recipe-maintainers/lasuite-drive
0
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

chore: upgrade mailcatcher to v0.11.0, web nginx to 1.31.5 #7

Open
autonomic-bot wants to merge 2 commits from upgrade-7f0164c into main
pull from: upgrade-7f0164c
merge into: :main
Conversation 9 Commits 2 Files Changed 1
+6 -6
autonomic-bot commented 2026-08-28 03:27:00 +00:00
Owner
Copy Link
Copy Source

Upgrade lasuite-drive app images v0.21.0 → v0.21.2 (frontend + backend/celery/celery-beat, carried from the prior run) plus this week's sidecar bumps mailcatcher v0.10.0 → v0.11.0 and web nginx 1.31.4 → 1.31.5. One evolving upgrade PR for the recipe.

Image tags

service image current → new
app lasuite/drive-frontend v0.21.0 → v0.21.2
backend lasuite/drive-backend v0.21.0 → v0.21.2
celery lasuite/drive-backend v0.21.0 → v0.21.2
celery-beat lasuite/drive-backend v0.21.0 → v0.21.2
mailcatcher sj26/mailcatcher v0.10.0 → v0.11.0
web nginx 1.31.4 → 1.31.5

Sidecars unchanged (per direct checks): redis 8.10.1, pgautoupgrade 18-debian (both abra/upstream-latest), minio RELEASE.2025-09-07T16-13-09Z (Docker Hub cap; AIStor switch is an operator decision), onlyoffice 9.4.1.2 (Docker Hub max tag), collabora 25.04.10.3.1 (see note).

Upstream release notes

What changed upstream

  • drive v0.21.1 / v0.21.2 (2026-08-21/25): patch-level — v0.21.1 fixes backend malware re-analysis of an already-scanned file; v0.21.2 adds helm scheduling + admin actions for malware analyses and fixes malware-analysis processing-slot exhaustion. No breaking changes, no config/env changes, no DB migrations beyond automatic v0.21.x migrations.
  • mailcatcher v0.11.0 (2026-09-02): security/dependency fixes — update rack, sinatra, thin for security fixes; Rack + WebSocket stack bumped to patched releases (PR #578); sqlite3 2.x + Ruby 3.4 support (Docker image now Ruby 3.4); Removed Compass/Sass/CoffeeScript build chain; release automation across registries. No recipe-side breaking changes (SMTP catch-all + web UI).
  • nginx 1.31.5 (2026-09-02): no security CVE named. Features: control API, predicate locations, ngx_http_json_module, client_body_early_read. Bugfixes: use-after-free possible when proxying with buffering + error sending to an HTTP/2 client; worker FD-exhaustion shutdown bug; too-long FastCGI/uwsgi parameter names; HTTP/3 + slice + memcached fixes. Plain reverse-proxy use in this recipe — no behavioural change.

Advisory scan (2026-09-04)

CVEs fixed by this upgrade: 0 (union of release-note reading + deterministic scan --from v0.21.0 --to v0.21.2 --image mailcatcher=v0.10.0:v0.11.0 --image nginx=1.31.4:1.31.5). No source failed. Adjudication of the 75 undecided vendor-page CVEs: all NOT-FIXED in this window — nginx 1.31.5 names zero security fixes (every nginx CVE seen was already fixed at the pinned 1.31.4); ONLYOFFICE (23) + redis (1) sidecars did not move. mailcatcher's security-dependency updates fix no named CVE id in the window.

Operator action

  • None beyond a normal deploy. Two patch-level sidecar bumps + the carried app patch; no config, env, or volume changes; no DB migrations.
  • collabora note (not part of this PR): drive projects now pin the collabora 26.04 line (drive's own compose uses collabora/code:26.04.2.2.1). The 26.04 image changed its runtime contract (shell-less: entrypoint runs coolwsd directly, no /start-collabora-online.sh, no extra_params env). Moving this recipe's collabora service onto 26.04 is a service redesign, not a tag swap — deliberately deferred (see 08-31 run). Flagging for the recipe maintainer.
  • minio note (not part of this PR): Docker Hub minio/minio latest is frozen at the pinned release; newer minio moved to the AIStor product line — registry+product switch is an operator decision.
  • Recommended release (after merge): abra recipe release lasuite-drive -z

Verification

Verified live on cc-ci first: dev-lasuite-drive.ci.commoninternet.net (--chaos) — all 11 services 1/1 on the new images (incl. mailcatcher v0.11.0 + nginx 1.31.5), migrations applied (incl. malware_detection.0005_alter_malwaredetection_path), mailcatcher SMTP+HTTP up, nginx workers started, app HTTP/HTTPS 200, teardown verified clean. Then !testme on this PR (full recipe suite).

Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.

cc @trav @notplants

Upgrade `lasuite-drive` app images **v0.21.0 → v0.21.2** (frontend + backend/celery/celery-beat, carried from the prior run) plus this week's sidecar bumps **mailcatcher v0.10.0 → v0.11.0** and **web nginx 1.31.4 → 1.31.5**. One evolving upgrade PR for the recipe. ## Image tags | service | image | current → new | |-------------|------------------------|---------------| | app | lasuite/drive-frontend | v0.21.0 → **v0.21.2** | | backend | lasuite/drive-backend | v0.21.0 → **v0.21.2** | | celery | lasuite/drive-backend | v0.21.0 → **v0.21.2** | | celery-beat | lasuite/drive-backend | v0.21.0 → **v0.21.2** | | mailcatcher | sj26/mailcatcher | v0.10.0 → **v0.11.0** | | web | nginx | 1.31.4 → **1.31.5** | Sidecars unchanged (per direct checks): redis 8.10.1, pgautoupgrade 18-debian (both abra/upstream-latest), minio RELEASE.2025-09-07T16-13-09Z (Docker Hub cap; AIStor switch is an operator decision), onlyoffice 9.4.1.2 (Docker Hub max tag), collabora 25.04.10.3.1 (see note). ## Upstream release notes - **lasuite/drive** v0.21.0→v0.21.2 (app/backend/celery/celery-beat share the monorepo tag): https://github.com/suitenumerique/drive/releases/tag/v0.21.1 and https://github.com/suitenumerique/drive/releases/tag/v0.21.2 - **mailcatcher** v0.10.0→v0.11.0: https://github.com/sj26/mailcatcher/compare/v0.10.0...v0.11.0 (Docker image v0.11.0 published 2026-09-03; tag-only, formal GitHub release entry pending) - **web nginx** 1.31.4→1.31.5: https://nginx.org/en/CHANGES ## What changed upstream - **drive v0.21.1 / v0.21.2** (2026-08-21/25): patch-level — v0.21.1 fixes backend malware re-analysis of an already-scanned file; v0.21.2 adds helm scheduling + admin actions for malware analyses and fixes malware-analysis processing-slot exhaustion. No breaking changes, no config/env changes, no DB migrations beyond automatic v0.21.x migrations. - **mailcatcher v0.11.0** (2026-09-02): security/dependency fixes — update rack, sinatra, thin for security fixes; Rack + WebSocket stack bumped to patched releases (PR #578); sqlite3 2.x + Ruby 3.4 support (Docker image now Ruby 3.4); Removed Compass/Sass/CoffeeScript build chain; release automation across registries. No recipe-side breaking changes (SMTP catch-all + web UI). - **nginx 1.31.5** (2026-09-02): no security CVE named. Features: control API, predicate locations, `ngx_http_json_module`, `client_body_early_read`. Bugfixes: use-after-free possible when proxying with buffering + error sending to an HTTP/2 client; worker FD-exhaustion shutdown bug; too-long FastCGI/uwsgi parameter names; HTTP/3 + slice + memcached fixes. Plain reverse-proxy use in this recipe — no behavioural change. ## Advisory scan (2026-09-04) **CVEs fixed by this upgrade: 0** (union of release-note reading + deterministic scan --from v0.21.0 --to v0.21.2 --image mailcatcher=v0.10.0:v0.11.0 --image nginx=1.31.4:1.31.5). No source failed. Adjudication of the 75 undecided vendor-page CVEs: all NOT-FIXED in this window — nginx 1.31.5 names zero security fixes (every nginx CVE seen was already fixed at the pinned 1.31.4); ONLYOFFICE (23) + redis (1) sidecars did not move. mailcatcher's security-dependency updates fix no named CVE id in the window. ## Operator action - None beyond a normal deploy. Two patch-level sidecar bumps + the carried app patch; no config, env, or volume changes; no DB migrations. - **collabora note (not part of this PR):** drive projects now pin the collabora **26.04** line (drive's own compose uses `collabora/code:26.04.2.2.1`). The 26.04 image changed its runtime contract (shell-less: entrypoint runs `coolwsd` directly, no `/start-collabora-online.sh`, no `extra_params` env). Moving this recipe's collabora service onto 26.04 is a **service redesign**, not a tag swap — deliberately deferred (see 08-31 run). Flagging for the recipe maintainer. - **minio note (not part of this PR):** Docker Hub `minio/minio` `latest` is frozen at the pinned release; newer minio moved to the AIStor product line — registry+product switch is an operator decision. - Recommended release (after merge): `abra recipe release lasuite-drive -z` ## Verification Verified live on cc-ci first: `dev-lasuite-drive.ci.commoninternet.net` (`--chaos`) — all 11 services 1/1 on the new images (incl. mailcatcher v0.11.0 + nginx 1.31.5), migrations applied (incl. `malware_detection.0005_alter_malwaredetection_path`), mailcatcher SMTP+HTTP up, nginx workers started, app HTTP/HTTPS 200, teardown verified clean. Then `!testme` on this PR (full recipe suite). Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review. cc @trav @notplants
autonomic-bot added 1 commit 2026-08-28 03:27:01 +00:00
chore: upgrade lasuite-drive app/backend/celery/celery-beat to v0.21.2
cc-ci/testme cc-ci: success
Details
7f0164cb00
autonomic-bot requested review from trav 2026-08-28 03:27:01 +00:00
autonomic-bot requested review from notplants 2026-08-28 03:27:01 +00:00
autonomic-bot commented 2026-08-28 03:27:08 +00:00
Author
Owner
Copy Link
Copy Source

