Upgrade lasuite-drive app images v0.21.0 → v0.22.0 (frontend + backend/celery/celery-beat — the drive feature release, reached through the carried v0.21.1/v0.21.2 tail), carried mailcatcher v0.10.0 → v0.11.0, and — new in this 2026-09-18 extension — web nginx 1.31.4 → 1.31.6 (folding the carried 1.31.5 bump forward to the 15-Sep security release, CVE-2026-90439) plus a MinIO registry switchminio/minio → quay.io/minio/minio (same release): Docker Hub removed the minio/minio repository (verified 2026-09-18: Hub repo API 404, anonymous manifest pull 401), which breaks cold deploys of main itself; the identical tag is served from quay.io, MinIO's official channel. This mirrors the same fix merged upstream for lasuite-docs ("fix: pull MinIO image from Quay", PR #25, 2026-09-15). One evolving upgrade PR for the recipe.
Image tags
service
image
current → new
app
lasuite/drive-frontend
v0.21.0 → v0.22.0 (via carried v0.21.2)
backend
lasuite/drive-backend
v0.21.0 → v0.22.0 (via carried v0.21.2)
celery
lasuite/drive-backend
v0.21.0 → v0.22.0 (via carried v0.21.2)
celery-beat
lasuite/drive-backend
v0.21.0 → v0.22.0 (via carried v0.21.2)
mailcatcher
sj26/mailcatcher
v0.10.0 → v0.11.0 (carried, 09-04)
web
nginx
1.31.4 → 1.31.6 (carried 1.31.5 + security 1.31.6, this extension)
minio
minio/minio → quay.io/minio/minio
RELEASE.2025-09-07T16-13-09Z — same release, registry switch only (Docker Hub repo removed 2026-09-18)
Sidecars unchanged (per direct checks, 2026-09-18): redis 8.10.1 (Docker Hub latest), pgautoupgrade 18-debian (latest major line; 18.6-debian is a point tag of the same major), onlyoffice 9.4.1.2 (Docker Hub max tag), collabora 25.04.10.3.1 (max 25.04.x; see note).
minio: no version change (registry switch only, same RELEASE.2025-09-07T16-13-09Z) — no release-notes window
What changed upstream
drive v0.22.0 (2026-09-09): Added — Sentry performance-monitoring sample-rate setting (optional — this recipe wires no Sentry config, so no compose change; available to operators who wire Sentry themselves); permission decisions routed through a swappable backend; restricted access on folders, detached behind a restriction (feature-flagged). Changed — frontend migrated to the merged @gouvfr-lasuite/ui-components package (internal build change). Fixed — JPEG 2000 layers of scanned PDFs render in the preview; item deletion prevented for a creator whose access was revoked; direct parent resolved by exact path after a move. New automatic migrations core.0030_item_add_restriction_target and malware_detection.0005_alter_malwaredetection_path (apply on backend startup; both verified live on the dev deploy, including over a v0.21.0-initialized DB — the realistic upgrade path). No breaking changes, no new required config/env.
drive v0.21.1 / v0.21.2 (2026-08-21/25, carried): v0.21.1 fixes backend malware re-analysis of an already-scanned file; v0.21.2 adds helm scheduling + admin actions for malware analyses and fixes malware-analysis processing-slot exhaustion.
nginx 1.31.5 (2026-09-02, carried): no security CVE named. Features (control API, predicate locations, ngx_http_json_module, client_body_early_read) + bugfixes (HTTP/2-buffered-proxy use-after-free, worker FD-exhaustion shutdown, long FastCGI/uwsgi parameter names, HTTP/3 + slice + memcached). Plain reverse-proxy use — no behavioural change.
nginx 1.31.6 (2026-09-15, this extension): Security — heap memory buffer overflow in a worker process under certain configurations when using HTTP/3 with OpenSSL 3.5.0 and earlier (CVE-2026-90439); QUIC transport-params change + bugfixes. The recipe's web is a plain reverse proxy (no HTTP/3 listener), so the vulnerable config is not in use — this pins the fixed line regardless.
