chore: upgrade ghost to 6.67.0-alpine #7

Closed
autonomic-bot wants to merge 0 commits from upgrade-808ac05 into main
Owner

Recipe upgrade: ghost 6.65.0-alpine → 6.67.0-alpine

Image-tag bump on top of upstream main (269e08c). The recipe version label is intentionally not
bumped in this PR — the operator's final abra recipe release does that after the upstream PR merges.

Service Image Current New Notes
app ghost 6.65.0-alpine 6.67.0-alpine security fix + feature + bugfixes
db mysql 8.4 8.4 (unchanged) abra flags 9.0–9.7 / 26.7 (non-LTS majors + DB-image-gen artifacts); Ghost supports MySQL 8 only → held at 8.4 LTS

Security (why this upgrade matters)

  • CVE-2026-84383 / GHSA-cr6m-qrr6-q3j8 — high (CVSS 8.8), heap-based buffer overflow
    (CWE-122) via crafted image uploads; affected >=6.46.0, <6.67.0; fixed in 6.67.0. Any staff
    user, including Contributors, could upload a crafted image that reached the vulnerable bundled image
    library → crash and possible code execution.

Upstream release notes: ghost 6.65.0→6.67.0: https://github.com/TryGhost/Ghost/releases

Operator Action Required

  • None for Ghost 6.65→6.67: no breaking changes, no required migrations, no new-or-renamed config.
  • MySQL stays on 8.4 — do not move to 9.x/26.x (Ghost supports only MySQL 8).

Advisory scan (deterministic, step 2a)

CVEs fixed by this upgrade: 1 — CVE-2026-84383 (high, fixed in 6.67.0; GHSA-cr6m-qrr6-q3j8;
source github-advisories:TryGhost/Ghost). Sources checked: 7 (5 registry URLs + advisory APIs); no
failed sources, no unjudged advisories. No sidecar upgraded.

Live verification (step 2b, cc-ci local swarm)

Deployed the WIP head (67442ff) on dev-ghost.ci.commoninternet.net — base 6.65.0 then a rolling
update to 6.67.0: migration chain ran clean (Database state requires migration → Running migrations → Database is in a ready state), booted in 2.3s, HTTP 200, generator meta
Ghost 6.67. Only the pre-existing ActivityPub webhook-secret noise (identical on 6.65.0). Dev deploy
torn down; 0 dev-ghost* stacks/volumes/services/.env leaked.

Recommended release (operator, after upstream merge)

abra recipe release ghost -y

Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.

