Image-tag bump on top of upstream main (269e08c). The recipe version label is intentionally not
bumped in this PR — the operator's final abra recipe release does that after the upstream PR merges.
Service
Image
Current
New
Notes
app
ghost
6.65.0-alpine
6.67.0-alpine
security fix + feature + bugfixes
db
mysql
8.4
8.4 (unchanged)
abra flags 9.0–9.7 / 26.7 (non-LTS majors + DB-image-gen artifacts); Ghost supports MySQL 8 only → held at 8.4 LTS
Security (why this upgrade matters)
CVE-2026-84383 / GHSA-cr6m-qrr6-q3j8 — high (CVSS 8.8), heap-based buffer overflow
(CWE-122) via crafted image uploads; affected >=6.46.0, <6.67.0; fixed in 6.67.0. Any staff
user, including Contributors, could upload a crafted image that reached the vulnerable bundled image
library → crash and possible code execution.
None for Ghost 6.65→6.67: no breaking changes, no required migrations, no new-or-renamed config.
MySQL stays on 8.4 — do not move to 9.x/26.x (Ghost supports only MySQL 8).
Advisory scan (deterministic, step 2a)
CVEs fixed by this upgrade: 1 — CVE-2026-84383 (high, fixed in 6.67.0; GHSA-cr6m-qrr6-q3j8;
source github-advisories:TryGhost/Ghost). Sources checked: 7 (5 registry URLs + advisory APIs); no
failed sources, no unjudged advisories. No sidecar upgraded.
Live verification (step 2b, cc-ci local swarm)
Deployed the WIP head (67442ff) on dev-ghost.ci.commoninternet.net — base 6.65.0 then a rolling
update to 6.67.0: migration chain ran clean (Database state requires migration → Running migrations → Database is in a ready state), booted in 2.3s, HTTP 200, generator meta Ghost 6.67. Only the pre-existing ActivityPub webhook-secret noise (identical on 6.65.0). Dev deploy
torn down; 0 dev-ghost* stacks/volumes/services/.env leaked.
Recommended release (operator, after upstream merge)
abra recipe release ghost -y
Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.
## Recipe upgrade: ghost `6.65.0-alpine` → `6.67.0-alpine`
Image-tag bump on top of upstream `main` (`269e08c`). The recipe version label is intentionally **not**
bumped in this PR — the operator's final `abra recipe release` does that after the upstream PR merges.
| Service | Image | Current | New | Notes |
|---------|-------|---------|-----|-------|
| app | ghost | `6.65.0-alpine` | **`6.67.0-alpine`** | security fix + feature + bugfixes |
| db | mysql | `8.4` | `8.4` (unchanged) | abra flags `9.0`–`9.7` / `26.7` (non-LTS majors + DB-image-gen artifacts); Ghost supports MySQL 8 only → held at 8.4 LTS |
### Security (why this upgrade matters)
- **CVE-2026-84383** / **GHSA-cr6m-qrr6-q3j8** — **high (CVSS 8.8)**, heap-based buffer overflow
(CWE-122) via crafted image uploads; affected `>=6.46.0, <6.67.0`; **fixed in 6.67.0**. Any staff
user, including Contributors, could upload a crafted image that reached the vulnerable bundled image
library → crash and possible code execution.
**Upstream release notes:** ghost `6.65.0`→`6.67.0`: https://github.com/TryGhost/Ghost/releases
- v6.66.0 was **never published to npm** (packaging bug) and is fully contained in v6.67.0 — hence the
target is `6.67.0` and `6.66.0` is deliberately skipped.
- full compare: https://github.com/TryGhost/Ghost/compare/v6.65.0...v6.67.0
### Operator Action Required
- None for Ghost `6.65`→`6.67`: no breaking changes, no required migrations, no new-or-renamed config.
- MySQL stays on `8.4` — do **not** move to `9.x`/`26.x` (Ghost supports only MySQL 8).
### Advisory scan (deterministic, step 2a)
**CVEs fixed by this upgrade: 1** — `CVE-2026-84383` (high, fixed in `6.67.0`; GHSA-cr6m-qrr6-q3j8;
source `github-advisories:TryGhost/Ghost`). Sources checked: 7 (5 registry URLs + advisory APIs); no
failed sources, no unjudged advisories. No sidecar upgraded.
### Live verification (step 2b, cc-ci local swarm)
Deployed the WIP head (`67442ff`) on `dev-ghost.ci.commoninternet.net` — base `6.65.0` then a rolling
update to `6.67.0`: migration chain ran clean (`Database state requires migration` → `Running
migrations` → `Database is in a ready state`), booted in 2.3s, HTTP 200, `generator` meta
`Ghost 6.67`. Only the pre-existing ActivityPub webhook-secret noise (identical on 6.65.0). Dev deploy
torn down; 0 `dev-ghost*` stacks/volumes/services/.env leaked.
