cc-ci-orchestrator/cc-ci-plan/upstream/hedgedoc.md

Upstream sources — hedgedoc

service	image	source repo	releases / changelog
app	quay.io/hedgedoc/hedgedoc	https://github.com/hedgedoc/hedgedoc	https://github.com/hedgedoc/hedgedoc/releases
db	pgautoupgrade/pgautoupgrade	https://github.com/pgautoupgrade/docker-pgautoupgrade	https://github.com/pgautoupgrade/docker-pgautoupgrade/commits/main (no GitHub releases; tag-only)

Standing notes

• hedgedoc 1.11.0 (2026): 4 security CVEs fixed (HTML injection, YAML DoS, CSRF via Gist export, rate-limit bypass). No breaking changes, no migrations, no schema changes. Optional new env var CMD_RATE_LIMIT_USING_CLOUDFLARE only needed if running behind Cloudflare — not required for standard deployments.
• pgautoupgrade: handles Postgres major-version upgrades automatically on container start; multi-major in ONE deploy works (16.15→18.6 verified live 2026-09-18 — pg_upgrade ran directly on the v16 files to 18.6, data survived). The image tag is <pg-major>-alpine.
• pgautoupgrade 18+ (RESOLVED on PR #3, 2026-09-18): PG 18 changes the data-directory layout (docker-library/postgres#1259; PGDATA → /var/lib/postgresql/<MAJOR>/docker, /var/lib/postgresql/data becomes a symlink → mount error or EMPTY instance if the mount stays at .../data). The fix carried by PR #3: move the volume mount to postgres:/var/lib/postgresql (NO PGDATA env pin needed) — the entrypoint's MOVING_TO_NEW_STRUCTURE detects /var/lib/postgresql/PG_VERSION, upgrades, and moves data into <MAJOR>/docker automatically. Verified live on cc-ci 2026-09-18: Upgrade to PostgreSQL 18.6 complete., pad data byte-identical, app green; 16→17 separately verified 2026-09-11 (Upgrade to PostgreSQL 17.11 complete.). Upstream coopcloud renovate PR #22 bumps the tag WITHOUT this mount fix — do not merge that alone.
• hedgedoc 1.12.0 (2026-08): requires Node 20.17+ (app image bundles its own node — not recipe-relevant); webp uploads; some highlight.js languages removed/changed. No breaking changes or migrations for the recipe.
• cc-ci tests use the sqlite backend (default compose.yml), not the postgresql compose override — so pgautoupgrade bumps do not affect CI test coverage (verify pg bumps via a direct --chaos deploy with the postgresql override instead).