chore: upgrade lasuite/meet to v1.31.0, livekit to v1.13.7, nginx to 1.31.6 #10

Merged

trav merged 2 commits from upgrade-669cdf3 into main 2026-09-21 17:41:23 +00:00

Conversation 4 Commits 2 Files Changed 1

+5 -5

autonomic-bot commented 2026-09-11 04:35:34 +00:00

Owner

Copy Link

Copy Source

Extends this evolving upgrade PR to the newest pins vs upstream main (a464cc6, 0.6.0+v1.30.0). Fast-forwards the existing meet bump (669cdf3) and adds the newly available livekit + nginx bumps. Subsumes upstream renovate PRs #19/#20/#24/#25, which propose these same bumps individually.

Image bumps (vs upstream main)

service	image	current	new
app	lasuite/meet-frontend	v1.30.0	v1.31.0
backend	lasuite/meet-backend	v1.30.0	v1.31.0
celery	lasuite/meet-backend	v1.30.0	v1.31.0
livekit	livekit/livekit-server	v1.13.6	v1.13.7
web	nginx	1.31.5	1.31.6

redis 8.10.1 and pgautoupgrade 18-debian are already the newest tags of their schemes (no PG 19 exists yet) — unchanged. No digest pins in this recipe.

Upstream release notes: meet v1.30.0→v1.31.0: https://github.com/suitenumerique/meet/releases/tag/v1.31.0
Upstream release notes: livekit v1.13.6→v1.13.7: https://github.com/livekit/livekit/releases/tag/v1.13.7
Upstream release notes: nginx 1.31.5→1.31.6: https://nginx.org/en/CHANGES

What changed upstream

• meet v1.31.0 (feature release): 1080p sending resolution option, Traefik support via configurable media-auth url header (#1649), room attributes updatable from the external API, waiting-participant sort by arrival, several frontend/backend fixes. No breaking changes; no new required config; Django migrations run on boot (none pending vs v1.30.0 — verified on a live deploy).
• livekit v1.13.7 (patch, same 1.13.x line meet itself pins in dev): VP9/AV1 simulcast, telemetry additions, opt-in TURN PROXY protocol on TCP listener + udp:// ingress; fixes: hold signal messages until ReconnectResponse goes out, WHIP ICE-URI escaping, SDP unmarshal hardening. No config-format changes.
• nginx 1.31.6 (security + bugfix): CVE-2026-90439 — heap buffer overflow in a worker under certain HTTP/3 configurations with OpenSSL ≤ 3.5.0; QUIC transport-params extension now always ignored in SSL connections; bugfixes (binary upgrade + perl module, predicate locations, nested location lookup, geo ranges segfault).

Security (advisory scan — GitHub Security Advisories + vendor pages, unioned with the release-note read)

1 CVE fixed by this upgrade: CVE-2026-90439 (nginx 1.31.6). No CVEs named in the meet v1.31.0 or livekit v1.13.7 release notes. One out-of-window redis advisory (CVE-2026-62356, no version data available) is left undecided — redis is not bumped in this PR.

Operator Action Required

None mandatory — no breaking changes, no migrations beyond Django's automatic on-boot ones, no compose/env changes. The new Traefik media-auth header support and the 1080p option are opt-in features that need no config change to keep current behavior.

Live verification (direct deploy on the cc-ci swarm)

This exact tree was deployed with --chaos on dev-lasuite-meet.ci.commoninternet.net as an in-place upgrade from the running 0.6.0+v1.30.0: all 7 services converged healthy — backend v1.31.0 gunicorn up with "no pending migrations", livekit logs show version: 1.13.7 with TURN started, nginx 1.31.6 healthy — and both https://dev-lasuite-meet.../ and the livekit route answered 200 through Traefik. Dev deploy torn down afterwards (0 stacks/volumes leaked).

Release

The coop-cloud.${STACK_NAME}.version label is intentionally NOT bumped in this PR. After merge, publish with:

abra recipe release lasuite-meet -y

(app minor feature release v1.30.0→v1.31.0 → recipe minor 0.7.0+v1.31.0; livekit/nginx bumps are patch-level.)

Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.

