chore: upgrade redis to 8.10.1, nginx to 1.31.4 #7
trav
notplants
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: recipe-maintainers/lasuite-docs#7
Reference in New Issue
Block a user
Recipe upgrade step: redis 8.10.0 → 8.10.1 and nginx 1.31.3 → 1.31.4, added on top of the existing open upgrade PR (branch
upgrade-505e53c) so this remains ONE evolving upgrade PR for lasuite-docs (impress v5.2.1 → v5.4.1, redis 8.8.0 → 8.10.1, nginx 1.31.1 → 1.31.4, minio RELEASE.2025-05-24 → RELEASE.2025-09-07).Image-tag table (this PR vs true upstream main
911c982)The four impress images share one version tag from the suitenumerique/docs monorepo and move in lockstep.
Upstream release notes:
Operator action required
None — drop-in image bumps; no compose/config/env changes impress- or sidecar-side.
AUTO_MIGRATIONS=trueruns DB migrations automatically on backend startup. The impress v5.4.0 Bearer-auth removal only affects API clients sending raw Bearer JWTs (browser/session login unaffected); cc-ci lasuite-docs tests were aligned in cc-ci PR #12 (2026-08-03).Recipe version bump (recommended, NOT applied — left for the operator)
The over-all upgrade is impress minor v5.2.1 → v5.4.1 plus redis/nginx/minio sidecar patches; recommended semver bump is minor. Operator runs after this PR merges:
Verification
Verified on the cc-ci recipe CI server (full suite, cold, against this PR head). Dev smoke-deploy of the WIP head (
dev-lasuite-docs.ci.commoninternet.net) converged green (all 9 services healthy, web served 200) and was fully torn down. NOT merged — for operator review.cc @trav @notplants
Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.
cc @trav @notplants
!testme
🌻 cc-ci —
lasuite-docs@505e53cc✅ passedfull logs · dashboard
chore: upgrade to v5.3.0 (impress app/backend/celery/y-provider) + nginx 1.31.2to chore: upgrade impress to v5.3.0, nginx to 1.31.2, minio to RELEASE.2025-09-07!testme
🌻 cc-ci —
lasuite-docs@9e3f3b13✅ passedfull logs · dashboard
chore: upgrade impress to v5.3.0, nginx to 1.31.2, minio to RELEASE.2025-09-07to chore: upgrade impress to v5.4.1!testme
🌻 cc-ci —
lasuite-docs@7e7ba76a❌ failurefull logs · dashboard
!testme RED diagnosis — stale test (upgrade is correct)
The
!testmerun on this PR head (7e7ba76a, build #1121) came back RED on one custom test:All other stages passed: install ✅, upgrade ✅, backup ✅, restore ✅. The other custom test (
test_oidc_with_keycloak.py::test_oidc_password_grant_against_dep_keycloak) also passed — it only verifies the OIDC password grant (obtaining a token from keycloak), not using it against the docs API.Why this test is stale
The test
test_oidc_login_via_keycloaksends a Bearer JWT (obtained via OIDC password grant) toGET /api/v1.0/users/me/and expects HTTP 200. This was the correct behavior up to impress v5.3.0.In v5.4.0, upstream PR suitenumerique/docs#2480 deliberately removed
mozilla_django_oidc.contrib.drf.OIDCAuthenticationfrom DRF'sDEFAULT_AUTHENTICATION_CLASSES. The stated rationale:The API now uses cookie session auth only — Bearer token auth against the API is intentionally no longer supported. The 401 "Authentication credentials were not provided" is the new correct behavior when a Bearer token is sent: DRF's remaining
SessionAuthenticationbackend doesn't recognize theAuthorization: Bearerheader.The upgrade itself is correct
dev-lasuite-docs,--chaos) converged cleanly on v5.4.1: all 9 services 1/1, backend migrations applied (migrate: done), gunicorn serving, minio bucket created, nginx landing page HTTP 200.install/upgrade/backup/restorelifecycle stages all pass, confirming the recipe deploys and operates correctly on v5.4.1.Recommended action
This test needs updating to reflect the new auth model (cookie session instead of Bearer token). Re-run with
--with-teststo open + verify a cc-ci test-update PR:The recipe PR itself is ready for operator review — the image-tag bumps are correct and the app converges. Nothing was merged.
