chore: upgrade lasuite/drive to v0.22.0, mailcatcher to v0.11.0, web nginx to 1.31.6; pull MinIO from Quay #7

Merged
trav merged 4 commits from upgrade-7f0164c into main 2026-09-21 17:49:34 +00:00
Owner

Upgrade lasuite-drive app images v0.21.0 → v0.22.0 (frontend + backend/celery/celery-beat — the drive feature release, reached through the carried v0.21.1/v0.21.2 tail), carried mailcatcher v0.10.0 → v0.11.0, and — new in this 2026-09-18 extension — web nginx 1.31.4 → 1.31.6 (folding the carried 1.31.5 bump forward to the 15-Sep security release, CVE-2026-90439) plus a MinIO registry switch minio/minio → quay.io/minio/minio (same release): Docker Hub removed the minio/minio repository (verified 2026-09-18: Hub repo API 404, anonymous manifest pull 401), which breaks cold deploys of main itself; the identical tag is served from quay.io, MinIO's official channel. This mirrors the same fix merged upstream for lasuite-docs ("fix: pull MinIO image from Quay", PR #25, 2026-09-15). One evolving upgrade PR for the recipe.

Image tags

service image current → new
app lasuite/drive-frontend v0.21.0 → v0.22.0 (via carried v0.21.2)
backend lasuite/drive-backend v0.21.0 → v0.22.0 (via carried v0.21.2)
celery lasuite/drive-backend v0.21.0 → v0.22.0 (via carried v0.21.2)
celery-beat lasuite/drive-backend v0.21.0 → v0.22.0 (via carried v0.21.2)
mailcatcher sj26/mailcatcher v0.10.0 → v0.11.0 (carried, 09-04)
web nginx 1.31.4 → 1.31.6 (carried 1.31.5 + security 1.31.6, this extension)
minio minio/minio → quay.io/minio/minio RELEASE.2025-09-07T16-13-09Z — same release, registry switch only (Docker Hub repo removed 2026-09-18)

Sidecars unchanged (per direct checks, 2026-09-18): redis 8.10.1 (Docker Hub latest), pgautoupgrade 18-debian (latest major line; 18.6-debian is a point tag of the same major), onlyoffice 9.4.1.2 (Docker Hub max tag), collabora 25.04.10.3.1 (max 25.04.x; see note).

Upstream release notes

What changed upstream

  • drive v0.22.0 (2026-09-09): Added — Sentry performance-monitoring sample-rate setting (optional — this recipe wires no Sentry config, so no compose change; available to operators who wire Sentry themselves); permission decisions routed through a swappable backend; restricted access on folders, detached behind a restriction (feature-flagged). Changed — frontend migrated to the merged @gouvfr-lasuite/ui-components package (internal build change). Fixed — JPEG 2000 layers of scanned PDFs render in the preview; item deletion prevented for a creator whose access was revoked; direct parent resolved by exact path after a move. New automatic migrations core.0030_item_add_restriction_target and malware_detection.0005_alter_malwaredetection_path (apply on backend startup; both verified live on the dev deploy, including over a v0.21.0-initialized DB — the realistic upgrade path). No breaking changes, no new required config/env.
  • drive v0.21.1 / v0.21.2 (2026-08-21/25, carried): v0.21.1 fixes backend malware re-analysis of an already-scanned file; v0.21.2 adds helm scheduling + admin actions for malware analyses and fixes malware-analysis processing-slot exhaustion.
  • mailcatcher v0.11.0 (2026-09-02, carried): security/dependency fixes — update rack, sinatra, thin for security fixes; Rack + WebSocket stack bumped to patched releases (PR #578); sqlite3 2.x + Ruby 3.4 base; Compass/Sass/CoffeeScript build chain removed. No recipe-side breaking changes (SMTP catch-all + web UI).
  • nginx 1.31.5 (2026-09-02, carried): no security CVE named. Features (control API, predicate locations, ngx_http_json_module, client_body_early_read) + bugfixes (HTTP/2-buffered-proxy use-after-free, worker FD-exhaustion shutdown, long FastCGI/uwsgi parameter names, HTTP/3 + slice + memcached). Plain reverse-proxy use — no behavioural change.
  • nginx 1.31.6 (2026-09-15, this extension): Security — heap memory buffer overflow in a worker process under certain configurations when using HTTP/3 with OpenSSL 3.5.0 and earlier (CVE-2026-90439); QUIC transport-params change + bugfixes. The recipe's web is a plain reverse proxy (no HTTP/3 listener), so the vulnerable config is not in use — this pins the fixed line regardless.

