security watch: seven pins it can never read are a stated GAP, so the source streaks reset; a read timeout is retried; every failed source is printed (R-1334); R-1310's rules (another package, every GHSA a release names, a word-only line, date tags)
gates / gates (push) Successful in 3m35s
gates / gates (push) Successful in 3m35s
This commit is contained in:
admin committed
1 parent
c25b790ce9
commit
4afa8c3cde
12 files changed
+2202
-35
No files matched your search
@@ -731,3 +731,20 @@ cache, so the cache helps a same-day re-run on one runner, not the nightly; the
|
||||
dry runs 2026-10-28: 0 refused). The image reader (`image_runtime.py`) also waits out a 429 and tries again (3 tries):
|
||||
ghcr.io refused two blob reads when two dry runs read the same 14 new images 15 minutes apart.
|
||||
|
||||
**[DESIGN — 2026-11-02, R-1334] A pin the watch can never read is a stated GAP, not a failed source; a read timeout is tried
|
||||
again.** The memory showed `registry:docker.io` and `runtime` down for a week, and the logs said otherwise: 0 Docker Hub 429
|
||||
on five real nights, on both runners. A streak is per SOURCE, so seven pins that can never be read (six of our own images in
|
||||
the private registry; `minio/minio`, which Docker Hub answers with 401) held both streaks open, and a real outage of either
|
||||
source could not have mailed. Now those seven are GAP, with their reason, in every weekly mail. Only the stated answer counts:
|
||||
`STATED_UNREADABLE` names the pin AND its one answer, so an unlisted 401 (a Docker Hub outage) or the same pin timing out stays
|
||||
NOT CHECKED. A transport failure on any source, and a ghcr.io 429, is tried again (a budget of 30 a night, so an outage cannot
|
||||
pass the job's limit). The log prints `FAILED-SOURCE …` for every failed source of every pin — the table shows one class per
|
||||
pin, so an ADVISORY pin hid its failure — and `FAILED-SOURCES n`. Evidence: `audits/security-2026-11-02/part1/DIAGNOSIS.md`.
|
||||
Tests W12, W15.
|
||||
|
||||
**[DESIGN — 2026-11-02, R-1310] What counts as a notice.** A release that names GHSA ids gives one entry per id (the lowest
|
||||
fixing release, never twice); a release with a security line and no id gives one `release:` entry; a line where „security" is
|
||||
only a word (`WORD_ONLY`: „security announcements", „no longer receives security fixes") gives none. A notice naming only
|
||||
another program in the repo (`PACKAGE_NOT_OURS`: Gitea's runner, Home Assistant's phone apps, Uptime Kuma's rootless image) is
|
||||
not listed; a name not in the table is listed — the safe direction. A `YY.MM.YYYYMMDD` tag is not „newer". Test W16.
|
||||
|
||||
@@ -0,0 +1,52 @@
|
||||
# Why the watch's memory showed two sources down for a week (R-1334, R-1303) — numbers first, 2026-11-02
|
||||
|
||||
Read from the CI logs of every night since 10-28 (`night-<job>.log` here; older: `audits/dockerhub-bigsteps-2026-10-28/part1/`).
|
||||
**The 03:20 run is `gates` (repo_gates on the night's HEAD), not the watch. The watch is only the 03:40 run.**
|
||||
|
||||
| Night | Job | Runner | TAGS fetched / cache / retried-429 | hub.docker.com requests | `registry:docker.io` failures | `runtime` failures |
|
||||
|---|---|---|---|---|---|---|
|
||||
| 10-29 | 2483 | runner-2 | 0 / 116 / 0 | 1 | minio (401) | minio (401) + 6 private |
|
||||
| 10-30 | 2531 | runner | 117 / 0 / 0 | 206 | minio + `alpine/k8s` (read timeout) | same 7 |
|
||||
| 10-31 | 2543 | runner-2 | 117 / 0 / 0 | 207 | minio + `linuxserver/code-server` (timeout) | same 7 |
|
||||
| 11-01 | 2545 | runner-2 | 1 / 115 / 0 | 4 | minio | same 7 |
|
||||
| 11-02 | 2547 | runner-2 | 116 / 0 / 0 | 207 | minio + `mongodb-community-server`, `wanderer-db`, `linuxserver/grocy` (timeouts) | same 7 |
|
||||
|
||||
The 7: `minio/minio:latest` (Docker Hub answers 401 on tags and manifest: the image is no longer published there) and six
|
||||
of our own images in the private registry (`gitea.dooplex.hu/admin/{felhom-act-runner,jarr,recipe-importer,
|
||||
revfulop-calendar,sparkyfitness-export,wan-probe}`, „no anonymous token route"). All seven are DooPlex-group pins.
|
||||
|
||||
## What this means
|
||||
|
||||
1. **R-1334's fix DID hold.** Five real nights, two different runners, **0 HTTP 429** from Docker Hub, 0 retries. The brief's
|
||||
reading („did not hold") came from the streak numbers; the logs say the streak has another cause.
|
||||
2. **The watch was not blind to Docker Hub.** About 115 of 116 tag lists and every readable runtime were read every night
|
||||
(`RUNTIME … from-cache=181–185`, read-path failures 0). The zstd wheel is fine (`zstandard 0.25.0`, sha256 checked).
|
||||
3. **What kept the streak open — the mechanism:** `plan()` counts a streak per SOURCE (`scripts/security_watch.py`, „for s in
|
||||
sorted(set(fails) | set(failed_now))"): one pin failing keeps the whole source's streak running. Seven pins that can
|
||||
NEVER be read fail every night, so `registry:docker.io` and `runtime` could never reset, `mailed` stayed true, and **a
|
||||
real outage of either source could not have mailed**. That is the real hole, and it is why the operator heard nothing:
|
||||
nothing new was happening, but nothing new could have been heard either.
|
||||
4. **Real one-night misses: read timeouts.** 0–3 pins a night, a different one each time (30 s, `Net.get`, no retry), plus
|
||||
one GitHub feed (nginx, 10-29). Each was read fine the next night. On 2026-11-02 by hand from DooPlex: also a ghcr.io 429
|
||||
on one tag list, and timeouts on karakeep, Radarr and wanderer feeds. So it is the line, not one host.
|
||||
5. **Three instruments lied, so the diagnosis took the state file, not the log:**
|
||||
- `RUNTIME … not-checked=0` for six nights while `runtime` failed: the resolve path returned before it counted.
|
||||
- The table shows one class per pin: an ADVISORY pin hid its failed source (night 10-27: streak 1 with `NOT_CHECKED` absent
|
||||
from COUNTS).
|
||||
- Dry runs looked clean because the same 7 were there too and read as „expected".
|
||||
|
||||
## What was read in the blind week that is reported for the first time
|
||||
|
||||
**Nothing because of the blindness:** every pin that timed out was read the next night, and the seven stated pins are still
|
||||
unread (now a stated GAP, in every weekly mail). The fixed run's new lines come from R-1310's better reading (`dry-local-after-fix.log`,
|
||||
13 new): each GHSA a release names (Vaultwarden's two, Uptime Kuma's GHSA-v2p3, **Traefik's GHSA-xv5x**), and notices newer than
|
||||
the last night (Meilisearch's release lines, Actual's GHSA-p7p2). They go to Part 2.
|
||||
|
||||
## The fix (felhom.eu only)
|
||||
|
||||
- The seven are a GAP with their reason, listed in every weekly mail: no failed source, so the streak resets. `STATED_UNREADABLE`
|
||||
names minio with the ONE answer it gives; an unlisted 401, or minio failing another way, stays NOT CHECKED. Test W15, W12.
|
||||
- A read timeout is tried again on every source (a budget of 30 a night, so an outage cannot pass the job's limit); a ghcr.io
|
||||
429 too. The resolve gets one more try. Test W15.
|
||||
- The log: `FAILED-SOURCE …` for every failed source of every pin, `FAILED-SOURCES n`, a truthful RUNTIME line, `retried-timeout`.
|
||||
- No Docker Hub login and no runner image change are needed.
|
||||
@@ -0,0 +1,208 @@
|
||||
/mnt/5_hdsecurity watch 2026-11-02: 197 pins (11 box/build, 97 app, 89 DooPlex); GitHub key PRESENT — every repo's advisories tonight
|
||||
ADVISORY doop actualbudget/actual-server 26.10.0 GHSA-p7p2-pm6f-rg6x (fixed 26.11.0); CVE-2026-111497 (fixed 24.22.1)
|
||||
ADVISORY doop advplyr/audiobookshelf 2.37.1 CVE-2026-111497 (fixed 24.22.1)
|
||||
ADVISORY box cloudflare/cloudflared 2026.10.4 feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3 (fixed read the notice); vulnnotes:cloudflared@2026.10.6:VULN-184686 (fixed 2026.10.6); vulnnotes:cloudflared@2026.10.5:VULN-183456 (fixed 2026.10.5)
|
||||
ADVISORY doop codewithcj/sparkyfitness v1.9.0 release:CodeWithCJ/SparkyFitness@v1.10.0 (fixed v1.10.0)
|
||||
ADVISORY doop codewithcj/sparkyfitness_server v1.9.0 release:CodeWithCJ/SparkyFitness@v1.10.0 (fixed v1.10.0); CVE-2026-111497 (fixed 24.22.1)
|
||||
ADVISORY doop crocodilestick/calibre-web-automated dev CVE-2026-111497 (fixed 1.2.1)
|
||||
ADVISORY doop docker.io/calcom/cal.com v6.2.0 CVE-2026-111497 (fixed 22.23.4, 24.22.1, 26.12.1)
|
||||
ADVISORY doop flomp/wanderer-db v0.21.0 GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2)
|
||||
ADVISORY doop flomp/wanderer-web v0.21.0 GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2); … 1 more
|
||||
ADVISORY doop getmeili/meilisearch v1.11.3 release:meilisearch/meilisearch@v1.55.1 (fixed v1.55.1); release:meilisearch/meilisearch@v1.56.1 (fixed v1.56.1)
|
||||
ADVISORY doop ghcr.io/gethomepage/homepage v1.13.2 GHSA-669x-4pg4-w24r (fixed 2.2.0); CVE-2026-111497 (fixed 22.23.4)
|
||||
ADVISORY doop ghcr.io/immich-app/immich-machine-learning v2.7.5 GHSA-q89f-h332-8q2h (fixed v3.2.4); GHSA-h5w4-vjv4-9r5q (fixed a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 (fixed v3.2.0); GHSA-72rm-x7xr-v679 (fixed v3.3.0); … 7 more
|
||||
ADVISORY doop ghcr.io/immich-app/immich-server v2.7.5 GHSA-q89f-h332-8q2h (fixed v3.2.4); GHSA-h5w4-vjv4-9r5q (fixed a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 (fixed v3.2.0); GHSA-72rm-x7xr-v679 (fixed v3.3.0); … 8 more
|
||||
ADVISORY doop ghcr.io/lukegus/termix release-2.9.2 CVE-2026-111497 (fixed 26.12.1)
|
||||
ADVISORY doop ghcr.io/paperless-ngx/paperless-ngx 3.3.4 release:paperless-ngx/paperless-ngx@v3.4.0 (fixed v3.4.0); CVE-2026-111497 (fixed 1.2.1)
|
||||
ADVISORY doop gitea/gitea 1.26.2 GHSA-mf6p-vqpw-3r7x (fixed 28.3.0); GHSA-32h8-5xqg-h466 (fixed 28.3.0); GHSA-9v6p-xpcp-7488 (fixed 28.3.0); GHSA-6h2f-c8jm-84hc (fixed 28.3.0); … 145 more
|
||||
ADVISORY doop grafana/grafana 13.2.4 GHSA-8xmm-x63g-f6xv (fixed no fixed version named yet); GHSA-4724-7jwc-3fpw (fixed the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 (fixed the range is unreadable — check by hand); GHSA-8wjh-59cw-9xh4 (fixed no fixed version named yet); … 2 more
|
||||
ADVISORY box gtstef/filebrowser 1.5.8-stable GHSA-892f-9h5p-mfc8 (fixed 2.1.0-stable, 2.1.4-beta); GHSA-gfgm-886h-6r47 (fixed 2.0.2-stable, 2.1.4-beta); GHSA-wxj5-g3qp-g732 (fixed 2.0.2-stable, 2.1.3-beta); GHSA-3j46-5w28-f8p2 (fixed 2.1.0-stable, 2.1.3-beta); … 32 more
|
||||
ADVISORY doop louislam/uptime-kuma 2.5.6 GHSA-86ch-2247-gr56 (fixed 2.5.9); GHSA-v2p3-6f5h-6hhf (fixed 2.5.8); GHSA-qjxc-h5jf-c7rj (fixed the range is unreadable — check by hand); release:louislam/uptime-kuma@2.5.7 (fixed 2.5.7); … 1 more
|
||||
ADVISORY doop outlinewiki/outline 1.11.0 GHSA-x4w3-9p9j-cprh (fixed 1.12.0); GHSA-rq53-m97j-f2pg (fixed 1.12.0); GHSA-h6ff-rw9x-5mq2 (fixed 1.12.0); GHSA-rvj7-2gww-6xfq (fixed 1.12.0); … 3 more
|
||||
ADVISORY doop redis 8.10.2 GHSA-c8h9-259x-jff4 (fixed the range is unreadable — check by hand); GHSA-8ghh-qpmp-7826 (fixed no fixed version named yet); GHSA-93m2-935m-8rj3 (fixed no fixed version named yet); GHSA-m8fj-85cg-7vhp (fixed the range is unreadable — check by hand); … 8 more
|
||||
ADVISORY doop rommapp/romm 5.4.0 release:rommapp/romm@5.4.1 (fixed 5.4.1); CVE-2026-111497 (fixed 24.22.1)
|
||||
ADVISORY box traefik v3.7.16 GHSA-xv5x-242w-7hf7 (fixed v3.7.17)
|
||||
ADVISORY doop vabene1111/recipes 2.6.15 CVE-2026-111497 (fixed 24.22.1)
|
||||
ADVISORY doop vaultwarden/server 1.37.4 GHSA-x9cq-f669-vrr4 (fixed 1.37.5); GHSA-9pjj-f9g5-3x4c (fixed 1.37.5)
|
||||
ADVISORY app actualbudget/actual-server 26.9.0 GHSA-p7p2-pm6f-rg6x (fixed 26.11.0); CVE-2026-111497 (fixed 24.22.1)
|
||||
ADVISORY app calcom/cal.com v6.2.0 GHSA-p3f6-52gv-cj7m (fixed the range is unreadable — check by hand); GHSA-cpf2-q635-xrwx (fixed the range is unreadable — check by hand); CVE-2026-111497 (fixed 22.23.4, 24.22.1, 26.12.1)
|
||||
ADVISORY app codewithcj/sparkyfitness v0.17.3 GHSA-v883-jx9h-qf29 (fixed a version after 1.7.2 (the notice names none)); GHSA-cmmf-53wf-r5gv (fixed a version after 1.6.5 (the notice names none)); GHSA-p8cf-g8rv-gvrq (fixed a version after 1.6.5 (the notice names none))
|
||||
ADVISORY app codewithcj/sparkyfitness_server v0.17.3 GHSA-v883-jx9h-qf29 (fixed a version after 1.7.2 (the notice names none)); GHSA-cmmf-53wf-r5gv (fixed a version after 1.6.5 (the notice names none)); GHSA-p8cf-g8rv-gvrq (fixed a version after 1.6.5 (the notice names none)); CVE-2026-111497 (fixed 24.22.1)
|
||||
ADVISORY app crocodilestick/calibre-web-automated v4.0.8 CVE-2026-111497 (fixed 1.2.1)
|
||||
ADVISORY app f0rc3/gokapi v1.9.6 GHSA-45vh-rpc8-hxpp (fixed 2.2.4); GHSA-qwc6-vc2v-2ggj (fixed 2.2.4); GHSA-j6jp-78w8-34x6 (fixed 2.2.4); GHSA-m2hx-wjxc-9fp4 (fixed 2.2.3); … 6 more
|
||||
ADVISORY app getmeili/meilisearch v1.41.0 release:meilisearch/meilisearch@v1.55.1 (fixed v1.55.1); release:meilisearch/meilisearch@v1.56.1 (fixed v1.56.1)
|
||||
ADVISORY app getmeili/meilisearch v1.36.0 release:meilisearch/meilisearch@v1.55.1 (fixed v1.55.1); release:meilisearch/meilisearch@v1.56.1 (fixed v1.56.1)
|
||||
ADVISORY app ghcr.io/immich-app/immich-machine-learning v3.3.5 GHSA-8244-8vpr-vp9c (fixed the range is unreadable — check by hand)
|
||||
ADVISORY app ghcr.io/immich-app/immich-server v3.3.5 GHSA-8244-8vpr-vp9c (fixed the range is unreadable — check by hand)
|
||||
ADVISORY app ghcr.io/karakeep-app/karakeep 0.34.1 GHSA-pp34-2c9r-mchw (fixed no fixed version named yet)
|
||||
ADVISORY app ghcr.io/lukegus/termix 26.10.5 GHSA-r9gw-3w87-mhh7 (fixed no fixed version named yet); release:Termix-SSH/Termix@v26.10.6 (fixed v26.10.6)
|
||||
ADVISORY app ghcr.io/mealie-recipes/mealie v3.29.0 release:mealie-recipes/mealie@v3.30.0 (fixed v3.30.0)
|
||||
ADVISORY app ghcr.io/paperless-ngx/paperless-ngx 2.20.15 GHSA-c8f3-pqr2-rr24 (fixed 3.3.2); GHSA-2jhj-xqrq-rmrq (fixed 3.1.2); CVE-2026-111497 (fixed 1.1.1)
|
||||
ADVISORY app ghcr.io/tandoorrecipes/recipes 2.7.2 GHSA-c7mc-c9jr-38hf (fixed the range is unreadable — check by hand); GHSA-cqj3-64qw-4w52 (fixed the range is unreadable — check by hand)
|
||||
ADVISORY app gitea/gitea 28.2.0 GHSA-mf6p-vqpw-3r7x (fixed 28.3.0); GHSA-32h8-5xqg-h466 (fixed 28.3.0); GHSA-9v6p-xpcp-7488 (fixed 28.3.0); GHSA-6h2f-c8jm-84hc (fixed 28.3.0); … 18 more
|
||||
ADVISORY app glanceapp/glance v0.8.5 GHSA-r225-jhr6-68cc (fixed >= 0.8.7)
|
||||
ADVISORY app grafana/grafana 13.2.4 GHSA-8xmm-x63g-f6xv (fixed no fixed version named yet); GHSA-4724-7jwc-3fpw (fixed the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 (fixed the range is unreadable — check by hand); GHSA-8wjh-59cw-9xh4 (fixed no fixed version named yet); … 2 more
|
||||
ADVISORY app louislam/uptime-kuma 2.5.7 GHSA-86ch-2247-gr56 (fixed 2.5.9); GHSA-v2p3-6f5h-6hhf (fixed 2.5.8); GHSA-qjxc-h5jf-c7rj (fixed the range is unreadable — check by hand)
|
||||
ADVISORY app n8nio/n8n 2.44.7 GHSA-2x68-96jw-5r6c (fixed >= 3.0.1); GHSA-9p7v-45m2-wxgj (fixed >= 3.0.1); GHSA-mx4r-96jx-v278 (fixed >= 3.0.1); GHSA-4v22-g448-h4rg (fixed >= 2.45.5, >= 2.46.1, >= 3.0.1); … 9 more
|
||||
ADVISORY app privatebin/pdo 2.1.0 GHSA-c4gc-8mcm-hh65 (fixed 2.1.1); GHSA-hw9p-r7fq-8mvr (fixed 2.1.1)
|
||||
ADVISORY app rommapp/romm 5.4.1 CVE-2026-111497 (fixed 24.22.1)
|
||||
ADVISORY app vaultwarden/server 1.37.4-alpine GHSA-x9cq-f669-vrr4 (fixed 1.37.5); GHSA-9pjj-f9g5-3x4c (fixed 1.37.5)
|
||||
BEHIND doop ghcr.io/alam00000/bentopdf 2.8.10 newest 2.8.11
|
||||
BEHIND doop ghcr.io/diced/zipline 4.8.1 newest 4.8.2
|
||||
BEHIND app freikin/dawarich 1.19.0 newest 1.20.1
|
||||
BEHIND app ghcr.io/alam00000/bentopdf v2.8.10 newest v2.8.11
|
||||
BEHIND app ghcr.io/alexta69/metube 2026.10.27 newest 2026.11.01
|
||||
BEHIND app ghcr.io/hargata/lubelogger v1.7.3 newest v1.7.4
|
||||
BEHIND app ghcr.io/kozea/radicale 3.8.1 newest 3.9.0
|
||||
BEHIND app gotson/komga 1.28.0 newest 1.29.2
|
||||
BEHIND app kimai/kimai2 2.67.0 newest 2.71.0
|
||||
BEHIND app lscr.io/linuxserver/code-server 4.143.1 newest 4.144.0
|
||||
