recipe-maintainers/cc-ci-orchestrator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
a6efcec7200e5656a3d37dff1d33f412640526e4
cc-ci-orchestrator/.claude/skills/recipe-report/example-spec.json
T
autonomic-botandClaude Opus 4.8 a6efcec720 feat(recipe-report): link recipe names in the lead to their mirror repos; 3-para concise lead 
render() auto-links whole-word recipe mentions in the editorial lead to
git.autonomic.zone/recipe-maintainers/<recipe> (single regex pass, longest-name-first,
no href corruption). Skill: lead is ~3 short paragraphs (~150-180 words) incl. an
'anything strange worth looking into' paragraph. example-spec.json lead updated to the
concise target.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-04 02:17:19 +00:00

1 line
15 KiB
JSON
Raw Blame History

{"date": "2026-06-02", "subtitle": "Week of June 2, 2026", "lead": "The recipe fleet is healthy this week. Of 18 recipes, eleven upgrades are !testme GREEN and ready to merge, two failed on genuine recipe bugs, and one waits on a stale-test refresh \u2014 a clean run overall.\n\nDo the security merges first: the nginx 1.29\u21921.31 bump closes a high-severity batch (heap overflows, request smuggling, an HTTP/3 spoofing flaw) and ships in custom-html and cryptpad, both green. Then triage the two reds \u2014 mattermost-lts and plausible \u2014 both pre-existing backup/restore bugs, not regressions from this week.\n\nWorth a closer look: four recipes \u2014 discourse, ghost, mattermost-lts, plausible \u2014 now carry two open PRs each (a fresh upgrade alongside an older backup fix) that want reconciling; immich and lasuite-drive both tripped abra's image-tag parser on digest-pinned / non-standard tags, a recurring format snag; and a stray recipe-create-pr smoke-test PR still lingers on bluesky-pds.", "security": [{"title": "nginx 1.31 \u2014 memory-safety + request-smuggling CVE batch (high) \u00b7 custom-html, cryptpad", "body": "Bumping the nginx sidecar from 1.29 to 1.31.1 closes a cluster of CVEs fixed in 1.31.0/1.31.1: heap buffer overflows in the rewrite module, data injection via proxy_set_body, an HTTP/3 address-spoofing flaw, and a use-after-free in the DNS/ssl_ocsp path. Two recipes ship the sidecar \u2014 custom-html (also alpine/git \u2192 v2.52.0) and cryptpad \u2014 and both are !testme GREEN. These are the highest-value merges of the week; do them first.", "links": [{"text": "custom-html PR #1 (build 163)", "url": "https://git.autonomic.zone/recipe-maintainers/custom-html/pulls/1"}, {"text": "cryptpad PR #4 (build 154)", "url": "https://git.autonomic.zone/recipe-maintainers/cryptpad/pulls/4"}]}, {"title": "mailu \u2014 Roundcube webmail CVE-2026-49217 (high) \u00b7 internet-facing", "body": "mailu 2024.06.37 \u2192 2024.06.52 rolls up the Roundcube security fix CVE-2026-49217 along with certdumper v2.11.2 and a redis 8.8 bump. Webmail is exposed on a mail host, so this one is worth prioritising. No config changes; !testme GREEN.", "links": [{"text": "mailu PR #1 (build 157)", "url": "https://git.autonomic.zone/recipe-maintainers/mailu/pulls/1"}]}, {"title": "uptime-kuma \u2014 authenticated RCE fix (high) \u00b7 plus MariaDB 12.3 major bump", "body": "uptime-kuma 2.2.1 \u2192 2.4.0 patches a remote-code-execution flaw in an upstream dependency (exploitable by authenticated users). It is bundled with a MariaDB 11.8 \u2192 12.3 major-version bump, so take a database backup before deploying if you run the mariadb overlay. !testme GREEN.", "links": [{"text": "uptime-kuma PR #2 (build 165)", "url": "https://git.autonomic.zone/recipe-maintainers/uptime-kuma/pulls/2"}]}, {"title": "redis 8.8 \u2014 CVE-2026-23479, CVE-2026-25243 (moderate) \u00b7 lasuite-meet, lasuite-docs", "body": "The redis 8.6.3 \u2192 8.8.0 bump carries several redis security patches, including CVE-2026-23479 and CVE-2026-25243. It ships in lasuite-meet (alongside the meet v1.16\u2192v1.17 app upgrade) and lasuite-docs. Redis