chore: upgrade lasuite-drive redis to 8.10.1, web (nginx) to 1.31.4 #6
trav
notplants
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: recipe-maintainers/lasuite-drive#6
Reference in New Issue
Block a user
Recipe upgrade — extends #6: completes lasuite-drive to app v0.21.0 with all sidecars at their newest supported tags (this run adds redis 8.10.0→8.10.1 and nginx 1.31.3→1.31.4).
Image-tag changes (vs current upstream main)
Upstream release notes
Advisory scan
4 CVEs fixed by this window (nginx 1.31.3 security fixes carried into 1.31.4: CVE-2026-42533, CVE-2026-56434, CVE-2026-60005; redis 8.10.1 SECURITY release: CVE-2026-62356 + TLS/ACL/RDB fixes). Adjudication added none; the 71 undecided cases are historical pre-window vendor-changelog references.
Operator action required
Release (operator, after merge)
abra recipe release lasuite-drive -y
Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.
cc @trav @notplants
!testme
🌻 cc-ci —
lasuite-drive@1935df02✅ passedfull logs · dashboard
chore: upgrade collabora to 25.04.10.3.1, onlyoffice to 9.4.1.1to chore: upgrade collabora to 26.04.2.1.1, onlyoffice to 9.4.1.2!testme
🌻 cc-ci —
lasuite-drive@119bbae3❌ failurefull logs · dashboard
⚠️ The
!testmeon this PR head (119bbae3, run #979) came back RED, but the failure is an environmental infra block on the shared Swarm host, NOT a regression of this upgrade.Root cause: the cc-i host disk is 100% full (
df /→150G 147G 0 100%). Run #979 shows every service failing withNo space left on device, including images this PR does not touch:db(pgautoupgrade18-debian, unchanged):initdb: could not create directory ".../pg_wal": No space left on deviceapp(drive-frontendv0.19.0, unchanged):mkdir() "/tmp/proxy_temp" failed (28: No space left on device)minio(minioRELEASE.2025-09-07T16-13-09Z, unchanged):Storage reached its minimum free drive thresholdcollabora(26.04.2.1.1, the only bumped collabora):No space left on device /opt/cool/child-roots+mkdir: cannot create directory '/tmp/ssl/': No space left on device— collabora extracts a chroot jail, so it is the most disk-sensitive service, but the ENOSPC is shared across the whole stack.web(nginx, unchanged): cascaded fromappfailing.Evidence this is infra, not the recipe:
1935df02, the earlier collabora/onlyoffice bump) was GREEN — the recipe and the cc-i test suite pass on a healthy host (run #964).--chaosdeploy I ran on the same host right before this run hit the identicaldf / 100%condition; onlyoffice9.4.1.2converged cleanly there (RabbitMQ/redis/postgres/nginx/ds:docservice/ds:converterall started), while collabora/cohost were ENOSPC. Dev deploy was torn down cleanly.What is needed: an operator should free space on the cc-i host (the shared Swarm disk;
/upgrade-all's reaper /docker system pruneof accumulated images/containers is the usual fix), then re-post!testmeon this PR. The upgrade changes themselves are minimal and, on the evidence, correct:9.3.1.2→9.4.1.2: verified converging; the 9.4.0 backend consolidation (removed external RabbitMQ/DB deps) does not affect this recipe (nodepends_on, WOPI-only config; the image still bundles rabbit/redis/postgres internally).25.04.9.4.1→26.04.2.1.1: COOLWSD initializes; the only failures are ENOSPC. WOPI discovery interface unchanged (additiveUserCanOnlyManageRedlines). Notecollabora/codeis upstream's CODE (dev) edition — this recipe already runs it.Only 1 of 3
!testmeruns was used; the remaining 2 were not consumed since a retry on an un-freed disk cannot change the verdict. NOT merged.!testme
🌻 cc-ci —
lasuite-drive@119bbae3❌ failurefull logs · dashboard
!testme
🌻 cc-ci —
lasuite-drive@119bbae3❌ killed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/982(summary card unavailable — see the run for details.) full logs · dashboard
!testme
🌻 cc-ci —
lasuite-drive@119bbae3❌ killed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/983(summary card unavailable — see the run for details.) full logs · dashboard
!testme
🌻 cc-ci —
lasuite-drive@119bbae3❌ running → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/984(summary card unavailable — see the run for details.) full logs · dashboard