cc @trav @notplants

## Recipe upgrade: ghost `6.65.0-alpine` → `6.67.0-alpine` Image-tag bump on top of upstream `main` (`269e08c`). The recipe version label is intentionally **not** bumped in this PR — the operator's final `abra recipe release` does that after the upstream PR merges. | Service | Image | Current | New | Notes | |---------|-------|---------|-----|-------| | app | ghost | `6.65.0-alpine` | **`6.67.0-alpine`** | security fix + feature + bugfixes | | db | mysql | `8.4` | `8.4` (unchanged) | abra flags `9.0`–`9.7` / `26.7` (non-LTS majors + DB-image-gen artifacts); Ghost supports MySQL 8 only → held at 8.4 LTS | ### Security (why this upgrade matters) - **CVE-2026-84383** / **GHSA-cr6m-qrr6-q3j8** — **high (CVSS 8.8)**, heap-based buffer overflow (CWE-122) via crafted image uploads; affected `>=6.46.0, <6.67.0`; **fixed in 6.67.0**. Any staff user, including Contributors, could upload a crafted image that reached the vulnerable bundled image library → crash and possible code execution. **Upstream release notes:** ghost `6.65.0`→`6.67.0`: https://github.com/TryGhost/Ghost/releases - v6.66.0 was **never published to npm** (packaging bug) and is fully contained in v6.67.0 — hence the target is `6.67.0` and `6.66.0` is deliberately skipped. - full compare: https://github.com/TryGhost/Ghost/compare/v6.65.0...v6.67.0 ### Operator Action Required - None for Ghost `6.65`→`6.67`: no breaking changes, no required migrations, no new-or-renamed config. - MySQL stays on `8.4` — do **not** move to `9.x`/`26.x` (Ghost supports only MySQL 8). ### Advisory scan (deterministic, step 2a) **CVEs fixed by this upgrade: 1** — `CVE-2026-84383` (high, fixed in `6.67.0`; GHSA-cr6m-qrr6-q3j8; source `github-advisories:TryGhost/Ghost`). Sources checked: 7 (5 registry URLs + advisory APIs); no failed sources, no unjudged advisories. No sidecar upgraded. ### Live verification (step 2b, cc-ci local swarm) Deployed the WIP head (`67442ff`) on `dev-ghost.ci.commoninternet.net` — base `6.65.0` then a rolling update to `6.67.0`: migration chain ran clean (`Database state requires migration` → `Running migrations` → `Database is in a ready state`), booted in 2.3s, HTTP 200, `generator` meta `Ghost 6.67`. Only the pre-existing ActivityPub webhook-secret noise (identical on 6.65.0). Dev deploy torn down; 0 `dev-ghost*` stacks/volumes/services/.env leaked. ### Recommended release (operator, after upstream merge) ``` abra recipe release ghost -y ``` Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review. cc @trav @notplants
autonomic-bot added 1 commit 2026-06-26 04:01:25 +00:00
autonomic-bot requested review from trav 2026-06-26 04:01:25 +00:00
autonomic-bot requested review from notplants 2026-06-26 04:01:26 +00:00
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — ghost @ 808ac052 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `ghost` @ `808ac052` ✅ **passed** [![cc-ci result card](https://ci.commoninternet.net/runs/961/summary.png)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/961) [![level](https://ci.commoninternet.net/runs/961/badge.svg)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/961) [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/961) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot changed title from chore: upgrade ghost to 6.47.0-alpine to chore: upgrade ghost to 6.50.0-alpine 2026-07-03 03:21:35 +00:00
autonomic-bot added 1 commit 2026-07-03 03:21:36 +00:00
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — ghost @ d5fe2003 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `ghost` @ `d5fe2003` ✅ **passed** [![cc-ci result card](https://ci.commoninternet.net/runs/974/summary.png)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/974) [![level](https://ci.commoninternet.net/runs/974/badge.svg)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/974) [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/974) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot changed title from chore: upgrade ghost to 6.50.0-alpine to chore: upgrade ghost to 6.52.1-alpine 2026-07-13 17:50:08 +00:00
autonomic-bot added 1 commit 2026-07-13 17:50:09 +00:00
Author
Owner

!testme

!testme
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — ghost @ c4250926 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `ghost` @ `c4250926` ✅ **passed** [![cc-ci result card](https://ci.commoninternet.net/runs/1116/summary.png)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1116) [![level](https://ci.commoninternet.net/runs/1116/badge.svg)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1116) [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1116) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot changed title from chore: upgrade ghost to 6.52.1-alpine to chore: upgrade ghost to 6.53.0-alpine 2026-07-24 04:03:22 +00:00
autonomic-bot added 1 commit 2026-07-24 04:03:24 +00:00
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — ghost @ a006236b ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `ghost` @ `a006236b` ✅ **passed** [![cc-ci result card](https://ci.commoninternet.net/runs/1133/summary.png)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1133) [![level](https://ci.commoninternet.net/runs/1133/badge.svg)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1133) [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1133) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot changed title from chore: upgrade ghost to 6.53.0-alpine to chore: upgrade ghost to 6.55.0-alpine 2026-08-03 22:18:41 +00:00
autonomic-bot added 1 commit 2026-08-03 22:18:42 +00:00
chore: upgrade ghost to 6.55.0-alpine
cc-ci/testme !testme GREEN via Drone API workaround (bridge silent)
1a115513bb
Author
Owner

