/mnt/5_hdd/felhom.eu/git/felhom.eu/scripts/security_watch.py:829: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datesecurity watch 2026-10-27: 197 pins (11 box/build, 97 app, 89 DooPlex); GitHub key ABSENT — apps' advisories in a 2-night rotation
ADVISORY    doop actualbudget/actual-server                     26.10.0                CVE-2026-111497 (fixed 24.22.1)
ADVISORY    doop advplyr/audiobookshelf                         2.37.1                 CVE-2026-111497 (fixed 24.22.1)
ADVISORY    box  cloudflare/cloudflared                         2026.10.4              feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3 (fixed read the notice); vulnnotes:cloudflared@2026.10.5:VULN-183456 (fixed 2026.10.5)
ADVISORY    doop codewithcj/sparkyfitness_server                v1.9.0                 CVE-2026-111497 (fixed 24.22.1)
ADVISORY    doop crocodilestick/calibre-web-automated           dev                    CVE-2026-111497 (fixed 1.2.1)
ADVISORY    doop docker.io/calcom/cal.com                       v6.2.0                 CVE-2026-111497 (fixed 22.23.4, 24.22.1, 26.12.1)
ADVISORY    doop flomp/wanderer-db                              v0.21.0                GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2); … 1 more
ADVISORY    doop flomp/wanderer-web                             v0.21.0                GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2); … 2 more
ADVISORY    doop ghcr.io/gethomepage/homepage                   v1.13.2                GHSA-669x-4pg4-w24r (fixed 2.2.0); CVE-2026-111497 (fixed 22.23.4)
ADVISORY    doop ghcr.io/immich-app/immich-machine-learning     v2.7.5                 GHSA-q89f-h332-8q2h (fixed v3.2.4); GHSA-h5w4-vjv4-9r5q (fixed a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 (fixed v3.2.0); GHSA-72rm-x7xr-v679 (fixed v3.3.0); … 7 more
ADVISORY    doop ghcr.io/immich-app/immich-server               v2.7.5                 GHSA-q89f-h332-8q2h (fixed v3.2.4); GHSA-h5w4-vjv4-9r5q (fixed a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 (fixed v3.2.0); GHSA-72rm-x7xr-v679 (fixed v3.3.0); … 8 more
ADVISORY    doop ghcr.io/lukegus/termix                         release-2.9.2          CVE-2026-111497 (fixed 26.12.1)
ADVISORY    doop ghcr.io/paperless-ngx/paperless-ngx            3.3.4                  CVE-2026-111497 (fixed 1.2.1)
ADVISORY    doop gitea/gitea                                    1.26.2                 GHSA-wx44-9m3m-rjqx (fixed 28.2.0); GHSA-4jmf-h2cm-hg7w (fixed 28.2.0); GHSA-8j56-f865-gqq2 (fixed 28.2.0); GHSA-fxq4-gr55-7x5g (fixed 28.2.0); … 127 more
ADVISORY    doop grafana/grafana                                13.2.4                 GHSA-8xmm-x63g-f6xv (fixed no fixed version named yet); GHSA-4724-7jwc-3fpw (fixed the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 (fixed the range is unreadable — check by hand); GHSA-8wjh-59cw-9xh4 (fixed no fixed version named yet); … 2 more
ADVISORY    box  gtstef/filebrowser                             1.5.8-stable           GHSA-gfgm-886h-6r47 (fixed 2.0.2-stable, 2.1.4-beta); GHSA-wxj5-g3qp-g732 (fixed 2.0.2-stable, 2.1.3-beta); GHSA-3j46-5w28-f8p2 (fixed 2.1.0-stable, 2.1.3-beta); GHSA-4vrc-935w-xxq2 (fixed 2.1.0-stable, 2.1.3-beta); … 31 more
ADVISORY    doop louislam/uptime-kuma                           2.5.6                  GHSA-qjxc-h5jf-c7rj (fixed the range is unreadable — check by hand); release:louislam/uptime-kuma@2.5.8 (fixed 2.5.8); release:louislam/uptime-kuma@2.5.7 (fixed 2.5.7); CVE-2026-111497 (fixed 22.23.4)
ADVISORY    doop outlinewiki/outline                            1.11.0                 GHSA-x4w3-9p9j-cprh (fixed 1.12.0); GHSA-rq53-m97j-f2pg (fixed 1.12.0); GHSA-h6ff-rw9x-5mq2 (fixed 1.12.0); GHSA-rvj7-2gww-6xfq (fixed 1.12.0); … 3 more
ADVISORY    doop redis                                          8.10.2                 GHSA-c8h9-259x-jff4 (fixed the range is unreadable — check by hand); GHSA-8ghh-qpmp-7826 (fixed no fixed version named yet); GHSA-93m2-935m-8rj3 (fixed no fixed version named yet); GHSA-m8fj-85cg-7vhp (fixed the range is unreadable — check by hand); … 8 more