Advisory scan (2026-09-18)
CVEs fixed by this upgrade: 1 — CVE-2026-90439 (nginx 1.31.6; union of release-note reading + deterministic scan --from v0.21.0 --to v0.22.0 --image mailcatcher=v0.10.0:v0.11.0 --image nginx=1.31.4:1.31.6). No source failed. Adjudication of the 75 undecided vendor-page CVEs: all NOT-FIXED in this window — every nginx CVE is named in a CHANGES section ≤ 1.31.3 (already fixed in the pinned 1.31.4 base; the 1.31.5 section has zero Security: lines, 1.31.6's only one is CVE-2026-90439, counted); the ONLYOFFICE (23) + redis (1) entries belong to sidecars this PR does not move. drive v0.22.0 and mailcatcher v0.11.0 name no CVE ids in the window. The minio registry switch changes no version, so it opens no advisory window.
Operator action
None beyond a normal deploy. Automatic DB migrations apply on backend startup (verified live: core.0030_item_add_restriction_target + malware_detection.0005_alter_malwaredetection_path applied cleanly, including over a v0.21.0-initialized database).
New optional upstream setting: Sentry performance-monitoring sample rate — the recipe wires no Sentry config, so nothing to set unless an operator opts into Sentry.
minio registry switch is required, not optional: Docker Hub removed minio/minio (repo API 404, anonymous pull 401 — verified 2026-09-18). Without this switch the recipe cannot cold-deploy (the previous 09-11 !testme green predates the removal). Same release from quay.io/minio/minio; the minio service's own minio-initialize.sh entrypoint still creates drive-media-storage (verified live). Precedent: lasuite-docs PR #25 merged upstream 2026-09-15.
collabora note (not part of this PR): drive projects now pin the collabora 26.04 line (drive's own compose uses collabora/code:26.04.2.2.1). The 26.04 image changed its runtime contract (shell-less: entrypoint runs coolwsd directly, no /start-collabora-online.sh, no extra_params env). Moving this recipe's collabora service onto 26.04 is a service redesign, not a tag swap — deliberately deferred. Flagging for the recipe maintainer. (Latest 26.04.x on Docker Hub is now 26.04.4.1.1; max 25.04.x remains the pinned 25.04.10.3.1.)
minio version note (not part of this PR): quay.io only re-hosts the frozen community line; a future minio version bump still means the AIStor product-line decision — operator call.
Recommended release (after merge) — minor, since the app moves v0.21.x → v0.22.0 (feature release; the earlier -z recommendation applied while this PR carried only patch-level bumps):
abra recipe release lasuite-drive -y
Verification (2026-09-18 extension)
Verified live on cc-ci first: dev-lasuite-drive.ci.commoninternet.net (--chaos --force, this branch head) — all 11 services 1/1 on the target images (quartet v0.22.0, mailcatcher v0.11.0, nginx 1.31.6, quay.io minio RELEASE.2025-09-07T16-13-09Z), both new migrations applied (over a v0.21.0-initialized DB — the realistic upgrade path), gunicorn up (the /.gunicorn control-server permission error is pre-existing — present in the 09-11 log too — and non-fatal), mailcatcher SMTP+HTTP up, minio bucket drive-media-storage created by the service's own entrypoint, frontend serving the Drive app (HTTPS 200), backend /api/v1.0/ 200 + /admin/login/ 200, teardown verified clean (0 stacks/volumes/secrets/configs). Then !testme on this PR (full recipe suite).
Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.
