admin/felhom.eu
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security app updates 2026-10-27, close-out: Jellyfin 12.4 live (catalog 540f185; bench + box + the undo proven, R-1314 filed and closed); per-box floors cleared after a clean 30-min watch; TRIAGE states; STATUS (four picks D56-D59); teardown; REPORT-security-app-updates-2026-10-27.md
gates / gates (push) Successful in 2m4s
Details

Browse Source
This commit is contained in:
admin committed 2026-10-27 19:26:39 +01:00
1 parent 33f3cd7af0
commit 1796112508
11 files changed
+474 -41
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

documentation/backlog/CLOSED-ITEMS.md
+3 -2
View File
@@ -26,12 +26,13 @@
---
## 2026-10-27 (day, attended) — security app updates: two rows closed (full text of the rows: `git show 708a3451:documentation/backlog/OPEN-ITEMS.md`)
## 2026-10-27 (day, attended) — security app updates: three rows closed; R-1314 was filed and closed the same day (full text of the rows: `git show 708a3451:documentation/backlog/OPEN-ITEMS.md`)
| Row | What | Closed | Evidence |
|---|---|---|---|
| **R-1314** | **Jellyfin 10.11.11: six notices, one a file read with NO login through the legacy HLS routes (GHSA-hw73); the fix is 12.x, a big step with a database conversion that has no way back.** (P2) | CLOSED 2026-10-27 — RELEASED as a NORMAL ladder step 10.11.11 → 12.4 in catalog `540f185` on the operator's yes at the Part 3 STOP: bench 9401 `proven` (its abort put 10.11 on the converted data: the data was gone — the reason the undo must restore the copy); box 9202 `proven` (done in 53 s, the user signs in after, soak clean); **the undo proven on 9202**: 12.4 ran its migrations, failed its check on purpose, the box undid it in 18 s and 10.11.11 signed the seeded user in again. Two stale fixture steps fixed on the way (10.11's wizard needs a GET first; `/Users/Public` lists nobody — the read-back is a sign-in). No box ran Jellyfin. | `audits/security-app-updates-2026-10-27/part3/`, `walks/jellyfin/`, `bench/jellyfin/` |
| **R-1304** | **traefik v3.7.13 (our pin) is inside 12 advisories of October 2026, fixed in v3.7.14–v3.7.16** (GHSA-fh26-gfpp-7xxx snicheck, GHSA-hrpp-p4fc-wwf8 ForwardAuth pool, GHSA-53qr-784g-cj35 FastProxy, and nine on the Kubernetes ingress-nginx provider or NTLM/Negotiate backends). Triage from our config: docker + file providers only, no FastProxy, no per-router TLS options, no NTLM backend; ForwardAuth goes to the controller — none seem to apply. Found by the security-watch spike (R-1303). `audits/security-watch-2026-10-26/raw/repoadv-traefik_traefik.txt` (P3) | CLOSED 2026-10-27 — RELEASED: controller v0.346.1 (= v0.346.0 `b1b9be3` + one commit `5ba1b86`, tag `v0.346.1`) pins `traefik:v3.7.16`; test `TestEnsureTraefik_ANewImageRecreatesTraefik` (red first); global floor 15:50:15Z (MinAgent 0.158.1) on the operator's yes; live on Tester 1, demo-hp, demo-felhom (per-box floors, 15:41Z) and 9202: all 29 public names redirect to https; the Traefik restart 7–20 s, the tunnel gap 4–5 s per box. | `audits/security-app-updates-2026-10-27/part5/` |