ADVISORY    doop rommapp/romm                                   5.4.0                  release:rommapp/romm@5.4.1 (fixed 5.4.1); CVE-2026-111497 (fixed 24.22.1)
ADVISORY    doop vabene1111/recipes                             2.6.15                 CVE-2026-111497 (fixed 24.22.1)
ADVISORY    app  actualbudget/actual-server                     26.9.0                 CVE-2026-111497 (fixed 24.22.1)
ADVISORY    app  calcom/cal.com                                 v6.2.0                 GHSA-p3f6-52gv-cj7m (fixed the range is unreadable — check by hand); GHSA-cpf2-q635-xrwx (fixed the range is unreadable — check by hand); CVE-2026-111497 (fixed 22.23.4, 24.22.1, 26.12.1)
ADVISORY    app  codewithcj/sparkyfitness_server                v0.17.3                CVE-2026-111497 (fixed 24.22.1)
ADVISORY    app  crocodilestick/calibre-web-automated           v4.0.8                 CVE-2026-111497 (fixed 1.2.1)
ADVISORY    app  fallenbagel/jellyseerr                         2.7.3                  CVE-2026-111497 (fixed 22.23.4)
ADVISORY    app  flomp/wanderer-db                              v0.20.0                release:open-wanderer/wanderer@v0.21.2 (fixed v0.21.2); release:open-wanderer/wanderer@v0.21.0 (fixed v0.21.0)
ADVISORY    app  flomp/wanderer-web                             v0.20.0                release:open-wanderer/wanderer@v0.21.2 (fixed v0.21.2); release:open-wanderer/wanderer@v0.21.0 (fixed v0.21.0); CVE-2026-111497 (fixed 22.23.4)
ADVISORY    app  freikin/dawarich                               1.15.3                 release:Freika/dawarich@1.17.0 (fixed 1.17.0); CVE-2026-111497 (fixed 22.23.4, 24.22.1, 26.12.1)
ADVISORY    app  ghcr.io/alexta69/metube                        2026.09.29             CVE-2026-111497 (fixed 1.2.1)
ADVISORY    app  ghcr.io/diced/zipline                          4.8.0                  CVE-2026-111497 (fixed 24.22.1)
ADVISORY    app  ghcr.io/gethomepage/homepage                   v1.13.2                GHSA-669x-4pg4-w24r (fixed 2.2.0); CVE-2026-111497 (fixed 22.23.4)
ADVISORY    app  ghcr.io/home-assistant/home-assistant          2026.9.4               CVE-2026-111497 (fixed 1.2.1)
ADVISORY    app  ghcr.io/immich-app/immich-machine-learning     v3.2.4                 release:immich-app/immich@v3.3.5 (fixed v3.3.5)
ADVISORY    app  ghcr.io/immich-app/immich-server               v3.2.4                 release:immich-app/immich@v3.3.5 (fixed v3.3.5); CVE-2026-111497 (fixed 24.22.1)
ADVISORY    app  ghcr.io/karakeep-app/karakeep                  0.33.2                 release:karakeep-app/karakeep@v0.34.1 (fixed v0.34.1); release:karakeep-app/karakeep@v0.34.0 (fixed v0.34.0); CVE-2026-111497 (fixed 24.22.1)
ADVISORY    app  ghcr.io/lukegus/termix                         2.8.0                  GHSA-6gr3-r7jx-wfmh (fixed >= 26.10.0); GHSA-frx8-qqgg-7j7g (fixed >= 26.10.0); GHSA-3q2m-5r5p-w45r (fixed >= 26.10.0); GHSA-rgf3-2q88-q4wp (fixed >= 26.10.0); … 9 more
ADVISORY    app  ghcr.io/paperless-ngx/paperless-ngx            2.20.15                GHSA-c8f3-pqr2-rr24 (fixed 3.3.2); GHSA-2jhj-xqrq-rmrq (fixed 3.1.2); CVE-2026-111497 (fixed 1.1.1)
ADVISORY    app  ghcr.io/papra-hq/papra                         26.6.2-rootless        CVE-2026-111497 (fixed 26.12.1)
ADVISORY    app  ghcr.io/seanmorley15/adventurelog-backend      v0.13.0                release:seanmorley15/AdventureLog@v0.13.1 (fixed v0.13.1)
ADVISORY    app  ghcr.io/seanmorley15/adventurelog-frontend     v0.13.0                release:seanmorley15/AdventureLog@v0.13.1 (fixed v0.13.1); CVE-2026-111497 (fixed 26.12.1)
ADVISORY    app  ghcr.io/tandoorrecipes/recipes                 2.6.15                 GHSA-5f74-7rgh-pc97 (fixed a version after 2.6.15 (the notice names none)); GHSA-pcq2-64qw-jm4x (fixed no fixed version named yet); GHSA-69q3-5q6x-7hmx (fixed no fixed version named yet); GHSA-xq7g-9q95-vjc6 (fixed a version after 2.6.15 (the notice names none)); … 7 more
