recipe-maintainers/cryptpad
0
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

chore: upgrade to 2026.10.1 #6

Open
autonomic-bot wants to merge 1 commits from upgrade-2026.10.0 into main
pull from: upgrade-2026.10.0
merge into: :main
Conversation 4 Commits 1 Files Changed 10
+65 -23
autonomic-bot commented 2026-10-30 02:22:11 +00:00
Owner
Copy Link
Copy Source

Upgrade: cryptpad 2026.5.1 → 2026.10.1

Extends the existing upgrade-2026.10.0 PR/branch (one evolving upgrade PR per recipe) to the current
newest image, version-2026.10.1 (Docker Hub 2026-11-10). 2026.10.1 is the Autumn fix release on
top of the breaking 2026.10.0 server rewrite and is itself a security release (vendor: highest
CVSS 4.0 score 7.3 / High).

service image change
app cryptpad/cryptpad:version-2026.5.1 → version-2026.10.1 server rewrite + fix release
web nginx:1.31 unchanged (floating tag resolves to 1.31.8; resolver confirms no newer same-shape tag)

Upstream release notes: app 2026.5.1→2026.10.1: https://github.com/cryptpad/cryptpad/releases/tag/2026.10.1
Upstream release notes: app 2026.5.1→2026.10.0 (breaking — read first): https://github.com/cryptpad/cryptpad/releases/tag/2026.10.0

Recipe changes

  • CPAD_MAIN_DOMAIN / CPAD_SANDBOX_DOMAIN now carry the scheme (https://${DOMAIN},
    https://${SANDBOX_DOMAIN}); the new server assigns them verbatim to infra.public.origin /
    sandboxOrigin. config.js.tmpl no longer prepends https://.
  • config/infra.js is now mounted as a Docker config (infra.js.tmpl, INFRA_JS_VERSION=v1).
    /cryptpad/config is root-owned in the 2026.10+ image, so the image entrypoint's attempt to create
    infra.js fails (cp: … Permission denied) and the app crash-loops on a fresh deploy. The prior
    2026.10.0 head of this PR did not mount it; an in-place upgrade of an older stack masked the issue
    because the old image's config dir was cryptpad-owned. This matches upstream coop-cloud PR #15.
  • nginx /cryptpad_websocket proxies to app:3000 — one HTTP+websocket port in 2026.10+, no separate
    3003; verified a real 101 Switching Protocols through nginx.
  • abra.sh: CONFIG_VERSION v3, NGINX_CONF_VERSION v2, new INFRA_JS_VERSION v1,
    SSO_ENTRYPOINT_VERSION v8, ONLYOFFICE_ENTRYPOINT_VERSION v2 so changed templates re-mount.
  • SSO plugin default 1.0.0; sso.js is mounted directly at /cryptpad/config/sso.js (root-owned
    config dir) and sso-entrypoint.sh installs the plugin's npm deps, as required by 2026.10.
  • README / onlyoffice-entrypoint.sh: install-onlyoffice.sh → install-office.sh (Euro-Office 9.3).
  • Recipe version label deliberately untouched (as usual for upgrade PRs).

Operator Action Required

  • Breaking release / major bump: after merge, publish with
    abra recipe release cryptpad -x (0.6.0+v2026.5.1 → 1.0.0+v2026.10.1).
  • Security release: upgrade promptly (highest CVSS 7.3).
  • Reverse proxy: any operator overriding nginx.conf.tmpl must drop the 3003 websocket upstream;
    websocket and HTTP share public.httpPort (3000).
  • SSO users: the plugin must be 1.0.0 (SSO_PLUGIN_VERSION=1.0.0).
  • Office users (optional compose.onlyoffice.yaml): editors are now Euro-Office 9.3; the
    oldest_needed_version flow is unchanged.
  • Review /checkup/ after upgrading.

Advisory scan

  • Deterministic scan window 2026.5.1→2026.10.1: 0 CVEs identified. The 57 unclassified items are
    historical nginx.org/en/CHANGES entries for the unchanged nginx sidecar (no version window /
    no structured advisory) — recorded STILL-UNKNOWN, not counted.
  • The 2026.10.1 notes state security fixes (highest CVSS 7.3) but name no CVE IDs, so no specific CVE
    is attributed; the scan count is a floor, not a complete security accounting.