Upgrade `lasuite-drive` app images **v0.21.0 → v0.22.0** (frontend + backend/celery/celery-beat — the drive feature release, reached through the carried v0.21.1/v0.21.2 tail), carried **mailcatcher v0.10.0 → v0.11.0**, and — new in this 2026-09-18 extension — **web nginx 1.31.4 → 1.31.6** (folding the carried 1.31.5 bump forward to the 15-Sep **security release**, CVE-2026-90439) plus a **MinIO registry switch** `minio/minio` → `quay.io/minio/minio` (same release): Docker Hub **removed the `minio/minio` repository** (verified 2026-09-18: Hub repo API 404, anonymous manifest pull 401), which breaks cold deploys of `main` itself; the identical tag is served from quay.io, MinIO's official channel. This mirrors the same fix merged upstream for lasuite-docs ("fix: pull MinIO image from Quay", PR #25, 2026-09-15). One evolving upgrade PR for the recipe.
## Image tags
| service | image | current → new |
|-------------|-----------------------------|---------------|
| app | lasuite/drive-frontend | v0.21.0 → **v0.22.0** (via carried v0.21.2) |
| backend | lasuite/drive-backend | v0.21.0 → **v0.22.0** (via carried v0.21.2) |
| celery | lasuite/drive-backend | v0.21.0 → **v0.22.0** (via carried v0.21.2) |
| celery-beat | lasuite/drive-backend | v0.21.0 → **v0.22.0** (via carried v0.21.2) |
| mailcatcher | sj26/mailcatcher | v0.10.0 → **v0.11.0** (carried, 09-04) |
| web | nginx | 1.31.4 → **1.31.6** (carried 1.31.5 + security 1.31.6, this extension) |
| minio | minio/minio → **quay.io/minio/minio** | RELEASE.2025-09-07T16-13-09Z — **same release**, registry switch only (Docker Hub repo removed 2026-09-18) |
Sidecars unchanged (per direct checks, 2026-09-18): redis 8.10.1 (Docker Hub latest), pgautoupgrade 18-debian (latest major line; 18.6-debian is a point tag of the same major), onlyoffice 9.4.1.2 (Docker Hub max tag), collabora 25.04.10.3.1 (max 25.04.x; see note).
## Upstream release notes
- **lasuite/drive** v0.21.0→v0.22.0 (app/backend/celery/celery-beat share the monorepo tag), through v0.21.1 + v0.21.2: https://github.com/suitenumerique/drive/releases/tag/v0.22.0 (intermediates: https://github.com/suitenumerique/drive/releases/tag/v0.21.1 , https://github.com/suitenumerique/drive/releases/tag/v0.21.2 )
- **mailcatcher** v0.10.0→v0.11.0: https://github.com/sj26/mailcatcher/compare/v0.10.0...v0.11.0 (tag-only, formal GitHub release entry pending)
- **web nginx** 1.31.4→1.31.6: https://nginx.org/en/CHANGES (1.31.5 + 1.31.6 sections)
- **minio**: no version change (registry switch only, same RELEASE.2025-09-07T16-13-09Z) — no release-notes window
## What changed upstream
- **drive v0.22.0** (2026-09-09): Added — Sentry performance-monitoring sample-rate **setting** (optional — this recipe wires no Sentry config, so no compose change; available to operators who wire Sentry themselves); permission decisions routed through a swappable backend; restricted access on folders, detached behind a restriction (feature-flagged). Changed — frontend migrated to the merged `@gouvfr-lasuite/ui-components` package (internal build change). Fixed — JPEG 2000 layers of scanned PDFs render in the preview; item deletion prevented for a creator whose access was revoked; direct parent resolved by exact path after a move. New automatic migrations `core.0030_item_add_restriction_target` and `malware_detection.0005_alter_malwaredetection_path` (apply on backend startup; both verified live on the dev deploy, including over a v0.21.0-initialized DB — the realistic upgrade path). **No breaking changes, no new required config/env.**
- **drive v0.21.1 / v0.21.2** (2026-08-21/25, carried): v0.21.1 fixes backend malware re-analysis of an already-scanned file; v0.21.2 adds helm scheduling + admin actions for malware analyses and fixes malware-analysis processing-slot exhaustion.