is used purely as cache/session/pub-sub here, so the upgrade is drop-in. Both green.", "links": [{"text": "lasuite-meet PR #3 (build 156)", "url": "https://git.autonomic.zone/recipe-maintainers/lasuite-meet/pulls/3"}, {"text": "lasuite-docs PR #4 (build 169)", "url": "https://git.autonomic.zone/recipe-maintainers/lasuite-docs/pulls/4"}]}, {"title": "static-web-server \u2014 Basic-Auth timing attack CVE-2026-27480 (low/moderate) \u00b7 custom-html-tiny", "body": "static-web-server 2.38 \u2192 2.42 picks up CVE-2026-27480, a timing attack in Basic Auth fixed in v2.41.0. Note v2.41 also flips --ignore-hidden-files and --disable-symlinks on by default; this recipe serves an explicit -d path and is unaffected. !testme GREEN.", "links": [{"text": "custom-html-tiny PR #6 (build 164)", "url": "https://git.autonomic.zone/recipe-maintainers/custom-html-tiny/pulls/6"}]}], "needs_attention": [{"title": "Eleven green PRs await your merge", "body": "The merge-ready set: cryptpad, custom-html, custom-html-tiny, discourse, keycloak, lasuite-docs, lasuite-meet, mailu, n8n, and uptime-kuma \u2014 plus ghost, which the operator already resolved. discourse #2 is the late arrival: it is now !testme GREEN at build 179, clearing the stale-test RED (the allow_uncategorized_topics default flip) that the morning run had flagged. Full per-recipe detail in the wire below.", "links": []}, {"title": "mattermost-lts \u2014 RED on restore; a security patch is held hostage", "body": "The 10.11.19 ESR bump is correct and carries medium-severity security fixes, but !testme is RED at build 161 on test_restore_returns_state \u2014 a pre-existing backup/restore bug (the ci_marker row does not survive backup\u2192restore), not something this upgrade introduced. Three restore strategies were tried without success. A companion fix PR (#1, ci/pg-restore) is open; reconcile the pair. The security patch cannot land until restore is fixed.", "links": [{"text": "upgrade PR #2 (build 161 RED)", "url": "https://git.autonomic.zone/recipe-maintainers/mattermost-lts/pulls/2"}, {"text": "companion fix PR #1", "url": "https://git.autonomic.zone/recipe-maintainers/mattermost-lts/pulls/1"}]}, {"title": "plausible \u2014 RED on deploy after the pg13\u219216 + ClickHouse 24 jump", "body": "plausible 4.0.0+v2.1.5 (image moved Docker Hub \u2192 GHCR, postgres 13\u219216, ClickHouse 23.4\u219224.3) is RED at build 168. The ClickHouse IPv6-bind crash was fixed with an ipv4-only config, but the deploy still fails: Postgres appears to stay at 13 and the app gets NXDOMAIN for the events DB \u2014 most likely abra re-fetching the upstream compose over the PR head. A companion PR (#1, ci/clickhouse-backup-resilient) is also open and RED. Note: the v3.x-only CVE-2026-8467 does not affect this v2.1.5 target.", "links": [{"text": "upgrade PR #2 (build 168 RED)", "url": "https://git.autonomic.zone/recipe-maintainers/plausible/pulls/2"}, {"text": "companion PR #1", "url": "https://git.autonomic.zone/recipe-maintainers/plausible/pulls/1"}]}, {"title": "matrix-synapse \u2014 green except for one stale test; run --with-tests", "body": "synapse v1.149.1 \u2192 v1.153.0 (with mas 1.17, nginx 1.31.1, pgautoupgrade 17\u219218) is RED at build 158 only on test_upgrade_preserves_data \u2014 the ci_marker table is lost across the pg17\u219218 in-place upgrade. Everything else passes (reconverge, serving, backup, restore, /_matrix/client/versions 200), so the diagnosis is a stale CI test, not a broken upgrade. Refresh it with /recipe-upgrade matrix-synapse --with-tests.", "links": [{"text": "PR #1 (build 158 RED \u00b7 upgrade-test)", "url": "https://git.autonomic.zone/recipe-maintainers/matrix-synapse/pulls/1"}]}, {"title": "n8n \u2014 GREEN, but a mandatory migration rides with it", "body": "n8n 2.20.6 \u2192 2.23.2 is !testme GREEN at build 162, but the pgautoupgrade 17\u219218 bump requires the volume mount path to move from /var/lib/postgresql/data to /var/lib/postgresql, and an in-place pg_upgrade --link runs on first start. Back up the database first, and apply the path change on existing deployments \u2014 green here does not mean no-op for operators.", "links": [{"text": "n8n PR #4 (build 162)", "url": "https://git.autonomic.zone/recipe-maintainers/n8n/pulls/4"}]}, {"title": "ghost \u2014 already resolved since the run", "body": "Ghost now has no open PR. The operator merged the backup-fix PR (#1, which landed Ghost at 6.42.0-alpine and added a proper mysql restore hook) and closed the 6.43.1 PR (#3). Net effect: the data-loss-on-restore bug is fixed, but Ghost sits one patch behind the 6.43.1 the upgrader had proposed \u2014 a future run can re-offer that bump.", "links": [{"text": "merged PR #1", "url": "https://git.autonomic.zone/recipe-maintainers/ghost/pulls/1"}]}], "routine": [{"title": "Clean dependency bumps", "body": "keycloak 10.7.1 \u2192 10.8.0 (MariaDB 12.2 \u2192 12.3, app unchanged) and lasuite-docs 0.3.3 \u2192 0.3.4 (redis 8.8) are routine, no-operator-action bumps \u2014 both green. lasuite-meet also carries its meet v1.17.0 app upgrade with no required config changes.", "links": []}, {"title": "Skipped \u2014 already current", "body": "bluesky-pds, mumble, and lasuite-drive are up-to-date (drive's collabora/minio/onlyoffice tags are unparseable to abra, but its core images are at latest).", "links": []}, {"title": "immich \u2014 blocked by an abra tooling limit", "body": "immich was skipped: abra cannot parse its tag-plus-digest image references (e.g. ghcr.io/immich-app/postgres:14-vectorchord\u2026@sha256:\u2026), so the survey can't compute an upgrade. An explanatory comment was left on its open PR #1. This is a tooling gap, not a recipe fault.", "links": [{"text": "immich PR #1", "url": "https://git.autonomic.zone/recipe-maintainers/immich/pulls/1"}]}, {"title": "Infrastructure footnote", "body": "Eight recipes initially failed the survey with an abra go-git auth error (credentials must be embedded in the git origin URL, not via .netrc); all were recovered before the run completed. No fleet impact.", "links": []}], "table": [{"recipe": "cryptpad", "change": "0.5.4+v2026.2.0 \u2192 0.5.5+v2026.2.0", "status": "GREEN", "ci": "build 154 \u2713", "ci_url": "https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/154", "pr": "#4", "pr_url": "https://git.autonomic.zone/recipe-maintainers/cryptpad/pulls/4", "notes": "nginx 1.29 \u2192 1.31 (CVE batch). Ready to merge."}, {"recipe": "custom-html", "change": "1.11.0+1.29.0 \u2192 1.13.0+1.31.1", "status": "GREEN", "ci": "build 163 \u2713", "ci_url": "https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/163", "pr": "#1", "pr_url": "https://git.autonomic.zone/recipe-maintainers/custom-html/pulls/1", "notes": "nginx 1.31.1 CVEs + alpine/git v2.52.0. Ready to merge."}, {"recipe": "custom-html-tiny", "change": "1.0.1+2.38.0 \u2192 1.1.0+2.42.0", "status": "GREEN", "ci": "build 164 \u2713", "ci_url": "https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/164", "pr": "#6", "pr_url": "https://git.autonomic.zone/recipe-maintainers/custom-html-tiny/pulls/6", "notes": "static-web-server 2.42 (Basic-Auth timing CVE)."}, {"recipe": "discourse", "change": "0.7.0+3.3.1 \u2192 0.8.0+3.5.0", "status": "GREEN", "ci": "build 179 \u2713", "ci_url": "https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/179", "pr": "#2", "pr_url": "https://git.autonomic.zone/recipe-maintainers/discourse/pulls/2", "notes": "Now green \u2014 stale test cleared. pg13\u219216, backup fix, bitnami\u2192bitnamilegacy (archived mirror)."}, {"recipe": "ghost", "change": "1.2.0+6.21.2-alpine \u2192 1.3.0+6.42.0-alpine", "status": "UPTODATE", "ci": "merged", "pr": "#1", "pr_url": "https://git.autonomic.zone/recipe-maintainers/ghost/pulls/1", "notes": "Resolved by operator: #1 merged (backup fix, 6.42.0); 6.43.1 PR #3 closed."