!testme

!testme
Author
Owner

"### !testme verdict: GREEN\n\nManually run via the Drone API workaround (the ccci-bridge is currently silently dropping !testme triggers because its mounted Gitea-bot swarm secret is stale → bridge auth 401; reported in 2026-08-03 /upgrade-all run).\n\n- Recipe: ghost\n- PR head: 1a115513bb (branch upgrade-808ac05, 6.45.0-alpine → 6.55.0-alpine)\n- Drone build: recipe-maintainers/cc-ci #1164 — success\n- Build URL: https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1164\n- Params used: RECIPE=ghost PR=7 REF=<sha> SRC=recipe-maintainers/ghost, plus a fresh per-run GITEA_TOKEN (the runner's /run/secrets/bridge_gitea_token is the same stale secret → clone 401'd on the first attempt; the env override is the documented first-branch of _gitea_token() in runner/run_recipe_ci.py).\n\nVERDICT=GREEN — full cc-ci suite (install / upgrade / backup / restore / custom) passed cold against this PR head. Gitea commit-status cc-ci/testme = success posted manually so testme-on-pr.sh reads it.\n\ncc-ci operator: the bridge secret needs rotation (operator infra, NOT touched here).\n"

"### !testme verdict: GREEN\n\nManually run via the **Drone API workaround** (the `ccci-bridge` is currently silently dropping `!testme` triggers because its mounted Gitea-bot swarm secret is stale → bridge auth 401; reported in 2026-08-03 /upgrade-all run).\n\n- **Recipe:** ghost\n- **PR head:** `1a115513bb` (branch `upgrade-808ac05`, 6.45.0-alpine → 6.55.0-alpine)\n- **Drone build:** recipe-maintainers/cc-ci #1164 — `success`\n- **Build URL:** https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1164\n- **Params used:** `RECIPE=ghost PR=7 REF=<sha> SRC=recipe-maintainers/ghost`, plus a fresh per-run `GITEA_TOKEN` (the runner's `/run/secrets/bridge_gitea_token` is the same stale secret → clone 401'd on the first attempt; the env override is the documented first-branch of `_gitea_token()` in `runner/run_recipe_ci.py`).\n\n**VERDICT=GREEN** — full cc-ci suite (install / upgrade / backup / restore / custom) passed cold against this PR head. Gitea commit-status `cc-ci/testme = success` posted manually so `testme-on-pr.sh` reads it.\n\ncc-ci operator: the bridge secret needs rotation (operator infra, NOT touched here).\n"
autonomic-bot changed title from chore: upgrade ghost to 6.55.0-alpine to chore: upgrade ghost to 6.56.0-alpine 2026-08-07 03:29:00 +00:00
autonomic-bot added 1 commit 2026-08-07 03:29:01 +00:00
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — ghost @ 2b025117 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `ghost` @ `2b025117` ✅ **passed** [![cc-ci result card](https://ci.commoninternet.net/runs/1208/summary.png)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1208) [![level](https://ci.commoninternet.net/runs/1208/badge.svg)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1208) [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1208) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot changed title from chore: upgrade ghost to 6.56.0-alpine to chore: upgrade ghost to 6.57.1-alpine 2026-08-14 02:18:53 +00:00
autonomic-bot added 1 commit 2026-08-14 02:18:53 +00:00
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — ghost @ 5197ca51 ❌ failure → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1256

(summary card unavailable — see the run for details.) full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `ghost` @ `5197ca51` ❌ **failure** → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1256 _(summary card unavailable — see the run for details.)_ [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1256) · [dashboard](https://ci.commoninternet.net/)
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — ghost @ 5197ca51 ❌ failure → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1258

(summary card unavailable — see the run for details.) full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `ghost` @ `5197ca51` ❌ **failure** → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1258 _(summary card unavailable — see the run for details.)_ [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1258) · [dashboard](https://ci.commoninternet.net/)
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — ghost @ 5197ca51 ✅ passed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1261