- **mailcatcher v0.11.0** (2026-09-02, carried): security/dependency fixes — update rack, sinatra, thin for security fixes; Rack + WebSocket stack bumped to patched releases (PR #578); sqlite3 2.x + Ruby 3.4 base; Compass/Sass/CoffeeScript build chain removed. No recipe-side breaking changes (SMTP catch-all + web UI).
- **nginx 1.31.5** (2026-09-02, carried): no security CVE named. Features (control API, predicate locations, `ngx_http_json_module`, `client_body_early_read`) + bugfixes (HTTP/2-buffered-proxy use-after-free, worker FD-exhaustion shutdown, long FastCGI/uwsgi parameter names, HTTP/3 + slice + memcached). Plain reverse-proxy use — no behavioural change.
- **nginx 1.31.6** (2026-09-15, this extension): **Security — heap memory buffer overflow in a worker process under certain configurations when using HTTP/3 with OpenSSL 3.5.0 and earlier (CVE-2026-90439)**; QUIC transport-params change + bugfixes. The recipe's `web` is a plain reverse proxy (no HTTP/3 listener), so the vulnerable config is not in use — this pins the fixed line regardless.
## Advisory scan (2026-09-18)
**CVEs fixed by this upgrade: 1** — **CVE-2026-90439** (nginx 1.31.6; union of release-note reading + deterministic scan `--from v0.21.0 --to v0.22.0 --image mailcatcher=v0.10.0:v0.11.0 --image nginx=1.31.4:1.31.6`). No source failed. Adjudication of the 75 undecided vendor-page CVEs: all NOT-FIXED in this window — every nginx CVE is named in a CHANGES section **≤ 1.31.3** (already fixed in the pinned 1.31.4 base; the 1.31.5 section has zero `Security:` lines, 1.31.6's only one is CVE-2026-90439, counted); the ONLYOFFICE (23) + redis (1) entries belong to sidecars this PR does not move. drive v0.22.0 and mailcatcher v0.11.0 name no CVE ids in the window. The minio registry switch changes no version, so it opens no advisory window.
## Operator action
- None beyond a normal deploy. Automatic DB migrations apply on backend startup (verified live: `core.0030_item_add_restriction_target` + `malware_detection.0005_alter_malwaredetection_path` applied cleanly, including over a v0.21.0-initialized database).
- New **optional** upstream setting: Sentry performance-monitoring sample rate — the recipe wires no Sentry config, so nothing to set unless an operator opts into Sentry.
- **minio registry switch is required, not optional**: Docker Hub removed `minio/minio` (repo API 404, anonymous pull 401 — verified 2026-09-18). Without this switch the recipe cannot cold-deploy (the previous 09-11 !testme green predates the removal). Same release from `quay.io/minio/minio`; the `minio` service's own `minio-initialize.sh` entrypoint still creates `drive-media-storage` (verified live). Precedent: lasuite-docs PR #25 merged upstream 2026-09-15.
- **collabora note (not part of this PR):** drive projects now pin the collabora **26.04** line (drive's own compose uses `collabora/code:26.04.2.2.1`). The 26.04 image changed its runtime contract (shell-less: entrypoint runs `coolwsd` directly, no `/start-collabora-online.sh`, no `extra_params` env). Moving this recipe's collabora service onto 26.04 is a **service redesign**, not a tag swap — deliberately deferred. Flagging for the recipe maintainer. (Latest 26.04.x on Docker Hub is now 26.04.4.1.1; max 25.04.x remains the pinned 25.04.10.3.1.)
- **minio version note (not part of this PR):** quay.io only re-hosts the frozen community line; a future minio **version** bump still means the AIStor product-line decision — operator call.