chore: upgrade impress to v5.4.1to chore: upgrade nginx to 1.31.3!testme
🌻 cc-ci —
lasuite-docs@f772297f❌ failurefull logs · dashboard
!testme update — 2026-07-24 (head
f772297f, build #1136) ❌This PR was extended with the nginx 1.31.2 → 1.31.3 security bump (CVE-2026-42533 / CVE-2026-60005 / CVE-2026-56434) on top of the existing impress v5.4.1 work. The
!testmerun came back RED — on the same stale tests as the 2026-07-13 run (#1121), not on the nginx bump.Lifecycle stages — all pass
Failing custom tests — both STALE (Bearer-token auth removed in v5.4.0)
test_oidc_login.py::test_oidc_login_via_keycloak—GET /api/v1.0/users/me/withAuthorization: Bearer→ HTTP 401 (expected 200).test_create_doc.py::test_create_doc_and_read_back—POST /api/v1.0/documents/withAuthorization: Bearer→ HTTP 401 (expected 200/201).Both tests obtain a JWT via the OIDC password grant and send it as
Authorization: Bearer <jwt>to the impress API. In v5.4.0, upstream PR suitenumerique/docs#2480 deliberately removedmozilla_django_oidc.contrib.drf.OIDCAuthenticationfrom DRF'sDEFAULT_AUTHENTICATION_CLASSES; the API now uses cookie session auth only. The 401 "Authentication credentials were not provided" is the new correct behavior for a Bearer token —SessionAuthenticationdoesn't recognize theAuthorizationheader. This is a deliberate upstream security decision; no recipe-level config change should or could restore it.The upgrade itself is correct
dev-lasuite-docsdeploy (--chaos) on the cc-i swarm converged cleanly on impress v5.4.1 + nginx 1.31.3 + minio RELEASE.2025-09-07: all 9 services 1/1, backend migrations applied (migrate: done), gunicorn serving, minio bucket created, nginx landing HTTP 200, nginx version confirmednginx/1.31.3. Torn down cleanly (0 stacks/volumes/apps leaked).Recommended action
Both stale tests need updating to the new auth model (cookie session instead of Bearer token). Re-run with
--with-teststo open + verify a cc-ci test-update PR:Nothing merged; PR awaits operator review. cc @trav @notplants
The stale cc-ci tests blocking this PR are now fixed and merged: cc-ci PR #12
(recipe-maintainers/cc-ci#12) replaces the removed Bearer-auth
path with the real OIDC authorization-code session login (impress v5.4.0 hardening).
Verified GREEN: cold full-suite ×1 against THIS PR's head (
f772297f) with the updated tests —install/upgrade/backup/restore/custom all pass. A fresh
!testmewill now run with the mergedtests. Merging this PR ⇒ green.
chore: upgrade nginx to 1.31.3to chore: upgrade to impress v5.4.1 + redis 8.8.1 + nginx 1.31.3 + minio 2025-09-07!testme
🌻 cc-ci —
lasuite-docs@58210603✅ successDrone build #1182 — full lifecycle suite GREEN (recipe-ci stage: success; ~3.4 min).
Triggered directly via the drone API (RECIPE=lasuite-docs, REF=
5821060= this PR head, PR=7, SRC=recipe-maintainers/lasuite-docs) — the comment-bridge did not pick up the!testmecomment this pass, so the result is reflected here manually.What this verifies
test_oidc_login.py+test_create_doc.pyfor the impress v5.4.0 Bearer-auth removal (session-cookie auth + assert Bearer rejected). No test files were modified in this pass (DEFAULT mode).dev-lasuite-docs--chaosdeploy also converged cleanly on this head (all 9 services 1/1, redis 8.8.1 ready, backend migrations applied, nginx 1.31.3 serving) and was torn down.Nothing merged — for operator review. Recommended release after merge:
abra recipe release lasuite-docs -ychore: upgrade to impress v5.4.1 + redis 8.8.1 + nginx 1.31.3 + minio 2025-09-07to chore: upgrade impress to v5.4.1, redis to 8.10.0, nginx to 1.31.3[cc-ci/testme] VERDICT=GREEN — recipe lasuite-docs PR #7 verified on the cc-ci harness (Drone build #1185, status=success). Triggered directly via the Drone API with the bridge's exact query-string params () — the bridge !testme path was unavailable because the cc-ci-bridge container's mounted Gitea-bot swarm secret is stale (gitea returns 401 'user does not exist'); per the known infra workaround I drove Drone directly and reflected the verdict back to the PR manually. Drone build: https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1185 Recipe head:
bdbefca6. NOT merged — for operator review.!testme
🌻 cc-ci —
lasuite-docs@bdbefca6❌ failure → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1212(summary card unavailable — see the run for details.) full logs · dashboard
!testme
🌻 cc-ci —
lasuite-docs@bdbefca6✅ passedfull logs · dashboard
chore: upgrade impress to v5.4.1, redis to 8.10.0, nginx to 1.31.3to chore: upgrade redis to 8.10.1, nginx to 1.31.4!testme
🌻 cc-ci —
lasuite-docs@1dc6544f✅ passed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1294(summary card unavailable — see the run for details.) full logs · dashboard
Pull request closed