}, {"recipe": "keycloak", "change": "10.7.1+26.6.2 \u2192 10.8.0+26.6.2", "status": "GREEN", "ci": "build 155 \u2713", "ci_url": "https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/155", "pr": "#2", "pr_url": "https://git.autonomic.zone/recipe-maintainers/keycloak/pulls/2", "notes": "MariaDB 12.2 \u2192 12.3. Clean."}, {"recipe": "lasuite-docs", "change": "0.3.3+v5.1.0 \u2192 0.3.4+v5.1.0", "status": "GREEN", "ci": "build 169 \u2713", "ci_url": "https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/169", "pr": "#4", "pr_url": "https://git.autonomic.zone/recipe-maintainers/lasuite-docs/pulls/4", "notes": "redis 8.6.3 \u2192 8.8.0 (CVEs). Clean."}, {"recipe": "lasuite-meet", "change": "0.3.0+v1.16.0 \u2192 0.3.0+v1.17.0", "status": "GREEN", "ci": "build 156 \u2713", "ci_url": "https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/156", "pr": "#3", "pr_url": "https://git.autonomic.zone/recipe-maintainers/lasuite-meet/pulls/3", "notes": "meet v1.17.0 + redis 8.8 (CVEs). Swagger routes now /api-prefixed."}, {"recipe": "mailu", "change": "3.0.1+2024.06.37 \u2192 3.0.1+2024.06.52", "status": "GREEN", "ci": "build 157 \u2713", "ci_url": "https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/157", "pr": "#1", "pr_url": "https://git.autonomic.zone/recipe-maintainers/mailu/pulls/1", "notes": "Roundcube CVE-2026-49217 + certdumper v2.11.2 + redis 8.8."}, {"recipe": "matrix-synapse", "change": "7.1.1+v1.149.1 \u2192 7.2.0+v1.153.0", "status": "STALE", "ci": "RED 158 \u00b7 upgrade-test", "ci_url": "https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/158", "pr": "#1", "pr_url": "https://git.autonomic.zone/recipe-maintainers/matrix-synapse/pulls/1", "notes": "Stale test_upgrade_preserves_data (pg17\u219218 ci_marker loss). Run --with-tests."}, {"recipe": "mattermost-lts", "change": "2.1.10+10.11.18 \u2192 2.2.0+10.11.19", "status": "FAILED", "ci": "RED 161 \u00b7 restore", "ci_url": "https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/161", "pr": "#2", "pr_url": "https://git.autonomic.zone/recipe-maintainers/mattermost-lts/pulls/2", "notes": "Pre-existing restore bug; see companion #1. ESR carries a medium-severity security patch."}, {"recipe": "n8n", "change": "3.2.0+2.20.6 \u2192 3.3.0+2.23.2", "status": "GREEN", "ci": "build 162 \u2713", "ci_url": "https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/162", "pr": "#4", "pr_url": "https://git.autonomic.zone/recipe-maintainers/n8n/pulls/4", "notes": "\u26a0 pg17\u219218: volume path /var/lib/postgresql/data \u2192 /var/lib/postgresql; back up first."}, {"recipe": "plausible", "change": "3.0.1+v2.0.0 \u2192 4.0.0+v2.1.5", "status": "FAILED", "ci": "RED 168 \u00b7 deploy", "ci_url": "https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/168", "pr": "#2", "pr_url": "https://git.autonomic.zone/recipe-maintainers/plausible/pulls/2", "notes": "GHCR move + pg13\u219216 + ClickHouse 24. ClickHouse fixed; deploy still fails (pg re-fetch). See #1."}, {"recipe": "uptime-kuma", "change": "3.0.0+2.2.1 \u2192 4.0.0+2.4.0", "status": "GREEN", "ci": "build 165 \u2713", "ci_url": "https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/165", "pr": "#2", "pr_url": "https://git.autonomic.zone/recipe-maintainers/uptime-kuma/pulls/2", "notes": "Authenticated RCE fix + MariaDB 11.8 \u2192 12.3 (back up first)."}, {"recipe": "bluesky-pds", "change": "\u2014", "status": "UPTODATE", "ci": "", "pr": "", "notes": "Up-to-date."}, {"recipe": "mumble", "change": "\u2014", "status": "UPTODATE", "ci": "", "pr": "", "notes": "Up-to-date."}, {"recipe": "lasuite-drive", "change": "\u2014", "status": "UPTODATE", "ci": "", "pr": "", "notes": "Up-to-date (some tags unparseable; core images at latest)."}, {"recipe": "immich", "change": "\u2014", "status": "SKIPPED", "ci": "", "pr": "#1", "pr_url": "https://git.autonomic.zone/recipe-maintainers/immich/pulls/1", "notes": "abra cannot parse tag+digest image pins; explanatory comment left on PR."}]}
Reference in New Issue View Git Blame Copy Permalink