# Upstream sources — mumble

| service | image | source repo | releases / changelog |
|---------|-------|-------------|----------------------|
| app | mumblevoip/mumble-server | https://github.com/mumble-voip/mumble | https://github.com/mumble-voip/mumble/releases |
| web | rankenstein/mumble-web | https://github.com/rankenstein/mumble-web | https://github.com/rankenstein/mumble-web/releases |

## Standing notes
- This file was **missing entirely** until 2026-08-11. Without it the advisory scan had no source to
  query, and still printed "0 identified by the deterministic scan" — which was then published as a
  clean `0` in the 2026-08-11 CVE check. The scan now refuses to emit a count when it has no usable
  source (it reports UNKNOWN), and `audit-sources.py` flags a missing registry file directly.
- `mumblevoip/mumble-server` tracks the upstream server releases and DOES publish GitHub security
  advisories, so it is the recipe's primary CVE source.
- `rankenstein/mumble-web` is a **fork** of the original `Johni0702/mumble-web`, which has been
  dormant since 2023-05. The fork itself last pushed 2023-07 and its Docker tag `0.5` was last built
  well over five years ago. Neither is archived, but treat the web client as effectively unmaintained:
  if a CVE lands there, expect no upstream fix and plan a replacement rather than an upgrade.
- The server image tag is `v<version>-<build>` (e.g. `v1.6.870-4`); the trailing number is the image
  build, not an app version, and moves independently of upstream releases — `abra recipe upgrade`
  reports "no new versions" for it, so use `resolve-images.py` to see those bumps.