Files

T

autonomic-bot 3307bdb0fe advisory-scan: separate benign source absence from real failures; fix pgautoupgrade URLs

Two refinements found by running the scan across all 14 recipes of the 2026-08-07 run:

1. A repo with no advisory feed returns HTTP 404 on /security-advisories (e.g. the
   pgautoupgrade sidecar image). That is a BENIGN ABSENCE, not a failed check.
   Likewise registry entries that are TEMPLATE urls for humans
   (…/changelog/v<VERSION>/, …/<vX.Y.Z>/…) are documentation, not fetchable.
   Counting either as a failure pushed most recipes to '?', which would make the
   unknown-vs-clean distinction meaningless again — the exact signal the ? exists to
   preserve. Both are now recorded in sources_benign; only genuine errors (rate
   limit, network, 5xx, wrong URL) land in sources_failed.

2. upstream/*.md pointed at github.com/pgautoupgrade/pgautoupgrade, which 404s —
   the repo is pgautoupgrade/docker-pgautoupgrade. Corrected in n8n, lasuite-docs,
   lasuite-drive, lasuite-meet. A 404ing registry URL means we were not scanning a
   source we believed we were.

Effect on the 2026-08-07 data: recipes with genuine failed sources 5 -> 3 (the
remainder are really unreachable vendor pages). CVE counts unchanged where they
were already sound: discourse 130, gitea 2, plausible 1.

2026-08-10 18:45:45 +00:00

2.8 KiB

Raw Blame History

Upstream sources — lasuite-docs

service	image	source repo	releases / changelog
app	lasuite/impress-frontend	https://github.com/suitenumerique/docs	https://github.com/suitenumerique/docs/releases
backend	lasuite/impress-backend	https://github.com/suitenumerique/docs	https://github.com/suitenumerique/docs/releases
celery	lasuite/impress-backend	https://github.com/suitenumerique/docs	https://github.com/suitenumerique/docs/releases
y-provider	lasuite/impress-y-provider	https://github.com/suitenumerique/docs	https://github.com/suitenumerique/docs/releases
docspec	ghcr.io/docspecio/api	https://github.com/docspecIO/api	https://github.com/docspecIO/api/releases
db	pgautoupgrade/pgautoupgrade	https://github.com/pgautoupgrade/docker-pgautoupgrade	https://github.com/pgautoupgrade/docker-pgautoupgrade/releases
redis	redis	https://github.com/redis/redis	https://hub.docker.com/_/redis/tags
minio	minio/minio	https://github.com/minio/minio	https://github.com/minio/minio/releases
web	nginx	https://github.com/nginx/nginx	https://nginx.org/en/CHANGES

Standing notes

impress-frontend, impress-backend (used for both backend + celery services), impress-y-provider all share the same version tag from the suitenumerique/docs monorepo. Upgrade all four in lockstep.
AUTO_MIGRATIONS=true means DB migrations run automatically on backend startup. No manual step needed.
Minio tag uses a date-based RELEASE.YYYY-MM-DDTHH-MM-SSZ format — abra cannot parse it for upgrades; check manually on https://github.com/minio/minio/releases.
v5.2.0 adds two optional new env vars: DOCUMENT_ALL_ENDPOINT_ENABLED and OIDC_OP_USER_ENDPOINT_FORMAT. Both are backward-compatible (no action required for existing deployments).
Recipe version label convention: 0.X.Y+vA.B.C where A.B.C is the impress version.
v5.4.0 removed Bearer/JWT auth on the API (upstream PR suitenumerique/docs#2480 dropped mozilla_django_oidc.contrib.drf.OIDCAuthentication from DRF DEFAULT_AUTHENTICATION_CLASSES). The API now accepts only the app's session cookie from the real OIDC authorization-code flow. Any test/assertion that sends Authorization: Bearer <jwt> to /api/v1.0/* will get 401 — this is the NEW CORRECT behavior, not a regression. The cc-ci lasuite-docs tests were updated for this in cc-ci PR #12 (merged 2026-08-03): test_oidc_login.py + test_create_doc.py now use session cookies and assert Bearer is rejected. Don't revert to Bearer assertions.
redis sidecar (cache/broker for celery+backend): prefer the patch line (8.8.1 over 8.10.0) unless a feature is needed — 8.8.1 is a security patch (RedisBloom/TDigest RESTORE RCE); 8.10.0 is a minor with many new features.

2.8 KiB Raw Blame History

Upstream sources — lasuite-docs

Standing notes

2.8 KiB

Raw Blame History