ADVISORY    app  ghost                                          6.67.0-alpine          CVE-2026-111497 (fixed 22.23.4)
ADVISORY    app  gitea/gitea                                    1.27.3                 GHSA-wx44-9m3m-rjqx (fixed 28.2.0); GHSA-4jmf-h2cm-hg7w (fixed 28.2.0); GHSA-8j56-f865-gqq2 (fixed 28.2.0); GHSA-fxq4-gr55-7x5g (fixed 28.2.0); … 37 more
ADVISORY    app  glanceapp/glance                               v0.8.5                 GHSA-r225-jhr6-68cc (fixed >= 0.8.7)
ADVISORY    app  grafana/grafana                                13.2.4                 GHSA-8xmm-x63g-f6xv (fixed no fixed version named yet); GHSA-4724-7jwc-3fpw (fixed the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 (fixed the range is unreadable — check by hand); GHSA-8wjh-59cw-9xh4 (fixed no fixed version named yet); … 2 more
ADVISORY    app  louislam/uptime-kuma                           2.5.7                  release:louislam/uptime-kuma@2.5.8 (fixed 2.5.8)
ADVISORY    app  n8nio/n8n                                      2.44.7                 GHSA-365g-vjw2-grx8 (fixed no fixed version named yet)
ADVISORY    app  rommapp/romm                                   5.4.1                  CVE-2026-111497 (fixed 24.22.1)
NOT CHECKED doop gitea.dooplex.hu/admin/felhom-act-runner       0.1.0                  registry gitea.dooplex.hu: no anonymous token route
NOT CHECKED doop gitea.dooplex.hu/admin/jarr                    latest                 registry gitea.dooplex.hu: no anonymous token route
NOT CHECKED doop gitea.dooplex.hu/admin/recipe-importer         latest                 registry gitea.dooplex.hu: no anonymous token route
NOT CHECKED doop gitea.dooplex.hu/admin/revfulop-calendar       1.6.2                  registry gitea.dooplex.hu: no anonymous token route
NOT CHECKED doop gitea.dooplex.hu/admin/sparkyfitness-export    0.3.0                  registry gitea.dooplex.hu: no anonymous token route
NOT CHECKED doop gitea.dooplex.hu/admin/wan-probe               0.1.0                  registry gitea.dooplex.hu: no anonymous token route
NOT CHECKED doop minio/minio                                    latest                 Docker registry tags of minio/minio: HTTP 401; manifest minio/minio:latest: HTTP 401
BEHIND      doop getmeili/meilisearch                           v1.11.3                newest v1.56.0
BEHIND      doop ghcr.io/diced/zipline                          4.8.1                  newest 4.8.2
BEHIND      app  getmeili/meilisearch                           v1.41.0                newest v1.56.0
BEHIND      app  getmeili/meilisearch                           v1.36.0                newest v1.56.0
BEHIND      app  ghcr.io/hargata/lubelogger                     v1.7.3                 newest v1.7.4
BEHIND      app  ghcr.io/kozea/radicale                         3.8.1                  newest 3.9.0
BEHIND      app  gotson/komga                                   1.28.0                 newest 1.29.1
BEHIND      app  kimai/kimai2                                   2.67.0                 newest 2.71.0
BEHIND      app  lscr.io/linuxserver/bookstack                  26.09.2                newest 26.09.20260929
BEHIND      app  nextcloud                                      34.0.4-apache          newest 34.0.5-apache
BEHIND      app  nginx                                          1.30.5-alpine          newest 1.31.8-alpine
BEHIND      app  qbittorrentofficial/qbittorrent-nox            5.2.4-1                newest 5.3.0-2
GAP         buil alpine                                         3.24.2                 newest 3.24.3
GAP         buil alpine                                         3.24.2                 newest 3.24.3
GAP         doop alpine/k8s                                     1.37.1                 
GAP         doop arcadiatechnology/crafty-4                     4.11.0                 