BEHIND app lukevella/rallly 4.16.3 newest 4.16.4
|
||||
BEHIND app nextcloud 34.0.4-apache newest 34.0.5-apache
|
||||
BEHIND app nginx 1.30.5-alpine newest 1.31.8-alpine
|
||||
BEHIND app qbittorrentofficial/qbittorrent-nox 5.2.4-1 newest 5.3.0-2
|
||||
GAP buil alpine 3.24.2 newest 3.24.3
|
||||
GAP buil alpine 3.24.2 newest 3.24.3
|
||||
GAP doop alpine/k8s 1.37.1 newest 1.37.2
|
||||
GAP doop arcadiatechnology/crafty-4 4.11.0
|
||||
GAP doop bhgedigital/envsubst latest
|
||||
GAP doop busybox 1.38
|
||||
GAP doop codercom/code-server 4.143.1 newest 4.144.0
|
||||
GAP buil debian 13.7-slim
|
||||
GAP buil debian 13.7-slim
|
||||
GAP doop docker.io/bitnamilegacy/postgresql 17.6.0-debian-12-r3
|
||||
GAP doop docker.io/library/nextcloud 34.0.5-apache
|
||||
GAP doop docker.io/valkey/valkey 9.2-alpine
|
||||
GAP doop filebrowser/filebrowser v2.63.23
|
||||
GAP doop ghcr.io/cloudnative-pg/postgresql 17.2 newest 17.11
|
||||
GAP doop ghcr.io/headlamp-k8s/headlamp v0.46.0
|
||||
GAP doop ghcr.io/immich-app/postgres 16-vectorchord0.3.0
|
||||
GAP doop ghcr.io/jimmidyson/configmap-reload v0.15.0
|
||||
GAP doop ghcr.io/onedr0p/exportarr v2.3.0
|
||||
GAP doop ghcr.io/seriousm4x/upsnap 5
|
||||
GAP doop ghcr.io/stakater/reloader v1.4.22 newest v1.4.23
|
||||
GAP doop ghcr.io/tautulli/tautulli v2.18.2
|
||||
GAP doop gitea.dooplex.hu/admin/felhom-act-runner 0.1.0
|
||||
GAP doop gitea.dooplex.hu/admin/jarr latest
|
||||
GAP doop gitea.dooplex.hu/admin/recipe-importer latest
|
||||
GAP doop gitea.dooplex.hu/admin/revfulop-calendar 1.6.2
|
||||
GAP doop gitea.dooplex.hu/admin/sparkyfitness-export 0.3.0
|
||||
GAP doop gitea.dooplex.hu/admin/wan-probe 0.1.0
|
||||
GAP doop griefed/serverpackcreator 8.1.2
|
||||
GAP doop gtstef/filebrowser 1.5.8-stable
|
||||
GAP doop guacamole/guacamole 1.6.0
|
||||
GAP doop guacamole/guacd 1.6.0
|
||||
GAP doop index.docker.io/plexinc/pms-docker 1.43.5.11029-6bf8af3f0
|
||||
GAP doop itzg/mc-backup 2026.10.1 newest 2026.10.3
|
||||
GAP doop itzg/minecraft-server 2026.10.0-java21 newest 2026.10.1-java17
|
||||
GAP doop linuxserver/bookstack 26.09.20260929
|
||||
GAP doop linuxserver/prowlarr version-2.6.5.5623
|
||||
GAP doop linuxserver/qbittorrent 5.3.0
|
||||
GAP doop linuxserver/radarr version-6.4.4.10685
|
||||
GAP doop linuxserver/sonarr version-4.0.20.3014
|
||||
GAP doop mariadb 11
|
||||
GAP doop mikefarah/yq 4.54.1
|
||||
GAP doop minio/minio latest
|
||||
GAP doop mongodb/mongodb-community-server 8.0.5-ubuntu2204 newest 8.3.13-ubuntu2204
|
||||
GAP doop msdeluise/plant-it-server 0.10.0
|
||||
GAP doop mysql 8.4
|
||||
GAP doop nicolaka/netshoot latest
|
||||
GAP doop postgis/postgis 16-3.5
|
||||
GAP doop postgres 15-alpine
|
||||
GAP doop postgres 16-alpine
|
||||
GAP doop privatebin/nginx-fpm-alpine 2.0.6 newest 2.1.0
|
||||
GAP doop prom/alertmanager v0.34.1 newest v0.34.2
|
||||
GAP doop prom/node-exporter v1.12.1
|
||||
GAP doop prom/prometheus v3.15.0 newest v3.15.1
|
||||
GAP doop prometheuscommunity/smartctl-exporter v0.15.0
|
||||
GAP doop python 3.15-bookworm
|
||||
GAP doop quay.io/jetstack/version-checker v0.11.0
|
||||
GAP doop quay.io/prometheus/blackbox-exporter v0.29.1
|
||||
GAP doop renovate/renovate 44.181.1 newest 44.206.0
|
||||
GAP doop tailscale/tailscale v1.104.2 newest v1.104.4
|
||||
GAP app emby/embyserver 4.11.0.4 newest 4.11.0.13
|
||||
GAP app ghcr.io/immich-app/postgres 16-vectorchord0.4.3-pg
|
||||
GAP app ghcr.io/karakeep-app/karakeep-chrome 151.0.7922.47-r1
|
||||
GAP app mariadb 12.3
|
||||
GAP app mariadb 11.4 newest 11.8
|
||||
GAP app mariadb 11.8
|
||||
GAP app mariadb 12.3
|
||||
GAP app mariadb 11.8
|
||||
GAP app msdeluise/plant-it 0.10.0
|
||||
GAP app plexinc/pms-docker 1.43.5.11029-6bf8af3f0
|
||||
GAP app postgis/postgis 16-3.5-alpine
|
||||
GAP app postgis/postgis 17-3.5-alpine
|
||||
GAP app postgres 18-alpine
|
||||
GAP app postgres 17-alpine
|
||||
GAP app postgres 18-alpine
|
||||
GAP app postgres 18-alpine
|
||||
GAP app postgres 18-alpine
|
||||
GAP app postgres 18-alpine
|
||||
GAP app postgres 18-alpine
|
||||
GAP app postgres 17-alpine
|
||||
GAP app postgres 16-alpine
|
||||
GAP app registry.gitlab.com/crafty-controller/crafty-4 4.11.0
|
||||
FLOATING doop ghcr.io/seanmorley15/adventurelog-backend latest
|
||||
FLOATING doop ghcr.io/seanmorley15/adventurelog-frontend latest
|
||||
FLOATING doop nginx 1.31-alpine
|
||||
FLOATING doop redis 8-alpine
|
||||
FLOATING doop redis 8.10-alpine
|
||||
FLOATING app ghcr.io/claperco/claper 2.5
|
||||
FLOATING app ghcr.io/thomiceli/opengist 1.15
|
||||
FLOATING app jellyfin/jellyfin 12.4
|
||||
FLOATING app lscr.io/linuxserver/prowlarr version-2.6.5.5623
|
||||
FLOATING app lscr.io/linuxserver/sabnzbd version-5.1.3
|
||||
FLOATING app lscr.io/linuxserver/transmission version-4.1.3-r0
|
||||
FLOATING app nzbgetcom/nzbget v26.3
|
||||
FLOATING app redis 7.4-alpine
|
||||
FLOATING app redis 7-alpine
|
||||
FLOATING app redis 7-alpine
|
||||
FLOATING app redis 7-alpine
|
||||
FLOATING app redis 7-alpine
|
||||
FLOATING app redis 7-alpine
|
||||
FLOATING app redis 7-alpine
|
||||
FLOATING app wger/server 2.7
|
||||
SELF box gitea.dooplex.hu/admin/felhom-samba 1.2.0
|
||||
SELF app gitea.dooplex.hu/admin/recipe-importer v0.9.11
|
||||
CURRENT doop f0rc3/gokapi v2.2.4
|
||||
CURRENT doop ghcr.io/seerr-team/seerr v3.5.1
|
||||
CURRENT doop ghcr.io/thomiceli/opengist 1.15.3
|
||||
CURRENT doop glanceapp/glance v0.8.7
|
||||
CURRENT buil golang 1.27.3-trixie
|
||||
CURRENT buil golang 1.27.3-alpine3.24
|
||||
CURRENT doop onlyoffice/documentserver 9.4.0
|
||||
CURRENT buil restic 0.19.1
|
||||
CURRENT app deluan/navidrome 0.64.2
|
||||
CURRENT app docmost/docmost 0.97.0
|
||||
CURRENT app flomp/wanderer-db v0.21.2
|
||||
CURRENT app flomp/wanderer-web v0.21.2
|
||||
CURRENT app ghcr.io/advplyr/audiobookshelf 2.37.2
|
||||
CURRENT app ghcr.io/cmintey/wishlist v0.69.0
|
||||
CURRENT app ghcr.io/diced/zipline 4.8.2
|
||||
CURRENT app ghcr.io/gethomepage/homepage v2.7.0
|
||||
CURRENT app ghcr.io/gramps-project/grampsweb v25.6.0
|
||||
CURRENT app ghcr.io/grimmory-tools/grimmory v3.5.0
|
||||
CURRENT app ghcr.io/home-assistant/home-assistant 2026.10.4
|
||||
CURRENT app ghcr.io/papra-hq/papra 26.7.1-rootless
|
||||
CURRENT app ghcr.io/seanmorley15/adventurelog-backend v0.13.1
|
||||
CURRENT app ghcr.io/seanmorley15/adventurelog-frontend v0.13.1
|
||||
CURRENT app ghcr.io/seerr-team/seerr v3.5.1
|
||||
CURRENT app ghcr.io/sysadminsmedia/homebox 0.27.1
|
||||
CURRENT app ghost 6.73.0-alpine
|
||||
CURRENT app lscr.io/linuxserver/bookstack 26.09.2
|
||||
CURRENT app lscr.io/linuxserver/grocy 4.7.1
|
||||
CURRENT app lscr.io/linuxserver/radarr 6.4.4
|
||||
CURRENT app lscr.io/linuxserver/sonarr 4.0.20
|
||||
CURRENT app onlyoffice/documentserver 9.4.0
|
||||
CURRENT app outlinewiki/outline 1.12.0
|
||||
CURRENT app vikunja/vikunja 2.7.1
|
||||
COUNTS ADVISORY=48 BEHIND=14 CURRENT=32 FLOATING=20 GAP=81 SELF=2
|
||||
FAILED-SOURCE registry:ghcr.io ghcr.io/immich-app/immich-server:v3.3.5 — ghcr.io tags of immich-app/immich-server: HTTP 429
|
||||
FAILED-SOURCES 1
|
||||
RUNTIME read=0 (0 s) from-cache=185 not-checked=10 zstd-decoder=not needed
|
||||
TAGS fetched=118 from-cache=0 retried-429=0 retried-timeout=1 (cache $S/tags.json)
|
||||
REQUESTS api.github.com=68 api.osv.dev=1 auth.docker.io=1 blog.cloudflare.d/felhom.eu/git/felhom.eu/scripts/security_watch.py:1015: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
|
||||
today = datetime.date.fromisoformat(opts["today"]) if "today" in opts else datetime.datetime.utcnow().date()
|
||||
com=1 ghcr.io=180 github.com=63 hub.docker.com=209 raw.githubusercontent.com=1 registry-1.docker.io=1
|
||||
MAIL (not sent, --no-mail): [Felhom security] traefik, actual-server, meilisearch, uptime-kuma … — 13 new advisories
|
||||
STATE written: $S/state-dry.json (364 known advisories)
|
||||
@@ -0,0 +1,311 @@
|
||||
2026-10-29T03:40:11.7202953Z felhom-gates-runner-2(version:v0.6.1) received task 2507 of job watch, be triggered by event: schedule
|
||||
2026-10-29T03:40:11.7224939Z workflow prepared
|
||||
2026-10-29T03:40:11.7226542Z evaluating expression 'always()'
|
||||
2026-10-29T03:40:11.7228169Z expression 'always()' evaluated to 'true'
|
||||
2026-10-29T03:40:11.7236004Z evaluating expression ''
|
||||
2026-10-29T03:40:11.7236483Z expression '' evaluated to 'true'
|
||||
2026-10-29T03:40:11.7236764Z ⭐ Run Main Fetch main (latest, for the memory) and the two sibling repos
|
||||
2026-10-29T03:40:11.7241613Z Wrote command \n\necho "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"\nbase=http://gitea.gitea-system.svc.cluster.local:3000/admin\ngit init -q . && git remote add origin $base/felhom.eu.git\ngit fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD\necho "felhom.eu main at $(git rev-parse --short=12 HEAD)"\nfor r in felhom-controller app-catalog-felhom.eu; do\n git init -q ../$r && git -C ../$r remote add origin $base/$r.git\n git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD\n echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)"\ndone\n\n\n to 'workflow/0.sh'
|
||||
2026-10-29T03:40:11.7243226Z ::group::Run echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"
|
||||
2026-10-29T03:40:11.7243585Z echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"
|
||||
2026-10-29T03:40:11.7243872Z base=http://gitea.gitea-system.svc.cluster.local:3000/admin
|
||||
2026-10-29T03:40:11.7244002Z git init -q . && git remote add origin $base/felhom.eu.git
|
||||
2026-10-29T03:40:11.7244140Z git fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD
|
||||
2026-10-29T03:40:11.7244266Z echo "felhom.eu main at $(git rev-parse --short=12 HEAD)"
|
||||
2026-10-29T03:40:11.7244393Z for r in felhom-controller app-catalog-felhom.eu; do
|
||||
2026-10-29T03:40:11.7244682Z git init -q ../$r && git -C ../$r remote add origin $base/$r.git
|
||||
2026-10-29T03:40:11.7244812Z git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD
|
||||
2026-10-29T03:40:11.7244944Z echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)"
|
||||
2026-10-29T03:40:11.7245095Z done
|
||||
2026-10-29T03:40:11.7245210Z shell: bash --noprofile --norc -e -o pipefail {0}
|
||||
2026-10-29T03:40:11.7245351Z ::endgroup::
|
||||
2026-10-29T03:40:21.1361453Z felhom.eu main at 6a6dd94daca4
|
||||
2026-10-29T03:40:23.1908764Z felhom-controller at 20c5877056e2
|
||||
2026-10-29T03:40:23.5344863Z app-catalog-felhom.eu at 0baf8f948575
|
||||
2026-10-29T03:40:23.5371727Z ::group::Run set -u
|
||||
2026-10-29T03:40:23.5371953Z set -u
|
||||
2026-10-29T03:40:23.5372078Z mkdir -p documentation/security-watch
|
||||
2026-10-29T03:40:23.5372188Z mode="${MODE:-run}"
|
||||
2026-10-29T03:40:23.5372319Z [ "${GITHUB_EVENT_NAME:-}" = "schedule" ] && mode=run
|
||||
2026-10-29T03:40:23.5372422Z echo "mode: $mode"
|
||||
2026-10-29T03:40:23.5372543Z case "$mode" in
|
||||
2026-10-29T03:40:23.5372785Z test-mail) python3 scripts/security_watch.py --test-mail; exit $? ;;
|
||||
2026-10-29T03:40:23.5372991Z dry) extra="--no-mail" ; state=/tmp/state-dry.json
|
||||
2026-10-29T03:40:23.5373172Z cp documentation/security-watch/state.json "$state" 2>/dev/null || true ;;
|
||||
2026-10-29T03:40:23.5373366Z seed) extra="--seed" ; state=documentation/security-watch/state.json ;;
|
||||
2026-10-29T03:40:23.5373597Z run) extra="" ; state=documentation/security-watch/state.json ;;
|
||||
2026-10-29T03:40:23.5373839Z *) echo "unknown mode $mode"; exit 2 ;;
|
||||
2026-10-29T03:40:23.5373988Z esac
|
||||
2026-10-29T03:40:23.5374364Z python3 scripts/security_watch.py --state="$state" --catalog=../app-catalog-felhom.eu \
|
||||
2026-10-29T03:40:23.5374561Z --controller=../felhom-controller --json=/tmp/watch-results.json $extra
|
||||
2026-10-29T03:40:23.5374875Z shell: bash --noprofile --norc -e -o pipefail {0}
|
||||
2026-10-29T03:40:23.5375145Z env:
|
||||
2026-10-29T03:40:23.5376183Z RESEND_API_KEY: ***
|
||||
2026-10-29T03:40:23.5376579Z GH_ADVISORY_TOKEN: ***
|
||||
2026-10-29T03:40:23.5376762Z MODE:
|
||||
2026-10-29T03:40:23.5376997Z FELHOM_WHEEL_FETCH: 1
|
||||
2026-10-29T03:40:23.5377245Z ::endgroup::
|
||||
2026-10-29T03:40:23.5439598Z mode: run
|
||||
2026-10-29T03:40:23.7857825Z /root/.cache/act/2a6440825f6876fa/hostexecutor/scripts/security_watch.py:905: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
|
||||
2026-10-29T03:40:23.7858899Z today = datetime.date.fromisoformat(opts["today"]) if "today" in opts else datetime.datetime.utcnow().date()
|
||||
2026-10-29T03:40:23.8364115Z security watch 2026-10-29: 197 pins (11 box/build, 97 app, 89 DooPlex); GitHub key PRESENT — every repo's advisories tonight
|
||||
2026-10-29T03:40:48.7656275Z RUNTIME-READ golang:1.27.3-trixie 17 s ok
|
||||
2026-10-29T03:40:52.6564202Z RUNTIME-READ debian:13.7-slim 3 s ok
|
||||
2026-10-29T03:41:24.9631738Z RUNTIME-READ lscr.io/linuxserver/bookstack:26.09.2 26 s ok
|
||||
2026-10-29T03:41:28.4809264Z RUNTIME-READ gitea/gitea:28.2.0 23 s ok
|
||||
2026-10-29T03:41:59.4507381Z RUNTIME-READ ghcr.io/gethomepage/homepage:v2.7.0 48 s ok
|
||||
2026-10-29T03:42:27.1340174Z RUNTIME-READ ghost:6.73.0-alpine 84 s ok
|
||||
2026-10-29T03:42:53.3960683Z RUNTIME-READ ghcr.io/immich-app/immich-machine-learning:v3.3.5 84 s ok
|
||||
2026-10-29T03:43:13.5548282Z RUNTIME-READ freikin/dawarich:1.19.0 133 s ok
|
||||
2026-10-29T03:43:19.3003941Z RUNTIME-READ ghcr.io/home-assistant/home-assistant:2026.10.4 129 s ok
|
||||
2026-10-29T03:43:22.2903090Z RUNTIME-READ ghcr.io/alexta69/metube:2026.10.27 42 s ok
|
||||
2026-10-29T03:43:24.5321881Z RUNTIME-READ ghcr.io/immich-app/immich-server:v3.3.5 117 s ok
|
||||
2026-10-29T03:43:42.3091577Z RUNTIME-READ ghcr.io/karakeep-app/karakeep:0.34.1 99 s ok
|
||||
2026-10-29T03:43:53.5315995Z RUNTIME-READ flomp/wanderer-db:v0.21.2 11 s ok
|
||||
2026-10-29T03:44:06.9760762Z RUNTIME-READ ghcr.io/papra-hq/papra:26.7.1-rootless 50 s ok
|
||||
2026-10-29T03:44:09.1286025Z RUNTIME-READ rommapp/romm:5.4.1 42 s ok
|
||||
2026-10-29T03:44:11.4679858Z RUNTIME-READ flomp/wanderer-web:v0.21.2 33 s ok
|
||||
2026-10-29T03:44:15.0633614Z RUNTIME-READ busybox:1.38 2 s ok
|
||||
2026-10-29T03:44:18.1985022Z RUNTIME-READ ghcr.io/lukegus/termix:26.10.5 49 s ok
|
||||
2026-10-29T03:44:24.7879830Z RUNTIME-READ ghcr.io/tandoorrecipes/recipes:2.7.2 56 s ok
|
||||
2026-10-29T03:44:40.5312194Z RUNTIME-READ nginx:1.31-alpine 11 s ok
|
||||
2026-10-29T03:44:43.5665910Z RUNTIME-READ redis:8.10-alpine 9 s ok
|
||||
2026-10-29T03:44:44.3224490Z RUNTIME-READ redis:8-alpine 10 s ok
|
||||
2026-10-29T03:44:56.9107213Z RUNTIME-READ ghcr.io/diced/zipline:4.8.2 46 s ok
|
||||
2026-10-29T03:45:05.1986991Z RUNTIME-READ python:3.15-bookworm 32 s ok
|
||||
2026-10-29T03:45:10.1228890Z RUNTIME-READ docker.io/library/nextcloud:34.0.5-apache 54 s ok
|
||||
2026-10-29T03:45:10.2702229Z ADVISORY doop actualbudget/actual-server 26.10.0 CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-10-29T03:45:10.2702993Z ADVISORY doop advplyr/audiobookshelf 2.37.1 CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-10-29T03:45:10.2703319Z ADVISORY box cloudflare/cloudflared 2026.10.4 feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3 (fixed read the notice); vulnnotes:cloudflared@2026.10.5:VULN-183456 (fixed 2026.10.5)
|
||||
2026-10-29T03:45:10.2703777Z ADVISORY doop codewithcj/sparkyfitness v1.9.0 release:CodeWithCJ/SparkyFitness@v1.10.0 (fixed v1.10.0)
|
||||
2026-10-29T03:45:10.2704098Z ADVISORY doop codewithcj/sparkyfitness_server v1.9.0 release:CodeWithCJ/SparkyFitness@v1.10.0 (fixed v1.10.0); CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-10-29T03:45:10.2704413Z ADVISORY doop crocodilestick/calibre-web-automated dev CVE-2026-111497 (fixed 1.2.1)
|
||||
2026-10-29T03:45:10.2704686Z ADVISORY doop docker.io/calcom/cal.com v6.2.0 CVE-2026-111497 (fixed 22.23.4, 24.22.1, 26.12.1)
|
||||
2026-10-29T03:45:10.2704951Z ADVISORY doop flomp/wanderer-db v0.21.0 GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2); … 1 more
|
||||
2026-10-29T03:45:10.2705278Z ADVISORY doop flomp/wanderer-web v0.21.0 GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2); … 2 more
