Files

T

autonomic-bot 3307bdb0fe advisory-scan: separate benign source absence from real failures; fix pgautoupgrade URLs

Two refinements found by running the scan across all 14 recipes of the 2026-08-07 run:

1. A repo with no advisory feed returns HTTP 404 on /security-advisories (e.g. the
   pgautoupgrade sidecar image). That is a BENIGN ABSENCE, not a failed check.
   Likewise registry entries that are TEMPLATE urls for humans
   (…/changelog/v<VERSION>/, …/<vX.Y.Z>/…) are documentation, not fetchable.
   Counting either as a failure pushed most recipes to '?', which would make the
   unknown-vs-clean distinction meaningless again — the exact signal the ? exists to
   preserve. Both are now recorded in sources_benign; only genuine errors (rate
   limit, network, 5xx, wrong URL) land in sources_failed.

2. upstream/*.md pointed at github.com/pgautoupgrade/pgautoupgrade, which 404s —
   the repo is pgautoupgrade/docker-pgautoupgrade. Corrected in n8n, lasuite-docs,
   lasuite-drive, lasuite-meet. A 404ing registry URL means we were not scanning a
   source we believed we were.

Effect on the 2026-08-07 data: recipes with genuine failed sources 5 -> 3 (the
remainder are really unreachable vendor pages). CVE counts unchanged where they
were already sound: discourse 130, gitea 2, plausible 1.

2026-08-10 18:45:45 +00:00

2.6 KiB

Raw Blame History

Upstream sources — lasuite-drive

service	image	source repo	releases / changelog
app	lasuite/drive-frontend	https://github.com/suitenumerique/drive	https://github.com/suitenumerique/drive/releases
backend	lasuite/drive-backend	https://github.com/suitenumerique/drive	https://github.com/suitenumerique/drive/releases
celery	lasuite/drive-backend	https://github.com/suitenumerique/drive	https://github.com/suitenumerique/drive/releases
celery-beat	lasuite/drive-backend	https://github.com/suitenumerique/drive	https://github.com/suitenumerique/drive/releases
db	pgautoupgrade/pgautoupgrade	https://github.com/pgautoupgrade/docker-pgautoupgrade	https://github.com/pgautoupgrade/docker-pgautoupgrade/releases
redis	redis	https://github.com/redis/redis	https://github.com/redis/redis/releases
mailcatcher	sj26/mailcatcher	https://github.com/sj26/mailcatcher	https://github.com/sj26/mailcatcher/releases
minio	minio/minio	https://github.com/minio/minio	https://github.com/minio/minio/releases
minio-createbuckets	minio/minio	https://github.com/minio/minio	https://github.com/minio/minio/releases
collabora	collabora/code	https://github.com/CollaboraOnline/online	https://www.collaboraonline.com/release-notes/ (per-version: .../collabora-online-25-04-release-notes/)
onlyoffice	onlyoffice/documentserver-de	https://github.com/ONLYOFFICE/DocumentServer	https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md
web	nginx	https://github.com/nginx/nginx	https://nginx.org/en/CHANGES

Standing notes

lasuite/drive-frontend and lasuite/drive-backend share the same version tag (drive monorepo).
minio and onlyoffice tags use non-semver formats; abra cannot auto-detect upgrades for them.
collabora/code uses a 5-part version scheme; abra cannot auto-detect upgrades for it.
minio: Docker Hub minio/minio latest is frozen at RELEASE.2025-09-07T16-13-09Z (the RELEASE.2025-10-15T17-29-55Z GitHub security release is NOT on Docker Hub minio/minio). Newer minio releases moved to the AIStor product line (quay.io/minio/aistor/minio). A future minio bump requires a registry+product switch — operator decision, not a routine tag bump.
nginx 1.31.x (1.31.0, 1.31.1) contains multiple security CVE fixes; upgrade is recommended.
nginx 1.31.0 breaking change: HTTP/2 and HTTP/3 requests with Connection/Proxy-Connection/Keep-Alive/Transfer-Encoding/Upgrade headers are now rejected (affects proxied HTTP/2 backends).

2.6 KiB Raw Blame History

Upstream sources — lasuite-drive

Standing notes

2.6 KiB

Raw Blame History