### Recommended release (operator, after upstream merge)
```
abra recipe release ghost -y
```
Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.
cc @trav @notplants
"### !testme verdict: GREEN\n\nManually run via the Drone API workaround (the ccci-bridge is currently silently dropping !testme triggers because its mounted Gitea-bot swarm secret is stale → bridge auth 401; reported in 2026-08-03 /upgrade-all run).\n\n- Recipe: ghost\n- PR head:1a115513bb (branch upgrade-808ac05, 6.45.0-alpine → 6.55.0-alpine)\n- Drone build: recipe-maintainers/cc-ci #1164 — success\n- Build URL:https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1164\n-Params used:RECIPE=ghost PR=7 REF=<sha> SRC=recipe-maintainers/ghost, plus a fresh per-run GITEA_TOKEN (the runner's /run/secrets/bridge_gitea_token is the same stale secret → clone 401'd on the first attempt; the env override is the documented first-branch of _gitea_token() in runner/run_recipe_ci.py).\n\nVERDICT=GREEN — full cc-ci suite (install / upgrade / backup / restore / custom) passed cold against this PR head. Gitea commit-status cc-ci/testme = success posted manually so testme-on-pr.sh reads it.\n\ncc-ci operator: the bridge secret needs rotation (operator infra, NOT touched here).\n"
"### !testme verdict: GREEN\n\nManually run via the **Drone API workaround** (the `ccci-bridge` is currently silently dropping `!testme` triggers because its mounted Gitea-bot swarm secret is stale → bridge auth 401; reported in 2026-08-03 /upgrade-all run).\n\n- **Recipe:** ghost\n- **PR head:** `1a115513bb` (branch `upgrade-808ac05`, 6.45.0-alpine → 6.55.0-alpine)\n- **Drone build:** recipe-maintainers/cc-ci #1164 — `success`\n- **Build URL:** https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1164\n- **Params used:** `RECIPE=ghost PR=7 REF=<sha> SRC=recipe-maintainers/ghost`, plus a fresh per-run `GITEA_TOKEN` (the runner's `/run/secrets/bridge_gitea_token` is the same stale secret → clone 401'd on the first attempt; the env override is the documented first-branch of `_gitea_token()` in `runner/run_recipe_ci.py`).\n\n**VERDICT=GREEN** — full cc-ci suite (install / upgrade / backup / restore / custom) passed cold against this PR head. Gitea commit-status `cc-ci/testme = success` posted manually so `testme-on-pr.sh` reads it.\n\ncc-ci operator: the bridge secret needs rotation (operator infra, NOT touched here).\n"
autonomic-bot
changed title from chore: upgrade ghost to 6.55.0-alpine to chore: upgrade ghost to 6.56.0-alpine2026-08-07 03:29:00 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Recipe upgrade: ghost
6.65.0-alpine→6.67.0-alpineImage-tag bump on top of upstream
main(269e08c). The recipe version label is intentionally notbumped in this PR — the operator's final
abra recipe releasedoes that after the upstream PR merges.6.65.0-alpine6.67.0-alpine8.48.4(unchanged)9.0–9.7/26.7(non-LTS majors + DB-image-gen artifacts); Ghost supports MySQL 8 only → held at 8.4 LTSSecurity (why this upgrade matters)
(CWE-122) via crafted image uploads; affected
>=6.46.0, <6.67.0; fixed in 6.67.0. Any staffuser, including Contributors, could upload a crafted image that reached the vulnerable bundled image
library → crash and possible code execution.
Upstream release notes: ghost
6.65.0→6.67.0: https://github.com/TryGhost/Ghost/releasestarget is
6.67.0and6.66.0is deliberately skipped.Operator Action Required
6.65→6.67: no breaking changes, no required migrations, no new-or-renamed config.8.4— do not move to9.x/26.x(Ghost supports only MySQL 8).Advisory scan (deterministic, step 2a)
CVEs fixed by this upgrade: 1 —
CVE-2026-84383(high, fixed in6.67.0; GHSA-cr6m-qrr6-q3j8;source
github-advisories:TryGhost/Ghost). Sources checked: 7 (5 registry URLs + advisory APIs); nofailed sources, no unjudged advisories. No sidecar upgraded.
