PR #2's
+    head (`59e8c2c`, app image `11.7.10`) is still the correct target → this run RE-VERIFIES PR #2
+    (no new app bump). 11.11.0-rc1/rc2 seen on GitHub but innovation + pre-release — not a target.
+    postgres 15-alpine still HELD (DB-major out of scope, operator dump/pg_upgrade).
 
 ## NVD CPE fallback
 This project publishes nothing machine-readable we can reach — no GitHub advisory feed,

cc-ci-plan/upstream/n8n.md

@@ -137,3 +137,24 @@
   2.37.5 withdrawn). 2.36.9 holds the Stable/Latest badge; 2.37.x remains Pre-release on GitHub
   (consistent precedent). Re-verified 2.37.3→2.37.6 (pure core bugfixes), no breaking changes beyond
   the already-flagged 2.37.0 API behavior pair. Rolling upgrade safe. Recommended release: `-y`.
+- 2.37.7 (2026-09-02, **stable**): empty changelog (auto-generated release, no bugfixes listed).
+- **2.37.8**: plain Docker Hub tag exists (2026-09-03) but **no GitHub release page** (like 2.36.1/
+  2.37.2/2.37.5 for the release notes; the tag itself is real). Treat as no separate changelog.
+- 2.37.9 (2026-09-03, **now the stable/Latest badge** — `stable` tag points here): 1 core bugfix
+  (restore mutating array methods on $json data in expressions).
+- **2.38.0**: plain Docker Hub tag exists (2026-09-01) but **no GitHub release page**; the 2.38.1
+  release body compares `2.37.0...2.38.1` (it absorbs the 2.38.0 changes).
+- 2.38.1 (2026-09-01, Pre-release): the large 2.38.x line changelog (compare basis 2.37.0). Mostly
+  bugfixes + features: expression-engine fixes (copy-on-write writes on VM lazy proxies, one shared
+  time budget across nested expressions, validate engine timeout/memory settings), distroless runners
+  image fixes (glibc/libatomic — only relevant if using n8n's community/distroless runner image, not
+  the recipe), model-provider additions (Moonshot/MiniMax/Qwen Cloud), editor improvements. **No
+  breaking compose/config/migration changes, no `N8N_*` env renames.**
+- 2.38.2 (2026-09-02, Pre-release): empty changelog (auto-generated, no bugfixes listed).
+- 2.38.3 (2026-09-03, Pre-release; **newest 2.x tag abra lists**): 1 core bugfix (ensure running job
+  cleanup when a workflow run rejects).
+- 2026-09-04 run: PR #7 extended **2.34.4 → 2.38.3** (newest tag abra lists = 2.38.3/2.38.2/2.38.1/
+  2.38.0/2.37.9/2.37.8/2.37.7/…). 2.37.9 holds the Stable/Latest badge; 2.38.x remains Pre-release on
+  GitHub (consistent newest-tag precedent). 2.37.7/2.37.9 patched the stable line; 2.38.x carries the
+  expression-engine / agent-runtime fixes. No breaking changes beyond the already-flagged 2.37.0 API
+  behavior pair. Rolling upgrade safe. Recommended release: `-y`.