|
||||
2026-10-29T03:45:10.2705583Z ADVISORY doop ghcr.io/gethomepage/homepage v1.13.2 GHSA-669x-4pg4-w24r (fixed 2.2.0); CVE-2026-111497 (fixed 22.23.4)
|
||||
2026-10-29T03:45:10.2705874Z ADVISORY doop ghcr.io/immich-app/immich-machine-learning v2.7.5 GHSA-q89f-h332-8q2h (fixed v3.2.4); GHSA-h5w4-vjv4-9r5q (fixed a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 (fixed v3.2.0); GHSA-72rm-x7xr-v679 (fixed v3.3.0); … 7 more
|
||||
2026-10-29T03:45:10.2706238Z ADVISORY doop ghcr.io/immich-app/immich-server v2.7.5 GHSA-q89f-h332-8q2h (fixed v3.2.4); GHSA-h5w4-vjv4-9r5q (fixed a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 (fixed v3.2.0); GHSA-72rm-x7xr-v679 (fixed v3.3.0); … 8 more
|
||||
2026-10-29T03:45:10.2706551Z ADVISORY doop ghcr.io/lukegus/termix release-2.9.2 CVE-2026-111497 (fixed 26.12.1)
|
||||
2026-10-29T03:45:10.2706808Z ADVISORY doop ghcr.io/paperless-ngx/paperless-ngx 3.3.4 CVE-2026-111497 (fixed 1.2.1)
|
||||
2026-10-29T03:45:10.2708268Z ADVISORY doop gitea/gitea 1.26.2 GHSA-wx44-9m3m-rjqx (fixed 28.2.0); GHSA-4jmf-h2cm-hg7w (fixed 28.2.0); GHSA-8j56-f865-gqq2 (fixed 28.2.0); GHSA-fxq4-gr55-7x5g (fixed 28.2.0); … 127 more
|
||||
2026-10-29T03:45:10.2708623Z ADVISORY doop grafana/grafana 13.2.4 GHSA-8xmm-x63g-f6xv (fixed no fixed version named yet); GHSA-4724-7jwc-3fpw (fixed the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 (fixed the range is unreadable — check by hand); GHSA-8wjh-59cw-9xh4 (fixed no fixed version named yet); … 2 more
|
||||
2026-10-29T03:45:10.2709027Z ADVISORY box gtstef/filebrowser 1.5.8-stable GHSA-gfgm-886h-6r47 (fixed 2.0.2-stable, 2.1.4-beta); GHSA-wxj5-g3qp-g732 (fixed 2.0.2-stable, 2.1.3-beta); GHSA-3j46-5w28-f8p2 (fixed 2.1.0-stable, 2.1.3-beta); GHSA-4vrc-935w-xxq2 (fixed 2.1.0-stable, 2.1.3-beta); … 31 more
|
||||
2026-10-29T03:45:10.2709400Z ADVISORY doop louislam/uptime-kuma 2.5.6 GHSA-qjxc-h5jf-c7rj (fixed the range is unreadable — check by hand); release:louislam/uptime-kuma@2.5.8 (fixed 2.5.8); release:louislam/uptime-kuma@2.5.7 (fixed 2.5.7); CVE-2026-111497 (fixed 22.23.4)
|
||||
2026-10-29T03:45:10.2709760Z ADVISORY doop outlinewiki/outline 1.11.0 GHSA-x4w3-9p9j-cprh (fixed 1.12.0); GHSA-rq53-m97j-f2pg (fixed 1.12.0); GHSA-h6ff-rw9x-5mq2 (fixed 1.12.0); GHSA-rvj7-2gww-6xfq (fixed 1.12.0); … 3 more
|
||||
2026-10-29T03:45:10.2710060Z ADVISORY doop redis 8.10.2 GHSA-c8h9-259x-jff4 (fixed the range is unreadable — check by hand); GHSA-8ghh-qpmp-7826 (fixed no fixed version named yet); GHSA-93m2-935m-8rj3 (fixed no fixed version named yet); GHSA-m8fj-85cg-7vhp (fixed the range is unreadable — check by hand); … 8 more
|
||||
2026-10-29T03:45:10.2710423Z ADVISORY doop rommapp/romm 5.4.0 release:rommapp/romm@5.4.1 (fixed 5.4.1); CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-10-29T03:45:10.2710679Z ADVISORY doop vabene1111/recipes 2.6.15 CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-10-29T03:45:10.2710914Z ADVISORY app actualbudget/actual-server 26.9.0 CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-10-29T03:45:10.2711234Z ADVISORY app calcom/cal.com v6.2.0 GHSA-p3f6-52gv-cj7m (fixed the range is unreadable — check by hand); GHSA-cpf2-q635-xrwx (fixed the range is unreadable — check by hand); CVE-2026-111497 (fixed 22.23.4, 24.22.1, 26.12.1)
|
||||
2026-10-29T03:45:10.2711707Z ADVISORY app codewithcj/sparkyfitness v0.17.3 GHSA-v883-jx9h-qf29 (fixed a version after 1.7.2 (the notice names none)); GHSA-cmmf-53wf-r5gv (fixed a version after 1.6.5 (the notice names none)); GHSA-p8cf-g8rv-gvrq (fixed a version after 1.6.5 (the notice names none))
|
||||
2026-10-29T03:45:10.2712054Z ADVISORY app codewithcj/sparkyfitness_server v0.17.3 GHSA-v883-jx9h-qf29 (fixed a version after 1.7.2 (the notice names none)); GHSA-cmmf-53wf-r5gv (fixed a version after 1.6.5 (the notice names none)); GHSA-p8cf-g8rv-gvrq (fixed a version after 1.6.5 (the notice names none)); CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-10-29T03:45:10.2712500Z ADVISORY app crocodilestick/calibre-web-automated v4.0.8 CVE-2026-111497 (fixed 1.2.1)
|
||||
2026-10-29T03:45:10.2712858Z ADVISORY app f0rc3/gokapi v1.9.6 GHSA-45vh-rpc8-hxpp (fixed 2.2.4); GHSA-qwc6-vc2v-2ggj (fixed 2.2.4); GHSA-j6jp-78w8-34x6 (fixed 2.2.4); GHSA-m2hx-wjxc-9fp4 (fixed 2.2.3); … 6 more
|
||||
2026-10-29T03:45:10.2713243Z ADVISORY app ghcr.io/immich-app/immich-machine-learning v3.3.5 GHSA-8244-8vpr-vp9c (fixed the range is unreadable — check by hand)
|
||||
2026-10-29T03:45:10.2713887Z ADVISORY app ghcr.io/immich-app/immich-server v3.3.5 GHSA-8244-8vpr-vp9c (fixed the range is unreadable — check by hand)
|
||||
2026-10-29T03:45:10.2714233Z ADVISORY app ghcr.io/karakeep-app/karakeep 0.34.1 GHSA-pp34-2c9r-mchw (fixed no fixed version named yet)
|
||||
2026-10-29T03:45:10.2714676Z ADVISORY app ghcr.io/lukegus/termix 26.10.5 GHSA-r9gw-3w87-mhh7 (fixed no fixed version named yet)
|
||||
2026-10-29T03:45:10.2715108Z ADVISORY app ghcr.io/paperless-ngx/paperless-ngx 2.20.15 GHSA-c8f3-pqr2-rr24 (fixed 3.3.2); GHSA-2jhj-xqrq-rmrq (fixed 3.1.2); CVE-2026-111497 (fixed 1.1.1)
|
||||
2026-10-29T03:45:10.2715469Z ADVISORY app ghcr.io/tandoorrecipes/recipes 2.7.2 GHSA-c7mc-c9jr-38hf (fixed the range is unreadable — check by hand); GHSA-cqj3-64qw-4w52 (fixed the range is unreadable — check by hand)
|
||||
2026-10-29T03:45:10.2715891Z ADVISORY app gitea/gitea 28.2.0 GHSA-rqhx-647v-wx32 (fixed no fixed version named yet)
|
||||
2026-10-29T03:45:10.2716198Z ADVISORY app glanceapp/glance v0.8.5 GHSA-r225-jhr6-68cc (fixed >= 0.8.7)
|
||||
2026-10-29T03:45:10.2716634Z ADVISORY app grafana/grafana 13.2.4 GHSA-8xmm-x63g-f6xv (fixed no fixed version named yet); GHSA-4724-7jwc-3fpw (fixed the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 (fixed the range is unreadable — check by hand); GHSA-8wjh-59cw-9xh4 (fixed no fixed version named yet); … 2 more
|
||||
2026-10-29T03:45:10.2717021Z ADVISORY app louislam/uptime-kuma 2.5.7 GHSA-qjxc-h5jf-c7rj (fixed the range is unreadable — check by hand); release:louislam/uptime-kuma@2.5.8 (fixed 2.5.8)
|
||||
2026-10-29T03:45:10.2717489Z ADVISORY app n8nio/n8n 2.44.7 GHSA-2x68-96jw-5r6c (fixed >= 3.0.1); GHSA-9p7v-45m2-wxgj (fixed >= 3.0.1); GHSA-mx4r-96jx-v278 (fixed >= 3.0.1); GHSA-4v22-g448-h4rg (fixed >= 2.45.5, >= 2.46.1, >= 3.0.1); … 9 more
|
||||
2026-10-29T03:45:10.2717844Z ADVISORY app rommapp/romm 5.4.1 CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-10-29T03:45:10.2719539Z NOT CHECKED doop gitea.dooplex.hu/admin/felhom-act-runner 0.1.0 registry gitea.dooplex.hu: no anonymous token route
|
||||
2026-10-29T03:45:10.2720137Z NOT CHECKED doop gitea.dooplex.hu/admin/jarr latest registry gitea.dooplex.hu: no anonymous token route
|
||||
2026-10-29T03:45:10.2720466Z NOT CHECKED doop gitea.dooplex.hu/admin/recipe-importer latest registry gitea.dooplex.hu: no anonymous token route
|
||||
2026-10-29T03:45:10.2721092Z NOT CHECKED doop gitea.dooplex.hu/admin/revfulop-calendar 1.6.2 registry gitea.dooplex.hu: no anonymous token route
|
||||
2026-10-29T03:45:10.2721581Z NOT CHECKED doop gitea.dooplex.hu/admin/sparkyfitness-export 0.3.0 registry gitea.dooplex.hu: no anonymous token route
|
||||
2026-10-29T03:45:10.2721975Z NOT CHECKED doop gitea.dooplex.hu/admin/wan-probe 0.1.0 registry gitea.dooplex.hu: no anonymous token route
|
||||
2026-10-29T03:45:10.2722286Z NOT CHECKED doop minio/minio latest Docker registry tags of minio/minio: HTTP 401; manifest minio/minio:latest: HTTP 401
|
||||
2026-10-29T03:45:10.2722903Z NOT CHECKED app nginx 1.30.5-alpine https://github.com/nginx/nginx/releases.atom: The read operation timed out
|
||||
2026-10-29T03:45:10.2723332Z BEHIND doop getmeili/meilisearch v1.11.3 newest v1.56.0
|
||||
2026-10-29T03:45:10.2723627Z BEHIND doop ghcr.io/diced/zipline 4.8.1 newest 4.8.2
|
||||
2026-10-29T03:45:10.2724078Z BEHIND app getmeili/meilisearch v1.41.0 newest v1.56.0
|
||||
2026-10-29T03:45:10.2724557Z BEHIND app getmeili/meilisearch v1.36.0 newest v1.56.0
|
||||
2026-10-29T03:45:10.2724916Z BEHIND app ghcr.io/hargata/lubelogger v1.7.3 newest v1.7.4
|
||||
2026-10-29T03:45:10.2725457Z BEHIND app ghcr.io/kozea/radicale 3.8.1 newest 3.9.0
|
||||
2026-10-29T03:45:10.2725874Z BEHIND app gotson/komga 1.28.0 newest 1.29.2
|
||||
2026-10-29T03:45:10.2726286Z BEHIND app kimai/kimai2 2.67.0 newest 2.71.0
|
||||
2026-10-29T03:45:10.2726511Z BEHIND app lscr.io/linuxserver/bookstack 26.09.2 newest 26.09.20260929
|
||||
2026-10-29T03:45:10.2726951Z BEHIND app nextcloud 34.0.4-apache newest 34.0.5-apache
|
||||
2026-10-29T03:45:10.2727330Z BEHIND app qbittorrentofficial/qbittorrent-nox 5.2.4-1 newest 5.3.0-2
|
||||
2026-10-29T03:45:10.2727572Z GAP buil alpine 3.24.2 newest 3.24.3
|
||||
2026-10-29T03:45:10.2727788Z GAP buil alpine 3.24.2 newest 3.24.3
|
||||
2026-10-29T03:45:10.2728280Z GAP doop alpine/k8s 1.37.1
|
||||
2026-10-29T03:45:10.2728725Z GAP doop arcadiatechnology/crafty-4 4.11.0
|
||||
2026-10-29T03:45:10.2729015Z GAP doop bhgedigital/envsubst latest
|
||||
2026-10-29T03:45:10.2729311Z GAP doop busybox 1.38
|
||||
2026-10-29T03:45:10.2729584Z GAP doop codercom/code-server 4.143.1
|
||||
2026-10-29T03:45:10.2729826Z GAP buil debian 13.7-slim
|
||||
2026-10-29T03:45:10.2730036Z GAP buil debian 13.7-slim
|
||||
2026-10-29T03:45:10.2730253Z GAP doop docker.io/bitnamilegacy/postgresql 17.6.0-debian-12-r3
|
||||
2026-10-29T03:45:10.2730550Z GAP doop docker.io/library/nextcloud 34.0.5-apache
|
||||
2026-10-29T03:45:10.2731354Z GAP doop docker.io/valkey/valkey 9.2-alpine
|
||||
2026-10-29T03:45:10.2731711Z GAP doop filebrowser/filebrowser v2.63.23
|
||||
2026-10-29T03:45:10.2731938Z GAP doop ghcr.io/cloudnative-pg/postgresql 17.2 newest 17.11
|
||||
2026-10-29T03:45:10.2732170Z GAP doop ghcr.io/headlamp-k8s/headlamp v0.46.0
|
||||
2026-10-29T03:45:10.2732386Z GAP doop ghcr.io/immich-app/postgres 16-vectorchord0.3.0
|
||||
2026-10-29T03:45:10.2732679Z GAP doop ghcr.io/jimmidyson/configmap-reload v0.15.0
|
||||
2026-10-29T03:45:10.2732914Z GAP doop ghcr.io/onedr0p/exportarr v2.3.0
|
||||
2026-10-29T03:45:10.2733158Z GAP doop ghcr.io/seriousm4x/upsnap 5
|
||||
2026-10-29T03:45:10.2733409Z GAP doop ghcr.io/stakater/reloader v1.4.22 newest v1.4.23
|
||||
2026-10-29T03:45:10.2733695Z GAP doop ghcr.io/tautulli/tautulli v2.18.2
|
||||
2026-10-29T03:45:10.2733913Z GAP doop griefed/serverpackcreator 8.1.2
|
||||
2026-10-29T03:45:10.2734208Z GAP doop gtstef/filebrowser 1.5.8-stable
|
||||
2026-10-29T03:45:10.2734553Z GAP doop guacamole/guacamole 1.6.0
|
||||
2026-10-29T03:45:10.2734769Z GAP doop guacamole/guacd 1.6.0
|
||||
2026-10-29T03:45:10.2734974Z GAP doop index.docker.io/plexinc/pms-docker 1.43.5.11029-6bf8af3f0
|
||||
2026-10-29T03:45:10.2735220Z GAP doop itzg/mc-backup 2026.10.1 newest 2026.10.2
|
||||
2026-10-29T03:45:10.2735508Z GAP doop itzg/minecraft-server 2026.10.0-java21 newest 2026.10.1-java17
|
||||
2026-10-29T03:45:10.2735780Z GAP doop linuxserver/bookstack 26.09.20260929
|
||||
2026-10-29T03:45:10.2736002Z GAP doop linuxserver/prowlarr version-2.6.5.5623
|
||||
2026-10-29T03:45:10.2736276Z GAP doop linuxserver/qbittorrent 5.3.0
|
||||
2026-10-29T03:45:10.2736498Z GAP doop linuxserver/radarr version-6.4.4.10685
|
||||
2026-10-29T03:45:10.2736718Z GAP doop linuxserver/sonarr version-4.0.20.3014
|
||||
2026-10-29T03:45:10.2736962Z GAP doop mariadb 11
|
||||
2026-10-29T03:45:10.2737234Z GAP doop mikefarah/yq 4.54.1
|
||||
2026-10-29T03:45:10.2737453Z GAP doop mongodb/mongodb-community-server 8.0.5-ubuntu2204 newest 8.3.13-ubuntu2204
|
||||
2026-10-29T03:45:10.2737689Z GAP doop msdeluise/plant-it-server 0.10.0
|
||||
2026-10-29T03:45:10.2737908Z GAP doop mysql 8.4
|
||||
2026-10-29T03:45:10.2738173Z GAP doop nicolaka/netshoot latest
|
||||
2026-10-29T03:45:10.2738388Z GAP doop postgis/postgis 16-3.5
|
||||
2026-10-29T03:45:10.2738622Z GAP doop postgres 15-alpine
|
||||
2026-10-29T03:45:10.2738924Z GAP doop postgres 16-alpine
|
||||
2026-10-29T03:45:10.2739152Z GAP doop privatebin/nginx-fpm-alpine 2.0.6 newest 2.1.0
|
||||
2026-10-29T03:45:10.2739500Z GAP doop prom/alertmanager v0.34.1
|
||||
2026-10-29T03:45:10.2739720Z GAP doop prom/node-exporter v1.12.1
|
||||
2026-10-29T03:45:10.2739962Z GAP doop prom/prometheus v3.15.0 newest v3.15.1
|
||||
2026-10-29T03:45:10.2740197Z GAP doop prometheuscommunity/smartctl-exporter v0.15.0
|
||||
2026-10-29T03:45:10.2740485Z GAP doop python 3.15-bookworm
|
||||
2026-10-29T03:45:10.2740710Z GAP doop quay.io/jetstack/version-checker v0.11.0
|
||||
2026-10-29T03:45:10.2741020Z GAP doop quay.io/prometheus/blackbox-exporter v0.29.1
|
||||
2026-10-29T03:45:10.2741246Z GAP doop renovate/renovate 44.181.1 newest 44.190.2
|
||||
2026-10-29T03:45:10.2741522Z GAP doop tailscale/tailscale v1.104.2
|
||||
2026-10-29T03:45:10.2741740Z GAP app emby/embyserver 4.11.0.4 newest 4.11.0.11
|
||||
2026-10-29T03:45:10.2741960Z GAP app ghcr.io/immich-app/postgres 16-vectorchord0.4.3-pg
|
||||
2026-10-29T03:45:10.2742311Z GAP app ghcr.io/karakeep-app/karakeep-chrome 151.0.7922.47-r1
|
||||
2026-10-29T03:45:10.2742544Z GAP app mariadb 12.3
|
||||
2026-10-29T03:45:10.2742757Z GAP app mariadb 11.4 newest 11.8
|
||||
2026-10-29T03:45:10.2742977Z GAP app mariadb 11.8
|
||||
2026-10-29T03:45:10.2743199Z GAP app mariadb 12.3
|
||||
2026-10-29T03:45:10.2743422Z GAP app mariadb 11.8
|
||||
2026-10-29T03:45:10.2743635Z GAP app msdeluise/plant-it 0.10.0
|
||||
2026-10-29T03:45:10.2743857Z GAP app plexinc/pms-docker 1.43.5.11029-6bf8af3f0
|
||||
2026-10-29T03:45:10.2744082Z GAP app postgis/postgis 16-3.5-alpine
|
||||
2026-10-29T03:45:10.2744286Z GAP app postgis/postgis 17-3.5-alpine
|
||||
2026-10-29T03:45:10.2744496Z GAP app postgres 18-alpine
|
||||
2026-10-29T03:45:10.2744710Z GAP app postgres 17-alpine
|
||||
2026-10-29T03:45:10.2744918Z GAP app postgres 18-alpine
|
||||
2026-10-29T03:45:10.2745134Z GAP app postgres 18-alpine
|
||||
2026-10-29T03:45:10.2745429Z GAP app postgres 18-alpine
|
||||
2026-10-29T03:45:10.2745644Z GAP app postgres 18-alpine
|
||||
2026-10-29T03:45:10.2745910Z GAP app postgres 18-alpine
|
||||
2026-10-29T03:45:10.2746228Z GAP app postgres 17-alpine
|
||||
2026-10-29T03:45:10.2746496Z GAP app postgres 16-alpine
|
||||
2026-10-29T03:45:10.2747078Z GAP app registry.gitlab.com/crafty-controller/crafty-4 4.11.0
|
||||
2026-10-29T03:45:10.2747317Z FLOATING doop ghcr.io/seanmorley15/adventurelog-backend latest
|
||||
2026-10-29T03:45:10.2747607Z FLOATING doop ghcr.io/seanmorley15/adventurelog-frontend latest
|
||||
2026-10-29T03:45:10.2747839Z FLOATING doop nginx 1.31-alpine
|
||||
2026-10-29T03:45:10.2748058Z FLOATING doop redis 8-alpine
|
||||
2026-10-29T03:45:10.2748265Z FLOATING doop redis 8.10-alpine
|
||||
2026-10-29T03:45:10.2748532Z FLOATING app ghcr.io/claperco/claper 2.5
|
||||
2026-10-29T03:45:10.2748796Z FLOATING app ghcr.io/thomiceli/opengist 1.15
|
||||
2026-10-29T03:45:10.2749211Z FLOATING app jellyfin/jellyfin 12.4
|
||||
2026-10-29T03:45:10.2749534Z FLOATING app lscr.io/linuxserver/prowlarr version-2.6.5.5623
|
||||
2026-10-29T03:45:10.2749761Z FLOATING app lscr.io/linuxserver/sabnzbd version-5.1.3
|
||||
2026-10-29T03:45:10.2750107Z FLOATING app lscr.io/linuxserver/transmission version-4.1.3-r0
|
||||
2026-10-29T03:45:10.2750317Z FLOATING app nzbgetcom/nzbget v26.3
|
||||
2026-10-29T03:45:10.2750537Z FLOATING app redis 7.4-alpine
|
||||
2026-10-29T03:45:10.2750745Z FLOATING app redis 7-alpine
|
||||
2026-10-29T03:45:10.2750961Z FLOATING app redis 7-alpine
|
||||
2026-10-29T03:45:10.2751174Z FLOATING app redis 7-alpine
|
||||
2026-10-29T03:45:10.2751381Z FLOATING app redis 7-alpine
|
||||
2026-10-29T03:45:10.2751592Z FLOATING app redis 7-alpine
|
||||
2026-10-29T03:45:10.2751792Z FLOATING app redis 7-alpine
|
||||
2026-10-29T03:45:10.2752051Z FLOATING app wger/server 2.7
|
||||
2026-10-29T03:45:10.2752334Z SELF box gitea.dooplex.hu/admin/felhom-samba 1.2.0
|
||||
2026-10-29T03:45:10.2752551Z SELF app gitea.dooplex.hu/admin/recipe-importer v0.9.11
|
||||
2026-10-29T03:45:10.2752795Z CURRENT doop f0rc3/gokapi v2.2.4
|
||||
2026-10-29T03:45:10.2753026Z CURRENT doop ghcr.io/alam00000/bentopdf 2.8.10
|
||||
