chore: upgrade impress to v5.4.1, redis to 8.10.0, nginx to 1.31.3 #7
trav
notplants
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: recipe-maintainers/lasuite-docs#7
Reference in New Issue
Block a user
Recipe upgrade: impress v5.2.1 → v5.4.1 + redis 8.8.0 → 8.10.0 + nginx 1.31.1 → 1.31.3 (security) + minio RELEASE.2025-05-24 → RELEASE.2025-09-07.
Extends the existing upgrade PR on branch
upgrade-505e53c(one evolving upgrade PR per recipe). Earlier passes carried impress v5.4.1 + nginx 1.31.3 + minio 2025-09-07; this pass re-specifies the redis bump as 8.8.0 → 8.10.0 (the latest stable redis minor, released 2026-08-03 on Docker Hub, superset of the 8.8.x security patches) per the run's explicit target.Image-tag table
911c982)RELEASE.2025-10-15T17-29-55Zsecurity CVE was NOT published to Docker Hub, so perdo not blindly take the max, 2025-09-07 remains the latest actual container tag)The four impress images share one version tag from the suitenumerique/docs monorepo and move in lockstep.
Upstream release notes
Operator action required
None — drop-in image bumps; no compose/config/env changes impress-side.
AUTO_MIGRATIONS=truemeans DB migrations run automatically on backend startup. No new required env vars. The impress v5.4.0 Bearer-auth removal only affects API clients using raw Bearer JWTs (browser/session login is unaffected); cc-ci lasuite-docs tests were already aligned with this in cc-ci PR #12 (2026-08-03).Recipe version bump (recommended, NOT applied — left for the operator)
impress v5.2.1→v5.4.1 is minor (new features) + the v5.4.0 default-Bearer-auth removal (security hardening). Combined with the redis + nginx security bumps, recommended recipe semver bump is minor. Operator runs after this PR merges:
abra recipe release lasuite-docs -y(NO--dry-run)Verification
!testmeresults are posted on this PR by the cc-ci CI server (harness):!testmetriggers (stale Gitea-bot swarm secret — a known infra issue, operator to fix), so this run was verified by driving Drone directly (the harness'srecipe-maintainers/cc-cirepo) with the bridge's exact query-string params and reflecting the verdict back to this PR as a manual commit-statuscc-ci/testme=success/failure+ a PR comment.Tested on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.
cc @trav @notplants
Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.
cc @trav @notplants
!testme
🌻 cc-ci —
lasuite-docs@505e53cc✅ passedfull logs · dashboard
chore: upgrade to v5.3.0 (impress app/backend/celery/y-provider) + nginx 1.31.2to chore: upgrade impress to v5.3.0, nginx to 1.31.2, minio to RELEASE.2025-09-07!testme
🌻 cc-ci —
lasuite-docs@9e3f3b13✅ passedfull logs · dashboard
chore: upgrade impress to v5.3.0, nginx to 1.31.2, minio to RELEASE.2025-09-07to chore: upgrade impress to v5.4.1!testme
🌻 cc-ci —
lasuite-docs@7e7ba76a❌ failurefull logs · dashboard
!testme RED diagnosis — stale test (upgrade is correct)
The
!testmerun on this PR head (7e7ba76a, build #1121) came back RED on one custom test:All other stages passed: install ✅, upgrade ✅, backup ✅, restore ✅. The other custom test (
test_oidc_with_keycloak.py::test_oidc_password_grant_against_dep_keycloak) also passed — it only verifies the OIDC password grant (obtaining a token from keycloak), not using it against the docs API.Why this test is stale
The test
test_oidc_login_via_keycloaksends a Bearer JWT (obtained via OIDC password grant) toGET /api/v1.0/users/me/and expects HTTP 200. This was the correct behavior up to impress v5.3.0.In v5.4.0, upstream PR suitenumerique/docs#2480 deliberately removed
mozilla_django_oidc.contrib.drf.OIDCAuthenticationfrom DRF'sDEFAULT_AUTHENTICATION_CLASSES. The stated rationale:The API now uses cookie session auth only — Bearer token auth against the API is intentionally no longer supported. The 401 "Authentication credentials were not provided" is the new correct behavior when a Bearer token is sent: DRF's remaining
SessionAuthenticationbackend doesn't recognize theAuthorization: Bearerheader.The upgrade itself is correct
dev-lasuite-docs,--chaos) converged cleanly on v5.4.1: all 9 services 1/1, backend migrations applied (migrate: done), gunicorn serving, minio bucket created, nginx landing page HTTP 200.install/upgrade/backup/restorelifecycle stages all pass, confirming the recipe deploys and operates correctly on v5.4.1.Recommended action
This test needs updating to reflect the new auth model (cookie session instead of Bearer token). Re-run with
--with-teststo open + verify a cc-ci test-update PR:The recipe PR itself is ready for operator review — the image-tag bumps are correct and the app converges. Nothing was merged.