Advisory scan (2026-09-18)

CVEs fixed by this upgrade: 1 — CVE-2026-90439 (nginx 1.31.6; union of release-note reading + deterministic scan --from v0.21.0 --to v0.22.0 --image mailcatcher=v0.10.0:v0.11.0 --image nginx=1.31.4:1.31.6). No source failed. Adjudication of the 75 undecided vendor-page CVEs: all NOT-FIXED in this window — every nginx CVE is named in a CHANGES section ≤ 1.31.3 (already fixed in the pinned 1.31.4 base; the 1.31.5 section has zero Security: lines, 1.31.6's only one is CVE-2026-90439, counted); the ONLYOFFICE (23) + redis (1) entries belong to sidecars this PR does not move. drive v0.22.0 and mailcatcher v0.11.0 name no CVE ids in the window. The minio registry switch changes no version, so it opens no advisory window.

Operator action

  • None beyond a normal deploy. Automatic DB migrations apply on backend startup (verified live: core.0030_item_add_restriction_target + malware_detection.0005_alter_malwaredetection_path applied cleanly, including over a v0.21.0-initialized database).
  • New optional upstream setting: Sentry performance-monitoring sample rate — the recipe wires no Sentry config, so nothing to set unless an operator opts into Sentry.
  • minio registry switch is required, not optional: Docker Hub removed minio/minio (repo API 404, anonymous pull 401 — verified 2026-09-18). Without this switch the recipe cannot cold-deploy (the previous 09-11 !testme green predates the removal). Same release from quay.io/minio/minio; the minio service's own minio-initialize.sh entrypoint still creates drive-media-storage (verified live). Precedent: lasuite-docs PR #25 merged upstream 2026-09-15.
  • collabora note (not part of this PR): drive projects now pin the collabora 26.04 line (drive's own compose uses collabora/code:26.04.2.2.1). The 26.04 image changed its runtime contract (shell-less: entrypoint runs coolwsd directly, no /start-collabora-online.sh, no extra_params env). Moving this recipe's collabora service onto 26.04 is a service redesign, not a tag swap — deliberately deferred. Flagging for the recipe maintainer. (Latest 26.04.x on Docker Hub is now 26.04.4.1.1; max 25.04.x remains the pinned 25.04.10.3.1.)
  • minio version note (not part of this PR): quay.io only re-hosts the frozen community line; a future minio version bump still means the AIStor product-line decision — operator call.
  • Recommended release (after merge) — minor, since the app moves v0.21.x → v0.22.0 (feature release; the earlier -z recommendation applied while this PR carried only patch-level bumps):

abra recipe release lasuite-drive -y

Verification (2026-09-18 extension)

Verified live on cc-ci first: dev-lasuite-drive.ci.commoninternet.net (--chaos --force, this branch head) — all 11 services 1/1 on the target images (quartet v0.22.0, mailcatcher v0.11.0, nginx 1.31.6, quay.io minio RELEASE.2025-09-07T16-13-09Z), both new migrations applied (over a v0.21.0-initialized DB — the realistic upgrade path), gunicorn up (the /.gunicorn control-server permission error is pre-existing — present in the 09-11 log too — and non-fatal), mailcatcher SMTP+HTTP up, minio bucket drive-media-storage created by the service's own entrypoint, frontend serving the Drive app (HTTPS 200), backend /api/v1.0/ 200 + /admin/login/ 200, teardown verified clean (0 stacks/volumes/secrets/configs). Then !testme on this PR (full recipe suite).

Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.