2026-10-29T03:45:10.2753243Z CURRENT doop ghcr.io/seerr-team/seerr v3.5.1
|
||||
2026-10-29T03:45:10.2753461Z CURRENT doop ghcr.io/thomiceli/opengist 1.15.3
|
||||
2026-10-29T03:45:10.2753671Z CURRENT doop glanceapp/glance v0.8.7
|
||||
2026-10-29T03:45:10.2753939Z CURRENT buil golang 1.27.3-trixie
|
||||
2026-10-29T03:45:10.2754143Z CURRENT buil golang 1.27.3-alpine3.24
|
||||
2026-10-29T03:45:10.2754374Z CURRENT doop onlyoffice/documentserver 9.4.0
|
||||
2026-10-29T03:45:10.2754586Z CURRENT buil restic 0.19.1
|
||||
2026-10-29T03:45:10.2754799Z CURRENT box traefik v3.7.16
|
||||
2026-10-29T03:45:10.2755017Z CURRENT doop vaultwarden/server 1.37.4
|
||||
2026-10-29T03:45:10.2755236Z CURRENT app deluan/navidrome 0.64.2
|
||||
2026-10-29T03:45:10.2755449Z CURRENT app docmost/docmost 0.97.0
|
||||
2026-10-29T03:45:10.2755665Z CURRENT app flomp/wanderer-db v0.21.2
|
||||
2026-10-29T03:45:10.2755958Z CURRENT app flomp/wanderer-web v0.21.2
|
||||
2026-10-29T03:45:10.2756178Z CURRENT app freikin/dawarich 1.19.0
|
||||
2026-10-29T03:45:10.2756394Z CURRENT app ghcr.io/advplyr/audiobookshelf 2.37.2
|
||||
2026-10-29T03:45:10.2756605Z CURRENT app ghcr.io/alam00000/bentopdf v2.8.10
|
||||
2026-10-29T03:45:10.2756859Z CURRENT app ghcr.io/alexta69/metube 2026.10.27
|
||||
2026-10-29T03:45:10.2757075Z CURRENT app ghcr.io/cmintey/wishlist v0.69.0
|
||||
2026-10-29T03:45:10.2757281Z CURRENT app ghcr.io/diced/zipline 4.8.2
|
||||
2026-10-29T03:45:10.2757551Z CURRENT app ghcr.io/gethomepage/homepage v2.7.0
|
||||
2026-10-29T03:45:10.2757984Z CURRENT app ghcr.io/gramps-project/grampsweb v25.6.0
|
||||
2026-10-29T03:45:10.2758496Z CURRENT app ghcr.io/grimmory-tools/grimmory v3.5.0
|
||||
2026-10-29T03:45:10.2758740Z CURRENT app ghcr.io/home-assistant/home-assistant 2026.10.4
|
||||
2026-10-29T03:45:10.2759004Z CURRENT app ghcr.io/mealie-recipes/mealie v3.29.0
|
||||
2026-10-29T03:45:10.2759225Z CURRENT app ghcr.io/papra-hq/papra 26.7.1-rootless
|
||||
2026-10-29T03:45:10.2759446Z CURRENT app ghcr.io/seanmorley15/adventurelog-backend v0.13.1
|
||||
2026-10-29T03:45:10.2759727Z CURRENT app ghcr.io/seanmorley15/adventurelog-frontend v0.13.1
|
||||
2026-10-29T03:45:10.2760034Z CURRENT app ghcr.io/seerr-team/seerr v3.5.1
|
||||
2026-10-29T03:45:10.2760436Z CURRENT app ghcr.io/sysadminsmedia/homebox 0.27.1
|
||||
2026-10-29T03:45:10.2760648Z CURRENT app ghost 6.73.0-alpine
|
||||
2026-10-29T03:45:10.2760906Z CURRENT app lscr.io/linuxserver/code-server 4.143.1
|
||||
2026-10-29T03:45:10.2761126Z CURRENT app lscr.io/linuxserver/grocy 4.7.1
|
||||
2026-10-29T03:45:10.2761339Z CURRENT app lscr.io/linuxserver/radarr 6.4.4
|
||||
2026-10-29T03:45:10.2761737Z CURRENT app lscr.io/linuxserver/sonarr 4.0.20
|
||||
2026-10-29T03:45:10.2761955Z CURRENT app lukevella/rallly 4.16.3
|
||||
2026-10-29T03:45:10.2762164Z CURRENT app onlyoffice/documentserver 9.4.0
|
||||
2026-10-29T03:45:10.2762381Z CURRENT app outlinewiki/outline 1.12.0
|
||||
2026-10-29T03:45:10.2762630Z CURRENT app privatebin/pdo 2.1.0
|
||||
2026-10-29T03:45:10.2762853Z CURRENT app vaultwarden/server 1.37.4-alpine
|
||||
2026-10-29T03:45:10.2763063Z CURRENT app vikunja/vikunja 2.7.1
|
||||
2026-10-29T03:45:10.2763339Z COUNTS ADVISORY=40 BEHIND=11 CURRENT=42 FLOATING=20 GAP=74 NOT_CHECKED=8 SELF=2
|
||||
2026-10-29T03:45:10.2763565Z RUNTIME read=25 (1211 s) from-cache=160 not-checked=0 zstd-decoder=zstandard 0.25.0 (pinned wheel, sha256 checked)
|
||||
2026-10-29T03:45:10.2763804Z TAGS fetched=0 from-cache=116 retried-429=0 (cache /root/.cache/felhom-watch-tags.json)
|
||||
2026-10-29T03:45:10.2764147Z REQUESTS api.github.com=69 api.osv.dev=1 auth.docker.io=1 blog.cloudflare.com=1 github.com=62 hub.docker.com=1 raw.githubusercontent.com=1 registry-1.docker.io=1
|
||||
2026-10-29T03:45:10.5832730Z MAIL RESEND-ACCEPTED id=01a185c2-fb55-75ab-829d-c93568d9e150 kind=advisory subject=[Felhom security] n8n, sparkyfitness, sparkyfitness_server — 14 new advisories
|
||||
2026-10-29T03:45:10.8162255Z MAIL RESEND-ACCEPTED id=01a185c2-fc34-7900-9a73-4f827a391139 kind=not_checked subject=[Felhom security] the watch could not check runtime
|
||||
2026-10-29T03:45:10.8307889Z STATE written: documentation/security-watch/state.json (307 known advisories)
|
||||
2026-10-29T03:45:10.9541884Z ::group::Run set -u
|
||||
2026-10-29T03:45:10.9542180Z set -u
|
||||
2026-10-29T03:45:10.9542296Z f=documentation/security-watch/state.json
|
||||
2026-10-29T03:45:10.9542408Z if [ ! -f "$f" ]; then
|
||||
2026-10-29T03:45:10.9542566Z echo "no memory file was written - nothing to commit"; exit 0
|
||||
2026-10-29T03:45:10.9542688Z fi
|
||||
2026-10-29T03:45:10.9542787Z if git ls-files --error-unmatch "$f" >/dev/null 2>&1 && git diff --quiet -- "$f"; then
|
||||
2026-10-29T03:45:10.9542919Z echo "memory unchanged - nothing to commit"; exit 0
|
||||
2026-10-29T03:45:10.9543057Z fi
|
||||
2026-10-29T03:45:10.9543148Z cp "$f" /tmp/state.json
|
||||
2026-10-29T03:45:10.9543259Z auth=$(python3 -c 'import base64,os;print(base64.b64encode(("x:"+os.environ["PUSH_TOKEN"]).encode()).decode())')
|
||||
2026-10-29T03:45:10.9543433Z for attempt in 1 2 3; do
|
||||
2026-10-29T03:45:10.9543536Z git fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD
|
||||
2026-10-29T03:45:10.9543648Z mkdir -p "$(dirname "$f")" && cp /tmp/state.json "$f"
|
||||
2026-10-29T03:45:10.9543758Z git add "$f"
|
||||
2026-10-29T03:45:10.9543885Z git -c user.name="felhom security watch" -c user.email=monitoring@felhom.eu \
|
||||
2026-10-29T03:45:10.9544007Z commit -q -m "security-watch: memory of $(date -u +%F) (R-1303). Docs only." || { echo "nothing to commit"; exit 0; }
|
||||
2026-10-29T03:45:10.9544136Z if git -c http.extraHeader="Authorization: Basic $auth" push -q origin HEAD:main; then
|
||||
2026-10-29T03:45:10.9544294Z echo "memory pushed: $(git rev-parse --short=12 HEAD)"; exit 0
|
||||
2026-10-29T03:45:10.9544412Z fi
|
||||
2026-10-29T03:45:10.9544507Z echo "push refused (attempt $attempt) - re-fetching main"
|
||||
2026-10-29T03:45:10.9544625Z sleep 5
|
||||
2026-10-29T03:45:10.9544754Z done
|
||||
2026-10-29T03:45:10.9544906Z echo "MEMORY NOT SAVED after 3 attempts"; exit 1
|
||||
2026-10-29T03:45:10.9545013Z shell: bash --noprofile --norc -e -o pipefail {0}
|
||||
2026-10-29T03:45:10.9545182Z env:
|
||||
2026-10-29T03:45:10.9545758Z PUSH_TOKEN: ***
|
||||
2026-10-29T03:45:10.9545875Z ::endgroup::
|
||||
2026-10-29T03:45:12.3598427Z memory pushed: ecae56559c5a
|
||||
2026-10-29T03:45:12.3608136Z Cleaning up container for job watch
|
||||
2026-10-29T03:45:12.9441522Z 🏁 Job succeeded
|
||||
@@ -0,0 +1,289 @@
|
||||
2026-10-30T03:40:11.7248310Z felhom-gates-runner(version:v0.6.1) received task 2558 of job watch, be triggered by event: schedule
|
||||
2026-10-30T03:40:11.7265758Z workflow prepared
|
||||
2026-10-30T03:40:11.7267133Z evaluating expression 'always()'
|
||||
2026-10-30T03:40:11.7268272Z expression 'always()' evaluated to 'true'
|
||||
2026-10-30T03:40:11.7273884Z evaluating expression ''
|
||||
2026-10-30T03:40:11.7274264Z expression '' evaluated to 'true'
|
||||
2026-10-30T03:40:11.7274465Z ⭐ Run Main Fetch main (latest, for the memory) and the two sibling repos
|
||||
2026-10-30T03:40:11.7277590Z Wrote command \n\necho "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"\nbase=http://gitea.gitea-system.svc.cluster.local:3000/admin\ngit init -q . && git remote add origin $base/felhom.eu.git\ngit fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD\necho "felhom.eu main at $(git rev-parse --short=12 HEAD)"\nfor r in felhom-controller app-catalog-felhom.eu; do\n git init -q ../$r && git -C ../$r remote add origin $base/$r.git\n git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD\n echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)"\ndone\n\n\n to 'workflow/0.sh'
|
||||
2026-10-30T03:40:11.7278728Z ::group::Run echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"
|
||||
2026-10-30T03:40:11.7278951Z echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"
|
||||
2026-10-30T03:40:11.7279111Z base=http://gitea.gitea-system.svc.cluster.local:3000/admin
|
||||
2026-10-30T03:40:11.7279234Z git init -q . && git remote add origin $base/felhom.eu.git
|
||||
2026-10-30T03:40:11.7279358Z git fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD
|
||||
2026-10-30T03:40:11.7279483Z echo "felhom.eu main at $(git rev-parse --short=12 HEAD)"
|
||||
2026-10-30T03:40:11.7279595Z for r in felhom-controller app-catalog-felhom.eu; do
|
||||
2026-10-30T03:40:11.7279723Z git init -q ../$r && git -C ../$r remote add origin $base/$r.git
|
||||
2026-10-30T03:40:11.7279837Z git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD
|
||||
2026-10-30T03:40:11.7279956Z echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)"
|
||||
2026-10-30T03:40:11.7280065Z done
|
||||
2026-10-30T03:40:11.7280170Z shell: bash --noprofile --norc -e -o pipefail {0}
|
||||
2026-10-30T03:40:11.7280303Z ::endgroup::
|
||||
2026-10-30T03:40:22.7209250Z felhom.eu main at e7d9c4637038
|
||||
2026-10-30T03:40:24.8509644Z felhom-controller at a90b62323f11
|
||||
2026-10-30T03:40:25.2932278Z app-catalog-felhom.eu at 313eaf68d01f
|
||||
2026-10-30T03:40:25.2960887Z ::group::Run set -u
|
||||
2026-10-30T03:40:25.2961285Z set -u
|
||||
2026-10-30T03:40:25.2961644Z mkdir -p documentation/security-watch
|
||||
2026-10-30T03:40:25.2961880Z mode="${MODE:-run}"
|
||||
2026-10-30T03:40:25.2962077Z [ "${GITHUB_EVENT_NAME:-}" = "schedule" ] && mode=run
|
||||
2026-10-30T03:40:25.2962397Z echo "mode: $mode"
|
||||
2026-10-30T03:40:25.2962597Z case "$mode" in
|
||||
2026-10-30T03:40:25.2962785Z test-mail) python3 scripts/security_watch.py --test-mail; exit $? ;;
|
||||
2026-10-30T03:40:25.2963031Z dry) extra="--no-mail" ; state=/tmp/state-dry.json
|
||||
2026-10-30T03:40:25.2963338Z cp documentation/security-watch/state.json "$state" 2>/dev/null || true ;;
|
||||
2026-10-30T03:40:25.2963571Z seed) extra="--seed" ; state=documentation/security-watch/state.json ;;
|
||||
2026-10-30T03:40:25.2963826Z run) extra="" ; state=documentation/security-watch/state.json ;;
|
||||
2026-10-30T03:40:25.2964228Z *) echo "unknown mode $mode"; exit 2 ;;
|
||||
2026-10-30T03:40:25.2964451Z esac
|
||||
2026-10-30T03:40:25.2964624Z python3 scripts/security_watch.py --state="$state" --catalog=../app-catalog-felhom.eu \
|
||||
2026-10-30T03:40:25.2964960Z --controller=../felhom-controller --json=/tmp/watch-results.json $extra
|
||||
2026-10-30T03:40:25.2965226Z shell: bash --noprofile --norc -e -o pipefail {0}
|
||||
2026-10-30T03:40:25.2965517Z env:
|
||||
2026-10-30T03:40:25.2966547Z RESEND_API_KEY: ***
|
||||
2026-10-30T03:40:25.2966770Z GH_ADVISORY_TOKEN: ***
|
||||
2026-10-30T03:40:25.2966988Z MODE:
|
||||
2026-10-30T03:40:25.2967226Z FELHOM_WHEEL_FETCH: 1
|
||||
2026-10-30T03:40:25.2967479Z ::endgroup::
|
||||
2026-10-30T03:40:25.3004031Z mode: run
|
||||
2026-10-30T03:40:25.5364487Z /root/.cache/act/0dffe838e7aa4c6b/hostexecutor/scripts/security_watch.py:905: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
|
||||
2026-10-30T03:40:25.5365252Z today = datetime.date.fromisoformat(opts["today"]) if "today" in opts else datetime.datetime.utcnow().date()
|
||||
2026-10-30T03:40:25.5923804Z security watch 2026-10-30: 197 pins (11 box/build, 97 app, 89 DooPlex); GitHub key PRESENT — every repo's advisories tonight
|
||||
2026-10-30T03:41:31.9624723Z RUNTIME-READ redis:7.4-alpine 6 s ok
|
||||
2026-10-30T03:41:34.9615036Z RUNTIME-READ redis:7-alpine 6 s ok
|
||||
2026-10-30T03:42:43.3808150Z RUNTIME-READ lscr.io/linuxserver/sabnzbd:version-5.1.3 9 s ok
|
||||
2026-10-30T03:43:44.9575246Z RUNTIME-READ ghcr.io/seanmorley15/adventurelog-frontend:latest 30 s ok
|
||||
2026-10-30T03:44:02.9458103Z ADVISORY doop actualbudget/actual-server 26.10.0 CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-10-30T03:44:02.9459232Z ADVISORY doop advplyr/audiobookshelf 2.37.1 CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-10-30T03:44:02.9459505Z ADVISORY box cloudflare/cloudflared 2026.10.4 feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3 (fixed read the notice); vulnnotes:cloudflared@2026.10.6:VULN-184686 (fixed 2026.10.6); vulnnotes:cloudflared@2026.10.5:VULN-183456 (fixed 2026.10.5)
|
||||
2026-10-30T03:44:02.9459806Z ADVISORY doop codewithcj/sparkyfitness v1.9.0 release:CodeWithCJ/SparkyFitness@v1.10.0 (fixed v1.10.0)
|
||||
2026-10-30T03:44:02.9460115Z ADVISORY doop codewithcj/sparkyfitness_server v1.9.0 release:CodeWithCJ/SparkyFitness@v1.10.0 (fixed v1.10.0); CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-10-30T03:44:02.9460382Z ADVISORY doop crocodilestick/calibre-web-automated dev CVE-2026-111497 (fixed 1.2.1)
|
||||
2026-10-30T03:44:02.9460596Z ADVISORY doop docker.io/calcom/cal.com v6.2.0 CVE-2026-111497 (fixed 22.23.4, 24.22.1, 26.12.1)
|
||||
2026-10-30T03:44:02.9460811Z ADVISORY doop flomp/wanderer-db v0.21.0 GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2); … 1 more
|
||||
2026-10-30T03:44:02.9461111Z ADVISORY doop flomp/wanderer-web v0.21.0 GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2); … 2 more
|
||||
2026-10-30T03:44:02.9461398Z ADVISORY doop ghcr.io/gethomepage/homepage v1.13.2 GHSA-669x-4pg4-w24r (fixed 2.2.0); CVE-2026-111497 (fixed 22.23.4)
|
||||
2026-10-30T03:44:02.9461671Z ADVISORY doop ghcr.io/immich-app/immich-machine-learning v2.7.5 GHSA-q89f-h332-8q2h (fixed v3.2.4); GHSA-h5w4-vjv4-9r5q (fixed a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 (fixed v3.2.0); GHSA-72rm-x7xr-v679 (fixed v3.3.0); … 7 more
|
||||
2026-10-30T03:44:02.9461962Z ADVISORY doop ghcr.io/immich-app/immich-server v2.7.5 GHSA-q89f-h332-8q2h (fixed v3.2.4); GHSA-h5w4-vjv4-9r5q (fixed a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 (fixed v3.2.0); GHSA-72rm-x7xr-v679 (fixed v3.3.0); … 8 more
|
||||
2026-10-30T03:44:02.9462213Z ADVISORY doop ghcr.io/lukegus/termix release-2.9.2 CVE-2026-111497 (fixed 26.12.1)
|
||||
2026-10-30T03:44:02.9462454Z ADVISORY doop ghcr.io/paperless-ngx/paperless-ngx 3.3.4 release:paperless-ngx/paperless-ngx@v3.4.0 (fixed v3.4.0); CVE-2026-111497 (fixed 1.2.1)
|
||||
2026-10-30T03:44:02.9462694Z ADVISORY doop gitea/gitea 1.26.2 GHSA-wx44-9m3m-rjqx (fixed 28.2.0); GHSA-4jmf-h2cm-hg7w (fixed 28.2.0); GHSA-8j56-f865-gqq2 (fixed 28.2.0); GHSA-fxq4-gr55-7x5g (fixed 28.2.0); … 127 more
|
||||
2026-10-30T03:44:02.9462997Z ADVISORY doop grafana/grafana 13.2.4 GHSA-8xmm-x63g-f6xv (fixed no fixed version named yet); GHSA-4724-7jwc-3fpw (fixed the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 (fixed the range is unreadable — check by hand); GHSA-8wjh-59cw-9xh4 (fixed no fixed version named yet); … 2 more
|
||||
2026-10-30T03:44:02.9464579Z ADVISORY box gtstef/filebrowser 1.5.8-stable GHSA-gfgm-886h-6r47 (fixed 2.0.2-stable, 2.1.4-beta); GHSA-wxj5-g3qp-g732 (fixed 2.0.2-stable, 2.1.3-beta); GHSA-3j46-5w28-f8p2 (fixed 2.1.0-stable, 2.1.3-beta); GHSA-4vrc-935w-xxq2 (fixed 2.1.0-stable, 2.1.3-beta); … 31 more
|
||||
2026-10-30T03:44:02.9464890Z ADVISORY doop louislam/uptime-kuma 2.5.6 GHSA-qjxc-h5jf-c7rj (fixed the range is unreadable — check by hand); release:louislam/uptime-kuma@2.5.8 (fixed 2.5.8); release:louislam/uptime-kuma@2.5.7 (fixed 2.5.7); CVE-2026-111497 (fixed 22.23.4)
|
||||
2026-10-30T03:44:02.9465347Z ADVISORY doop outlinewiki/outline 1.11.0 GHSA-x4w3-9p9j-cprh (fixed 1.12.0); GHSA-rq53-m97j-f2pg (fixed 1.12.0); GHSA-h6ff-rw9x-5mq2 (fixed 1.12.0); GHSA-rvj7-2gww-6xfq (fixed 1.12.0); … 3 more
|
||||
2026-10-30T03:44:02.9465618Z ADVISORY doop redis 8.10.2 GHSA-c8h9-259x-jff4 (fixed the range is unreadable — check by hand); GHSA-8ghh-qpmp-7826 (fixed no fixed version named yet); GHSA-93m2-935m-8rj3 (fixed no fixed version named yet); GHSA-m8fj-85cg-7vhp (fixed the range is unreadable — check by hand); … 8 more
|
||||