Verification

  • Live --chaos deploy on cc-ci of this exact head (fresh 2026.10.1 image + configs): deploy succeeded,
    app 1/1 and web 1/1, logs CryptPad server ready, telemetry version: 2026.10.1 with
    httpUnsafeOrigin=https://dev-cryptpad.ci.commoninternet.net and
    httpSafeOrigin=https://dev-cryptpad-sb.ci.commoninternet.net. Main / 200, /pad/ 200, sandbox /
    200, /checkup/ 200, websocket 101 Switching Protocols. Dev deploy torn down (0 stacks/volumes
    left). The initial deploy without the infra_js mount reproduced the fresh-deploy crash above —
    which is what this PR fixes.
  • !testme result is posted below by cc-ci.

Nothing is merged — this PR is for operator review.

CI verification is run against this one-commit PR head. NOT merged — for operator review.

cc @trav @notplants

## Upgrade: cryptpad 2026.5.1 → 2026.10.1 Extends the existing `upgrade-2026.10.0` PR/branch (one evolving upgrade PR per recipe) to the current newest image, **`version-2026.10.1`** (Docker Hub 2026-11-10). `2026.10.1` is the Autumn fix release on top of the breaking `2026.10.0` server rewrite and is itself a **security release** (vendor: highest CVSS 4.0 score 7.3 / High). | service | image | change | |---|---|---| | app | `cryptpad/cryptpad:version-2026.5.1` → `version-2026.10.1` | server rewrite + fix release | | web | `nginx:1.31` | unchanged (floating tag resolves to 1.31.8; resolver confirms no newer same-shape tag) | **Upstream release notes:** app 2026.5.1→2026.10.1: https://github.com/cryptpad/cryptpad/releases/tag/2026.10.1 **Upstream release notes:** app 2026.5.1→2026.10.0 (breaking — read first): https://github.com/cryptpad/cryptpad/releases/tag/2026.10.0 ### Recipe changes - `CPAD_MAIN_DOMAIN` / `CPAD_SANDBOX_DOMAIN` now carry the scheme (`https://${DOMAIN}`, `https://${SANDBOX_DOMAIN}`); the new server assigns them verbatim to `infra.public.origin` / `sandboxOrigin`. `config.js.tmpl` no longer prepends `https://`. - **`config/infra.js` is now mounted as a Docker config** (`infra.js.tmpl`, `INFRA_JS_VERSION=v1`). `/cryptpad/config` is root-owned in the 2026.10+ image, so the image entrypoint's attempt to create `infra.js` fails (`cp: … Permission denied`) and the app crash-loops on a **fresh** deploy. The prior `2026.10.0` head of this PR did not mount it; an in-place upgrade of an older stack masked the issue because the old image's config dir was cryptpad-owned. This matches upstream coop-cloud PR #15. - nginx `/cryptpad_websocket` proxies to `app:3000` — one HTTP+websocket port in 2026.10+, no separate `3003`; verified a real `101 Switching Protocols` through nginx. - `abra.sh`: `CONFIG_VERSION` v3, `NGINX_CONF_VERSION` v2, new `INFRA_JS_VERSION` v1, `SSO_ENTRYPOINT_VERSION` v8, `ONLYOFFICE_ENTRYPOINT_VERSION` v2 so changed templates re-mount. - SSO plugin default 1.0.0; `sso.js` is mounted directly at `/cryptpad/config/sso.js` (root-owned config dir) and `sso-entrypoint.sh` installs the plugin's npm deps, as required by 2026.10. - README / `onlyoffice-entrypoint.sh`: `install-onlyoffice.sh` → `install-office.sh` (Euro-Office 9.3). - Recipe version label deliberately untouched (as usual for upgrade PRs). ### Operator Action Required - **Breaking release / major bump**: after merge, publish with `abra recipe release cryptpad -x` (0.6.0+v2026.5.1 → 1.0.0+v2026.10.1). - **Security release**: upgrade promptly (highest CVSS 7.3). - Reverse proxy: any operator overriding `nginx.conf.tmpl` must drop the `3003` websocket upstream; websocket and HTTP share `public.httpPort` (3000). - SSO users: the plugin must be 1.0.0 (`SSO_PLUGIN_VERSION=1.0.0`). - Office users (optional `compose.onlyoffice.yaml`): editors are now Euro-Office 9.3; the `oldest_needed_version` flow is unchanged. - Review `/checkup/` after upgrading. ### Advisory scan - Deterministic scan window 2026.5.1→2026.10.1: **0 CVEs identified**. The 57 unclassified items are historical `nginx.org/en/CHANGES` entries for the **unchanged** nginx sidecar (no version window / no structured advisory) — recorded STILL-UNKNOWN, not counted. - The 2026.10.1 notes state security fixes (highest CVSS 7.3) but name no CVE IDs, so no specific CVE is attributed; the scan count is a floor, not a complete security accounting. ### Verification - Live `--chaos` deploy on cc-ci of this exact head (fresh 2026.10.1 image + configs): deploy succeeded, app 1/1 and web 1/1, logs `CryptPad server ready`, telemetry `version: 2026.10.1` with `httpUnsafeOrigin=https://dev-cryptpad.ci.commoninternet.net` and `httpSafeOrigin=https://dev-cryptpad-sb.ci.commoninternet.net`. Main `/` 200, `/pad/` 200, sandbox `/` 200, `/checkup/` 200, websocket `101 Switching Protocols`. Dev deploy torn down (0 stacks/volumes left). The initial deploy without the `infra_js` mount reproduced the fresh-deploy crash above — which is what this PR fixes. - `!testme` result is posted below by cc-ci. Nothing is merged — this PR is for operator review. CI verification is run against this one-commit PR head. NOT merged — for operator review. cc @trav @notplants
autonomic-bot requested review from trav 2026-10-30 02:22:12 +00:00
autonomic-bot requested review from notplants 2026-10-30 02:22:12 +00:00
autonomic-bot commented 2026-10-30 02:22:17 +00:00
Author
Owner
Copy Link
Copy Source

