chore: upgrade rustdesk-server to 1.1.16 #1

2026-10-30T07:54:33Z

autonomic-bot commented

2026-10-30 07:54:33 +00:00

One-off upgrade: rustdesk-server 1.1.12 → 1.1.16 (latest; GitHub "Latest" release + docker latest both point here — the stray 1.4.5-* Docker tags are an aborted push with no GitHub release, ignored).

service	image	current → new
app (hbbs)	rustdesk/rustdesk-server	1.1.12 → 1.1.16
signal (hbbr)	rustdesk/rustdesk-server	1.1.12 → 1.1.16

Upstream release notes: app+signal 1.1.12→1.1.16: https://github.com/rustdesk/rustdesk-server/releases (1.1.13: version-check + hbb_common refactor; 1.1.14: windows crash fix; 1.1.15: loopback fix, higher default bandwidth, rootless HOME env, auth-failure logging for fail2ban/crowdsec, connection log query; 1.1.16: unauthenticated UDP punch-hole reflection/amplification fix, critical mio 0.8.5→0.8.11 fix, i32 overflow peer-status fix)

Security

CVEs fixed by this upgrade: 0 with CVE ids (deterministic advisory scan + manual GHSA/OSV/NVD cross-check — rustdesk-server has no published advisories in any of them).

But 1.1.16 fixes two real security issues that carry no valid CVE id (CVE-2026-30784 was reserved for the punch-hole issue and then withdrawn by its CNA):

Unauthenticated UDP punch-hole reflection/amplification (GH issue #670): any spoofed-source UDP request to :21116 made hbbs reply to the victim — actively exploited as a DDoS amplification vector even with -k _ enforced (which this recipe uses). This is the main reason to upgrade.
Critical issue in mio fixed by bumping 0.8.5 → 0.8.11.

Testing (one-off direct verification on the cc-ci test swarm — recipe not yet enrolled in !testme CI)

Fresh dev-rustdesk-server.ci.commoninternet.net deploy of this branch head (--chaos), full live inspection:

Both services converge 1/1 and stay stable (no restart loops; one rolling-update task replacement, graceful).
hbbs 1.1.16 version banner in-container; clean startup logs: key generated, relay-servers=[<domain>:21117] correct, all listeners up.
Key material + db_v2.sqlite3 (WAL) persisted in the shared rustdesk_data volume; pub key matches the log line.
All TCP ports 21115/21116/21117/21118/21119 reachable from the public internet; UDP :21116 listener bound.
WebSocket endpoints :21118 (hbbs) and :21119 (hbbr) complete real 101 Switching Protocols handshakes.

No config/env/volume changes needed — compose diff is exactly the two image tags. Existing deployments keep their keys and DB across the upgrade.

Release

Version label left untouched (per convention). Recommended publish after merge:

abra recipe release rustdesk-server -y

(minor bump → 1.0.5+1.1.16: new logging/bandwidth features in 1.1.15.)

Verified by one-off direct deploy + live inspection on the cc-ci test server (see Testing above) — this recipe is NOT yet enrolled in the !testme CI bridge. NOT merged — for operator review.

cc @trav @notplants

One-off upgrade: rustdesk-server 1.1.12 → **1.1.16** (latest; GitHub "Latest" release + docker `latest` both point here — the stray `1.4.5-*` Docker tags are an aborted push with no GitHub release, ignored). | service | image | current → new | |---------|-------|---------------| | app (hbbs) | rustdesk/rustdesk-server | 1.1.12 → 1.1.16 | | signal (hbbr) | rustdesk/rustdesk-server | 1.1.12 → 1.1.16 | **Upstream release notes:** app+signal 1.1.12→1.1.16: https://github.com/rustdesk/rustdesk-server/releases (1.1.13: version-check + hbb_common refactor; 1.1.14: windows crash fix; 1.1.15: loopback fix, higher default bandwidth, rootless HOME env, auth-failure logging for fail2ban/crowdsec, connection log query; 1.1.16: **unauthenticated UDP punch-hole reflection/amplification fix**, critical `mio` 0.8.5→0.8.11 fix, i32 overflow peer-status fix) ## Security **CVEs fixed by this upgrade: 0 with CVE ids** (deterministic advisory scan + manual GHSA/OSV/NVD cross-check — rustdesk-server has no published advisories in any of them). But 1.1.16 fixes two real security issues that carry **no valid CVE id** (CVE-2026-30784 was reserved for the punch-hole issue and then withdrawn by its CNA): - **Unauthenticated UDP punch-hole reflection/amplification** ([GH issue #670](https://github.com/rustdesk/rustdesk-server/issues/670)): any spoofed-source UDP request to :21116 made hbbs reply to the victim — actively exploited as a DDoS amplification vector **even with `-k _` enforced** (which this recipe uses). This is the main reason to upgrade. - **Critical issue in `mio`** fixed by bumping 0.8.5 → 0.8.11. ## Testing (one-off direct verification on the cc-ci test swarm — recipe not yet enrolled in !testme CI) Fresh `dev-rustdesk-server.ci.commoninternet.net` deploy of this branch head (`--chaos`), full live inspection: - Both services converge 1/1 and stay stable (no restart loops; one rolling-update task replacement, graceful). - `hbbs 1.1.16` version banner in-container; clean startup logs: key generated, `relay-servers=[<domain>:21117]` correct, all listeners up. - Key material + `db_v2.sqlite3` (WAL) persisted in the shared `rustdesk_data` volume; pub key matches the log line. - All TCP ports 21115/21116/21117/21118/21119 reachable from the **public internet**; UDP :21116 listener bound. - WebSocket endpoints :21118 (hbbs) and :21119 (hbbr) complete real `101 Switching Protocols` handshakes. No config/env/volume changes needed — compose diff is exactly the two image tags. Existing deployments keep their keys and DB across the upgrade. ## Release Version label left untouched (per convention). Recommended publish after merge: ``` abra recipe release rustdesk-server -y ``` (minor bump → `1.0.5+1.1.16`: new logging/bandwidth features in 1.1.15.) Verified by one-off direct deploy + live inspection on the cc-ci test server (see Testing above) — this recipe is NOT yet enrolled in the !testme CI bridge. NOT merged — for operator review. cc @trav @notplants

autonomic-bot added 1 commit 2026-10-30 07:54:33 +00:00

chore: upgrade rustdesk-server to 1.1.16 2e651358d5

autonomic-bot requested review from trav 2026-10-30 07:54:33 +00:00

autonomic-bot requested review from notplants 2026-10-30 07:54:33 +00:00

autonomic-bot referenced this pull request from recipe-maintainers/cc-ci

2026-10-30 18:58:58 +00:00

enroll(rustdesk-server): test suite + bridge poll #48

You are not authorized to merge this pull request.

This pull request can be merged automatically.

View command line instructions