!testme

!testme
autonomic-bot commented 2026-08-28 03:27:26 +00:00
Author
Owner
Copy Link
Copy Source

cc-ci: failed to start a CI run (see bridge logs).

cc-ci: failed to start a CI run (see bridge logs).
autonomic-bot commented 2026-08-28 03:54:50 +00:00
Author
Owner
Copy Link
Copy Source

CI status update: !testme was posted once, but the bridge could not start a CI run — failed to start a CI run (see bridge logs), confirmed in bridge logs as SSL: CERTIFICATE_VERIFY_FAILED certificate has expired against drone.ci.commoninternet.net. This is infra, not a recipe/test failure: the *.ci.commoninternet.net Let's Encrypt wildcard cert expired 2026-08-24 (operator renews ~90 days out-of-band; not yet renewed). No CI runs were burned on this. The "Tested green" line below is the PR template's default text and does NOT reflect a CI result for this head.

Verification that did happen: full direct deploy of this head on cc-ci (dev-lasuite-drive.ci.commoninternet.net, --chaos) — all 11 services 1/1 on the new images, migrations applied (malware_detection.0003_...), HTTP/HTTPS 200, then torn down. Please re-run /recipe-upgrade lasuite-drive (or !testme) after the cert is renewed to complete CI verification.

**CI status update:** `!testme` was posted once, but the bridge could not start a CI run — `failed to start a CI run (see bridge logs)`, confirmed in bridge logs as `SSL: CERTIFICATE_VERIFY_FAILED certificate has expired` against `drone.ci.commoninternet.net`. This is **infra**, not a recipe/test failure: the `*.ci.commoninternet.net` Let's Encrypt wildcard cert expired 2026-08-24 (operator renews ~90 days out-of-band; not yet renewed). No CI runs were burned on this. The "Tested green" line below is the PR template's default text and does NOT reflect a CI result for this head. Verification that **did** happen: full direct deploy of this head on cc-ci (`dev-lasuite-drive.ci.commoninternet.net`, `--chaos`) — all 11 services 1/1 on the new images, migrations applied (`malware_detection.0003_...`), HTTP/HTTPS 200, then torn down. Please re-run `/recipe-upgrade lasuite-drive` (or `!testme`) after the cert is renewed to complete CI verification.
autonomic-bot commented 2026-08-31 20:10:48 +00:00
Author
Owner
Copy Link
Copy Source

!testme

!testme
autonomic-bot commented 2026-08-31 20:11:01 +00:00
Author
Owner
Copy Link
Copy Source

🌻 cc-ci — lasuite-drive @ 7f0164cb ✅ passed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1309

(summary card unavailable — see the run for details.) full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `lasuite-drive` @ `7f0164cb` ✅ **passed** → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1309 _(summary card unavailable — see the run for details.)_ [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1309) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot changed title from chore: upgrade lasuite-drive app/backend/celery/celery-beat to v0.21.2 to chore: upgrade mailcatcher to v0.11.0, web nginx to 1.31.5 2026-09-04 02:31:10 +00:00
autonomic-bot added 1 commit 2026-09-04 02:31:10 +00:00
chore: upgrade mailcatcher to v0.11.0, web nginx to 1.31.5
cc-ci/testme cc-ci: success
Details
2662398786
autonomic-bot commented 2026-09-04 02:31:29 +00:00
Author
Owner
Copy Link
Copy Source

!testme

!testme
autonomic-bot commented 2026-09-04 02:31:30 +00:00
Author
Owner
Copy Link
Copy Source

🌻 cc-ci — lasuite-drive @ 26623987 ❌ failure → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1317

(summary card unavailable — see the run for details.) full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `lasuite-drive` @ `26623987` ❌ **failure** → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1317 _(summary card unavailable — see the run for details.)_ [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1317) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot commented 2026-09-04 02:39:08 +00:00
Author
Owner
Copy Link
Copy Source

!testme

!testme
autonomic-bot commented 2026-09-04 02:39:39 +00:00
Author
Owner
Copy Link
Copy Source

🌻 cc-ci — lasuite-drive @ 26623987 ✅ passed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1319

(summary card unavailable — see the run for details.) full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `lasuite-drive` @ `26623987` ✅ **passed** → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1319 _(summary card unavailable — see the run for details.)_ [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1319) · [dashboard](https://ci.commoninternet.net/)
All checks were successful
cc-ci/testme cc-ci: success
Details
You are not authorized to merge this pull request.
This pull request can be merged automatically.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin upgrade-7f0164c:upgrade-7f0164c
git checkout upgrade-7f0164c
Sign in to join this conversation.
Reviewers
No Reviewers
trav
notplants
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
autonomic autonomic-bot kawaiipunk (KawaiiPunk) notplants trav (Trav Fryer)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: recipe-maintainers/lasuite-drive#7