cc @trav @notplants

Upgrade `lasuite-drive` app images **v0.21.0 → v0.22.0** (frontend + backend/celery/celery-beat — the drive feature release, reached through the carried v0.21.1/v0.21.2 tail), carried **mailcatcher v0.10.0 → v0.11.0**, and — new in this 2026-09-18 extension — **web nginx 1.31.4 → 1.31.6** (folding the carried 1.31.5 bump forward to the 15-Sep **security release**, CVE-2026-90439) plus a **MinIO registry switch** `minio/minio` → `quay.io/minio/minio` (same release): Docker Hub **removed the `minio/minio` repository** (verified 2026-09-18: Hub repo API 404, anonymous manifest pull 401), which breaks cold deploys of `main` itself; the identical tag is served from quay.io, MinIO's official channel. This mirrors the same fix merged upstream for lasuite-docs ("fix: pull MinIO image from Quay", PR #25, 2026-09-15). One evolving upgrade PR for the recipe. ## Image tags | service | image | current → new | |-------------|-----------------------------|---------------| | app | lasuite/drive-frontend | v0.21.0 → **v0.22.0** (via carried v0.21.2) | | backend | lasuite/drive-backend | v0.21.0 → **v0.22.0** (via carried v0.21.2) | | celery | lasuite/drive-backend | v0.21.0 → **v0.22.0** (via carried v0.21.2) | | celery-beat | lasuite/drive-backend | v0.21.0 → **v0.22.0** (via carried v0.21.2) | | mailcatcher | sj26/mailcatcher | v0.10.0 → **v0.11.0** (carried, 09-04) | | web | nginx | 1.31.4 → **1.31.6** (carried 1.31.5 + security 1.31.6, this extension) | | minio | minio/minio → **quay.io/minio/minio** | RELEASE.2025-09-07T16-13-09Z — **same release**, registry switch only (Docker Hub repo removed 2026-09-18) | Sidecars unchanged (per direct checks, 2026-09-18): redis 8.10.1 (Docker Hub latest), pgautoupgrade 18-debian (latest major line; 18.6-debian is a point tag of the same major), onlyoffice 9.4.1.2 (Docker Hub max tag), collabora 25.04.10.3.1 (max 25.04.x; see note). ## Upstream release notes - **lasuite/drive** v0.21.0→v0.22.0 (app/backend/celery/celery-beat share the monorepo tag), through v0.21.1 + v0.21.2: https://github.com/suitenumerique/drive/releases/tag/v0.22.0 (intermediates: https://github.com/suitenumerique/drive/releases/tag/v0.21.1 , https://github.com/suitenumerique/drive/releases/tag/v0.21.2 ) - **mailcatcher** v0.10.0→v0.11.0: https://github.com/sj26/mailcatcher/compare/v0.10.0...v0.11.0 (tag-only, formal GitHub release entry pending) - **web nginx** 1.31.4→1.31.6: https://nginx.org/en/CHANGES (1.31.5 + 1.31.6 sections) - **minio**: no version change (registry switch only, same RELEASE.2025-09-07T16-13-09Z) — no release-notes window ## What changed upstream - **drive v0.22.0** (2026-09-09): Added — Sentry performance-monitoring sample-rate **setting** (optional — this recipe wires no Sentry config, so no compose change; available to operators who wire Sentry themselves); permission decisions routed through a swappable backend; restricted access on folders, detached behind a restriction (feature-flagged). Changed — frontend migrated to the merged `@gouvfr-lasuite/ui-components` package (internal build change). Fixed — JPEG 2000 layers of scanned PDFs render in the preview; item deletion prevented for a creator whose access was revoked; direct parent resolved by exact path after a move. New automatic migrations `core.0030_item_add_restriction_target` and `malware_detection.0005_alter_malwaredetection_path` (apply on backend startup; both verified live on the dev deploy, including over a v0.21.0-initialized DB — the realistic upgrade path). **No breaking changes, no new required config/env.** - **drive v0.21.1 / v0.21.2** (2026-08-21/25, carried): v0.21.1 fixes backend malware re-analysis of an already-scanned file; v0.21.2 adds helm scheduling + admin actions for malware analyses and fixes malware-analysis processing-slot exhaustion. - **mailcatcher v0.11.0** (2026-09-02, carried): security/dependency fixes — update rack, sinatra, thin for security fixes; Rack + WebSocket stack bumped to patched releases (PR #578); sqlite3 2.x + Ruby 3.4 base; Compass/Sass/CoffeeScript build chain removed. No recipe-side breaking changes (SMTP catch-all + web UI). - **nginx 1.31.5** (2026-09-02, carried): no security CVE named. Features (control API, predicate locations, `ngx_http_json_module`, `client_body_early_read`) + bugfixes (HTTP/2-buffered-proxy