# Upstream sources — drone

| service | image | source repo | releases / changelog |
|---------|-------|-------------|----------------------|
| app     | drone/drone | https://github.com/harness/drone | https://github.com/harness/drone/releases |

## Standing notes
- drone/drone releases are tagged on GitHub at https://github.com/harness/drone/releases
- The image is published to Docker Hub as `drone/drone:<version>`
- v2.27.0 was a problematic pre-release (breaking memory unit parsing via go-units v0.5.0); skip it
- v2.27.1 reverted the go-units breakage; v2.27.2 added security fix for docker/distribution
- v2.28.1 fixes a production issue where stages could get stuck permanently in pending state
- v2.28.2 fixes a Bitbucket SCM permission regression from v2.28.0's go-scm jump
- No schema changes required upgrading from 2.26.0 → 2.28.2 (build_deploy_id BIGINT migration was in 2.26.0 itself)
- Recipe uses `master` as the default branch on coopcloud (not `main`)
- Secret `client_secret` is flagged by lint (R015) as longer than 12 chars — pre-existing issue, not introduced by upgrade