recipe-maintainers/plausible
0
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

upgrade: plausible v2.0.0 → v3.2.1, clickhouse 23.4 → 24.12 #5

Open
autonomic-bot wants to merge 2 commits from upgrade-4.0.0+v3.2.1 into main
pull from: upgrade-4.0.0+v3.2.1
merge into: recipe-maintainers:main
Conversation 2 Commits 2 Files Changed 3 +39 -8
autonomic-bot commented 2026-06-29 18:59:42 +00:00
Owner
Copy Link

Upgrades Plausible CE from v2.0.0 to v3.2.1 (major release) and ClickHouse from 23.4.2.11-alpine to 24.12-alpine.

Changes

  • Switch app image: plausible/analytics:v2.0.0 → ghcr.io/plausible/community-edition:v3.2.1 (registry changed to GHCR)
  • Bump ClickHouse: 23.4.2.11-alpine → 24.12-alpine
  • Add CLICKHOUSE_SKIP_USER_SETUP=1 to plausible_events_db (required by CE v3.0.0+)
  • Update clickhouse-user-config.xml: <yandex> root → <clickhouse> root (CH 24.x requirement); adopt CE low-resource profile settings
  • Fix depends_on to list form (Swarm v3.8 does not support map-form condition)
  • Fix .env.sample: set SMTP_HOST_PORT=25 default (CE v3.x requires integer, crashes on empty string)

⚠️ Operator Actions Required

  1. Backup ClickHouse (abra app backup) before deploying — the 23.4 → 24.12 data migration is irreversible without a backup
  2. CLICKHOUSE_CONF_VERSION=v1 must be set in .env (new var — update if you have an existing deploy with the old config)
  3. CLICKHOUSE_USER_CONF_VERSION=v1 — same as above
  4. Stats API filter format changed in v3.0.0: ?filters=((is,page,...)) → ?f=is,page,... — update any external integrations

Security

CVE-2026-8467 / GHSA-55hg-8qxv-qj4p — RCE via /storybook endpoint in all Plausible v3.x < v3.2.1. Fixed in v3.2.1.

Upstream Release Notes

Upstream release notes: app v2.0.0→v3.2.1: https://github.com/plausible/analytics/releases/tag/v3.2.1
Upstream release notes: app v3.0.0: https://github.com/plausible/analytics/releases/tag/v3.0.0
Upstream release notes: app v3.1.0: https://github.com/plausible/analytics/releases/tag/v3.1.0
Upstream release notes: app v3.2.0: https://github.com/plausible/analytics/releases/tag/v3.2.0
Upstream release notes: clickhouse 23.4→24.12: https://clickhouse.com/docs/en/whats-new/changelog

cc @trav @notplants

Upgrades Plausible CE from `v2.0.0` to `v3.2.1` (major release) and ClickHouse from `23.4.2.11-alpine` to `24.12-alpine`. ## Changes - Switch app image: `plausible/analytics:v2.0.0` → `ghcr.io/plausible/community-edition:v3.2.1` (registry changed to GHCR) - Bump ClickHouse: `23.4.2.11-alpine` → `24.12-alpine` - Add `CLICKHOUSE_SKIP_USER_SETUP=1` to `plausible_events_db` (required by CE v3.0.0+) - Update `clickhouse-user-config.xml`: `<yandex>` root → `<clickhouse>` root (CH 24.x requirement); adopt CE low-resource profile settings - Fix `depends_on` to list form (Swarm v3.8 does not support map-form condition) - Fix `.env.sample`: set `SMTP_HOST_PORT=25` default (CE v3.x requires integer, crashes on empty string) ## ⚠️ Operator Actions Required 1. **Backup ClickHouse** (`abra app backup`) before deploying — the 23.4 → 24.12 data migration is irreversible without a backup 2. **`CLICKHOUSE_CONF_VERSION=v1`** must be set in `.env` (new var — update if you have an existing deploy with the old config) 3. **`CLICKHOUSE_USER_CONF_VERSION=v1`** — same as above 4. **Stats API filter format changed** in v3.0.0: `?filters=((is,page,...))` → `?f=is,page,...` — update any external integrations ## Security **CVE-2026-8467 / GHSA-55hg-8qxv-qj4p** — RCE via `/storybook` endpoint in all Plausible v3.x < v3.2.1. Fixed in v3.2.1. ## Upstream Release Notes **Upstream release notes:** app `v2.0.0`→`v3.2.1`: https://github.com/plausible/analytics/releases/tag/v3.2.1 **Upstream release notes:** app `v3.0.0`: https://github.com/plausible/analytics/releases/tag/v3.0.0 **Upstream release notes:** app `v3.1.0`: https://github.com/plausible/analytics/releases/tag/v3.1.0 **Upstream release notes:** app `v3.2.0`: https://github.com/plausible/analytics/releases/tag/v3.2.0 **Upstream release notes:** clickhouse `23.4`→`24.12`: https://clickhouse.com/docs/en/whats-new/changelog cc @trav @notplants
autonomic-bot added 2 commits 2026-06-29 18:59:43 +00:00
chore: upgrade to ghcr.io/plausible/community-edition:v3.2.1 78124a5076 
- Switch app image from plausible/analytics:v2.0.0 to
  ghcr.io/plausible/community-edition:v3.2.1 (image registry changed at v3.x)
- Bump ClickHouse from 23.4.2.11-alpine to 24.12-alpine (required for CE v3.x)
- Add CLICKHOUSE_SKIP_USER_SETUP=1 env var to ClickHouse service (required for v3.0.0+)
- Add ClickHouse healthcheck
- Update clickhouse-user-config.xml: replace deprecated <yandex> root with
  <clickhouse> root; adopt CE low-resource profile settings for < 16 GB RAM hosts
fix: update .env.sample for CE v3.x SMTP requirements and add config versions
Some checks failed
cc-ci/testme cc-ci: failure
Details
ad6b93a1f4
autonomic-bot requested review from trav 2026-06-29 18:59:43 +00:00
autonomic-bot requested review from notplants 2026-06-29 18:59:43 +00:00
autonomic-bot commented 2026-06-29 18:59:52 +00:00
Author
Owner
Copy Link

!testme

!testme
autonomic-bot commented 2026-06-29 19:00:17 +00:00
Author
Owner
Copy Link

🌻 cc-ci — plausible @ ad6b93a1 ❌ failure

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `plausible` @ `ad6b93a1` ❌ **failure** [![cc-ci result card](https://ci.commoninternet.net/runs/968/summary.png)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/968) [![level](https://ci.commoninternet.net/runs/968/badge.svg)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/968) [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/968) · [dashboard](https://ci.commoninternet.net/)
Some checks failed
cc-ci/testme cc-ci: failure
Details
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin upgrade-4.0.0+v3.2.1:upgrade-4.0.0+v3.2.1
git checkout upgrade-4.0.0+v3.2.1
Sign in to join this conversation.
Reviewers
No Reviewers
trav
notplants
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
autonomic autonomic-bot notplants trav
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: recipe-maintainers/plausible#5
No description provided.
Delete Branch "upgrade-4.0.0+v3.2.1"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?