- Recommended release (after merge) — minor, since the app moves v0.21.x → v0.22.0 (feature release; the earlier `-z` recommendation applied while this PR carried only patch-level bumps):
`abra recipe release lasuite-drive -y`
## Verification (2026-09-18 extension)
Verified live on cc-ci first: `dev-lasuite-drive.ci.commoninternet.net` (`--chaos --force`, this branch head) — **all 11 services 1/1** on the target images (quartet **v0.22.0**, mailcatcher v0.11.0, **nginx 1.31.6**, **quay.io** minio RELEASE.2025-09-07T16-13-09Z), both new migrations applied (over a v0.21.0-initialized DB — the realistic upgrade path), gunicorn up (the `/.gunicorn` control-server permission error is pre-existing — present in the 09-11 log too — and non-fatal), mailcatcher SMTP+HTTP up, minio bucket `drive-media-storage` created by the service's own entrypoint, frontend serving the Drive app (HTTPS 200), backend `/api/v1.0/` 200 + `/admin/login/` 200, teardown verified clean (0 stacks/volumes/secrets/configs). Then `!testme` on this PR (full recipe suite).
Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.
cc @trav @notplants
CI status update:!testme was posted once, but the bridge could not start a CI run — failed to start a CI run (see bridge logs), confirmed in bridge logs as SSL: CERTIFICATE_VERIFY_FAILED certificate has expired against drone.ci.commoninternet.net. This is infra, not a recipe/test failure: the *.ci.commoninternet.net Let's Encrypt wildcard cert expired 2026-08-24 (operator renews ~90 days out-of-band; not yet renewed). No CI runs were burned on this. The "Tested green" line below is the PR template's default text and does NOT reflect a CI result for this head.
Verification that did happen: full direct deploy of this head on cc-ci (dev-lasuite-drive.ci.commoninternet.net, --chaos) — all 11 services 1/1 on the new images, migrations applied (malware_detection.0003_...), HTTP/HTTPS 200, then torn down. Please re-run /recipe-upgrade lasuite-drive (or !testme) after the cert is renewed to complete CI verification.
**CI status update:** `!testme` was posted once, but the bridge could not start a CI run — `failed to start a CI run (see bridge logs)`, confirmed in bridge logs as `SSL: CERTIFICATE_VERIFY_FAILED certificate has expired` against `drone.ci.commoninternet.net`. This is **infra**, not a recipe/test failure: the `*.ci.commoninternet.net` Let's Encrypt wildcard cert expired 2026-08-24 (operator renews ~90 days out-of-band; not yet renewed). No CI runs were burned on this. The "Tested green" line below is the PR template's default text and does NOT reflect a CI result for this head.
Verification that **did** happen: full direct deploy of this head on cc-ci (`dev-lasuite-drive.ci.commoninternet.net`, `--chaos`) — all 11 services 1/1 on the new images, migrations applied (`malware_detection.0003_...`), HTTP/HTTPS 200, then torn down. Please re-run `/recipe-upgrade lasuite-drive` (or `!testme`) after the cert is renewed to complete CI verification.