(summary card unavailable — see the run for details.) full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `ghost` @ `5197ca51` ✅ **passed** → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1261 _(summary card unavailable — see the run for details.)_ [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1261) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot changed title from chore: upgrade ghost to 6.57.1-alpine to chore: upgrade ghost to 6.59.0-alpine 2026-08-21 02:26:46 +00:00
autonomic-bot added 1 commit 2026-08-21 02:26:46 +00:00
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — ghost @ 8c1bed00 ✅ passed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1292

(summary card unavailable — see the run for details.) full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `ghost` @ `8c1bed00` ✅ **passed** → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1292 _(summary card unavailable — see the run for details.)_ [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1292) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot changed title from chore: upgrade ghost to 6.59.0-alpine to chore: upgrade ghost to 6.61.0-alpine 2026-08-31 19:28:17 +00:00
autonomic-bot added 1 commit 2026-08-31 19:28:17 +00:00
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — ghost @ 13df5d03 ✅ passed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1304

(summary card unavailable — see the run for details.) full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `ghost` @ `13df5d03` ✅ **passed** → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1304 _(summary card unavailable — see the run for details.)_ [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1304) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot changed title from chore: upgrade ghost to 6.61.0-alpine to chore: upgrade ghost to 6.62.0-alpine 2026-09-04 02:20:39 +00:00
autonomic-bot added 1 commit 2026-09-04 02:20:39 +00:00
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — ghost @ 14575de6 ✅ passed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1316

(summary card unavailable — see the run for details.) full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `ghost` @ `14575de6` ✅ **passed** → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1316 _(summary card unavailable — see the run for details.)_ [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1316) · [dashboard](https://ci.commoninternet.net/)
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — ghost @ 14575de6 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `ghost` @ `14575de6` ✅ **passed** [![cc-ci result card](https://ci.commoninternet.net/runs/1332/summary.png)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1332) [![level](https://ci.commoninternet.net/runs/1332/badge.svg)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1332) [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1332) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot changed title from chore: upgrade ghost to 6.62.0-alpine to chore: upgrade ghost to 6.63.0-alpine 2026-09-11 02:40:32 +00:00
autonomic-bot added 1 commit 2026-09-11 02:40:33 +00:00
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — ghost @ 365f0b4c ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `ghost` @ `365f0b4c` ✅ **passed** [![cc-ci result card](https://ci.commoninternet.net/runs/1348/summary.png)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1348) [![level](https://ci.commoninternet.net/runs/1348/badge.svg)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1348) [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1348) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot changed title from chore: upgrade ghost to 6.63.0-alpine to chore: upgrade ghost to 6.64.0-alpine 2026-09-18 02:34:03 +00:00
autonomic-bot added 1 commit 2026-09-18 02:34:05 +00:00
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — ghost @ e2d2aa22 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `ghost` @ `e2d2aa22` ✅ **passed** [![cc-ci result card](https://ci.commoninternet.net/runs/1364/summary.png)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1364) [![level](https://ci.commoninternet.net/runs/1364/badge.svg)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1364) [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1364) · [dashboard](https://ci.commoninternet.net/)
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — ghost @ e2d2aa22 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `ghost` @ `e2d2aa22` ✅ **passed** [![cc-ci result card](https://ci.autonomic.zone/runs/3/summary.png)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/3) [![level](https://ci.autonomic.zone/runs/3/badge.svg)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/3) [full logs](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/3) · [dashboard](https://ci.autonomic.zone/)
autonomic-bot changed title from chore: upgrade ghost to 6.64.0-alpine to chore: upgrade ghost to 6.67.0-alpine 2026-10-02 02:22:48 +00:00
autonomic-bot added 1 commit 2026-10-02 02:22:48 +00:00
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — ghost @ 678565d7 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `ghost` @ `678565d7` ✅ **passed** [![cc-ci result card](https://ci.autonomic.zone/runs/24/summary.png)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/24) [![level](https://ci.autonomic.zone/runs/24/badge.svg)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/24) [full logs](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/24) · [dashboard](https://ci.autonomic.zone/)
trav closed this pull request 2026-10-05 17:09:44 +00:00

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
No Reviewers
No labels
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: recipe-maintainers/ghost#7