2026-10-30T03:44:02.9465963Z ADVISORY doop rommapp/romm 5.4.0 release:rommapp/romm@5.4.1 (fixed 5.4.1); CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-10-30T03:44:02.9466238Z ADVISORY doop vabene1111/recipes 2.6.15 CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-10-30T03:44:02.9466613Z ADVISORY app actualbudget/actual-server 26.9.0 CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-10-30T03:44:02.9466827Z ADVISORY app calcom/cal.com v6.2.0 GHSA-p3f6-52gv-cj7m (fixed the range is unreadable — check by hand); GHSA-cpf2-q635-xrwx (fixed the range is unreadable — check by hand); CVE-2026-111497 (fixed 22.23.4, 24.22.1, 26.12.1)
|
||||
2026-10-30T03:44:02.9467083Z ADVISORY app codewithcj/sparkyfitness v0.17.3 GHSA-v883-jx9h-qf29 (fixed a version after 1.7.2 (the notice names none)); GHSA-cmmf-53wf-r5gv (fixed a version after 1.6.5 (the notice names none)); GHSA-p8cf-g8rv-gvrq (fixed a version after 1.6.5 (the notice names none))
|
||||
2026-10-30T03:44:02.9467447Z ADVISORY app codewithcj/sparkyfitness_server v0.17.3 GHSA-v883-jx9h-qf29 (fixed a version after 1.7.2 (the notice names none)); GHSA-cmmf-53wf-r5gv (fixed a version after 1.6.5 (the notice names none)); GHSA-p8cf-g8rv-gvrq (fixed a version after 1.6.5 (the notice names none)); CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-10-30T03:44:02.9467765Z ADVISORY app crocodilestick/calibre-web-automated v4.0.8 CVE-2026-111497 (fixed 1.2.1)
|
||||
2026-10-30T03:44:02.9467979Z ADVISORY app f0rc3/gokapi v1.9.6 GHSA-45vh-rpc8-hxpp (fixed 2.2.4); GHSA-qwc6-vc2v-2ggj (fixed 2.2.4); GHSA-j6jp-78w8-34x6 (fixed 2.2.4); GHSA-m2hx-wjxc-9fp4 (fixed 2.2.3); … 6 more
|
||||
2026-10-30T03:44:02.9468293Z ADVISORY app ghcr.io/immich-app/immich-machine-learning v3.3.5 GHSA-8244-8vpr-vp9c (fixed the range is unreadable — check by hand)
|
||||
2026-10-30T03:44:02.9468543Z ADVISORY app ghcr.io/immich-app/immich-server v3.3.5 GHSA-8244-8vpr-vp9c (fixed the range is unreadable — check by hand)
|
||||
2026-10-30T03:44:02.9468833Z ADVISORY app ghcr.io/karakeep-app/karakeep 0.34.1 GHSA-pp34-2c9r-mchw (fixed no fixed version named yet)
|
||||
2026-10-30T03:44:02.9469073Z ADVISORY app ghcr.io/lukegus/termix 26.10.5 GHSA-r9gw-3w87-mhh7 (fixed no fixed version named yet); release:Termix-SSH/Termix@v26.10.6 (fixed v26.10.6)
|
||||
2026-10-30T03:44:02.9469458Z ADVISORY app ghcr.io/paperless-ngx/paperless-ngx 2.20.15 GHSA-c8f3-pqr2-rr24 (fixed 3.3.2); GHSA-2jhj-xqrq-rmrq (fixed 3.1.2); CVE-2026-111497 (fixed 1.1.1)
|
||||
2026-10-30T03:44:02.9469694Z ADVISORY app ghcr.io/tandoorrecipes/recipes 2.7.2 GHSA-c7mc-c9jr-38hf (fixed the range is unreadable — check by hand); GHSA-cqj3-64qw-4w52 (fixed the range is unreadable — check by hand)
|
||||
2026-10-30T03:44:02.9469950Z ADVISORY app gitea/gitea 28.2.0 GHSA-rqhx-647v-wx32 (fixed no fixed version named yet)
|
||||
2026-10-30T03:44:02.9470203Z ADVISORY app glanceapp/glance v0.8.5 GHSA-r225-jhr6-68cc (fixed >= 0.8.7)
|
||||
2026-10-30T03:44:02.9470421Z ADVISORY app grafana/grafana 13.2.4 GHSA-8xmm-x63g-f6xv (fixed no fixed version named yet); GHSA-4724-7jwc-3fpw (fixed the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 (fixed the range is unreadable — check by hand); GHSA-8wjh-59cw-9xh4 (fixed no fixed version named yet); … 2 more
|
||||
2026-10-30T03:44:02.9470707Z ADVISORY app louislam/uptime-kuma 2.5.7 GHSA-qjxc-h5jf-c7rj (fixed the range is unreadable — check by hand); release:louislam/uptime-kuma@2.5.8 (fixed 2.5.8)
|
||||
2026-10-30T03:44:02.9470989Z ADVISORY app n8nio/n8n 2.44.7 GHSA-2x68-96jw-5r6c (fixed >= 3.0.1); GHSA-9p7v-45m2-wxgj (fixed >= 3.0.1); GHSA-mx4r-96jx-v278 (fixed >= 3.0.1); GHSA-4v22-g448-h4rg (fixed >= 2.45.5, >= 2.46.1, >= 3.0.1); … 9 more
|
||||
2026-10-30T03:44:02.9471248Z ADVISORY app privatebin/pdo 2.1.0 GHSA-c4gc-8mcm-hh65 (fixed 2.1.1); GHSA-hw9p-r7fq-8mvr (fixed 2.1.1)
|
||||
2026-10-30T03:44:02.9471491Z ADVISORY app rommapp/romm 5.4.1 CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-10-30T03:44:02.9471757Z NOT CHECKED doop alpine/k8s 1.37.1 https://hub.docker.com/v2/repositories/alpine/k8s/tags: The read operation timed out
|
||||
2026-10-30T03:44:02.9472005Z NOT CHECKED doop gitea.dooplex.hu/admin/felhom-act-runner 0.1.0 registry gitea.dooplex.hu: no anonymous token route
|
||||
2026-10-30T03:44:02.9472251Z NOT CHECKED doop gitea.dooplex.hu/admin/jarr latest registry gitea.dooplex.hu: no anonymous token route
|
||||
2026-10-30T03:44:02.9472477Z NOT CHECKED doop gitea.dooplex.hu/admin/recipe-importer latest registry gitea.dooplex.hu: no anonymous token route
|
||||
2026-10-30T03:44:02.9472768Z NOT CHECKED doop gitea.dooplex.hu/admin/revfulop-calendar 1.6.2 registry gitea.dooplex.hu: no anonymous token route
|
||||
2026-10-30T03:44:02.9473014Z NOT CHECKED doop gitea.dooplex.hu/admin/sparkyfitness-export 0.3.0 registry gitea.dooplex.hu: no anonymous token route
|
||||
2026-10-30T03:44:02.9473212Z NOT CHECKED doop gitea.dooplex.hu/admin/wan-probe 0.1.0 registry gitea.dooplex.hu: no anonymous token route
|
||||
2026-10-30T03:44:02.9473422Z NOT CHECKED doop minio/minio latest Docker registry tags of minio/minio: HTTP 401; manifest minio/minio:latest: HTTP 401
|
||||
2026-10-30T03:44:02.9473643Z BEHIND doop getmeili/meilisearch v1.11.3 newest v1.56.0
|
||||
2026-10-30T03:44:02.9473856Z BEHIND doop ghcr.io/diced/zipline 4.8.1 newest 4.8.2
|
||||
2026-10-30T03:44:02.9474067Z BEHIND app getmeili/meilisearch v1.41.0 newest v1.56.0
|
||||
2026-10-30T03:44:02.9474288Z BEHIND app getmeili/meilisearch v1.36.0 newest v1.56.0
|
||||
2026-10-30T03:44:02.9474543Z BEHIND app ghcr.io/hargata/lubelogger v1.7.3 newest v1.7.4
|
||||
2026-10-30T03:44:02.9474729Z BEHIND app ghcr.io/kozea/radicale 3.8.1 newest 3.9.0
|
||||
2026-10-30T03:44:02.9474967Z BEHIND app gotson/komga 1.28.0 newest 1.29.2
|
||||
2026-10-30T03:44:02.9475183Z BEHIND app kimai/kimai2 2.67.0 newest 2.71.0
|
||||
2026-10-30T03:44:02.9475413Z BEHIND app lscr.io/linuxserver/bookstack 26.09.2 newest 26.09.20260929
|
||||
2026-10-30T03:44:02.9475638Z BEHIND app lscr.io/linuxserver/code-server 4.143.1 newest 4.144.0
|
||||
2026-10-30T03:44:02.9475846Z BEHIND app nextcloud 34.0.4-apache newest 34.0.5-apache
|
||||
2026-10-30T03:44:02.9476056Z BEHIND app nginx 1.30.5-alpine newest 1.31.8-alpine
|
||||
2026-10-30T03:44:02.9476284Z BEHIND app qbittorrentofficial/qbittorrent-nox 5.2.4-1 newest 5.3.0-2
|
||||
2026-10-30T03:44:02.9476512Z GAP buil alpine 3.24.2 newest 3.24.3
|
||||
2026-10-30T03:44:02.9476710Z GAP buil alpine 3.24.2 newest 3.24.3
|
||||
2026-10-30T03:44:02.9477045Z GAP doop arcadiatechnology/crafty-4 4.11.0
|
||||
2026-10-30T03:44:02.9477242Z GAP doop bhgedigital/envsubst latest
|
||||
2026-10-30T03:44:02.9477443Z GAP doop busybox 1.38
|
||||
2026-10-30T03:44:02.9477636Z GAP doop codercom/code-server 4.143.1 newest 4.144.0
|
||||
2026-10-30T03:44:02.9477847Z GAP buil debian 13.7-slim
|
||||
2026-10-30T03:44:02.9478057Z GAP buil debian 13.7-slim
|
||||
2026-10-30T03:44:02.9478278Z GAP doop docker.io/bitnamilegacy/postgresql 17.6.0-debian-12-r3
|
||||
2026-10-30T03:44:02.9478464Z GAP doop docker.io/library/nextcloud 34.0.5-apache
|
||||
2026-10-30T03:44:02.9478658Z GAP doop docker.io/valkey/valkey 9.2-alpine
|
||||
2026-10-30T03:44:02.9478959Z GAP doop filebrowser/filebrowser v2.63.23
|
||||
2026-10-30T03:44:02.9479171Z GAP doop ghcr.io/cloudnative-pg/postgresql 17.2 newest 17.11
|
||||
2026-10-30T03:44:02.9479360Z GAP doop ghcr.io/headlamp-k8s/headlamp v0.46.0
|
||||
2026-10-30T03:44:02.9479628Z GAP doop ghcr.io/immich-app/postgres 16-vectorchord0.3.0
|
||||
2026-10-30T03:44:02.9479859Z GAP doop ghcr.io/jimmidyson/configmap-reload v0.15.0
|
||||
2026-10-30T03:44:02.9480067Z GAP doop ghcr.io/onedr0p/exportarr v2.3.0
|
||||
2026-10-30T03:44:02.9480276Z GAP doop ghcr.io/seriousm4x/upsnap 5
|
||||
2026-10-30T03:44:02.9480579Z GAP doop ghcr.io/stakater/reloader v1.4.22 newest v1.4.23
|
||||
2026-10-30T03:44:02.9480793Z GAP doop ghcr.io/tautulli/tautulli v2.18.2
|
||||
2026-10-30T03:44:02.9480978Z GAP doop griefed/serverpackcreator 8.1.2
|
||||
2026-10-30T03:44:02.9481202Z GAP doop gtstef/filebrowser 1.5.8-stable
|
||||
2026-10-30T03:44:02.9481395Z GAP doop guacamole/guacamole 1.6.0
|
||||
2026-10-30T03:44:02.9481629Z GAP doop guacamole/guacd 1.6.0
|
||||
2026-10-30T03:44:02.9481819Z GAP doop index.docker.io/plexinc/pms-docker 1.43.5.11029-6bf8af3f0
|
||||
2026-10-30T03:44:02.9482025Z GAP doop itzg/mc-backup 2026.10.1 newest 2026.10.2
|
||||
2026-10-30T03:44:02.9482272Z GAP doop itzg/minecraft-server 2026.10.0-java21 newest 2026.10.1-java17
|
||||
2026-10-30T03:44:02.9482496Z GAP doop linuxserver/bookstack 26.09.20260929
|
||||
2026-10-30T03:44:02.9482703Z GAP doop linuxserver/prowlarr version-2.6.5.5623
|
||||
2026-10-30T03:44:02.9482924Z GAP doop linuxserver/qbittorrent 5.3.0
|
||||
2026-10-30T03:44:02.9483125Z GAP doop linuxserver/radarr version-6.4.4.10685
|
||||
2026-10-30T03:44:02.9483328Z GAP doop linuxserver/sonarr version-4.0.20.3014
|
||||
2026-10-30T03:44:02.9483519Z GAP doop mariadb 11
|
||||
2026-10-30T03:44:02.9483735Z GAP doop mikefarah/yq 4.54.1
|
||||
2026-10-30T03:44:02.9483981Z GAP doop mongodb/mongodb-community-server 8.0.5-ubuntu2204 newest 8.3.13-ubuntu2204
|
||||
2026-10-30T03:44:02.9484221Z GAP doop msdeluise/plant-it-server 0.10.0
|
||||
2026-10-30T03:44:02.9484396Z GAP doop mysql 8.4
|
||||
2026-10-30T03:44:02.9484573Z GAP doop nicolaka/netshoot latest
|
||||
2026-10-30T03:44:02.9484746Z GAP doop postgis/postgis 16-3.5
|
||||
2026-10-30T03:44:02.9484912Z GAP doop postgres 15-alpine
|
||||
2026-10-30T03:44:02.9485182Z GAP doop postgres 16-alpine
|
||||
2026-10-30T03:44:02.9485353Z GAP doop privatebin/nginx-fpm-alpine 2.0.6 newest 2.1.0
|
||||
2026-10-30T03:44:02.9485548Z GAP doop prom/alertmanager v0.34.1 newest v0.34.2
|
||||
2026-10-30T03:44:02.9485726Z GAP doop prom/node-exporter v1.12.1
|
||||
2026-10-30T03:44:02.9485902Z GAP doop prom/prometheus v3.15.0 newest v3.15.1
|
||||
2026-10-30T03:44:02.9486097Z GAP doop prometheuscommunity/smartctl-exporter v0.15.0
|
||||
2026-10-30T03:44:02.9486277Z GAP doop python 3.15-bookworm
|
||||
2026-10-30T03:44:02.9486454Z GAP doop quay.io/jetstack/version-checker v0.11.0
|
||||
2026-10-30T03:44:02.9486648Z GAP doop quay.io/prometheus/blackbox-exporter v0.29.1
|
||||
2026-10-30T03:44:02.9486860Z GAP doop renovate/renovate 44.181.1 newest 44.198.0
|
||||
2026-10-30T03:44:02.9487047Z GAP doop tailscale/tailscale v1.104.2 newest v1.104.4
|
||||
2026-10-30T03:44:02.9487347Z GAP app emby/embyserver 4.11.0.4 newest 4.11.0.12
|
||||
2026-10-30T03:44:02.9487534Z GAP app ghcr.io/immich-app/postgres 16-vectorchord0.4.3-pg
|
||||
2026-10-30T03:44:02.9487719Z GAP app ghcr.io/karakeep-app/karakeep-chrome 151.0.7922.47-r1
|
||||
2026-10-30T03:44:02.9487901Z GAP app mariadb 12.3
|
||||
2026-10-30T03:44:02.9488066Z GAP app mariadb 11.4 newest 11.8
|
||||
2026-10-30T03:44:02.9488260Z GAP app mariadb 11.8
|
||||
2026-10-30T03:44:02.9488432Z GAP app mariadb 12.3
|
||||
2026-10-30T03:44:02.9488609Z GAP app mariadb 11.8
|
||||
2026-10-30T03:44:02.9488777Z GAP app msdeluise/plant-it 0.10.0
|
||||
2026-10-30T03:44:02.9488947Z GAP app plexinc/pms-docker 1.43.5.11029-6bf8af3f0
|
||||
2026-10-30T03:44:02.9489136Z GAP app postgis/postgis 16-3.5-alpine
|
||||
2026-10-30T03:44:02.9489311Z GAP app postgis/postgis 17-3.5-alpine
|
||||
2026-10-30T03:44:02.9489490Z GAP app postgres 18-alpine
|
||||
2026-10-30T03:44:02.9489666Z GAP app postgres 17-alpine
|
||||
2026-10-30T03:44:02.9489835Z GAP app postgres 18-alpine
|
||||
2026-10-30T03:44:02.9490020Z GAP app postgres 18-alpine
|
||||
2026-10-30T03:44:02.9490186Z GAP app postgres 18-alpine
|
||||
2026-10-30T03:44:02.9490414Z GAP app postgres 18-alpine
|
||||
2026-10-30T03:44:02.9490588Z GAP app postgres 18-alpine
|
||||
2026-10-30T03:44:02.9491349Z GAP app postgres 17-alpine
|
||||
2026-10-30T03:44:02.9491524Z GAP app postgres 16-alpine
|
||||
2026-10-30T03:44:02.9491682Z GAP app registry.gitlab.com/crafty-controller/crafty-4 4.11.0
|
||||
2026-10-30T03:44:02.9491865Z FLOATING doop ghcr.io/seanmorley15/adventurelog-backend latest
|
||||
2026-10-30T03:44:02.9492035Z FLOATING doop ghcr.io/seanmorley15/adventurelog-frontend latest
|
||||
2026-10-30T03:44:02.9492207Z FLOATING doop nginx 1.31-alpine
|
||||
2026-10-30T03:44:02.9492368Z FLOATING doop redis 8-alpine
|
||||
2026-10-30T03:44:02.9492542Z FLOATING doop redis 8.10-alpine
|
||||
2026-10-30T03:44:02.9492702Z FLOATING app ghcr.io/claperco/claper 2.5
|
||||
2026-10-30T03:44:02.9492864Z FLOATING app ghcr.io/thomiceli/opengist 1.15
|
||||
2026-10-30T03:44:02.9493029Z FLOATING app jellyfin/jellyfin 12.4
|
||||
2026-10-30T03:44:02.9493196Z FLOATING app lscr.io/linuxserver/prowlarr version-2.6.5.5623
|
||||
2026-10-30T03:44:02.9493362Z FLOATING app lscr.io/linuxserver/sabnzbd version-5.1.3
|
||||
2026-10-30T03:44:02.9493531Z FLOATING app lscr.io/linuxserver/transmission version-4.1.3-r0
|
||||
2026-10-30T03:44:02.9493725Z FLOATING app nzbgetcom/nzbget v26.3
|
||||
2026-10-30T03:44:02.9494040Z FLOATING app redis 7.4-alpine
|
||||
2026-10-30T03:44:02.9494336Z FLOATING app redis 7-alpine
|
||||
2026-10-30T03:44:02.9494556Z FLOATING app redis 7-alpine
|
||||
2026-10-30T03:44:02.9494745Z FLOATING app redis 7-alpine
|
||||
2026-10-30T03:44:02.9494910Z FLOATING app redis 7-alpine
|
||||
2026-10-30T03:44:02.9495070Z FLOATING app redis 7-alpine
|
||||
2026-10-30T03:44:02.9495260Z FLOATING app redis 7-alpine
|
||||
2026-10-30T03:44:02.9495431Z FLOATING app wger/server 2.7
|
||||
2026-10-30T03:44:02.9495593Z SELF box gitea.dooplex.hu/admin/felhom-samba 1.2.0
|
||||
2026-10-30T03:44:02.9495755Z SELF app gitea.dooplex.hu/admin/recipe-importer v0.9.11
|
||||
2026-10-30T03:44:02.9495924Z CURRENT doop f0rc3/gokapi v2.2.4
|
||||
2026-10-30T03:44:02.9496085Z CURRENT doop ghcr.io/alam00000/bentopdf 2.8.10
|
||||
2026-10-30T03:44:02.9496260Z CURRENT doop ghcr.io/seerr-team/seerr v3.5.1
|
||||
2026-10-30T03:44:02.9496437Z CURRENT doop ghcr.io/thomiceli/opengist 1.15.3
|
||||
2026-10-30T03:44:02.9496595Z CURRENT doop glanceapp/glance v0.8.7
|
||||
2026-10-30T03:44:02.9496753Z CURRENT buil golang 1.27.3-trixie
|
||||
2026-10-30T03:44:02.9497016Z CURRENT buil golang 1.27.3-alpine3.24
|
||||
2026-10-30T03:44:02.9497175Z CURRENT doop onlyoffice/documentserver 9.4.0
|
||||
2026-10-30T03:44:02.9497333Z CURRENT buil restic 0.19.1
|
||||
2026-10-30T03:44:02.9497605Z CURRENT box traefik v3.7.16
|
||||
2026-10-30T03:44:02.9497773Z CURRENT doop vaultwarden/server 1.37.4
|
||||
2026-10-30T03:44:02.9497930Z CURRENT app deluan/navidrome 0.64.2
|
||||
2026-10-30T03:44:02.9498095Z CURRENT app docmost/docmost 0.97.0
|
||||
2026-10-30T03:44:02.9498260Z CURRENT app flomp/wanderer-db v0.21.2
|
||||
2026-10-30T03:44:02.9498440Z CURRENT app flomp/wanderer-web v0.21.2
|
||||
2026-10-30T03:44:02.9498872Z CURRENT app freikin/dawarich 1.19.0
|
||||
2026-10-30T03:44:02.9499046Z CURRENT app ghcr.io/advplyr/audiobookshelf 2.37.2
|
||||
2026-10-30T03:44:02.9499229Z CURRENT app ghcr.io/alam00000/bentopdf v2.8.10
|
||||
2026-10-30T03:44:02.9499386Z CURRENT app ghcr.io/alexta69/metube 2026.10.27
|
||||
2026-10-30T03:44:02.9499566Z CURRENT app ghcr.io/cmintey/wishlist v0.69.0
|
||||
2026-10-30T03:44:02.9499723Z CURRENT app ghcr.io/diced/zipline 4.8.2
|
||||
2026-10-30T03:44:02.9499896Z CURRENT app ghcr.io/gethomepage/homepage v2.7.0
|
||||
2026-10-30T03:44:02.9500056Z CURRENT app ghcr.io/gramps-project/grampsweb v25.6.0
|
||||
2026-10-30T03:44:02.9500222Z CURRENT app ghcr.io/grimmory-tools/grimmory v3.5.0
|
||||
2026-10-30T03:44:02.9500395Z CURRENT app ghcr.io/home-assistant/home-assistant 2026.10.4
|
||||
2026-10-30T03:44:02.9500552Z CURRENT app ghcr.io/mealie-recipes/mealie v3.29.0
|
||||
2026-10-30T03:44:02.9500733Z CURRENT app ghcr.io/papra-hq/papra 26.7.1-rootless
|
||||
2026-10-30T03:44:02.9500989Z CURRENT app ghcr.io/seanmorley15/adventurelog-backend v0.13.1
|
||||
2026-10-30T03:44:02.9501268Z CURRENT app ghcr.io/seanmorley15/adventurelog-frontend v0.13.1
|
||||
2026-10-30T03:44:02.9501456Z CURRENT app ghcr.io/seerr-team/seerr v3.5.1
|
||||
2026-10-30T03:44:02.9501622Z CURRENT app ghcr.io/sysadminsmedia/homebox 0.27.1
|
||||
2026-10-30T03:44:02.9501939Z CURRENT app ghost 6.73.0-alpine
|
||||
2026-10-30T03:44:02.9502205Z CURRENT app lscr.io/linuxserver/grocy 4.7.1
|
||||
2026-10-30T03:44:02.9502371Z CURRENT app lscr.io/linuxserver/radarr 6.4.4
|
||||