Live verification (step 2b, cc-ci local swarm)
Deployed the WIP head (
67442ff) ondev-ghost.ci.commoninternet.net— base6.65.0then a rollingupdate to
6.67.0: migration chain ran clean (Database state requires migration→Running migrations→Database is in a ready state), booted in 2.3s, HTTP 200,generatormetaGhost 6.67. Only the pre-existing ActivityPub webhook-secret noise (identical on 6.65.0). Dev deploytorn down; 0
dev-ghost*stacks/volumes/services/.env leaked.Recommended release (operator, after upstream merge)
Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.
cc @trav @notplants
!testme
🌻 cc-ci —
ghost@808ac052✅ passedfull logs · dashboard
chore: upgrade ghost to 6.47.0-alpineto chore: upgrade ghost to 6.50.0-alpine!testme
🌻 cc-ci —
ghost@d5fe2003✅ passedfull logs · dashboard
chore: upgrade ghost to 6.50.0-alpineto chore: upgrade ghost to 6.52.1-alpine!testme
!testme
🌻 cc-ci —
ghost@c4250926✅ passedfull logs · dashboard
chore: upgrade ghost to 6.52.1-alpineto chore: upgrade ghost to 6.53.0-alpine!testme
🌻 cc-ci —
ghost@a006236b✅ passedfull logs · dashboard
chore: upgrade ghost to 6.53.0-alpineto chore: upgrade ghost to 6.55.0-alpine!testme
"### !testme verdict: GREEN\n\nManually run via the Drone API workaround (the
ccci-bridgeis currently silently dropping!testmetriggers because its mounted Gitea-bot swarm secret is stale → bridge auth 401; reported in 2026-08-03 /upgrade-all run).\n\n- Recipe: ghost\n- PR head:1a115513bb(branchupgrade-808ac05, 6.45.0-alpine → 6.55.0-alpine)\n- Drone build: recipe-maintainers/cc-ci #1164 —success\n- Build URL: https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1164\n- Params used:RECIPE=ghost PR=7 REF=<sha> SRC=recipe-maintainers/ghost, plus a fresh per-runGITEA_TOKEN(the runner's/run/secrets/bridge_gitea_tokenis the same stale secret → clone 401'd on the first attempt; the env override is the documented first-branch of_gitea_token()inrunner/run_recipe_ci.py).\n\nVERDICT=GREEN — full cc-ci suite (install / upgrade / backup / restore / custom) passed cold against this PR head. Gitea commit-statuscc-ci/testme = successposted manually sotestme-on-pr.shreads it.\n\ncc-ci operator: the bridge secret needs rotation (operator infra, NOT touched here).\n"chore: upgrade ghost to 6.55.0-alpineto chore: upgrade ghost to 6.56.0-alpine!testme
🌻 cc-ci —
ghost@2b025117✅ passedfull logs · dashboard
chore: upgrade ghost to 6.56.0-alpineto chore: upgrade ghost to 6.57.1-alpine!testme
🌻 cc-ci —
ghost@5197ca51❌ failure → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1256(summary card unavailable — see the run for details.) full logs · dashboard
!testme
🌻 cc-ci —
ghost@5197ca51❌ failure → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1258(summary card unavailable — see the run for details.) full logs · dashboard
!testme
🌻 cc-ci —
ghost@5197ca51✅ passed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1261(summary card unavailable — see the run for details.) full logs · dashboard
chore: upgrade ghost to 6.57.1-alpineto chore: upgrade ghost to 6.59.0-alpine!testme
🌻 cc-ci —
ghost@8c1bed00✅ passed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1292(summary card unavailable — see the run for details.) full logs · dashboard
chore: upgrade ghost to 6.59.0-alpineto chore: upgrade ghost to 6.61.0-alpine!testme
🌻 cc-ci —
ghost@13df5d03✅ passed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1304(summary card unavailable — see the run for details.) full logs · dashboard
chore: upgrade ghost to 6.61.0-alpineto chore: upgrade ghost to 6.62.0-alpine!testme
🌻 cc-ci —
ghost@14575de6✅ passed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1316(summary card unavailable — see the run for details.) full logs · dashboard
!testme
🌻 cc-ci —
ghost@14575de6✅ passedfull logs · dashboard
chore: upgrade ghost to 6.62.0-alpineto chore: upgrade ghost to 6.63.0-alpine!testme
🌻 cc-ci —
ghost@365f0b4c✅ passedfull logs · dashboard
chore: upgrade ghost to 6.63.0-alpineto chore: upgrade ghost to 6.64.0-alpine!testme
🌻 cc-ci —
ghost@e2d2aa22✅ passedfull logs · dashboard
!testme
🌻 cc-ci —
ghost@e2d2aa22✅ passedfull logs · dashboard
chore: upgrade ghost to 6.64.0-alpineto chore: upgrade ghost to 6.67.0-alpine!testme
🌻 cc-ci —
ghost@678565d7✅ passedfull logs · dashboard
Pull request closed