No mandatory migration or compose change. The app command already pins -a/-p/-g/-d explicitly.
static-web-server v2 is now LTS; v3 is the future major. 2.44.0 adds an opt-in --use-relative-root; 2.44.1 tightens metrics + directory-archive behaviour.
Security in this window: 1 CVE (CVE-2026-75601, medium, GHSA-97q6-jph8-rxgm — metrics auth-order bypass, fixed 2.44.0), plus several GHSA-only moderate/low advice (2.44.0: GHSA-cg27-w6jh-934r, GHSA-cx3m-fg6q-xf3v, GHSA-4wf2-76p9-xrmx; 2.44.1: GHSA-cw5g-jrq8-536j, GHSA-3p6p-6r38-h33v).
The git sidecar is only in the optional compose.git-pull.yml overlay; it does a plain clone/pull and is unaffected by git 2.54 CLI changes.
The recipe version label is intentionally not bumped here. After merge, publish with:
abra recipe release custom-html-tiny -y
(minor bump: app moved 2.43 → 2.44; 2.44.0 carries a new feature alongside the fixes.)
Not merged — for operator review.
Upgrade image pins to the newest stable releases in the same tag scheme.
| service | file | current | new |
|---------|------|---------|-----|
| app | `compose.yml` | `joseluisq/static-web-server:2.43.0` | `joseluisq/static-web-server:2.44.1` |
| git | `compose.git-pull.yml` | `alpine/git:v2.52.0` | `alpine/git:v2.54.0` |
**Upstream release notes:** app static-web-server 2.43.0→2.44.1: https://github.com/static-web-server/static-web-server/releases/tag/v2.44.0 and https://github.com/static-web-server/static-web-server/releases/tag/v2.44.1
**Upstream release notes:** git alpine/git v2.52.0→v2.54.0: https://github.com/git/git/tree/v2.54.0/Documentation/RelNotes
### Operator Action Required
- No mandatory migration or compose change. The app command already pins `-a/-p/-g/-d` explicitly.
- static-web-server v2 is now **LTS**; v3 is the future major. 2.44.0 adds an opt-in `--use-relative-root`; 2.44.1 tightens metrics + directory-archive behaviour.
- Security in this window: **1 CVE** (CVE-2026-75601, medium, GHSA-97q6-jph8-rxgm — metrics auth-order bypass, fixed 2.44.0), plus several GHSA-only moderate/low advice (2.44.0: GHSA-cg27-w6jh-934r, GHSA-cx3m-fg6q-xf3v, GHSA-4wf2-76p9-xrmx; 2.44.1: GHSA-cw5g-jrq8-536j, GHSA-3p6p-6r38-h33v).
- The `git` sidecar is only in the optional `compose.git-pull.yml` overlay; it does a plain clone/pull and is unaffected by git 2.54 CLI changes.
The recipe version label is intentionally **not** bumped here. After merge, publish with:
`abra recipe release custom-html-tiny -y`
(minor bump: app moved 2.43 → 2.44; 2.44.0 carries a new feature alongside the fixes.)
Not merged — for operator review.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Upgrade image pins to the newest stable releases in the same tag scheme.
compose.ymljoseluisq/static-web-server:2.43.0joseluisq/static-web-server:2.44.1compose.git-pull.ymlalpine/git:v2.52.0alpine/git:v2.54.0Upstream release notes: app static-web-server 2.43.0→2.44.1: https://github.com/static-web-server/static-web-server/releases/tag/v2.44.0 and https://github.com/static-web-server/static-web-server/releases/tag/v2.44.1
Upstream release notes: git alpine/git v2.52.0→v2.54.0: https://github.com/git/git/tree/v2.54.0/Documentation/RelNotes
Operator Action Required
-a/-p/-g/-dexplicitly.--use-relative-root; 2.44.1 tightens metrics + directory-archive behaviour.gitsidecar is only in the optionalcompose.git-pull.ymloverlay; it does a plain clone/pull and is unaffected by git 2.54 CLI changes.The recipe version label is intentionally not bumped here. After merge, publish with:
abra recipe release custom-html-tiny -y(minor bump: app moved 2.43 → 2.44; 2.44.0 carries a new feature alongside the fixes.)
Not merged — for operator review.
!testme
🌻 cc-ci —
custom-html-tiny@a34432c5✅ passedfull logs · dashboard
!testme
🌻 cc-ci —
custom-html-tiny@a34432c5✅ passedfull logs · dashboard
!testme
🌻 cc-ci —
custom-html-tiny@a34432c5✅ passedfull logs · dashboard
!testme
chore: upgrade git to v2.54.0to chore: upgrade app to 2.44.0!testme
🌻 cc-ci —
custom-html-tiny@bf60c825✅ passed (bridge-bypasswatcher)full logs · dashboard
chore: upgrade app to 2.44.0to chore: upgrade app to 2.44.1!testme
🌻 cc-ci —
custom-html-tiny@4b0036da✅ passedfull logs · dashboard
chore: upgrade app to 2.44.1to chore: upgrade app to 2.44.1 and git to v2.54.0!testme
🌻 cc-ci —
custom-html-tiny@4b0036da✅ passedfull logs · dashboard
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.