use-after-free, worker FD-exhaustion shutdown, long FastCGI/uwsgi parameter names, HTTP/3 + slice + memcached). Plain reverse-proxy use — no behavioural change. - **nginx 1.31.6** (2026-09-15, this extension): **Security — heap memory buffer overflow in a worker process under certain configurations when using HTTP/3 with OpenSSL 3.5.0 and earlier (CVE-2026-90439)**; QUIC transport-params change + bugfixes. The recipe's `web` is a plain reverse proxy (no HTTP/3 listener), so the vulnerable config is not in use — this pins the fixed line regardless. ## Advisory scan (2026-09-18) **CVEs fixed by this upgrade: 1** — **CVE-2026-90439** (nginx 1.31.6; union of release-note reading + deterministic scan `--from v0.21.0 --to v0.22.0 --image mailcatcher=v0.10.0:v0.11.0 --image nginx=1.31.4:1.31.6`). No source failed. Adjudication of the 75 undecided vendor-page CVEs: all NOT-FIXED in this window — every nginx CVE is named in a CHANGES section **≤ 1.31.3** (already fixed in the pinned 1.31.4 base; the 1.31.5 section has zero `Security:` lines, 1.31.6's only one is CVE-2026-90439, counted); the ONLYOFFICE (23) + redis (1) entries belong to sidecars this PR does not move. drive v0.22.0 and mailcatcher v0.11.0 name no CVE ids in the window. The minio registry switch changes no version, so it opens no advisory window. ## Operator action - None beyond a normal deploy. Automatic DB migrations apply on backend startup (verified live: `core.0030_item_add_restriction_target` + `malware_detection.0005_alter_malwaredetection_path` applied cleanly, including over a v0.21.0-initialized database). - New **optional** upstream setting: Sentry performance-monitoring sample rate — the recipe wires no Sentry config, so nothing to set unless an operator opts into Sentry. - **minio registry switch is required, not optional**: Docker Hub removed `minio/minio` (repo API 404, anonymous pull 401 — verified 2026-09-18). Without this switch the recipe cannot cold-deploy (the previous 09-11 !testme green predates the removal). Same release from `quay.io/minio/minio`; the `minio` service's own `minio-initialize.sh` entrypoint still creates `drive-media-storage` (verified live). Precedent: lasuite-docs PR #25 merged upstream 2026-09-15. - **collabora note (not part of this PR):** drive projects now pin the collabora **26.04** line (drive's own compose uses `collabora/code:26.04.2.2.1`). The 26.04 image changed its runtime contract (shell-less: entrypoint runs `coolwsd` directly, no `/start-collabora-online.sh`, no `extra_params` env). Moving this recipe's collabora service onto 26.04 is a **service redesign**, not a tag swap — deliberately deferred. Flagging for the recipe maintainer. (Latest 26.04.x on Docker Hub is now 26.04.4.1.1; max 25.04.x remains the pinned 25.04.10.3.1.) - **minio version note (not part of this PR):** quay.io only re-hosts the frozen community line; a future minio **version** bump still means the AIStor product-line decision — operator call. - Recommended release (after merge) — minor, since the app moves v0.21.x → v0.22.0 (feature release; the earlier `-z` recommendation applied while this PR carried only patch-level bumps): `abra recipe release lasuite-drive -y` ## Verification (2026-09-18 extension) Verified live on cc-ci first: `dev-lasuite-drive.ci.commoninternet.net` (`--chaos --force`, this branch head) — **all 11 services 1/1** on the target images (quartet **v0.22.0**, mailcatcher v0.11.0, **nginx 1.31.6**, **quay.io** minio RELEASE.2025-09-07T16-13-09Z), both new migrations applied (over a v0.21.0-initialized DB — the realistic upgrade path), gunicorn up (the `/.gunicorn` control-server permission error is pre-existing — present in the 09-11 log too — and non-fatal), mailcatcher SMTP+HTTP up, minio bucket `drive-media-storage` created by the service's own entrypoint, frontend serving the Drive app (HTTPS 200), backend `/api/v1.0/` 200 + `/admin/login/` 200, teardown verified clean (0 stacks/volumes/secrets/configs). Then `!testme` on this PR (full recipe suite). Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review. cc @trav @notplants
autonomic-bot added 1 commit 2026-08-28 03:27:01 +00:00
autonomic-bot requested review from trav 2026-08-28 03:27:01 +00:00
autonomic-bot requested review from notplants 2026-08-28 03:27:01 +00:00
Author
Owner