chore: upgrade collabora to 26.04.2.1.1, onlyoffice to 9.4.1.2to chore: upgrade drive to v0.20.0, web (nginx) to 1.31.3!testme
🌻 cc-ci —
lasuite-drive@1e578b07❌ killed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1138(summary card unavailable — see the run for details.) full logs · dashboard
chore: upgrade drive to v0.20.0, web (nginx) to 1.31.3to chore: revert collabora to 25.04.9.4.1 (26.04.2.x crashes in-deploy: sh not found in $PATH)!testme
🌻 cc-ci —
lasuite-drive@9beb089d✅ passedfull logs · dashboard
cc-ci verdict: GREEN (drone build #1139, head
9beb089) — full suite pass: install / upgrade / backup / restore / custom (cc-ci + generic), all 0 failures.Run history on this evolving upgrade PR:
1e578b07(collabora 26.04.2.1.1):!testme❌ killed — install+backup tiers passed, then a later cold-redeploy tier hung past the 60-min drone build budget. Direct dev-deploy showed collabora crash-looping (exec: "sh": executable file not found in $PATHunder the recipeentrypoint: sh -c).9beb089(collabora reverted to upstream25.04.9.4.1):!testme✅ passed. Confirms collabora 26.04.2.x was the kill cause — independent of the drive v0.20.0 / nginx 1.31.3 / onlyoffice 9.4.1.2 bumps.The drive v0.19.0→v0.20.0, nginx 1.31.2→1.31.3, and onlyoffice 9.3.1.2→9.4.1.2 bumps all verified clean (also converged on a direct
--chaosdev-deploy: migrationsdone, backend serving). collabora was reverted to the upstream-published 25.04.9.4.1 (net zero change vs upstream) — recommend revisiting collabora separately (either a working 26.x tag with an entrypoint fix, e.g./bin/sh -c, or stay on 25.04.x).NOT merged — for operator review.
chore: revert collabora to 25.04.9.4.1 (26.04.2.x crashes in-deploy: sh not found in $PATH)to chore: upgrade redis to 8.8.1!testme
chore: upgrade redis to 8.8.1to chore: upgrade redis to 8.10.0cc-ci
!testmeverdict: 🟢 GREENVERDICT=GREEN — Drone build #1186 succeeded.
077ea217e11ac9eea6ade38c7dd1b5b218aea1a7ccci-bridgeis currently silently dropping!testmetriggers (stale Gitea-bot swarm secret → HTTP 401). Per the run's standing workaround, the cc-ci harness build was triggered directly onrecipe-maintainers/cc-civia the Drone API with the bridge's exact query-string params (RECIPE=lasuite-drive REF=077ea217e11ac9eea6ade38c7dd1b5b218aea1a7 PR=6 SRC=recipe-maintainers/lasuite-drive). This commit-status + comment were posted manually to mirror what the bridge would normally post.NOT merged — for operator review.
chore: upgrade redis to 8.10.0to chore: pin redis to 8.8.1 (security patch; prefer over 8.10.0 minor for sidecar cache)!testme
cc-ci
!testmeverdict: GREENVERDICT=GREEN — Drone build #1187 succeeded for head
543a017(redis 8.8.1 security patch).543a017(redis 8.8.1 — security patch; prefer over 8.10.0 minor for sidecar cache)--chaosdeploy on the cc-ci swarm also converged: all 11 services 1/1, redis 8.8.1 healthcheck healthy, backend migrations OK, app serving HTTP 200.Full suite pass (install / upgrade / backup / restore / custom). NOT merged — for operator review.
Recommended release after merge:
abra recipe release lasuite-drive -z(patch bump).chore: pin redis to 8.8.1 (security patch; prefer over 8.10.0 minor for sidecar cache)to chore: upgrade lasuite-drive redis to 8.10.0, collabora to 25.04.10.3.1!testme
🌻 cc-ci —
lasuite-drive@c3b6b722✅ passedfull logs · dashboard
chore: upgrade lasuite-drive redis to 8.10.0, collabora to 25.04.10.3.1to chore: upgrade lasuite/drive to v0.21.0!testme
🌻 cc-ci —
lasuite-drive@a5e67e55✅ passed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1267(summary card unavailable — see the run for details.) full logs · dashboard
chore: upgrade lasuite/drive to v0.21.0to chore: upgrade lasuite-drive redis to 8.10.1, web (nginx) to 1.31.4!testme
🌻 cc-ci —
lasuite-drive@8ac8c5a2✅ passed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1295(summary card unavailable — see the run for details.) full logs · dashboard
Auto-closed by /recipe-upgrade: its changes are already in upstream main (merged upstream); mirror main re-synced
Pull request closed