cc @trav @notplants

Extends this evolving upgrade PR to the newest pins vs upstream main (`a464cc6`, 0.6.0+v1.30.0). Fast-forwards the existing meet bump (669cdf3) and adds the newly available livekit + nginx bumps. Subsumes upstream renovate PRs #19/#20/#24/#25, which propose these same bumps individually. ## Image bumps (vs upstream main) | service | image | current | new | |---|---|---|---| | app | lasuite/meet-frontend | v1.30.0 | v1.31.0 | | backend | lasuite/meet-backend | v1.30.0 | v1.31.0 | | celery | lasuite/meet-backend | v1.30.0 | v1.31.0 | | livekit | livekit/livekit-server | v1.13.6 | v1.13.7 | | web | nginx | 1.31.5 | 1.31.6 | redis 8.10.1 and pgautoupgrade 18-debian are already the newest tags of their schemes (no PG 19 exists yet) — unchanged. No digest pins in this recipe. **Upstream release notes:** meet v1.30.0→v1.31.0: https://github.com/suitenumerique/meet/releases/tag/v1.31.0 **Upstream release notes:** livekit v1.13.6→v1.13.7: https://github.com/livekit/livekit/releases/tag/v1.13.7 **Upstream release notes:** nginx 1.31.5→1.31.6: https://nginx.org/en/CHANGES ## What changed upstream - **meet v1.31.0** (feature release): 1080p sending resolution option, Traefik support via configurable media-auth url header (#1649), room attributes updatable from the external API, waiting-participant sort by arrival, several frontend/backend fixes. No breaking changes; no new required config; Django migrations run on boot (none pending vs v1.30.0 — verified on a live deploy). - **livekit v1.13.7** (patch, same 1.13.x line meet itself pins in dev): VP9/AV1 simulcast, telemetry additions, opt-in TURN PROXY protocol on TCP listener + udp:// ingress; fixes: hold signal messages until ReconnectResponse goes out, WHIP ICE-URI escaping, SDP unmarshal hardening. No config-format changes. - **nginx 1.31.6** (security + bugfix): **CVE-2026-90439** — heap buffer overflow in a worker under certain HTTP/3 configurations with OpenSSL ≤ 3.5.0; QUIC transport-params extension now always ignored in SSL connections; bugfixes (binary upgrade + perl module, predicate locations, nested location lookup, `geo ranges` segfault). ## Security (advisory scan — GitHub Security Advisories + vendor pages, unioned with the release-note read) **1 CVE fixed by this upgrade: CVE-2026-90439** (nginx 1.31.6). No CVEs named in the meet v1.31.0 or livekit v1.13.7 release notes. One out-of-window redis advisory (CVE-2026-62356, no version data available) is left undecided — redis is not bumped in this PR. ## Operator Action Required None mandatory — no breaking changes, no migrations beyond Django's automatic on-boot ones, no compose/env changes. The new Traefik media-auth header support and the 1080p option are opt-in features that need no config change to keep current behavior. ## Live verification (direct deploy on the cc-ci swarm) This exact tree was deployed with `--chaos` on `dev-lasuite-meet.ci.commoninternet.net` as an in-place upgrade from the running 0.6.0+v1.30.0: all 7 services converged healthy — backend v1.31.0 gunicorn up with "no pending migrations", livekit logs show `version: 1.13.7` with TURN started, nginx 1.31.6 healthy — and both `https://dev-lasuite-meet.../` and the livekit route answered 200 through Traefik. Dev deploy torn down afterwards (0 stacks/volumes leaked). ## Release The `coop-cloud.${STACK_NAME}.version` label is intentionally NOT bumped in this PR. After merge, publish with: abra recipe release lasuite-meet -y (app minor feature release v1.30.0→v1.31.0 → recipe minor `0.7.0+v1.31.0`; livekit/nginx bumps are patch-level.) Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review. cc @trav @notplants

autonomic-bot added 1 commit 2026-09-11 04:35:34 +00:00

chore: upgrade lasuite/meet to v1.31.0 669cdf36d6

autonomic-bot requested review from trav 2026-09-11 04:35:34 +00:00

autonomic-bot requested review from notplants 2026-09-11 04:35:34 +00:00

autonomic-bot commented 2026-09-11 04:35:39 +00:00

Author

Owner

Copy Link

Copy Source

!testme

!testme

autonomic-bot commented 2026-09-11 04:36:01 +00:00

Author

Owner

Copy Link

Copy Source

🌻 cc-ci — lasuite-meet @ 669cdf36 ✅ passed

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `lasuite-meet` @ `669cdf36` ✅ **passed** [](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1353) [](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1353) [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1353) · [dashboard](https://ci.commoninternet.net/)

autonomic-bot changed title from chore: upgrade lasuite/meet to v1.31.0 to chore: upgrade lasuite/meet to v1.31.0, livekit to v1.13.7, nginx to 1.31.6 2026-09-18 07:33:28 +00:00

autonomic-bot added 1 commit 2026-09-18 07:33:28 +00:00

chore: upgrade lasuite/meet to v1.31.0, livekit to v1.13.7, nginx to 1.31.6 377d742267

autonomic-bot commented 2026-09-18 07:33:37 +00:00

Author

Owner

Copy Link

Copy Source

!testme

!testme

autonomic-bot commented 2026-09-18 07:33:57 +00:00

Author

Owner

Copy Link

Copy Source

🌻 cc-ci — lasuite-meet @ 377d7422 ✅ passed

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `lasuite-meet` @ `377d7422` ✅ **passed** [](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1372) [](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1372) [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1372) · [dashboard](https://ci.commoninternet.net/)

trav merged commit 3b4b69ea9f into main 2026-09-21 17:41:23 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

trav

notplants

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

autonomic autonomic-bot kawaiipunk (KawaiiPunk) notplants trav (Trav Fryer)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: recipe-maintainers/lasuite-meet#10