(summary card unavailable — see the run for details.)full logs · dashboard
<!-- cc-ci:testme -->
🌻 **cc-ci** — `lasuite-drive` @ `7f0164cb` ✅ **passed** → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1309
_(summary card unavailable — see the run for details.)_ [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1309) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot
changed title from chore: upgrade lasuite-drive app/backend/celery/celery-beat to v0.21.2 to chore: upgrade mailcatcher to v0.11.0, web nginx to 1.31.52026-09-04 02:31:10 +00:00
(summary card unavailable — see the run for details.)full logs · dashboard
<!-- cc-ci:testme -->
🌻 **cc-ci** — `lasuite-drive` @ `26623987` ✅ **passed** → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1319
_(summary card unavailable — see the run for details.)_ [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1319) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot
changed title from chore: upgrade mailcatcher to v0.11.0, web nginx to 1.31.5 to chore: upgrade lasuite-drive app/backend/celery/celery-beat to v0.22.02026-09-11 04:20:23 +00:00
autonomic-bot
changed title from chore: upgrade lasuite-drive app/backend/celery/celery-beat to v0.22.0 to chore: upgrade lasuite/drive to v0.22.0, mailcatcher to v0.11.0, web nginx to 1.31.6; pull MinIO from Quay2026-09-18 03:40:22 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Upgrade
lasuite-driveapp images v0.21.0 → v0.22.0 (frontend + backend/celery/celery-beat — the drive feature release, reached through the carried v0.21.1/v0.21.2 tail), carried mailcatcher v0.10.0 → v0.11.0, and — new in this 2026-09-18 extension — web nginx 1.31.4 → 1.31.6 (folding the carried 1.31.5 bump forward to the 15-Sep security release, CVE-2026-90439) plus a MinIO registry switchminio/minio→quay.io/minio/minio(same release): Docker Hub removed theminio/miniorepository (verified 2026-09-18: Hub repo API 404, anonymous manifest pull 401), which breaks cold deploys ofmainitself; the identical tag is served from quay.io, MinIO's official channel. This mirrors the same fix merged upstream for lasuite-docs ("fix: pull MinIO image from Quay", PR #25, 2026-09-15). One evolving upgrade PR for the recipe.Image tags
Sidecars unchanged (per direct checks, 2026-09-18): redis 8.10.1 (Docker Hub latest), pgautoupgrade 18-debian (latest major line; 18.6-debian is a point tag of the same major), onlyoffice 9.4.1.2 (Docker Hub max tag), collabora 25.04.10.3.1 (max 25.04.x; see note).
Upstream release notes
What changed upstream
@gouvfr-lasuite/ui-componentspackage (internal build change). Fixed — JPEG 2000 layers of scanned PDFs render in the preview; item deletion prevented for a creator whose access was revoked; direct parent resolved by exact path after a move. New automatic migrationscore.0030_item_add_restriction_targetandmalware_detection.0005_alter_malwaredetection_path(apply on backend startup; both verified live on the dev deploy, including over a v0.21.0-initialized DB — the realistic upgrade path). No breaking changes, no new required config/env.ngx_http_json_module,client_body_early_read) + bugfixes (HTTP/2-buffered-proxy use-after-free, worker FD-exhaustion shutdown, long FastCGI/uwsgi parameter names, HTTP/3 + slice + memcached). Plain reverse-proxy use — no behavioural change.webis a plain reverse proxy (no HTTP/3 listener), so the vulnerable config is not in use — this pins the fixed line regardless.Advisory scan (2026-09-18)
CVEs fixed by this upgrade: 1 — CVE-2026-90439 (nginx 1.31.6; union of release-note reading + deterministic scan
--from v0.21.0 --to v0.22.0 --image mailcatcher=v0.10.0:v0.11.0 --image nginx=1.31.4:1.31.6). No source failed. Adjudication of the 75 undecided vendor-page CVEs: all NOT-FIXED in this window — every nginx CVE is named in a CHANGES section ≤ 1.31.3 (already fixed in the pinned 1.31.4 base; the 1.31.5 section has zeroSecurity:lines, 1.31.6's only one is CVE-2026-90439, counted); the ONLYOFFICE (23) + redis (1) entries belong to sidecars this PR does not move. drive v0.22.0 and mailcatcher v0.11.0 name no CVE ids in the window. The minio registry switch changes no version, so it opens no advisory window.Operator action