!testme

!testme
autonomic-bot commented 2026-10-30 02:22:25 +00:00
Author
Owner
Copy Link
Copy Source

🌻 cc-ci — cryptpad @ 3e7ec818 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `cryptpad` @ `3e7ec818` ✅ **passed** [![cc-ci result card](https://ci.autonomic.zone/runs/100/summary.png)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/100) [![level](https://ci.autonomic.zone/runs/100/badge.svg)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/100) [full logs](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/100) · [dashboard](https://ci.autonomic.zone/)
autonomic-bot changed title from chore: upgrade to 2026.10.0 to chore: upgrade to 2026.10.1 2026-11-13 03:25:50 +00:00
autonomic-bot added 1 commit 2026-11-13 03:25:51 +00:00
chore: upgrade to 2026.10.1
cc-ci/testme cc-ci: success
Details
c73ce32857
autonomic-bot force-pushed upgrade-2026.10.0 from 3e7ec818af to c73ce32857 2026-11-13 03:25:51 +00:00 Compare
autonomic-bot commented 2026-11-13 03:25:57 +00:00
Author
Owner
Copy Link
Copy Source

!testme

!testme
autonomic-bot commented 2026-11-13 03:26:10 +00:00
Author
Owner
Copy Link
Copy Source

🌻 cc-ci — cryptpad @ c73ce328 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `cryptpad` @ `c73ce328` ✅ **passed** [![cc-ci result card](https://ci.autonomic.zone/runs/142/summary.png)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/142) [![level](https://ci.autonomic.zone/runs/142/badge.svg)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/142) [full logs](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/142) · [dashboard](https://ci.autonomic.zone/)
All checks were successful
cc-ci/testme cc-ci: success
Details
You are not authorized to merge this pull request.
This pull request can be merged automatically.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin upgrade-2026.10.0:upgrade-2026.10.0
git checkout upgrade-2026.10.0
Sign in to join this conversation.
Reviewers
No Reviewers
trav
notplants
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
aadil (alizeh) autonomic autonomic-bot kawaiipunk (KawaiiPunk) notplants spacehobo (Nick Moffitt) trav (Trav Fryer)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: recipe-maintainers/cryptpad#6