admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

CAMPAIGN 7 doc: MAJOR breaking-note table (§6.3)

Browse Source 
Fills the gap flagged in §8.1. Upstream notes for bookstack, immich, nextcloud,
n8n, grafana, vikunja, privatebin, radarr, romm; plus the ones this sweep found
EMPIRICALLY on a real deploy (outline PGSSLMODE, tandoor port+ALLOWED_HOSTS,
zipline DATABASE_URL/healthcheck rename, homebox tag prefix + pepper, wger
DJANGO_DB_* + :8000) -- which are the more useful half, being what actually
happens rather than what a changelog remembered to mention.

Four majors (calcom, claper, gramps-web, onlyoffice) deployed clean but have no
retrieved upstream one-liner; recorded as not-retrieved, not fabricated.

Campaign 7 catalog sweep.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nn3VgQk9iwEGgyx6QJ2NvE
This commit is contained in:
authentik Default Admin
2026-07-19 03:30:50 +02:00
parent 13d8bffa96
commit 3e2078be8a
1 changed files with 30 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
documentation/audits/CAMPAIGN-7-catalog-sweep-2026-07-19.md
+30 -3
View File
@@ -296,6 +296,32 @@ calibre-web **ok**, immich page-only (deliberate, §3). For the other 40 apps lo
| **wanderer** | FAIL — image | `ghcr.io/flomp/wanderer` does not resolve — **neither 0.20.0 nor the shipped 0.16.0** | **pre-existing**; meilisearch sidecar bumped v1.12 → v1.49. Needs upstream research |
| **plex** | not attempted | `PLEX_CLAIM` is a required field with no default — a real claim token from plex.tv is needed | not automatable; genuinely owner-supplied. Not a defect |
### 6.3 MAJOR breaking notes (for the future update-path story — see R-40)
Fresh deploys do not migrate, so none of these bit during the sweep. They matter for the moment an
EXISTING customer presses update.
| app | major | one-line breaking note | source |
|---|---|---|---|
| bookstack | 25.02 → 26.05 | `storage/fonts` must be writable for PDF export; revision-viewing became a separate permission | upstream releases |
| immich | v2 → v3 | drops pgvecto.rs, requires VectorChord (our pin was already VectorChord); most other breaks are API-only | v3.0.0 notes |
| nextcloud | 31 → 34 | **"You cannot skip major releases"** — sequential upgrade required. The sharpest case for R-40 | admin manual |
| n8n | 1 → 2 | MySQL/MariaDB support removed; several nodes removed; `ExecuteCommand`/`LocalFileTrigger` disabled by default; env access blocked in code expressions | 2.0.0 notes |
| grafana | 11 → 13 | Angular plugin support **removed** in 12 (deprecated in 11); `editors_can_admin` gone; v2 dashboard schema is one-way | whatsnew v12 |
| vikunja | 0.24 → 2.3 | CORS on by default and `service.publicurl` becomes **required to start**; OpenID provider config array→map; SQLite paths now relative to `service.rootpath`; API `/tasks/all`→`/tasks` | 1.0.0 changelog |
| privatebin | 1 → 2 | min PHP 7.3→7.4; `page` template removed; legacy model class names must become `Filesystem`/`Database`; v1/ZeroBin paste format support dropped (DB column drops needed) | 2.0.0 notes |
| radarr | 5 → 6 | no breaking config/DB changes documented; docker users must update the image (no in-container update) | 6.3.0 notes |
| romm | 4 → 5 | no breaking config/DB/folder changes documented (UI overhaul release) | 5.0.0 notes |
| outline | 0.82 → 1.9 | **found empirically:** 1.x defaults to SSL for Postgres — needs `PGSSLMODE=disable` against a sidecar DB | live deploy |
| tandoor | 1 → 2 | **found empirically:** app port moved 8080 → 80 and `ALLOWED_HOSTS` became mandatory (Django 400s everything without it) | live deploy |
| zipline | (4.0 → 4.6) | **found empirically:** v4 renamed `CORE_DATABASE_URL` → `DATABASE_URL` and `/api/health` → `/api/healthcheck` | live deploy |
| homebox | (v0.16 → 0.26) | **found empirically:** upstream dropped the `v` tag prefix; `HBOX_AUTH_API_KEY_PEPPER` now required | live deploy |
| wger | (2.3 → 2.6) | **found empirically:** full `DJANGO_DB_*` set required even for sqlite; app listens on :8000 | live deploy |
| calcom · claper · gramps-web · onlyoffice | v4→v6 · 1→2 · v24→v25 · 8→9 | deployed clean; upstream one-liner **not retrieved** within the wall-clock — flagged MAJOR without a fabricated note | — |
The empirically-found rows are the more valuable half: they are what actually happens on a real
deploy, not what a changelog remembered to mention.
---
## 7. Findings, ranked
@@ -393,9 +419,10 @@ terminal state.
- **DB/cache sidecar majors** (postgres 16→18, redis 7→8, mariadb→12, postgis 16→17) —
deliberately not bumped, rationale in §4. **ROADMAP decision item.**
- **MAJOR breaking notes** were retrieved from upstream for bookstack, immich, nextcloud, n8n and
grafana. For the remaining MAJOR rows the note was **not retrieved** within the wall-clock; they
are flagged MAJOR without an upstream one-liner rather than given a fabricated one.
- **MAJOR breaking notes** are in §6.3. Retrieved from upstream for bookstack, immich, nextcloud,
n8n, grafana, vikunja, privatebin, radarr and romm; found EMPIRICALLY (better) for outline,
tandoor, zipline, homebox and wger. Four (calcom, claper, gramps-web, onlyoffice) deployed clean
but have **no upstream one-liner** — recorded as not-retrieved rather than fabricated.
- **immich redis → valkey** (upstream migrated in v3; redis:7-alpine works fine on v3) — recorded,
not done: an image swap is structural, not a pin bump.
- **glance config seeding**, **gokapi v2 config migration**, **plant-it / wanderer upstream