recipe-maintainers/discourse
0
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

chore: upgrade app to 2026.7.5 #13

Open
autonomic-bot wants to merge 1 commits from upgrade-7d590f4 into main
pull from: upgrade-7d590f4
merge into: :main
Conversation 2 Commits 1 Files Changed 1
+1 -1
autonomic-bot commented 2026-11-13 03:50:37 +00:00
Owner
Copy Link
Copy Source

Upgrade: discourse app 2026.7.4 → 2026.7.5

Security patch release on the 2026.7 ESR line. One commit on current upstream main (6292862).

service image current target
app discourse/discourse 2026.7.4 2026.7.5
db discourse/postgres pg18 pg18 (unchanged)
redis redis 8.10-alpine 8.10-alpine (unchanged)

abra recipe upgrade reports only the app bump. The db pin is left as-is (pg18; abra cannot parse
pg<MAJOR> tags, and pg18 is still the newest tag on the same scheme — no pg19). Redis is already latest
per abra.

Upstream release notes: app 2026.7.4→2026.7.5: https://releases.discourse.org/changelog/v2026.7.5/

What changed

2026.7.5 is a security-only patch release: 37 security fixes (95 security commits) plus 3 small fixes
(BBCode quote/details parsing, quote-tag post-limit counting, startup when image sandboxing is
unavailable). Named SECURITY backports include moderator privilege escalation via other users' invite
keys, IP disclosure to restricted moderators, chat channel/mention access rechecks, public
signup/invite user-field assignment, DiscourseConnect invite-key CSRF, hidden group-membership leaks,
calendar subscription revocation, private category metadata leak, external-signup username override
handling, hashtag bridge resource exhaustion, Patreon reward-group deferral, developer-email signup
privilege escalation, and group-history viewer limits.

Advisory scan

Deterministic scan for this exact window: 0 CVE ids, 37 GHSA security advisories fixed (their
published patched versions include 2026.7.5), 1 undecided: CVE-2025-53016 (low, HTML injection in
solved posts with display_name_on_posts) has no published fix version and is not named in the
2026.7.5 notes — recorded as STILL-UNKNOWN, not counted and not treated as unaffected.

Operator Action Required

None for this patch release. Normal rolling app deploy; Rails migrations run automatically on boot.
No config renames, no dependency bumps, no sidecar changes. Existing sites on the 2026.7 ESR line need
no manual step.

Release step (operator, after merge)

The recipe version label is deliberately not bumped in this PR. Publish with:

abra recipe release discourse -z

(Recommended -z patch bump: security-only patch release.)

CI verification is run against this one-commit PR head. NOT merged — for operator review.

cc @trav @notplants

## Upgrade: discourse app 2026.7.4 → 2026.7.5 Security patch release on the 2026.7 ESR line. One commit on current upstream main (`6292862`). | service | image | current | target | |---------|-------|---------|--------| | app | discourse/discourse | 2026.7.4 | **2026.7.5** | | db | discourse/postgres | pg18 | pg18 (unchanged) | | redis | redis | 8.10-alpine | 8.10-alpine (unchanged) | `abra recipe upgrade` reports only the app bump. The db pin is left as-is (`pg18`; abra cannot parse `pg<MAJOR>` tags, and pg18 is still the newest tag on the same scheme — no pg19). Redis is already latest per abra. **Upstream release notes:** app 2026.7.4→2026.7.5: https://releases.discourse.org/changelog/v2026.7.5/ ### What changed 2026.7.5 is a security-only patch release: 37 security fixes (95 security commits) plus 3 small fixes (BBCode quote/details parsing, quote-tag post-limit counting, startup when image sandboxing is unavailable). Named SECURITY backports include moderator privilege escalation via other users' invite keys, IP disclosure to restricted moderators, chat channel/mention access rechecks, public signup/invite user-field assignment, DiscourseConnect invite-key CSRF, hidden group-membership leaks, calendar subscription revocation, private category metadata leak, external-signup username override handling, hashtag bridge resource exhaustion, Patreon reward-group deferral, developer-email signup privilege escalation, and group-history viewer limits. ### Advisory scan Deterministic scan for this exact window: **0 CVE ids**, **37 GHSA security advisories fixed** (their published patched versions include `2026.7.5`), **1 undecided**: CVE-2025-53016 (low, HTML injection in solved posts with `display_name_on_posts`) has no published fix version and is not named in the 2026.7.5 notes — recorded as STILL-UNKNOWN, not counted and not treated as unaffected. ### Operator Action Required None for this patch release. Normal rolling app deploy; Rails migrations run automatically on boot. No config renames, no dependency bumps, no sidecar changes. Existing sites on the 2026.7 ESR line need no manual step. ### Release step (operator, after merge) The recipe version label is deliberately not bumped in this PR. Publish with: ``` abra recipe release discourse -z ``` (Recommended `-z` patch bump: security-only patch release.) CI verification is run against this one-commit PR head. NOT merged — for operator review. cc @trav @notplants
autonomic-bot added 1 commit 2026-11-13 03:50:38 +00:00
chore: upgrade app to 2026.7.5
continuous-integration/drone/pr Build is pending
Details
cc-ci/testme cc-ci: success
Details
87c57b9efc
autonomic-bot requested review from trav 2026-11-13 03:50:38 +00:00
autonomic-bot requested review from notplants 2026-11-13 03:50:38 +00:00
autonomic-bot commented 2026-11-13 03:50:50 +00:00
Author
Owner
Copy Link
Copy Source

!testme

!testme
autonomic-bot commented 2026-11-13 03:51:02 +00:00
Author
Owner
Copy Link
Copy Source

🌻 cc-ci — discourse @ 87c57b9e ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `discourse` @ `87c57b9e` ✅ **passed** [![cc-ci result card](https://ci.autonomic.zone/runs/146/summary.png)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/146) [![level](https://ci.autonomic.zone/runs/146/badge.svg)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/146) [full logs](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/146) · [dashboard](https://ci.autonomic.zone/)
Some checks are pending
continuous-integration/drone/pr Build is pending
Details
cc-ci/testme cc-ci: success
Details
You are not authorized to merge this pull request.
This pull request can be merged automatically.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin upgrade-7d590f4:upgrade-7d590f4
git checkout upgrade-7d590f4
Sign in to join this conversation.
Reviewers
No Reviewers
notplants
trav
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
aadil (alizeh) autonomic autonomic-bot kawaiipunk (KawaiiPunk) notplants spacehobo (Nick Moffitt) trav (Trav Fryer)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: recipe-maintainers/discourse#13