!testme

!testme
Author
Owner

cc-ci: failed to start a CI run (see bridge logs).

cc-ci: failed to start a CI run (see bridge logs).
Author
Owner

CI status update: !testme was posted once, but the bridge could not start a CI run — failed to start a CI run (see bridge logs), confirmed in bridge logs as SSL: CERTIFICATE_VERIFY_FAILED certificate has expired against drone.ci.commoninternet.net. This is infra, not a recipe/test failure: the *.ci.commoninternet.net Let's Encrypt wildcard cert expired 2026-08-24 (operator renews ~90 days out-of-band; not yet renewed). No CI runs were burned on this. The "Tested green" line below is the PR template's default text and does NOT reflect a CI result for this head.

Verification that did happen: full direct deploy of this head on cc-ci (dev-lasuite-drive.ci.commoninternet.net, --chaos) — all 11 services 1/1 on the new images, migrations applied (malware_detection.0003_...), HTTP/HTTPS 200, then torn down. Please re-run /recipe-upgrade lasuite-drive (or !testme) after the cert is renewed to complete CI verification.

**CI status update:** `!testme` was posted once, but the bridge could not start a CI run — `failed to start a CI run (see bridge logs)`, confirmed in bridge logs as `SSL: CERTIFICATE_VERIFY_FAILED certificate has expired` against `drone.ci.commoninternet.net`. This is **infra**, not a recipe/test failure: the `*.ci.commoninternet.net` Let's Encrypt wildcard cert expired 2026-08-24 (operator renews ~90 days out-of-band; not yet renewed). No CI runs were burned on this. The "Tested green" line below is the PR template's default text and does NOT reflect a CI result for this head. Verification that **did** happen: full direct deploy of this head on cc-ci (`dev-lasuite-drive.ci.commoninternet.net`, `--chaos`) — all 11 services 1/1 on the new images, migrations applied (`malware_detection.0003_...`), HTTP/HTTPS 200, then torn down. Please re-run `/recipe-upgrade lasuite-drive` (or `!testme`) after the cert is renewed to complete CI verification.
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — lasuite-drive @ 7f0164cb ✅ passed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1309

(summary card unavailable — see the run for details.) full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `lasuite-drive` @ `7f0164cb` ✅ **passed** → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1309 _(summary card unavailable — see the run for details.)_ [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1309) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot changed title from chore: upgrade lasuite-drive app/backend/celery/celery-beat to v0.21.2 to chore: upgrade mailcatcher to v0.11.0, web nginx to 1.31.5 2026-09-04 02:31:10 +00:00
autonomic-bot added 1 commit 2026-09-04 02:31:10 +00:00
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — lasuite-drive @ 26623987 ❌ failure → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1317

(summary card unavailable — see the run for details.) full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `lasuite-drive` @ `26623987` ❌ **failure** → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1317 _(summary card unavailable — see the run for details.)_ [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1317) · [dashboard](https://ci.commoninternet.net/)
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — lasuite-drive @ 26623987 ✅ passed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1319

(summary card unavailable — see the run for details.) full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `lasuite-drive` @ `26623987` ✅ **passed** → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1319 _(summary card unavailable — see the run for details.)_ [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1319) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot changed title from chore: upgrade mailcatcher to v0.11.0, web nginx to 1.31.5 to chore: upgrade lasuite-drive app/backend/celery/celery-beat to v0.22.0 2026-09-11 04:20:23 +00:00
autonomic-bot added 1 commit 2026-09-11 04:20:25 +00:00
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — lasuite-drive @ 8324cf27 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `lasuite-drive` @ `8324cf27` ✅ **passed** [![cc-ci result card](https://ci.commoninternet.net/runs/1352/summary.png)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1352) [![level](https://ci.commoninternet.net/runs/1352/badge.svg)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1352) [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1352) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot changed title from chore: upgrade lasuite-drive app/backend/celery/celery-beat to v0.22.0 to chore: upgrade lasuite/drive to v0.22.0, mailcatcher to v0.11.0, web nginx to 1.31.6; pull MinIO from Quay 2026-09-18 03:40:22 +00:00
autonomic-bot added 1 commit 2026-09-18 03:40:23 +00:00
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — lasuite-drive @ f89cbbc0 ❌ failure

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `lasuite-drive` @ `f89cbbc0` ❌ **failure** [![cc-ci result card](https://ci.commoninternet.net/runs/1369/summary.png)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1369) [![level](https://ci.commoninternet.net/runs/1369/badge.svg)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1369) [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1369) · [dashboard](https://ci.commoninternet.net/)
Author
Owner

!testme

!testme
Author
Owner

🌻 cc-ci — lasuite-drive @ f89cbbc0 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `lasuite-drive` @ `f89cbbc0` ✅ **passed** [![cc-ci result card](https://ci.commoninternet.net/runs/1370/summary.png)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1370) [![level](https://ci.commoninternet.net/runs/1370/badge.svg)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1370) [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1370) · [dashboard](https://ci.commoninternet.net/)
trav merged commit 75a9c27425 into main 2026-09-21 17:49:34 +00:00
Sign in to join this conversation.
No Reviewers
No labels
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: recipe-maintainers/lasuite-drive#7