cc-ci-orchestrator/cc-ci-plan/upstream/cryptpad.md

Upstream sources — cryptpad

service	image	source repo	releases / changelog
app	cryptpad/cryptpad	https://github.com/cryptpad/cryptpad	https://github.com/cryptpad/cryptpad/releases · https://hub.docker.com/r/cryptpad/cryptpad/tags
web	nginx	https://github.com/nginx/nginx	https://nginx.org/en/CHANGES

Standing notes

• abra recipe upgrade cannot parse the version-YYYY.M.D tag format of the cryptpad/cryptpad image, so the app image is bumped by hand; the nginx sidecar is what abra recipe upgrade actually moves.
• Only use tags in the canonical version-YYYY.M.x scheme. The opendesk-YYYY.MM.DD tags on Docker Hub are openDesk-specific builds, not newer CryptPad releases — e.g. opendesk-2026.08.04 (built 2026-08-04) still contains CryptPad 2026.5.1 in /cryptpad/package.json.
• CryptPad's GitHub releases and Docker Hub tags are not simultaneous: 2026.10.0 was released 2026-10-21; version-2026.10.0 appeared on Docker Hub on 2026-10-23 (first seen by the weekly upgrade run on 2026-10-30). Re-check the Docker Hub tags page before treating a GitHub release as available for the recipe.
• The 2026.10.0 release is a breaking one for the recipe: full server rewrite (separate cryptpad-server package), split config.js → config/infra.js (public origin/ports move), one proxy port for HTTP + websocket (no separate 3003 websocket port), SSO plugin v1.0.0 required, and Euro-Office 9.3 replacing the OnlyOffice editors. Recipe handling in the upgrade-2026.10.0 PR: CPAD_MAIN_DOMAIN/CPAD_SANDBOX_DOMAIN must be full https://… URLs (the new server assigns them verbatim to infra.public.origin/sandboxOrigin; the image's entrypoint auto-creates config/infra.js), nginx /cryptpad_websocket proxies to :3000, abra.sh config/nginx/SSO-entrypoint version labels bumped, SSO default 1.0.0.
• nginx is HTTP/1.1-only here (sidecar on :8083, proxy_http_version 1.1), so HTTP/2/3 CVE changes in nginx releases generally don't affect this recipe — but still note them.