GAP         doop bhgedigital/envsubst                           latest                 
GAP         doop busybox                                        1.38                   
GAP         doop codercom/code-server                           4.143.1                
GAP         buil debian                                         13.7-slim              
GAP         buil debian                                         13.7-slim              
GAP         doop docker.io/bitnamilegacy/postgresql             17.6.0-debian-12-r3    
GAP         doop docker.io/library/nextcloud                    34.0.5-apache          
GAP         doop docker.io/valkey/valkey                        9.2-alpine             
GAP         doop filebrowser/filebrowser                        v2.63.23               
GAP         doop ghcr.io/cloudnative-pg/postgresql              17.2                   newest 17.11
GAP         doop ghcr.io/headlamp-k8s/headlamp                  v0.46.0                
GAP         doop ghcr.io/immich-app/postgres                    16-vectorchord0.3.0    
GAP         doop ghcr.io/jimmidyson/configmap-reload            v0.15.0                
GAP         doop ghcr.io/onedr0p/exportarr                      v2.3.0                 
GAP         doop ghcr.io/seerr-team/seerr                       v3.5.1                 
GAP         doop ghcr.io/seriousm4x/upsnap                      5                      
GAP         doop ghcr.io/stakater/reloader                      v1.4.22                newest v1.4.23
GAP         doop ghcr.io/tautulli/tautulli                      v2.18.2                
GAP         doop griefed/serverpackcreator                      8.1.2                  
GAP         doop gtstef/filebrowser                             1.5.8-stable           
GAP         doop guacamole/guacamole                            1.6.0                  
GAP         doop guacamole/guacd                                1.6.0                  
GAP         doop index.docker.io/plexinc/pms-docker             1.43.5.11029-6bf8af3f0 
GAP         doop itzg/mc-backup                                 2026.10.1              newest 2026.10.2
GAP         doop itzg/minecraft-server                          2026.10.0-java21       newest 2026.10.1-java17
GAP         doop linuxserver/bookstack                          26.09.20260929         
GAP         doop linuxserver/prowlarr                           version-2.6.5.5623     
GAP         doop linuxserver/qbittorrent                        5.3.0                  
GAP         doop linuxserver/radarr                             version-6.4.4.10685    
GAP         doop linuxserver/sonarr                             version-4.0.20.3014    
GAP         doop mariadb                                        11                     
GAP         doop mikefarah/yq                                   4.54.1                 
GAP         doop mongodb/mongodb-community-server               8.0.5-ubuntu2204       newest 8.3.13-ubuntu2204
GAP         doop msdeluise/plant-it-server                      0.10.0                 
GAP         doop mysql                                          8.4                    
GAP         doop nicolaka/netshoot                              latest                 
GAP         doop postgis/postgis                                16-3.5                 
GAP         doop postgres                                       15-alpine              
GAP         doop postgres                                       16-alpine              
GAP         doop privatebin/nginx-fpm-alpine                    2.0.6                  newest 2.1.0
GAP         doop prom/alertmanager                              v0.34.1                
GAP         doop prom/node-exporter                             v1.12.1                
GAP         doop prom/prometheus                                v3.15.0                newest v3.15.1
GAP         doop prometheuscommunity/smartctl-exporter          v0.15.0                