2026-10-30T03:44:02.9502535Z CURRENT app lscr.io/linuxserver/sonarr 4.0.20
|
||||
2026-10-30T03:44:02.9502699Z CURRENT app lukevella/rallly 4.16.3
|
||||
2026-10-30T03:44:02.9502853Z CURRENT app onlyoffice/documentserver 9.4.0
|
||||
2026-10-30T03:44:02.9503018Z CURRENT app outlinewiki/outline 1.12.0
|
||||
2026-10-30T03:44:02.9503207Z CURRENT app vaultwarden/server 1.37.4-alpine
|
||||
2026-10-30T03:44:02.9503423Z CURRENT app vikunja/vikunja 2.7.1
|
||||
2026-10-30T03:44:02.9503694Z COUNTS ADVISORY=41 BEHIND=13 CURRENT=40 FLOATING=20 GAP=73 NOT_CHECKED=8 SELF=2
|
||||
2026-10-30T03:44:03.1656126Z RUNTIME read=4 (50 s) from-cache=181 not-checked=0 zstd-decoder=zstandard 0.25.0 (pinned wheel, sha256 checked)
|
||||
2026-10-30T03:44:03.1657390Z TAGS fetched=117 from-cache=0 retried-429=0 (cache /root/.cache/felhom-watch-tags.json)
|
||||
2026-10-30T03:44:03.1657558Z REQUESTS api.github.com=69 api.osv.dev=1 auth.docker.io=1 blog.cloudflare.com=1 ghcr.io=174 github.com=63 hub.docker.com=206 raw.githubusercontent.com=1 registry-1.docker.io=1
|
||||
2026-10-30T03:44:03.4524313Z MAIL RESEND-ACCEPTED id=01a18ae8-511d-72ca-8660-6461fd8521b6 kind=advisory subject=[Felhom security] cloudflared, termix, pdo, paperless-ngx — 5 new advisories
|
||||
2026-10-30T03:44:03.4625308Z STATE written: documentation/security-watch/state.json (312 known advisories)
|
||||
2026-10-30T03:44:03.5491893Z ::group::Run set -u
|
||||
2026-10-30T03:44:03.5492182Z set -u
|
||||
2026-10-30T03:44:03.5492337Z f=documentation/security-watch/state.json
|
||||
2026-10-30T03:44:03.5492463Z if [ ! -f "$f" ]; then
|
||||
2026-10-30T03:44:03.5492576Z echo "no memory file was written - nothing to commit"; exit 0
|
||||
2026-10-30T03:44:03.5492795Z fi
|
||||
2026-10-30T03:44:03.5492905Z if git ls-files --error-unmatch "$f" >/dev/null 2>&1 && git diff --quiet -- "$f"; then
|
||||
2026-10-30T03:44:03.5493052Z echo "memory unchanged - nothing to commit"; exit 0
|
||||
2026-10-30T03:44:03.5493164Z fi
|
||||
2026-10-30T03:44:03.5493282Z cp "$f" /tmp/state.json
|
||||
2026-10-30T03:44:03.5493388Z auth=$(python3 -c 'import base64,os;print(base64.b64encode(("x:"+os.environ["PUSH_TOKEN"]).encode()).decode())')
|
||||
2026-10-30T03:44:03.5493534Z for attempt in 1 2 3; do
|
||||
2026-10-30T03:44:03.5493755Z git fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD
|
||||
2026-10-30T03:44:03.5493891Z mkdir -p "$(dirname "$f")" && cp /tmp/state.json "$f"
|
||||
2026-10-30T03:44:03.5494080Z git add "$f"
|
||||
2026-10-30T03:44:03.5494183Z git -c user.name="felhom security watch" -c user.email=monitoring@felhom.eu \
|
||||
2026-10-30T03:44:03.5494444Z commit -q -m "security-watch: memory of $(date -u +%F) (R-1303). Docs only." || { echo "nothing to commit"; exit 0; }
|
||||
2026-10-30T03:44:03.5494681Z if git -c http.extraHeader="Authorization: Basic $auth" push -q origin HEAD:main; then
|
||||
2026-10-30T03:44:03.5494811Z echo "memory pushed: $(git rev-parse --short=12 HEAD)"; exit 0
|
||||
2026-10-30T03:44:03.5494946Z fi
|
||||
2026-10-30T03:44:03.5495053Z echo "push refused (attempt $attempt) - re-fetching main"
|
||||
2026-10-30T03:44:03.5495179Z sleep 5
|
||||
2026-10-30T03:44:03.5495282Z done
|
||||
2026-10-30T03:44:03.5495389Z echo "MEMORY NOT SAVED after 3 attempts"; exit 1
|
||||
2026-10-30T03:44:03.5495504Z shell: bash --noprofile --norc -e -o pipefail {0}
|
||||
2026-10-30T03:44:03.5495647Z env:
|
||||
2026-10-30T03:44:03.5495770Z PUSH_TOKEN: ***
|
||||
2026-10-30T03:44:03.5495895Z ::endgroup::
|
||||
2026-10-30T03:44:06.2313696Z memory pushed: 28f3e15738a7
|
||||
2026-10-30T03:44:06.2324643Z Cleaning up container for job watch
|
||||
2026-10-30T03:44:06.8332361Z 🏁 Job succeeded
|
||||
@@ -0,0 +1,288 @@
|
||||
2026-10-31T03:40:12.4363620Z felhom-gates-runner-2(version:v0.6.1) received task 2570 of job watch, be triggered by event: schedule
|
||||
2026-10-31T03:40:12.4403167Z workflow prepared
|
||||
2026-10-31T03:40:12.4404114Z evaluating expression 'always()'
|
||||
2026-10-31T03:40:12.4408639Z expression 'always()' evaluated to 'true'
|
||||
2026-10-31T03:40:12.4414996Z evaluating expression ''
|
||||
2026-10-31T03:40:12.4415385Z expression '' evaluated to 'true'
|
||||
2026-10-31T03:40:12.4415529Z ⭐ Run Main Fetch main (latest, for the memory) and the two sibling repos
|
||||
2026-10-31T03:40:12.4419204Z Wrote command \n\necho "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"\nbase=http://gitea.gitea-system.svc.cluster.local:3000/admin\ngit init -q . && git remote add origin $base/felhom.eu.git\ngit fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD\necho "felhom.eu main at $(git rev-parse --short=12 HEAD)"\nfor r in felhom-controller app-catalog-felhom.eu; do\n git init -q ../$r && git -C ../$r remote add origin $base/$r.git\n git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD\n echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)"\ndone\n\n\n to 'workflow/0.sh'
|
||||
2026-10-31T03:40:12.4420527Z ::group::Run echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"
|
||||
2026-10-31T03:40:12.4420750Z echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"
|
||||
2026-10-31T03:40:12.4420869Z base=http://gitea.gitea-system.svc.cluster.local:3000/admin
|
||||
2026-10-31T03:40:12.4421013Z git init -q . && git remote add origin $base/felhom.eu.git
|
||||
2026-10-31T03:40:12.4421131Z git fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD
|
||||
2026-10-31T03:40:12.4421238Z echo "felhom.eu main at $(git rev-parse --short=12 HEAD)"
|
||||
2026-10-31T03:40:12.4421344Z for r in felhom-controller app-catalog-felhom.eu; do
|
||||
2026-10-31T03:40:12.4421484Z git init -q ../$r && git -C ../$r remote add origin $base/$r.git
|
||||
2026-10-31T03:40:12.4421593Z git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD
|
||||
2026-10-31T03:40:12.4421702Z echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)"
|
||||
2026-10-31T03:40:12.4421832Z done
|
||||
2026-10-31T03:40:12.4421923Z shell: bash --noprofile --norc -e -o pipefail {0}
|
||||
2026-10-31T03:40:12.4422037Z ::endgroup::
|
||||
2026-10-31T03:40:25.7211665Z felhom.eu main at 3cda7e8d6cec
|
||||
2026-10-31T03:40:28.3932513Z felhom-controller at a90b62323f11
|
||||
2026-10-31T03:40:28.8933688Z app-catalog-felhom.eu at 313eaf68d01f
|
||||
2026-10-31T03:40:28.8958360Z ::group::Run set -u
|
||||
2026-10-31T03:40:28.8958840Z set -u
|
||||
2026-10-31T03:40:28.8959057Z mkdir -p documentation/security-watch
|
||||
2026-10-31T03:40:28.8959260Z mode="${MODE:-run}"
|
||||
2026-10-31T03:40:28.8959497Z [ "${GITHUB_EVENT_NAME:-}" = "schedule" ] && mode=run
|
||||
2026-10-31T03:40:28.8959707Z echo "mode: $mode"
|
||||
2026-10-31T03:40:28.8959896Z case "$mode" in
|
||||
2026-10-31T03:40:28.8960083Z test-mail) python3 scripts/security_watch.py --test-mail; exit $? ;;
|
||||
2026-10-31T03:40:28.8960355Z dry) extra="--no-mail" ; state=/tmp/state-dry.json
|
||||
2026-10-31T03:40:28.8960563Z cp documentation/security-watch/state.json "$state" 2>/dev/null || true ;;
|
||||
2026-10-31T03:40:28.8960782Z seed) extra="--seed" ; state=documentation/security-watch/state.json ;;
|
||||
2026-10-31T03:40:28.8961047Z run) extra="" ; state=documentation/security-watch/state.json ;;
|
||||
2026-10-31T03:40:28.8961269Z *) echo "unknown mode $mode"; exit 2 ;;
|
||||
2026-10-31T03:40:28.8961456Z esac
|
||||
2026-10-31T03:40:28.8961632Z python3 scripts/security_watch.py --state="$state" --catalog=../app-catalog-felhom.eu \
|
||||
2026-10-31T03:40:28.8962092Z --controller=../felhom-controller --json=/tmp/watch-results.json $extra
|
||||
2026-10-31T03:40:28.8962307Z shell: bash --noprofile --norc -e -o pipefail {0}
|
||||
2026-10-31T03:40:28.8962624Z env:
|
||||
2026-10-31T03:40:28.8966285Z RESEND_API_KEY: ***
|
||||
2026-10-31T03:40:28.8966568Z GH_ADVISORY_TOKEN: ***
|
||||
2026-10-31T03:40:28.8966771Z MODE:
|
||||
2026-10-31T03:40:28.8967045Z FELHOM_WHEEL_FETCH: 1
|
||||
2026-10-31T03:40:28.8967232Z ::endgroup::
|
||||
2026-10-31T03:40:28.9008321Z mode: run
|
||||
2026-10-31T03:40:29.1348776Z /root/.cache/act/0e3a481055470df2/hostexecutor/scripts/security_watch.py:905: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
|
||||
2026-10-31T03:40:29.1349743Z today = datetime.date.fromisoformat(opts["today"]) if "today" in opts else datetime.datetime.utcnow().date()
|
||||
2026-10-31T03:40:29.1838472Z security watch 2026-10-31: 197 pins (11 box/build, 97 app, 89 DooPlex); GitHub key PRESENT — every repo's advisories tonight
|
||||
2026-10-31T03:42:55.9391387Z RUNTIME-READ lscr.io/linuxserver/sonarr:4.0.20 13 s ok
|
||||
2026-10-31T03:44:03.1103429Z RUNTIME-READ ghcr.io/seanmorley15/adventurelog-backend:latest 46 s ok
|
||||
2026-10-31T03:44:20.1615770Z RUNTIME-READ ghcr.io/seanmorley15/adventurelog-frontend:latest 63 s ok
|
||||
2026-10-31T03:44:20.3128443Z ADVISORY doop actualbudget/actual-server 26.10.0 CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-10-31T03:44:20.3129591Z ADVISORY doop advplyr/audiobookshelf 2.37.1 CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-10-31T03:44:20.3129979Z ADVISORY box cloudflare/cloudflared 2026.10.4 feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3 (fixed read the notice); vulnnotes:cloudflared@2026.10.6:VULN-184686 (fixed 2026.10.6); vulnnotes:cloudflared@2026.10.5:VULN-183456 (fixed 2026.10.5)
|
||||
2026-10-31T03:44:20.3130364Z ADVISORY doop codewithcj/sparkyfitness v1.9.0 release:CodeWithCJ/SparkyFitness@v1.10.0 (fixed v1.10.0)
|
||||
2026-10-31T03:44:20.3132411Z ADVISORY doop codewithcj/sparkyfitness_server v1.9.0 release:CodeWithCJ/SparkyFitness@v1.10.0 (fixed v1.10.0); CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-10-31T03:44:20.3132813Z ADVISORY doop crocodilestick/calibre-web-automated dev CVE-2026-111497 (fixed 1.2.1)
|
||||
2026-10-31T03:44:20.3133209Z ADVISORY doop docker.io/calcom/cal.com v6.2.0 CVE-2026-111497 (fixed 22.23.4, 24.22.1, 26.12.1)
|
||||
2026-10-31T03:44:20.3133491Z ADVISORY doop flomp/wanderer-db v0.21.0 GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2); … 1 more
|
||||
2026-10-31T03:44:20.3133970Z ADVISORY doop flomp/wanderer-web v0.21.0 GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2); … 2 more
|
||||
2026-10-31T03:44:20.3134297Z ADVISORY doop ghcr.io/gethomepage/homepage v1.13.2 GHSA-669x-4pg4-w24r (fixed 2.2.0); CVE-2026-111497 (fixed 22.23.4)
|
||||
2026-10-31T03:44:20.3134608Z ADVISORY doop ghcr.io/immich-app/immich-machine-learning v2.7.5 GHSA-q89f-h332-8q2h (fixed v3.2.4); GHSA-h5w4-vjv4-9r5q (fixed a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 (fixed v3.2.0); GHSA-72rm-x7xr-v679 (fixed v3.3.0); … 7 more
|
||||
2026-10-31T03:44:20.3135068Z ADVISORY doop ghcr.io/immich-app/immich-server v2.7.5 GHSA-q89f-h332-8q2h (fixed v3.2.4); GHSA-h5w4-vjv4-9r5q (fixed a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 (fixed v3.2.0); GHSA-72rm-x7xr-v679 (fixed v3.3.0); … 8 more
|
||||
2026-10-31T03:44:20.3135447Z ADVISORY doop ghcr.io/lukegus/termix release-2.9.2 CVE-2026-111497 (fixed 26.12.1)
|
||||
2026-10-31T03:44:20.3135778Z ADVISORY doop ghcr.io/paperless-ngx/paperless-ngx 3.3.4 release:paperless-ngx/paperless-ngx@v3.4.0 (fixed v3.4.0); CVE-2026-111497 (fixed 1.2.1)
|
||||
2026-10-31T03:44:20.3136190Z ADVISORY doop gitea/gitea 1.26.2 GHSA-wx44-9m3m-rjqx (fixed 28.2.0); GHSA-4jmf-h2cm-hg7w (fixed 28.2.0); GHSA-8j56-f865-gqq2 (fixed 28.2.0); GHSA-fxq4-gr55-7x5g (fixed 28.2.0); … 127 more
|
||||
2026-10-31T03:44:20.3136630Z ADVISORY doop grafana/grafana 13.2.4 GHSA-8xmm-x63g-f6xv (fixed no fixed version named yet); GHSA-4724-7jwc-3fpw (fixed the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 (fixed the range is unreadable — check by hand); GHSA-8wjh-59cw-9xh4 (fixed no fixed version named yet); … 2 more
|
||||
2026-10-31T03:44:20.3137179Z ADVISORY box gtstef/filebrowser 1.5.8-stable GHSA-gfgm-886h-6r47 (fixed 2.0.2-stable, 2.1.4-beta); GHSA-wxj5-g3qp-g732 (fixed 2.0.2-stable, 2.1.3-beta); GHSA-3j46-5w28-f8p2 (fixed 2.1.0-stable, 2.1.3-beta); GHSA-4vrc-935w-xxq2 (fixed 2.1.0-stable, 2.1.3-beta); … 31 more
|
||||
2026-10-31T03:44:20.3137606Z ADVISORY doop louislam/uptime-kuma 2.5.6 GHSA-qjxc-h5jf-c7rj (fixed the range is unreadable — check by hand); release:louislam/uptime-kuma@2.5.8 (fixed 2.5.8); release:louislam/uptime-kuma@2.5.7 (fixed 2.5.7); CVE-2026-111497 (fixed 22.23.4)
|
||||
2026-10-31T03:44:20.3138049Z ADVISORY doop outlinewiki/outline 1.11.0 GHSA-x4w3-9p9j-cprh (fixed 1.12.0); GHSA-rq53-m97j-f2pg (fixed 1.12.0); GHSA-h6ff-rw9x-5mq2 (fixed 1.12.0); GHSA-rvj7-2gww-6xfq (fixed 1.12.0); … 3 more
|
||||
2026-10-31T03:44:20.3138478Z ADVISORY doop redis 8.10.2 GHSA-c8h9-259x-jff4 (fixed the range is unreadable — check by hand); GHSA-8ghh-qpmp-7826 (fixed no fixed version named yet); GHSA-93m2-935m-8rj3 (fixed no fixed version named yet); GHSA-m8fj-85cg-7vhp (fixed the range is unreadable — check by hand); … 8 more
|
||||
2026-10-31T03:44:20.3138838Z ADVISORY doop rommapp/romm 5.4.0 release:rommapp/romm@5.4.1 (fixed 5.4.1); CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-10-31T03:44:20.3139149Z ADVISORY box traefik v3.7.16 release:traefik/traefik@v3.7.17 (fixed v3.7.17)
|
||||
2026-10-31T03:44:20.3139541Z ADVISORY doop vabene1111/recipes 2.6.15 CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-10-31T03:44:20.3139885Z ADVISORY app actualbudget/actual-server 26.9.0 CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-10-31T03:44:20.3140268Z ADVISORY app calcom/cal.com v6.2.0 GHSA-p3f6-52gv-cj7m (fixed the range is unreadable — check by hand); GHSA-cpf2-q635-xrwx (fixed the range is unreadable — check by hand); CVE-2026-111497 (fixed 22.23.4, 24.22.1, 26.12.1)
|
||||
2026-10-31T03:44:20.3140666Z ADVISORY app codewithcj/sparkyfitness v0.17.3 GHSA-v883-jx9h-qf29 (fixed a version after 1.7.2 (the notice names none)); GHSA-cmmf-53wf-r5gv (fixed a version after 1.6.5 (the notice names none)); GHSA-p8cf-g8rv-gvrq (fixed a version after 1.6.5 (the notice names none))
|
||||
2026-10-31T03:44:20.3141069Z ADVISORY app codewithcj/sparkyfitness_server v0.17.3 GHSA-v883-jx9h-qf29 (fixed a version after 1.7.2 (the notice names none)); GHSA-cmmf-53wf-r5gv (fixed a version after 1.6.5 (the notice names none)); GHSA-p8cf-g8rv-gvrq (fixed a version after 1.6.5 (the notice names none)); CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-10-31T03:44:20.3141575Z ADVISORY app crocodilestick/calibre-web-automated v4.0.8 CVE-2026-111497 (fixed 1.2.1)
|
||||
2026-10-31T03:44:20.3141906Z ADVISORY app f0rc3/gokapi v1.9.6 GHSA-45vh-rpc8-hxpp (fixed 2.2.4); GHSA-qwc6-vc2v-2ggj (fixed 2.2.4); GHSA-j6jp-78w8-34x6 (fixed 2.2.4); GHSA-m2hx-wjxc-9fp4 (fixed 2.2.3); … 6 more
|
||||
2026-10-31T03:44:20.3142302Z ADVISORY app ghcr.io/immich-app/immich-machine-learning v3.3.5 GHSA-8244-8vpr-vp9c (fixed the range is unreadable — check by hand)
|
||||
2026-10-31T03:44:20.3142696Z ADVISORY app ghcr.io/immich-app/immich-server v3.3.5 GHSA-8244-8vpr-vp9c (fixed the range is unreadable — check by hand)
|
||||
2026-10-31T03:44:20.3144263Z ADVISORY app ghcr.io/karakeep-app/karakeep 0.34.1 GHSA-pp34-2c9r-mchw (fixed no fixed version named yet)
|
||||
2026-10-31T03:44:20.3144892Z ADVISORY app ghcr.io/lukegus/termix 26.10.5 GHSA-r9gw-3w87-mhh7 (fixed no fixed version named yet); release:Termix-SSH/Termix@v26.10.6 (fixed v26.10.6)
|
||||
2026-10-31T03:44:20.3145250Z ADVISORY app ghcr.io/paperless-ngx/paperless-ngx 2.20.15 GHSA-c8f3-pqr2-rr24 (fixed 3.3.2); GHSA-2jhj-xqrq-rmrq (fixed 3.1.2); CVE-2026-111497 (fixed 1.1.1)
|
||||
2026-10-31T03:44:20.3145549Z ADVISORY app ghcr.io/tandoorrecipes/recipes 2.7.2 GHSA-c7mc-c9jr-38hf (fixed the range is unreadable — check by hand); GHSA-cqj3-64qw-4w52 (fixed the range is unreadable — check by hand)
|
||||
2026-10-31T03:44:20.3145930Z ADVISORY app gitea/gitea 28.2.0 GHSA-rqhx-647v-wx32 (fixed no fixed version named yet)
|
||||
2026-10-31T03:44:20.3146250Z ADVISORY app glanceapp/glance v0.8.5 GHSA-r225-jhr6-68cc (fixed >= 0.8.7)
|
||||
2026-10-31T03:44:20.3146511Z ADVISORY app grafana/grafana 13.2.4 GHSA-8xmm-x63g-f6xv (fixed no fixed version named yet); GHSA-4724-7jwc-3fpw (fixed the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 (fixed the range is unreadable — check by hand); GHSA-8wjh-59cw-9xh4 (fixed no fixed version named yet); … 2 more