core.0030_item_add_restriction_target+malware_detection.0005_alter_malwaredetection_pathapplied cleanly, including over a v0.21.0-initialized database).minio/minio(repo API 404, anonymous pull 401 — verified 2026-09-18). Without this switch the recipe cannot cold-deploy (the previous 09-11 !testme green predates the removal). Same release fromquay.io/minio/minio; theminioservice's ownminio-initialize.shentrypoint still createsdrive-media-storage(verified live). Precedent: lasuite-docs PR #25 merged upstream 2026-09-15.collabora/code:26.04.2.2.1). The 26.04 image changed its runtime contract (shell-less: entrypoint runscoolwsddirectly, no/start-collabora-online.sh, noextra_paramsenv). Moving this recipe's collabora service onto 26.04 is a service redesign, not a tag swap — deliberately deferred. Flagging for the recipe maintainer. (Latest 26.04.x on Docker Hub is now 26.04.4.1.1; max 25.04.x remains the pinned 25.04.10.3.1.)-zrecommendation applied while this PR carried only patch-level bumps):abra recipe release lasuite-drive -yVerification (2026-09-18 extension)
Verified live on cc-ci first:
dev-lasuite-drive.ci.commoninternet.net(--chaos --force, this branch head) — all 11 services 1/1 on the target images (quartet v0.22.0, mailcatcher v0.11.0, nginx 1.31.6, quay.io minio RELEASE.2025-09-07T16-13-09Z), both new migrations applied (over a v0.21.0-initialized DB — the realistic upgrade path), gunicorn up (the/.gunicorncontrol-server permission error is pre-existing — present in the 09-11 log too — and non-fatal), mailcatcher SMTP+HTTP up, minio bucketdrive-media-storagecreated by the service's own entrypoint, frontend serving the Drive app (HTTPS 200), backend/api/v1.0/200 +/admin/login/200, teardown verified clean (0 stacks/volumes/secrets/configs). Then!testmeon this PR (full recipe suite).Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.
cc @trav @notplants
!testme
cc-ci: failed to start a CI run (see bridge logs).
CI status update:
!testmewas posted once, but the bridge could not start a CI run —failed to start a CI run (see bridge logs), confirmed in bridge logs asSSL: CERTIFICATE_VERIFY_FAILED certificate has expiredagainstdrone.ci.commoninternet.net. This is infra, not a recipe/test failure: the*.ci.commoninternet.netLet's Encrypt wildcard cert expired 2026-08-24 (operator renews ~90 days out-of-band; not yet renewed). No CI runs were burned on this. The "Tested green" line below is the PR template's default text and does NOT reflect a CI result for this head.Verification that did happen: full direct deploy of this head on cc-ci (
dev-lasuite-drive.ci.commoninternet.net,--chaos) — all 11 services 1/1 on the new images, migrations applied (malware_detection.0003_...), HTTP/HTTPS 200, then torn down. Please re-run/recipe-upgrade lasuite-drive(or!testme) after the cert is renewed to complete CI verification.!testme
🌻 cc-ci —
lasuite-drive@7f0164cb✅ passed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1309(summary card unavailable — see the run for details.) full logs · dashboard
chore: upgrade lasuite-drive app/backend/celery/celery-beat to v0.21.2to chore: upgrade mailcatcher to v0.11.0, web nginx to 1.31.5!testme
🌻 cc-ci —
lasuite-drive@26623987❌ failure → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1317(summary card unavailable — see the run for details.) full logs · dashboard
!testme
🌻 cc-ci —
lasuite-drive@26623987✅ passed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1319(summary card unavailable — see the run for details.) full logs · dashboard
chore: upgrade mailcatcher to v0.11.0, web nginx to 1.31.5to chore: upgrade lasuite-drive app/backend/celery/celery-beat to v0.22.0!testme
🌻 cc-ci —
lasuite-drive@8324cf27✅ passedfull logs · dashboard
chore: upgrade lasuite-drive app/backend/celery/celery-beat to v0.22.0to chore: upgrade lasuite/drive to v0.22.0, mailcatcher to v0.11.0, web nginx to 1.31.6; pull MinIO from Quay!testme
🌻 cc-ci —
lasuite-drive@f89cbbc0❌ failurefull logs · dashboard
!testme
🌻 cc-ci —
lasuite-drive@f89cbbc0✅ passedfull logs · dashboard