GAP         doop python                                         3.15-bookworm          
GAP         doop quay.io/jetstack/version-checker               v0.11.0                
GAP         doop quay.io/prometheus/blackbox-exporter           v0.29.1                
GAP         doop renovate/renovate                              44.181.1               newest 44.190.0
GAP         doop tailscale/tailscale                            v1.104.2               
GAP         app  emby/embyserver                                4.11.0.4               newest 4.11.0.11
GAP         app  ghcr.io/immich-app/postgres                    16-vectorchord0.4.3-pg 
GAP         app  ghcr.io/karakeep-app/karakeep-chrome           151.0.7922.47-r1       
GAP         app  mariadb                                        12.3                   
GAP         app  mariadb                                        11.4                   newest 11.8
GAP         app  mariadb                                        11.8                   
GAP         app  mariadb                                        12.3                   
GAP         app  mariadb                                        11.8                   
GAP         app  msdeluise/plant-it                             0.10.0                 
GAP         app  plexinc/pms-docker                             1.43.5.11029-6bf8af3f0 
GAP         app  postgis/postgis                                16-3.5-alpine          
GAP         app  postgis/postgis                                17-3.5-alpine          
GAP         app  postgres                                       18-alpine              
GAP         app  postgres                                       17-alpine              
GAP         app  postgres                                       18-alpine              
GAP         app  postgres                                       18-alpine              
GAP         app  postgres                                       18-alpine              
GAP         app  postgres                                       18-alpine              
GAP         app  postgres                                       18-alpine              
GAP         app  postgres                                       17-alpine              
GAP         app  postgres                                       16-alpine              
GAP         app  registry.gitlab.com/crafty-controller/crafty-4 4.11.0                 
FLOATING    doop ghcr.io/seanmorley15/adventurelog-backend      latest                 
FLOATING    doop ghcr.io/seanmorley15/adventurelog-frontend     latest                 
FLOATING    doop nginx                                          1.31-alpine            
FLOATING    doop redis                                          8-alpine               
FLOATING    doop redis                                          8.10-alpine            
FLOATING    app  ghcr.io/claperco/claper                        2.5                    
FLOATING    app  ghcr.io/thomiceli/opengist                     1.15                   
FLOATING    app  jellyfin/jellyfin                              12.4                   
FLOATING    app  lscr.io/linuxserver/prowlarr                   version-2.6.5.5623     
FLOATING    app  lscr.io/linuxserver/sabnzbd                    version-5.1.3          
FLOATING    app  lscr.io/linuxserver/transmission               version-4.1.3-r0       
FLOATING    app  nzbgetcom/nzbget                               v26.3                  
FLOATING    app  redis                                          7.4-alpine             
FLOATING    app  redis                                          7-alpine               
FLOATING    app  redis                                          7-alpine               
FLOATING    app  redis                                          7-alpine               
FLOATING    app  redis                                          7-alpine               
FLOATING    app  redis                                          7-alpine               