|
||||
2026-10-31T03:44:20.3146931Z ADVISORY app louislam/uptime-kuma 2.5.7 GHSA-qjxc-h5jf-c7rj (fixed the range is unreadable — check by hand); release:louislam/uptime-kuma@2.5.8 (fixed 2.5.8)
|
||||
2026-10-31T03:44:20.3147247Z ADVISORY app n8nio/n8n 2.44.7 GHSA-2x68-96jw-5r6c (fixed >= 3.0.1); GHSA-9p7v-45m2-wxgj (fixed >= 3.0.1); GHSA-mx4r-96jx-v278 (fixed >= 3.0.1); GHSA-4v22-g448-h4rg (fixed >= 2.45.5, >= 2.46.1, >= 3.0.1); … 9 more
|
||||
2026-10-31T03:44:20.3147564Z ADVISORY app privatebin/pdo 2.1.0 GHSA-c4gc-8mcm-hh65 (fixed 2.1.1); GHSA-hw9p-r7fq-8mvr (fixed 2.1.1)
|
||||
2026-10-31T03:44:20.3147877Z ADVISORY app rommapp/romm 5.4.1 CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-10-31T03:44:20.3148119Z NOT CHECKED doop gitea.dooplex.hu/admin/felhom-act-runner 0.1.0 registry gitea.dooplex.hu: no anonymous token route
|
||||
2026-10-31T03:44:20.3148431Z NOT CHECKED doop gitea.dooplex.hu/admin/jarr latest registry gitea.dooplex.hu: no anonymous token route
|
||||
2026-10-31T03:44:20.3148714Z NOT CHECKED doop gitea.dooplex.hu/admin/recipe-importer latest registry gitea.dooplex.hu: no anonymous token route
|
||||
2026-10-31T03:44:20.3148967Z NOT CHECKED doop gitea.dooplex.hu/admin/revfulop-calendar 1.6.2 registry gitea.dooplex.hu: no anonymous token route
|
||||
2026-10-31T03:44:20.3149213Z NOT CHECKED doop gitea.dooplex.hu/admin/sparkyfitness-export 0.3.0 registry gitea.dooplex.hu: no anonymous token route
|
||||
2026-10-31T03:44:20.3149512Z NOT CHECKED doop gitea.dooplex.hu/admin/wan-probe 0.1.0 registry gitea.dooplex.hu: no anonymous token route
|
||||
2026-10-31T03:44:20.3149769Z NOT CHECKED doop minio/minio latest Docker registry tags of minio/minio: HTTP 401; manifest minio/minio:latest: HTTP 401
|
||||
2026-10-31T03:44:20.3150036Z NOT CHECKED app lscr.io/linuxserver/code-server 4.143.1 https://hub.docker.com/v2/repositories/linuxserver/code-server/tags: The read operation timed out
|
||||
2026-10-31T03:44:20.3150648Z BEHIND doop getmeili/meilisearch v1.11.3 newest v1.56.0
|
||||
2026-10-31T03:44:20.3150955Z BEHIND doop ghcr.io/diced/zipline 4.8.1 newest 4.8.2
|
||||
2026-10-31T03:44:20.3151250Z BEHIND app getmeili/meilisearch v1.41.0 newest v1.56.0
|
||||
2026-10-31T03:44:20.3151578Z BEHIND app getmeili/meilisearch v1.36.0 newest v1.56.0
|
||||
2026-10-31T03:44:20.3151873Z BEHIND app ghcr.io/hargata/lubelogger v1.7.3 newest v1.7.4
|
||||
2026-10-31T03:44:20.3152155Z BEHIND app ghcr.io/kozea/radicale 3.8.1 newest 3.9.0
|
||||
2026-10-31T03:44:20.3152378Z BEHIND app gotson/komga 1.28.0 newest 1.29.2
|
||||
2026-10-31T03:44:20.3152612Z BEHIND app kimai/kimai2 2.67.0 newest 2.71.0
|
||||
2026-10-31T03:44:20.3152843Z BEHIND app lscr.io/linuxserver/bookstack 26.09.2 newest 26.09.20260929
|
||||
2026-10-31T03:44:20.3153138Z BEHIND app nextcloud 34.0.4-apache newest 34.0.5-apache
|
||||
2026-10-31T03:44:20.3153456Z BEHIND app nginx 1.30.5-alpine newest 1.31.8-alpine
|
||||
2026-10-31T03:44:20.3153683Z BEHIND app qbittorrentofficial/qbittorrent-nox 5.2.4-1 newest 5.3.0-2
|
||||
2026-10-31T03:44:20.3154085Z GAP buil alpine 3.24.2 newest 3.24.3
|
||||
2026-10-31T03:44:20.3154347Z GAP buil alpine 3.24.2 newest 3.24.3
|
||||
2026-10-31T03:44:20.3154685Z GAP doop alpine/k8s 1.37.1
|
||||
2026-10-31T03:44:20.3155056Z GAP doop arcadiatechnology/crafty-4 4.11.0
|
||||
2026-10-31T03:44:20.3155282Z GAP doop bhgedigital/envsubst latest
|
||||
2026-10-31T03:44:20.3155505Z GAP doop busybox 1.38
|
||||
2026-10-31T03:44:20.3155776Z GAP doop codercom/code-server 4.143.1 newest 4.144.0
|
||||
2026-10-31T03:44:20.3156020Z GAP buil debian 13.7-slim
|
||||
2026-10-31T03:44:20.3156236Z GAP buil debian 13.7-slim
|
||||
2026-10-31T03:44:20.3156465Z GAP doop docker.io/bitnamilegacy/postgresql 17.6.0-debian-12-r3
|
||||
2026-10-31T03:44:20.3156724Z GAP doop docker.io/library/nextcloud 34.0.5-apache
|
||||
2026-10-31T03:44:20.3156948Z GAP doop docker.io/valkey/valkey 9.2-alpine
|
||||
2026-10-31T03:44:20.3157529Z GAP doop filebrowser/filebrowser v2.63.23
|
||||
2026-10-31T03:44:20.3157805Z GAP doop ghcr.io/cloudnative-pg/postgresql 17.2 newest 17.11
|
||||
2026-10-31T03:44:20.3158040Z GAP doop ghcr.io/headlamp-k8s/headlamp v0.46.0
|
||||
2026-10-31T03:44:20.3158251Z GAP doop ghcr.io/immich-app/postgres 16-vectorchord0.3.0
|
||||
2026-10-31T03:44:20.3158494Z GAP doop ghcr.io/jimmidyson/configmap-reload v0.15.0
|
||||
2026-10-31T03:44:20.3158778Z GAP doop ghcr.io/onedr0p/exportarr v2.3.0
|
||||
2026-10-31T03:44:20.3159006Z GAP doop ghcr.io/seriousm4x/upsnap 5
|
||||
2026-10-31T03:44:20.3159226Z GAP doop ghcr.io/stakater/reloader v1.4.22 newest v1.4.23
|
||||
2026-10-31T03:44:20.3159454Z GAP doop ghcr.io/tautulli/tautulli v2.18.2
|
||||
2026-10-31T03:44:20.3159715Z GAP doop griefed/serverpackcreator 8.1.2
|
||||
2026-10-31T03:44:20.3159938Z GAP doop gtstef/filebrowser 1.5.8-stable
|
||||
2026-10-31T03:44:20.3160165Z GAP doop guacamole/guacamole 1.6.0
|
||||
2026-10-31T03:44:20.3160380Z GAP doop guacamole/guacd 1.6.0
|
||||
2026-10-31T03:44:20.3160655Z GAP doop index.docker.io/plexinc/pms-docker 1.43.5.11029-6bf8af3f0
|
||||
2026-10-31T03:44:20.3160885Z GAP doop itzg/mc-backup 2026.10.1 newest 2026.10.3
|
||||
2026-10-31T03:44:20.3161113Z GAP doop itzg/minecraft-server 2026.10.0-java21 newest 2026.10.1-java17
|
||||
2026-10-31T03:44:20.3161481Z GAP doop linuxserver/bookstack 26.09.20260929
|
||||
2026-10-31T03:44:20.3161711Z GAP doop linuxserver/prowlarr version-2.6.5.5623
|
||||
2026-10-31T03:44:20.3161992Z GAP doop linuxserver/qbittorrent 5.3.0
|
||||
2026-10-31T03:44:20.3162265Z GAP doop linuxserver/radarr version-6.4.4.10685
|
||||
2026-10-31T03:44:20.3162481Z GAP doop linuxserver/sonarr version-4.0.20.3014
|
||||
2026-10-31T03:44:20.3162702Z GAP doop mariadb 11
|
||||
2026-10-31T03:44:20.3162976Z GAP doop mikefarah/yq 4.54.1
|
||||
2026-10-31T03:44:20.3163241Z GAP doop mongodb/mongodb-community-server 8.0.5-ubuntu2204 newest 8.3.13-ubuntu2204
|
||||
2026-10-31T03:44:20.3163517Z GAP doop msdeluise/plant-it-server 0.10.0
|
||||
2026-10-31T03:44:20.3163787Z GAP doop mysql 8.4
|
||||
2026-10-31T03:44:20.3164003Z GAP doop nicolaka/netshoot latest
|
||||
2026-10-31T03:44:20.3164219Z GAP doop postgis/postgis 16-3.5
|
||||
2026-10-31T03:44:20.3164430Z GAP doop postgres 15-alpine
|
||||
2026-10-31T03:44:20.3164726Z GAP doop postgres 16-alpine
|
||||
2026-10-31T03:44:20.3165013Z GAP doop privatebin/nginx-fpm-alpine 2.0.6 newest 2.1.0
|
||||
2026-10-31T03:44:20.3165360Z GAP doop prom/alertmanager v0.34.1 newest v0.34.2
|
||||
2026-10-31T03:44:20.3165651Z GAP doop prom/node-exporter v1.12.1
|
||||
2026-10-31T03:44:20.3165873Z GAP doop prom/prometheus v3.15.0 newest v3.15.1
|
||||
2026-10-31T03:44:20.3166101Z GAP doop prometheuscommunity/smartctl-exporter v0.15.0
|
||||
2026-10-31T03:44:20.3166320Z GAP doop python 3.15-bookworm
|
||||
2026-10-31T03:44:20.3168597Z GAP doop quay.io/jetstack/version-checker v0.11.0
|
||||
2026-10-31T03:44:20.3168834Z GAP doop quay.io/prometheus/blackbox-exporter v0.29.1
|
||||
2026-10-31T03:44:20.3169090Z GAP doop renovate/renovate 44.181.1 newest 44.198.3
|
||||
2026-10-31T03:44:20.3169332Z GAP doop tailscale/tailscale v1.104.2 newest v1.104.4
|
||||
2026-10-31T03:44:20.3169559Z GAP app emby/embyserver 4.11.0.4 newest 4.11.0.12
|
||||
2026-10-31T03:44:20.3169790Z GAP app ghcr.io/immich-app/postgres 16-vectorchord0.4.3-pg
|
||||
2026-10-31T03:44:20.3170016Z GAP app ghcr.io/karakeep-app/karakeep-chrome 151.0.7922.47-r1
|
||||
2026-10-31T03:44:20.3170304Z GAP app mariadb 12.3
|
||||
2026-10-31T03:44:20.3171117Z GAP app mariadb 11.4 newest 11.8
|
||||
2026-10-31T03:44:20.3171455Z GAP app mariadb 11.8
|
||||
2026-10-31T03:44:20.3171612Z GAP app mariadb 12.3
|
||||
2026-10-31T03:44:20.3171739Z GAP app mariadb 11.8
|
||||
2026-10-31T03:44:20.3171925Z GAP app msdeluise/plant-it 0.10.0
|
||||
2026-10-31T03:44:20.3172047Z GAP app plexinc/pms-docker 1.43.5.11029-6bf8af3f0
|
||||
2026-10-31T03:44:20.3172193Z GAP app postgis/postgis 16-3.5-alpine
|
||||
2026-10-31T03:44:20.3172311Z GAP app postgis/postgis 17-3.5-alpine
|
||||
2026-10-31T03:44:20.3172429Z GAP app postgres 18-alpine
|
||||
2026-10-31T03:44:20.3172566Z GAP app postgres 17-alpine
|
||||
2026-10-31T03:44:20.3172686Z GAP app postgres 18-alpine
|
||||
2026-10-31T03:44:20.3172887Z GAP app postgres 18-alpine
|
||||
2026-10-31T03:44:20.3172997Z GAP app postgres 18-alpine
|
||||
2026-10-31T03:44:20.3173116Z GAP app postgres 18-alpine
|
||||
2026-10-31T03:44:20.3173227Z GAP app postgres 18-alpine
|
||||
2026-10-31T03:44:20.3173341Z GAP app postgres 17-alpine
|
||||
2026-10-31T03:44:20.3173464Z GAP app postgres 16-alpine
|
||||
2026-10-31T03:44:20.3173583Z GAP app registry.gitlab.com/crafty-controller/crafty-4 4.11.0
|
||||
2026-10-31T03:44:20.3173702Z FLOATING doop ghcr.io/seanmorley15/adventurelog-backend latest
|
||||
2026-10-31T03:44:20.3173824Z FLOATING doop ghcr.io/seanmorley15/adventurelog-frontend latest
|
||||
2026-10-31T03:44:20.3173951Z FLOATING doop nginx 1.31-alpine
|
||||
2026-10-31T03:44:20.3174075Z FLOATING doop redis 8-alpine
|
||||
2026-10-31T03:44:20.3174198Z FLOATING doop redis 8.10-alpine
|
||||
2026-10-31T03:44:20.3174325Z FLOATING app ghcr.io/claperco/claper 2.5
|
||||
2026-10-31T03:44:20.3174487Z FLOATING app ghcr.io/thomiceli/opengist 1.15
|
||||
2026-10-31T03:44:20.3174617Z FLOATING app jellyfin/jellyfin 12.4
|
||||
2026-10-31T03:44:20.3174737Z FLOATING app lscr.io/linuxserver/prowlarr version-2.6.5.5623
|
||||
2026-10-31T03:44:20.3174860Z FLOATING app lscr.io/linuxserver/sabnzbd version-5.1.3
|
||||
2026-10-31T03:44:20.3175016Z FLOATING app lscr.io/linuxserver/transmission version-4.1.3-r0
|
||||
2026-10-31T03:44:20.3175139Z FLOATING app nzbgetcom/nzbget v26.3
|
||||
2026-10-31T03:44:20.3175271Z FLOATING app redis 7.4-alpine
|
||||
2026-10-31T03:44:20.3175401Z FLOATING app redis 7-alpine
|
||||
2026-10-31T03:44:20.3175520Z FLOATING app redis 7-alpine
|
||||
2026-10-31T03:44:20.3175632Z FLOATING app redis 7-alpine
|
||||
2026-10-31T03:44:20.3175778Z FLOATING app redis 7-alpine
|
||||
2026-10-31T03:44:20.3175891Z FLOATING app redis 7-alpine
|
||||
2026-10-31T03:44:20.3176002Z FLOATING app redis 7-alpine
|
||||
2026-10-31T03:44:20.3176126Z FLOATING app wger/server 2.7
|
||||
2026-10-31T03:44:20.3176249Z SELF box gitea.dooplex.hu/admin/felhom-samba 1.2.0
|
||||
2026-10-31T03:44:20.3176520Z SELF app gitea.dooplex.hu/admin/recipe-importer v0.9.11
|
||||
2026-10-31T03:44:20.3176705Z CURRENT doop f0rc3/gokapi v2.2.4
|
||||
2026-10-31T03:44:20.3176843Z CURRENT doop ghcr.io/alam00000/bentopdf 2.8.10
|
||||
2026-10-31T03:44:20.3177002Z CURRENT doop ghcr.io/seerr-team/seerr v3.5.1
|
||||
2026-10-31T03:44:20.3177131Z CURRENT doop ghcr.io/thomiceli/opengist 1.15.3
|
||||
2026-10-31T03:44:20.3177291Z CURRENT doop glanceapp/glance v0.8.7
|
||||
2026-10-31T03:44:20.3177413Z CURRENT buil golang 1.27.3-trixie
|
||||
2026-10-31T03:44:20.3177663Z CURRENT buil golang 1.27.3-alpine3.24
|
||||
2026-10-31T03:44:20.3177788Z CURRENT doop onlyoffice/documentserver 9.4.0
|
||||
2026-10-31T03:44:20.3177933Z CURRENT buil restic 0.19.1
|
||||
2026-10-31T03:44:20.3178054Z CURRENT doop vaultwarden/server 1.37.4
|
||||
2026-10-31T03:44:20.3178171Z CURRENT app deluan/navidrome 0.64.2
|
||||
2026-10-31T03:44:20.3178319Z CURRENT app docmost/docmost 0.97.0
|
||||
2026-10-31T03:44:20.3178561Z CURRENT app flomp/wanderer-db v0.21.2
|
||||
2026-10-31T03:44:20.3178682Z CURRENT app flomp/wanderer-web v0.21.2
|
||||
2026-10-31T03:44:20.3178809Z CURRENT app freikin/dawarich 1.19.0
|
||||
2026-10-31T03:44:20.3178964Z CURRENT app ghcr.io/advplyr/audiobookshelf 2.37.2
|
||||
2026-10-31T03:44:20.3179083Z CURRENT app ghcr.io/alam00000/bentopdf v2.8.10
|
||||
2026-10-31T03:44:20.3179205Z CURRENT app ghcr.io/alexta69/metube 2026.10.27
|
||||
2026-10-31T03:44:20.3179341Z CURRENT app ghcr.io/cmintey/wishlist v0.69.0
|
||||
2026-10-31T03:44:20.3179458Z CURRENT app ghcr.io/diced/zipline 4.8.2
|
||||
2026-10-31T03:44:20.3179572Z CURRENT app ghcr.io/gethomepage/homepage v2.7.0
|
||||
2026-10-31T03:44:20.3179690Z CURRENT app ghcr.io/gramps-project/grampsweb v25.6.0
|
||||
2026-10-31T03:44:20.3179878Z CURRENT app ghcr.io/grimmory-tools/grimmory v3.5.0
|
||||
2026-10-31T03:44:20.3180042Z CURRENT app ghcr.io/home-assistant/home-assistant 2026.10.4
|
||||
2026-10-31T03:44:20.3180174Z CURRENT app ghcr.io/mealie-recipes/mealie v3.29.0
|
||||
2026-10-31T03:44:20.3180313Z CURRENT app ghcr.io/papra-hq/papra 26.7.1-rootless
|
||||
2026-10-31T03:44:20.3180432Z CURRENT app ghcr.io/seanmorley15/adventurelog-backend v0.13.1
|
||||
2026-10-31T03:44:20.3180551Z CURRENT app ghcr.io/seanmorley15/adventurelog-frontend v0.13.1
|
||||
2026-10-31T03:44:20.3180672Z CURRENT app ghcr.io/seerr-team/seerr v3.5.1
|
||||
2026-10-31T03:44:20.3180798Z CURRENT app ghcr.io/sysadminsmedia/homebox 0.27.1
|
||||
2026-10-31T03:44:20.3180923Z CURRENT app ghost 6.73.0-alpine
|
||||
2026-10-31T03:44:20.3181043Z CURRENT app lscr.io/linuxserver/grocy 4.7.1
|
||||
2026-10-31T03:44:20.3181196Z CURRENT app lscr.io/linuxserver/radarr 6.4.4
|
||||
2026-10-31T03:44:20.3181321Z CURRENT app lscr.io/linuxserver/sonarr 4.0.20
|
||||
2026-10-31T03:44:20.3181435Z CURRENT app lukevella/rallly 4.16.3
|
||||
2026-10-31T03:44:20.3181559Z CURRENT app onlyoffice/documentserver 9.4.0
|
||||
2026-10-31T03:44:20.3181876Z CURRENT app outlinewiki/outline 1.12.0
|
||||
2026-10-31T03:44:20.3181994Z CURRENT app vaultwarden/server 1.37.4-alpine
|
||||
2026-10-31T03:44:20.3182112Z CURRENT app vikunja/vikunja 2.7.1
|
||||
2026-10-31T03:44:20.3182270Z COUNTS ADVISORY=42 BEHIND=12 CURRENT=39 FLOATING=20 GAP=74 NOT_CHECKED=8 SELF=2
|
||||
2026-10-31T03:44:20.5359163Z RUNTIME read=3 (122 s) from-cache=182 not-checked=0 zstd-decoder=zstandard 0.25.0 (pinned wheel, sha256 checked)
|
||||
2026-10-31T03:44:20.5360282Z TAGS fetched=117 from-cache=0 retried-429=0 (cache /root/.cache/felhom-watch-tags.json)
|
||||
2026-10-31T03:44:20.5360757Z REQUESTS api.github.com=68 api.osv.dev=1 auth.docker.io=1 blog.cloudflare.com=1 ghcr.io=174 github.com=62 hub.docker.com=207 raw.githubusercontent.com=1 registry-1.docker.io=1
|
||||
2026-10-31T03:44:21.0692312Z MAIL RESEND-ACCEPTED id=01a1900e-f1e4-7548-80ce-064f1d2ef9d3 kind=advisory subject=[Felhom security] traefik — 1 new advisory
|
||||
2026-10-31T03:44:21.0771116Z STATE written: documentation/security-watch/state.json (313 known advisories)
|
||||
2026-10-31T03:44:21.1780485Z ::group::Run set -u
|
||||
2026-10-31T03:44:21.1780729Z set -u
|
||||
2026-10-31T03:44:21.1780842Z f=documentation/security-watch/state.json
|
||||
2026-10-31T03:44:21.1780972Z if [ ! -f "$f" ]; then
|
||||
2026-10-31T03:44:21.1781112Z echo "no memory file was written - nothing to commit"; exit 0
|
||||
2026-10-31T03:44:21.1781233Z fi
|
||||
2026-10-31T03:44:21.1781325Z if git ls-files --error-unmatch "$f" >/dev/null 2>&1 && git diff --quiet -- "$f"; then
|
||||
2026-10-31T03:44:21.1781554Z echo "memory unchanged - nothing to commit"; exit 0
|
||||
2026-10-31T03:44:21.1781666Z fi
|
||||
2026-10-31T03:44:21.1781754Z cp "$f" /tmp/state.json
|
||||
2026-10-31T03:44:21.1781855Z auth=$(python3 -c 'import base64,os;print(base64.b64encode(("x:"+os.environ["PUSH_TOKEN"]).encode()).decode())')
|
||||
2026-10-31T03:44:21.1782016Z for attempt in 1 2 3; do
|
||||
2026-10-31T03:44:21.1782126Z git fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD
|
||||
2026-10-31T03:44:21.1782253Z mkdir -p "$(dirname "$f")" && cp /tmp/state.json "$f"
|
||||
2026-10-31T03:44:21.1782565Z git add "$f"
|
||||
2026-10-31T03:44:21.1782671Z git -c user.name="felhom security watch" -c user.email=monitoring@felhom.eu \
|
||||
2026-10-31T03:44:21.1782791Z commit -q -m "security-watch: memory of $(date -u +%F) (R-1303). Docs only." || { echo "nothing to commit"; exit 0; }
|
||||
2026-10-31T03:44:21.1782923Z if git -c http.extraHeader="Authorization: Basic $auth" push -q origin HEAD:main; then
|
||||
2026-10-31T03:44:21.1783065Z echo "memory pushed: $(git rev-parse --short=12 HEAD)"; exit 0
