None for this patch bump. The official image runs Rails migrations automatically on boot; no env/config/migration change is needed by 2026.7.4. The postgres major is intentionally not bumped.
The recipe version label is deliberately left at 1.1.2+2026.7.3. After this PR merges, publish with:
abra recipe release discourse -z
(expected 1.1.3+2026.7.4; patch bump — security/patch release on the same ESR line)
Verification
Direct --chaos dev deploy on cc-ci at dev-discourse.ci.commoninternet.net: app/db/redis all 1/1; GET /srv/status -> ok; GET /about.json reports version 2026.7.4; GET / -> 200. Dev deploy torn down (0 leftover stacks/volumes).
abra recipe lint discourse -C -n: all error rules satisfied; only pre-existing warnings (non-semver pg18, long smtp_password secret).
Advisory scan 2026.7.3 -> 2026.7.4: 5 GHSA security advisories fixed (no CVE ids assigned); 1 low CVE-2025-53016 left STILL-UNKNOWN (no published fix version); no failed sources.
Nothing is merged. This PR is for operator review.
Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.
Upgrade the app image on the ESR line from `discourse/discourse:2026.7.3` to `2026.7.4` (a security/patch release, published 2026-10-23).
## Images
| service | current | new |
|---|---|---|
| app (+ in-container sidekiq) | `discourse/discourse:2026.7.3` | `discourse/discourse:2026.7.4` |
| db | `discourse/postgres:pg18` | unchanged |
| redis | `redis:8.10-alpine` | unchanged |
## Upstream release notes
- app `discourse/discourse` 2026.7.3 -> 2026.7.4: https://releases.discourse.org/changelog/v2026.7.4/
- full diff: https://github.com/discourse/discourse/compare/v2026.7.3...v2026.7.4 (47 commits, incl. 5 security fixes)
- db `discourse/postgres` pg18: unchanged (non-semver tag; already newest major)
- redis `redis:8.10-alpine`: unchanged (already newest line)
## Operator action required
None for this patch bump. The official image runs Rails migrations automatically on boot; no env/config/migration change is needed by 2026.7.4. The postgres major is intentionally not bumped.
The recipe version label is deliberately left at `1.1.2+2026.7.3`. After this PR merges, publish with:
abra recipe release discourse -z
(expected `1.1.3+2026.7.4`; patch bump — security/patch release on the same ESR line)
## Verification
- Direct `--chaos` dev deploy on cc-ci at `dev-discourse.ci.commoninternet.net`: app/db/redis all 1/1; `GET /srv/status` -> `ok`; `GET /about.json` reports version `2026.7.4`; `GET /` -> 200. Dev deploy torn down (0 leftover stacks/volumes).
- `abra recipe lint discourse -C -n`: all error rules satisfied; only pre-existing warnings (non-semver `pg18`, long `smtp_password` secret).
- Advisory scan 2026.7.3 -> 2026.7.4: 5 GHSA security advisories fixed (no CVE ids assigned); 1 low CVE-2025-53016 left STILL-UNKNOWN (no published fix version); no failed sources.
Nothing is merged. This PR is for operator review.
Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.
cc @trav @notplants
Upstreamed to git.coopcloud.tech/coop-cloud/discourse and released as `1.1.3+2026.7.4`: https://git.coopcloud.tech/coop-cloud/discourse/src/tag/1.1.3+2026.7.4 — closing.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Upgrade the app image on the ESR line from
discourse/discourse:2026.7.3to2026.7.4(a security/patch release, published 2026-10-23).Images
discourse/discourse:2026.7.3discourse/discourse:2026.7.4discourse/postgres:pg18redis:8.10-alpineUpstream release notes
discourse/discourse2026.7.3 -> 2026.7.4: https://releases.discourse.org/changelog/v2026.7.4/discourse/postgrespg18: unchanged (non-semver tag; already newest major)redis:8.10-alpine: unchanged (already newest line)Operator action required
None for this patch bump. The official image runs Rails migrations automatically on boot; no env/config/migration change is needed by 2026.7.4. The postgres major is intentionally not bumped.
The recipe version label is deliberately left at
1.1.2+2026.7.3. After this PR merges, publish with:abra recipe release discourse -z
(expected
1.1.3+2026.7.4; patch bump — security/patch release on the same ESR line)Verification
--chaosdev deploy on cc-ci atdev-discourse.ci.commoninternet.net: app/db/redis all 1/1;GET /srv/status->ok;GET /about.jsonreports version2026.7.4;GET /-> 200. Dev deploy torn down (0 leftover stacks/volumes).abra recipe lint discourse -C -n: all error rules satisfied; only pre-existing warnings (non-semverpg18, longsmtp_passwordsecret).Nothing is merged. This PR is for operator review.
Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.
cc @trav @notplants
!testme
🌻 cc-ci —
discourse@5906ec92✅ passedfull logs · dashboard
Upstreamed to git.coopcloud.tech/coop-cloud/discourse and released as
1.1.3+2026.7.4: https://git.coopcloud.tech/coop-cloud/discourse/src/tag/1.1.3+2026.7.4 — closing.Pull request closed