FLOATING    app  redis                                          7-alpine               
FLOATING    app  wger/server                                    2.7                    
SELF        box  gitea.dooplex.hu/admin/felhom-samba            1.2.0                  
SELF        app  gitea.dooplex.hu/admin/recipe-importer         v0.9.11                
CURRENT     doop codewithcj/sparkyfitness                       v1.9.0                 
CURRENT     doop f0rc3/gokapi                                   v2.2.4                 
CURRENT     doop ghcr.io/alam00000/bentopdf                     2.8.10                 
CURRENT     doop ghcr.io/thomiceli/opengist                     1.15.3                 
CURRENT     doop glanceapp/glance                               v0.8.7                 
CURRENT     buil golang                                         1.27.3-trixie          
CURRENT     buil golang                                         1.27.3-alpine3.24      
CURRENT     doop onlyoffice/documentserver                      9.4.0                  
CURRENT     buil restic                                         0.19.1                 
CURRENT     box  traefik                                        v3.7.16                
CURRENT     doop vaultwarden/server                             1.37.4                 
CURRENT     app  codewithcj/sparkyfitness                       v0.17.3                
CURRENT     app  deluan/navidrome                               0.64.2                 
CURRENT     app  docmost/docmost                                0.97.0                 
CURRENT     app  f0rc3/gokapi                                   v1.9.6                 
CURRENT     app  ghcr.io/advplyr/audiobookshelf                 2.37.2                 
CURRENT     app  ghcr.io/alam00000/bentopdf                     v2.8.10                
CURRENT     app  ghcr.io/cmintey/wishlist                       v0.69.0                
CURRENT     app  ghcr.io/gramps-project/grampsweb               v25.6.0                
CURRENT     app  ghcr.io/grimmory-tools/grimmory                v3.5.0                 
CURRENT     app  ghcr.io/mealie-recipes/mealie                  v3.29.0                
CURRENT     app  ghcr.io/sysadminsmedia/homebox                 0.27.1                 
CURRENT     app  lscr.io/linuxserver/code-server                4.143.1                
CURRENT     app  lscr.io/linuxserver/grocy                      4.7.1                  
CURRENT     app  lscr.io/linuxserver/radarr                     6.4.4                  
CURRENT     app  lscr.io/linuxserver/sonarr                     4.0.20                 
CURRENT     app  lukevella/rallly                               4.16.3                 
CURRENT     app  onlyoffice/documentserver                      9.4.0                  
CURRENT     app  outlinewiki/outline                            1.12.0                 
CURRENT     app  privatebin/pdo                                 2.1.0                  
CURRENT     app  vaultwarden/server                             1.37.4-alpine          
CURRENT     app  vikunja/vikunja                                2.7.1                  
COUNTS ADVISORY=49 BEHIND=12 CURRENT=32 FLOATING=20 GAP=75 NOT_CHECKED=7 SELF=2
REQUESTS api.github.com=49 api.osv.dev=1 auth.docker.io=1 blog.cloudflare.com=1 ghcr.io=174 github.com=64 hub.docker.com=225 raw.githubusercontent.com=1 registry-1.docker.io=1
MAIL (not sent, --no-mail): [Felhom security] termix, wanderer-db, wanderer-web, immich-machine-learning … — 58 new advisories
MAIL (not sent, --no-mail): [Felhom security] the watch could not check runtime
STATE wtime.datetime.now(datetime.UTC).
  today = datetime.date.fromisoformat(opts["today"]) if "today" in opts else datetime.datetime.utcnow().date()
ritten: /tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/0b76c4d7-9b39-4e4e-869d-d0d2c6006331/scratchpad/watch-state-fill2.json (292 known advisories)
