autonomic-bot
3307bdb0fe
Two refinements found by running the scan across all 14 recipes of the 2026-08-07 run: 1. A repo with no advisory feed returns HTTP 404 on /security-advisories (e.g. the pgautoupgrade sidecar image). That is a BENIGN ABSENCE, not a failed check. Likewise registry entries that are TEMPLATE urls for humans (…/changelog/v<VERSION>/, …/<vX.Y.Z>/…) are documentation, not fetchable. Counting either as a failure pushed most recipes to '?', which would make the unknown-vs-clean distinction meaningless again — the exact signal the ? exists to preserve. Both are now recorded in sources_benign; only genuine errors (rate limit, network, 5xx, wrong URL) land in sources_failed. 2. upstream/*.md pointed at github.com/pgautoupgrade/pgautoupgrade, which 404s — the repo is pgautoupgrade/docker-pgautoupgrade. Corrected in n8n, lasuite-docs, lasuite-drive, lasuite-meet. A 404ing registry URL means we were not scanning a source we believed we were. Effect on the 2026-08-07 data: recipes with genuine failed sources 5 -> 3 (the remainder are really unreachable vendor pages). CVE counts unchanged where they were already sound: discourse 130, gitea 2, plausible 1.
28 lines
2.6 KiB
Markdown
28 lines
2.6 KiB
Markdown
# Upstream sources — lasuite-drive
|
|
|
|
| service | image | source repo | releases / changelog |
|
|
|---------|-------|-------------|----------------------|
|
|
| app | lasuite/drive-frontend | https://github.com/suitenumerique/drive | https://github.com/suitenumerique/drive/releases |
|
|
| backend | lasuite/drive-backend | https://github.com/suitenumerique/drive | https://github.com/suitenumerique/drive/releases |
|
|
| celery | lasuite/drive-backend | https://github.com/suitenumerique/drive | https://github.com/suitenumerique/drive/releases |
|
|
| celery-beat | lasuite/drive-backend | https://github.com/suitenumerique/drive | https://github.com/suitenumerique/drive/releases |
|
|
| db | pgautoupgrade/pgautoupgrade | https://github.com/pgautoupgrade/docker-pgautoupgrade | https://github.com/pgautoupgrade/docker-pgautoupgrade/releases |
|
|
| redis | redis | https://github.com/redis/redis | https://github.com/redis/redis/releases |
|
|
| mailcatcher | sj26/mailcatcher | https://github.com/sj26/mailcatcher | https://github.com/sj26/mailcatcher/releases |
|
|
| minio | minio/minio | https://github.com/minio/minio | https://github.com/minio/minio/releases |
|
|
| minio-createbuckets | minio/minio | https://github.com/minio/minio | https://github.com/minio/minio/releases |
|
|
| collabora | collabora/code | https://github.com/CollaboraOnline/online | https://www.collaboraonline.com/release-notes/ (per-version: .../collabora-online-25-04-release-notes/) |
|
|
| onlyoffice | onlyoffice/documentserver-de | https://github.com/ONLYOFFICE/DocumentServer | https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md |
|
|
| web | nginx | https://github.com/nginx/nginx | https://nginx.org/en/CHANGES |
|
|
|
|
## Standing notes
|
|
- lasuite/drive-frontend and lasuite/drive-backend share the same version tag (drive monorepo).
|
|
- minio and onlyoffice tags use non-semver formats; abra cannot auto-detect upgrades for them.
|
|
- collabora/code uses a 5-part version scheme; abra cannot auto-detect upgrades for it.
|
|
- minio: Docker Hub `minio/minio` `latest` is frozen at `RELEASE.2025-09-07T16-13-09Z` (the
|
|
`RELEASE.2025-10-15T17-29-55Z` GitHub security release is NOT on Docker Hub `minio/minio`).
|
|
Newer minio releases moved to the **AIStor** product line (`quay.io/minio/aistor/minio`).
|
|
A future minio bump requires a registry+product switch — operator decision, not a routine tag bump.
|
|
- nginx 1.31.x (1.31.0, 1.31.1) contains multiple security CVE fixes; upgrade is recommended.
|
|
- nginx 1.31.0 breaking change: HTTP/2 and HTTP/3 requests with Connection/Proxy-Connection/Keep-Alive/Transfer-Encoding/Upgrade headers are now rejected (affects proxied HTTP/2 backends).
|