| **R-1306** | **The first security-watch run: 27 catalog pins carry published notices that affect the version we pin** (89 notices; the list with our version and the fixed versions: `audits/security-watch-2026-10-26/ADVISORIES-2026-10-26.md`). Several fix only in a NEW major (Jellyfin 10.11.11 → 12.0; Gokapi 1.9.6 → 2.x; Seerr 2.7.3 → 3.x); some name no fix yet (SparkyFitness); some are release notes naming a CVE (Grafana, BookStack, PrivateBin …). The seed mailed none of them (R-1303). (P2) | CLOSED 2026-10-27 — WORKED THROUGH: 14 security-fix steps (rallly, romm, code-server, outline, vikunja; n8n, privatebin, docmost, grafana; homebox, mealie, audiobookshelf, bentopdf, uptime-kuma) + two normal steps (wishlist, bookstack) LIVE in catalog `06e603e`, `7b0071e`, `65a6b11`, each on the operator's yes at a batch STOP; 5 NOT-A-FINDING; what is left has its own row: R-1313 wanderer, R-1314 jellyfin, R-1315 gitea, R-1316 gokapi, R-1317 seerr, R-1318 karakeep, R-1319 paperless-ngx, R-1320 homepage, R-1321 tandoor, R-1322 immich, R-1311 termix, R-785 sparkyfitness. | `audits/security-app-updates-2026-10-27/TRIAGE.md` |
| **R-1306** | **The first security-watch run: 27 catalog pins carry published notices that affect the version we pin** (89 notices; the list with our version and the fixed versions: `audits/security-watch-2026-10-26/ADVISORIES-2026-10-26.md`). Several fix only in a NEW major (Jellyfin 10.11.11 → 12.0; Gokapi 1.9.6 → 2.x; Seerr 2.7.3 → 3.x); some name no fix yet (SparkyFitness); some are release notes naming a CVE (Grafana, BookStack, PrivateBin …). The seed mailed none of them (R-1303). (P2) | CLOSED 2026-10-27 — WORKED THROUGH: 14 security-fix steps (rallly, romm, code-server, outline, vikunja; n8n, privatebin, docmost, grafana; homebox, mealie, audiobookshelf, bentopdf, uptime-kuma) + two normal steps (wishlist, bookstack) LIVE in catalog `06e603e`, `7b0071e`, `65a6b11`, each on the operator's yes at a batch STOP; 5 NOT-A-FINDING; Jellyfin's big step done the same day (R-1314, below); what is left has its own row: R-1313 wanderer, R-1315 gitea, R-1316 gokapi, R-1317 seerr, R-1318 karakeep, R-1319 paperless-ngx, R-1320 homepage, R-1321 tandoor, R-1322 immich, R-1311 termix, R-785 sparkyfitness. | `audits/security-app-updates-2026-10-27/TRIAGE.md` |
## 2026-10-27 (attended release block) — ten rows released and closed (full text of the rows: `git show 708a3451:documentation/backlog/OPEN-ITEMS.md`)
documentation/backlog/STATUS-HISTORY.md
+4
View File
@@ -5,6 +5,10 @@ Moved here byte for byte on 2026-10-14 (night session), newest first, so that `S
**Updated 2026-10-13 (night): demo-hp, demo-felhom and Tester 1 run agent 0.155.0; demo-felhom runs controller 0.310.0, the other two 0.309.0 until the floor is raised. The open-items list is at 127. Reports: `REPORT-poweroff.md`, `REPORT-plugmeter.md`, `REPORT-usenet-2026-10-12.md`, `REPORT-newapps-2026-10-12.md`, `REPORT-disk-evening-2026-10-12.md`, `REPORT-answers-2026-10-12.md`, `REPORT-m3-2026-10-11.md`, `REPORT-redesign-2026-10-10.md`, `REPORT-testers-2026-10-10.md`, `REPORT-register-shrink-2026-10-10.md`, `REPORT-new-apps-2026-10-10.md`, `REPORT-release-2026-10-10.md`, `REPORT-break-the-circle-2026-10-09.md`, `REPORT-dooplex-survival-2026-10-09.md`, `REPORT-day4-2026-10-09.md`.**
## Moved from STATUS on 2026-10-27 (evening)
**Updated 2026-10-27 (afternoon).** Released on your yes: hub 0.173.0, agent 0.167.0 (not vouched yet), controller 0.346.0 (floor 15:37 CET). The line test on a seeding box failed first (qBittorrent keeps sending 14 s after the hold) and works since the same-day fix: 94.5 Mbit/s, the limit put back exactly. demo-hp's clean-up window removed 223 old copies, no alarm.
## Moved from STATUS on 2026-10-27 (afternoon)
**Updated 2026-10-26 (night).** Saved and proven tonight, not released: kept data never offers a live app's folder; a reinstalled box backs up off-site at once; app-file import keeps links and owners and works again for MariaDB apps; Go 1.27.3. D55's window runs tonight.