chore: upgrade impress to v5.4.1to chore: upgrade nginx to 1.31.3!testme
🌻 cc-ci —
lasuite-docs@f772297f❌ failurefull logs · dashboard
!testme update — 2026-07-24 (head
f772297f, build #1136) ❌This PR was extended with the nginx 1.31.2 → 1.31.3 security bump (CVE-2026-42533 / CVE-2026-60005 / CVE-2026-56434) on top of the existing impress v5.4.1 work. The
!testmerun came back RED — on the same stale tests as the 2026-07-13 run (#1121), not on the nginx bump.Lifecycle stages — all pass
Failing custom tests — both STALE (Bearer-token auth removed in v5.4.0)
test_oidc_login.py::test_oidc_login_via_keycloak—GET /api/v1.0/users/me/withAuthorization: Bearer→ HTTP 401 (expected 200).test_create_doc.py::test_create_doc_and_read_back—POST /api/v1.0/documents/withAuthorization: Bearer→ HTTP 401 (expected 200/201).Both tests obtain a JWT via the OIDC password grant and send it as
Authorization: Bearer <jwt>to the impress API. In v5.4.0, upstream PR suitenumerique/docs#2480 deliberately removedmozilla_django_oidc.contrib.drf.OIDCAuthenticationfrom DRF'sDEFAULT_AUTHENTICATION_CLASSES; the API now uses cookie session auth only. The 401 "Authentication credentials were not provided" is the new correct behavior for a Bearer token —SessionAuthenticationdoesn't recognize theAuthorizationheader. This is a deliberate upstream security decision; no recipe-level config change should or could restore it.The upgrade itself is correct
dev-lasuite-docsdeploy (--chaos) on the cc-i swarm converged cleanly on impress v5.4.1 + nginx 1.31.3 + minio RELEASE.2025-09-07: all 9 services 1/1, backend migrations applied (migrate: done), gunicorn serving, minio bucket created, nginx landing HTTP 200, nginx version confirmednginx/1.31.3. Torn down cleanly (0 stacks/volumes/apps leaked).Recommended action
Both stale tests need updating to the new auth model (cookie session instead of Bearer token). Re-run with
--with-teststo open + verify a cc-ci test-update PR:Nothing merged; PR awaits operator review. cc @trav @notplants
The stale cc-ci tests blocking this PR are now fixed and merged: cc-ci PR #12
(recipe-maintainers/cc-ci#12) replaces the removed Bearer-auth
path with the real OIDC authorization-code session login (impress v5.4.0 hardening).
Verified GREEN: cold full-suite ×1 against THIS PR's head (
f772297f) with the updated tests —install/upgrade/backup/restore/custom all pass. A fresh
!testmewill now run with the mergedtests. Merging this PR ⇒ green.
chore: upgrade nginx to 1.31.3to chore: upgrade to impress v5.4.1 + redis 8.8.1 + nginx 1.31.3 + minio 2025-09-07!testme
🌻 cc-ci —
lasuite-docs@58210603✅ successDrone build #1182 — full lifecycle suite GREEN (recipe-ci stage: success; ~3.4 min).
Triggered directly via the drone API (RECIPE=lasuite-docs, REF=
5821060= this PR head, PR=7, SRC=recipe-maintainers/lasuite-docs) — the comment-bridge did not pick up the!testmecomment this pass, so the result is reflected here manually.What this verifies
test_oidc_login.py+test_create_doc.pyfor the impress v5.4.0 Bearer-auth removal (session-cookie auth + assert Bearer rejected). No test files were modified in this pass (DEFAULT mode).dev-lasuite-docs--chaosdeploy also converged cleanly on this head (all 9 services 1/1, redis 8.8.1 ready, backend migrations applied, nginx 1.31.3 serving) and was torn down.Nothing merged — for operator review. Recommended release after merge:
abra recipe release lasuite-docs -ychore: upgrade to impress v5.4.1 + redis 8.8.1 + nginx 1.31.3 + minio 2025-09-07to chore: upgrade impress to v5.4.1, redis to 8.10.0, nginx to 1.31.3[cc-ci/testme] VERDICT=GREEN — recipe lasuite-docs PR #7 verified on the cc-ci harness (Drone build #1185, status=success). Triggered directly via the Drone API with the bridge's exact query-string params () — the bridge !testme path was unavailable because the cc-ci-bridge container's mounted Gitea-bot swarm secret is stale (gitea returns 401 'user does not exist'); per the known infra workaround I drove Drone directly and reflected the verdict back to the PR manually. Drone build: https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1185 Recipe head:
bdbefca6. NOT merged — for operator review.!testme
🌻 cc-ci —
lasuite-docs@bdbefca6❌ failure → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1212(summary card unavailable — see the run for details.) full logs · dashboard
!testme
🌻 cc-ci —
lasuite-docs@bdbefca6✅ passedfull logs · dashboard
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.