|
||||
2026-10-31T03:44:21.1783179Z fi
|
||||
2026-10-31T03:44:21.1783270Z echo "push refused (attempt $attempt) - re-fetching main"
|
||||
2026-10-31T03:44:21.1783409Z sleep 5
|
||||
2026-10-31T03:44:21.1783517Z done
|
||||
2026-10-31T03:44:21.1783617Z echo "MEMORY NOT SAVED after 3 attempts"; exit 1
|
||||
2026-10-31T03:44:21.1783725Z shell: bash --noprofile --norc -e -o pipefail {0}
|
||||
2026-10-31T03:44:21.1783942Z env:
|
||||
2026-10-31T03:44:21.1784450Z PUSH_TOKEN: ***
|
||||
2026-10-31T03:44:21.1784563Z ::endgroup::
|
||||
2026-10-31T03:44:24.0219826Z memory pushed: 38baf4b543d0
|
||||
2026-10-31T03:44:24.0228281Z Cleaning up container for job watch
|
||||
2026-10-31T03:44:24.5658870Z 🏁 Job succeeded
|
||||
@@ -0,0 +1,285 @@
|
||||
2026-11-01T03:40:12.3440494Z felhom-gates-runner-2(version:v0.6.1) received task 2573 of job watch, be triggered by event: schedule
|
||||
2026-11-01T03:40:12.3491038Z workflow prepared
|
||||
2026-11-01T03:40:12.3492326Z evaluating expression 'always()'
|
||||
2026-11-01T03:40:12.3498433Z expression 'always()' evaluated to 'true'
|
||||
2026-11-01T03:40:12.3515986Z evaluating expression ''
|
||||
2026-11-01T03:40:12.3516776Z expression '' evaluated to 'true'
|
||||
2026-11-01T03:40:12.3516959Z ⭐ Run Main Fetch main (latest, for the memory) and the two sibling repos
|
||||
2026-11-01T03:40:12.3526173Z Wrote command \n\necho "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"\nbase=http://gitea.gitea-system.svc.cluster.local:3000/admin\ngit init -q . && git remote add origin $base/felhom.eu.git\ngit fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD\necho "felhom.eu main at $(git rev-parse --short=12 HEAD)"\nfor r in felhom-controller app-catalog-felhom.eu; do\n git init -q ../$r && git -C ../$r remote add origin $base/$r.git\n git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD\n echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)"\ndone\n\n\n to 'workflow/0.sh'
|
||||
2026-11-01T03:40:12.3527640Z ::group::Run echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"
|
||||
2026-11-01T03:40:12.3527963Z echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"
|
||||
2026-11-01T03:40:12.3528120Z base=http://gitea.gitea-system.svc.cluster.local:3000/admin
|
||||
2026-11-01T03:40:12.3528260Z git init -q . && git remote add origin $base/felhom.eu.git
|
||||
2026-11-01T03:40:12.3528385Z git fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD
|
||||
2026-11-01T03:40:12.3528511Z echo "felhom.eu main at $(git rev-parse --short=12 HEAD)"
|
||||
2026-11-01T03:40:12.3528629Z for r in felhom-controller app-catalog-felhom.eu; do
|
||||
2026-11-01T03:40:12.3528743Z git init -q ../$r && git -C ../$r remote add origin $base/$r.git
|
||||
2026-11-01T03:40:12.3528856Z git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD
|
||||
2026-11-01T03:40:12.3528999Z echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)"
|
||||
2026-11-01T03:40:12.3529107Z done
|
||||
2026-11-01T03:40:12.3529204Z shell: bash --noprofile --norc -e -o pipefail {0}
|
||||
2026-11-01T03:40:12.3529336Z ::endgroup::
|
||||
2026-11-01T03:40:22.7943530Z felhom.eu main at 38baf4b543d0
|
||||
2026-11-01T03:40:24.8014694Z felhom-controller at a90b62323f11
|
||||
2026-11-01T03:40:25.4773186Z app-catalog-felhom.eu at 313eaf68d01f
|
||||
2026-11-01T03:40:25.4796263Z ::group::Run set -u
|
||||
2026-11-01T03:40:25.4796501Z set -u
|
||||
2026-11-01T03:40:25.4796687Z mkdir -p documentation/security-watch
|
||||
2026-11-01T03:40:25.4796807Z mode="${MODE:-run}"
|
||||
2026-11-01T03:40:25.4796908Z [ "${GITHUB_EVENT_NAME:-}" = "schedule" ] && mode=run
|
||||
2026-11-01T03:40:25.4797111Z echo "mode: $mode"
|
||||
2026-11-01T03:40:25.4797217Z case "$mode" in
|
||||
2026-11-01T03:40:25.4797325Z test-mail) python3 scripts/security_watch.py --test-mail; exit $? ;;
|
||||
2026-11-01T03:40:25.4797448Z dry) extra="--no-mail" ; state=/tmp/state-dry.json
|
||||
2026-11-01T03:40:25.4797603Z cp documentation/security-watch/state.json "$state" 2>/dev/null || true ;;
|
||||
2026-11-01T03:40:25.4797727Z seed) extra="--seed" ; state=documentation/security-watch/state.json ;;
|
||||
2026-11-01T03:40:25.4797842Z run) extra="" ; state=documentation/security-watch/state.json ;;
|
||||
2026-11-01T03:40:25.4797996Z *) echo "unknown mode $mode"; exit 2 ;;
|
||||
2026-11-01T03:40:25.4798104Z esac
|
||||
2026-11-01T03:40:25.4798193Z python3 scripts/security_watch.py --state="$state" --catalog=../app-catalog-felhom.eu \
|
||||
2026-11-01T03:40:25.4798452Z --controller=../felhom-controller --json=/tmp/watch-results.json $extra
|
||||
2026-11-01T03:40:25.4798607Z shell: bash --noprofile --norc -e -o pipefail {0}
|
||||
2026-11-01T03:40:25.4798745Z env:
|
||||
2026-11-01T03:40:25.4801554Z RESEND_API_KEY: ***
|
||||
2026-11-01T03:40:25.4801760Z GH_ADVISORY_TOKEN: ***
|
||||
2026-11-01T03:40:25.4801890Z MODE:
|
||||
2026-11-01T03:40:25.4801983Z FELHOM_WHEEL_FETCH: 1
|
||||
2026-11-01T03:40:25.4802119Z ::endgroup::
|
||||
2026-11-01T03:40:25.4843206Z mode: run
|
||||
2026-11-01T03:40:25.7143203Z /root/.cache/act/02dba97aa1adfb80/hostexecutor/scripts/security_watch.py:905: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
|
||||
2026-11-01T03:40:25.7144458Z today = datetime.date.fromisoformat(opts["today"]) if "today" in opts else datetime.datetime.utcnow().date()
|
||||
2026-11-01T03:40:25.7709336Z security watch 2026-11-01: 197 pins (11 box/build, 97 app, 89 DooPlex); GitHub key PRESENT — every repo's advisories tonight
|
||||
2026-11-01T03:41:12.1308400Z ADVISORY doop actualbudget/actual-server 26.10.0 CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-11-01T03:41:12.1309348Z ADVISORY doop advplyr/audiobookshelf 2.37.1 CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-11-01T03:41:12.1309677Z ADVISORY box cloudflare/cloudflared 2026.10.4 feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3 (fixed read the notice); vulnnotes:cloudflared@2026.10.6:VULN-184686 (fixed 2026.10.6); vulnnotes:cloudflared@2026.10.5:VULN-183456 (fixed 2026.10.5)
|
||||
2026-11-01T03:41:12.1310092Z ADVISORY doop codewithcj/sparkyfitness v1.9.0 release:CodeWithCJ/SparkyFitness@v1.10.0 (fixed v1.10.0)
|
||||
2026-11-01T03:41:12.1310504Z ADVISORY doop codewithcj/sparkyfitness_server v1.9.0 release:CodeWithCJ/SparkyFitness@v1.10.0 (fixed v1.10.0); CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-11-01T03:41:12.1311168Z ADVISORY doop crocodilestick/calibre-web-automated dev CVE-2026-111497 (fixed 1.2.1)
|
||||
2026-11-01T03:41:12.1311438Z ADVISORY doop docker.io/calcom/cal.com v6.2.0 CVE-2026-111497 (fixed 22.23.4, 24.22.1, 26.12.1)
|
||||
2026-11-01T03:41:12.1311724Z ADVISORY doop flomp/wanderer-db v0.21.0 GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2); … 1 more
|
||||
2026-11-01T03:41:12.1312082Z ADVISORY doop flomp/wanderer-web v0.21.0 GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2); … 2 more
|
||||
2026-11-01T03:41:12.1312450Z ADVISORY doop ghcr.io/gethomepage/homepage v1.13.2 GHSA-669x-4pg4-w24r (fixed 2.2.0); CVE-2026-111497 (fixed 22.23.4)
|
||||
2026-11-01T03:41:12.1312741Z ADVISORY doop ghcr.io/immich-app/immich-machine-learning v2.7.5 GHSA-q89f-h332-8q2h (fixed v3.2.4); GHSA-h5w4-vjv4-9r5q (fixed a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 (fixed v3.2.0); GHSA-72rm-x7xr-v679 (fixed v3.3.0); … 7 more
|
||||
2026-11-01T03:41:12.1313117Z ADVISORY doop ghcr.io/immich-app/immich-server v2.7.5 GHSA-q89f-h332-8q2h (fixed v3.2.4); GHSA-h5w4-vjv4-9r5q (fixed a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 (fixed v3.2.0); GHSA-72rm-x7xr-v679 (fixed v3.3.0); … 8 more
|
||||
2026-11-01T03:41:12.1313444Z ADVISORY doop ghcr.io/lukegus/termix release-2.9.2 CVE-2026-111497 (fixed 26.12.1)
|
||||
2026-11-01T03:41:12.1313801Z ADVISORY doop ghcr.io/paperless-ngx/paperless-ngx 3.3.4 release:paperless-ngx/paperless-ngx@v3.4.0 (fixed v3.4.0); CVE-2026-111497 (fixed 1.2.1)
|
||||
2026-11-01T03:41:12.1315994Z ADVISORY doop gitea/gitea 1.26.2 GHSA-wx44-9m3m-rjqx (fixed 28.2.0); GHSA-4jmf-h2cm-hg7w (fixed 28.2.0); GHSA-8j56-f865-gqq2 (fixed 28.2.0); GHSA-fxq4-gr55-7x5g (fixed 28.2.0); … 127 more
|
||||
2026-11-01T03:41:12.1316545Z ADVISORY doop grafana/grafana 13.2.4 GHSA-8xmm-x63g-f6xv (fixed no fixed version named yet); GHSA-4724-7jwc-3fpw (fixed the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 (fixed the range is unreadable — check by hand); GHSA-8wjh-59cw-9xh4 (fixed no fixed version named yet); … 2 more
|
||||
2026-11-01T03:41:12.1316932Z ADVISORY box gtstef/filebrowser 1.5.8-stable GHSA-892f-9h5p-mfc8 (fixed 2.1.0-stable, 2.1.4-beta); GHSA-gfgm-886h-6r47 (fixed 2.0.2-stable, 2.1.4-beta); GHSA-wxj5-g3qp-g732 (fixed 2.0.2-stable, 2.1.3-beta); GHSA-3j46-5w28-f8p2 (fixed 2.1.0-stable, 2.1.3-beta); … 32 more
|
||||
2026-11-01T03:41:12.1317307Z ADVISORY doop louislam/uptime-kuma 2.5.6 GHSA-86ch-2247-gr56 (fixed 2.5.9); GHSA-qjxc-h5jf-c7rj (fixed the range is unreadable — check by hand); release:louislam/uptime-kuma@2.5.9 (fixed 2.5.9); release:louislam/uptime-kuma@2.5.8 (fixed 2.5.8); … 2 more
|
||||
2026-11-01T03:41:12.1317669Z ADVISORY doop outlinewiki/outline 1.11.0 GHSA-x4w3-9p9j-cprh (fixed 1.12.0); GHSA-rq53-m97j-f2pg (fixed 1.12.0); GHSA-h6ff-rw9x-5mq2 (fixed 1.12.0); GHSA-rvj7-2gww-6xfq (fixed 1.12.0); … 3 more
|
||||
2026-11-01T03:41:12.1318031Z ADVISORY doop redis 8.10.2 GHSA-c8h9-259x-jff4 (fixed the range is unreadable — check by hand); GHSA-8ghh-qpmp-7826 (fixed no fixed version named yet); GHSA-93m2-935m-8rj3 (fixed no fixed version named yet); GHSA-m8fj-85cg-7vhp (fixed the range is unreadable — check by hand); … 8 more
|
||||
2026-11-01T03:41:12.1318449Z ADVISORY doop rommapp/romm 5.4.0 release:rommapp/romm@5.4.1 (fixed 5.4.1); CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-11-01T03:41:12.1318736Z ADVISORY box traefik v3.7.16 release:traefik/traefik@v3.7.17 (fixed v3.7.17)
|
||||
2026-11-01T03:41:12.1319031Z ADVISORY doop vabene1111/recipes 2.6.15 CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-11-01T03:41:12.1319320Z ADVISORY app actualbudget/actual-server 26.9.0 CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-11-01T03:41:12.1319701Z ADVISORY app calcom/cal.com v6.2.0 GHSA-p3f6-52gv-cj7m (fixed the range is unreadable — check by hand); GHSA-cpf2-q635-xrwx (fixed the range is unreadable — check by hand); CVE-2026-111497 (fixed 22.23.4, 24.22.1, 26.12.1)
|
||||
2026-11-01T03:41:12.1320033Z ADVISORY app codewithcj/sparkyfitness v0.17.3 GHSA-v883-jx9h-qf29 (fixed a version after 1.7.2 (the notice names none)); GHSA-cmmf-53wf-r5gv (fixed a version after 1.6.5 (the notice names none)); GHSA-p8cf-g8rv-gvrq (fixed a version after 1.6.5 (the notice names none))
|
||||
2026-11-01T03:41:12.1320624Z ADVISORY app codewithcj/sparkyfitness_server v0.17.3 GHSA-v883-jx9h-qf29 (fixed a version after 1.7.2 (the notice names none)); GHSA-cmmf-53wf-r5gv (fixed a version after 1.6.5 (the notice names none)); GHSA-p8cf-g8rv-gvrq (fixed a version after 1.6.5 (the notice names none)); CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-11-01T03:41:12.1321165Z ADVISORY app crocodilestick/calibre-web-automated v4.0.8 CVE-2026-111497 (fixed 1.2.1)
|
||||
2026-11-01T03:41:12.1321692Z ADVISORY app f0rc3/gokapi v1.9.6 GHSA-45vh-rpc8-hxpp (fixed 2.2.4); GHSA-qwc6-vc2v-2ggj (fixed 2.2.4); GHSA-j6jp-78w8-34x6 (fixed 2.2.4); GHSA-m2hx-wjxc-9fp4 (fixed 2.2.3); … 6 more
|
||||
2026-11-01T03:41:12.1322265Z ADVISORY app ghcr.io/immich-app/immich-machine-learning v3.3.5 GHSA-8244-8vpr-vp9c (fixed the range is unreadable — check by hand)
|
||||
2026-11-01T03:41:12.1322743Z ADVISORY app ghcr.io/immich-app/immich-server v3.3.5 GHSA-8244-8vpr-vp9c (fixed the range is unreadable — check by hand)
|
||||
2026-11-01T03:41:12.1323751Z ADVISORY app ghcr.io/karakeep-app/karakeep 0.34.1 GHSA-pp34-2c9r-mchw (fixed no fixed version named yet)
|
||||
2026-11-01T03:41:12.1324323Z ADVISORY app ghcr.io/lukegus/termix 26.10.5 GHSA-r9gw-3w87-mhh7 (fixed no fixed version named yet); release:Termix-SSH/Termix@v26.10.6 (fixed v26.10.6)
|
||||
2026-11-01T03:41:12.1324680Z ADVISORY app ghcr.io/mealie-recipes/mealie v3.29.0 release:mealie-recipes/mealie@v3.30.0 (fixed v3.30.0)
|
||||
2026-11-01T03:41:12.1325121Z ADVISORY app ghcr.io/paperless-ngx/paperless-ngx 2.20.15 GHSA-c8f3-pqr2-rr24 (fixed 3.3.2); GHSA-2jhj-xqrq-rmrq (fixed 3.1.2); CVE-2026-111497 (fixed 1.1.1)
|
||||
2026-11-01T03:41:12.1325500Z ADVISORY app ghcr.io/tandoorrecipes/recipes 2.7.2 GHSA-c7mc-c9jr-38hf (fixed the range is unreadable — check by hand); GHSA-cqj3-64qw-4w52 (fixed the range is unreadable — check by hand)
|
||||
2026-11-01T03:41:12.1326004Z ADVISORY app gitea/gitea 28.2.0 GHSA-rqhx-647v-wx32 (fixed no fixed version named yet)
|
||||
2026-11-01T03:41:12.1326285Z ADVISORY app glanceapp/glance v0.8.5 GHSA-r225-jhr6-68cc (fixed >= 0.8.7)
|
||||
2026-11-01T03:41:12.1326796Z ADVISORY app grafana/grafana 13.2.4 GHSA-8xmm-x63g-f6xv (fixed no fixed version named yet); GHSA-4724-7jwc-3fpw (fixed the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 (fixed the range is unreadable — check by hand); GHSA-8wjh-59cw-9xh4 (fixed no fixed version named yet); … 2 more
|
||||
2026-11-01T03:41:12.1327452Z ADVISORY app louislam/uptime-kuma 2.5.7 GHSA-86ch-2247-gr56 (fixed 2.5.9); GHSA-qjxc-h5jf-c7rj (fixed the range is unreadable — check by hand); release:louislam/uptime-kuma@2.5.9 (fixed 2.5.9); release:louislam/uptime-kuma@2.5.8 (fixed 2.5.8)
|
||||
2026-11-01T03:41:12.1327924Z ADVISORY app n8nio/n8n 2.44.7 GHSA-2x68-96jw-5r6c (fixed >= 3.0.1); GHSA-9p7v-45m2-wxgj (fixed >= 3.0.1); GHSA-mx4r-96jx-v278 (fixed >= 3.0.1); GHSA-4v22-g448-h4rg (fixed >= 2.45.5, >= 2.46.1, >= 3.0.1); … 9 more
|
||||
2026-11-01T03:41:12.1328322Z ADVISORY app privatebin/pdo 2.1.0 GHSA-c4gc-8mcm-hh65 (fixed 2.1.1); GHSA-hw9p-r7fq-8mvr (fixed 2.1.1)
|
||||
2026-11-01T03:41:12.1328770Z ADVISORY app rommapp/romm 5.4.1 CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-11-01T03:41:12.1329050Z NOT CHECKED doop gitea.dooplex.hu/admin/felhom-act-runner 0.1.0 registry gitea.dooplex.hu: no anonymous token route
|
||||
2026-11-01T03:41:12.1329464Z NOT CHECKED doop gitea.dooplex.hu/admin/jarr latest registry gitea.dooplex.hu: no anonymous token route
|
||||
2026-11-01T03:41:12.1329757Z NOT CHECKED doop gitea.dooplex.hu/admin/recipe-importer latest registry gitea.dooplex.hu: no anonymous token route
|
||||
2026-11-01T03:41:12.1330247Z NOT CHECKED doop gitea.dooplex.hu/admin/revfulop-calendar 1.6.2 registry gitea.dooplex.hu: no anonymous token route
|
||||
2026-11-01T03:41:12.1330586Z NOT CHECKED doop gitea.dooplex.hu/admin/sparkyfitness-export 0.3.0 registry gitea.dooplex.hu: no anonymous token route
|
||||
2026-11-01T03:41:12.1331899Z NOT CHECKED doop gitea.dooplex.hu/admin/wan-probe 0.1.0 registry gitea.dooplex.hu: no anonymous token route
|
||||
2026-11-01T03:41:12.1332372Z NOT CHECKED doop minio/minio latest Docker registry tags of minio/minio: HTTP 401; manifest minio/minio:latest: HTTP 401
|
||||
2026-11-01T03:41:12.1332894Z BEHIND doop getmeili/meilisearch v1.11.3 newest v1.56.0
|
||||
2026-11-01T03:41:12.1333406Z BEHIND doop ghcr.io/diced/zipline 4.8.1 newest 4.8.2
|
||||
2026-11-01T03:41:12.1333872Z BEHIND app getmeili/meilisearch v1.41.0 newest v1.56.0
|
||||
2026-11-01T03:41:12.1334586Z BEHIND app getmeili/meilisearch v1.36.0 newest v1.56.0
|
||||
2026-11-01T03:41:12.1335040Z BEHIND app ghcr.io/hargata/lubelogger v1.7.3 newest v1.7.4
|
||||
2026-11-01T03:41:12.1335480Z BEHIND app ghcr.io/kozea/radicale 3.8.1 newest 3.9.0
|
||||
2026-11-01T03:41:12.1335990Z BEHIND app gotson/komga 1.28.0 newest 1.29.2
|
||||
2026-11-01T03:41:12.1336417Z BEHIND app kimai/kimai2 2.67.0 newest 2.71.0
|
||||
2026-11-01T03:41:12.1336853Z BEHIND app lscr.io/linuxserver/bookstack 26.09.2 newest 26.09.20260929
|
||||
2026-11-01T03:41:12.1337295Z BEHIND app lscr.io/linuxserver/code-server 4.143.1 newest 4.144.0
|
||||
2026-11-01T03:41:12.1337726Z BEHIND app nextcloud 34.0.4-apache newest 34.0.5-apache
|
||||
2026-11-01T03:41:12.1338113Z BEHIND app nginx 1.30.5-alpine newest 1.31.8-alpine
|
||||
2026-11-01T03:41:12.1338572Z BEHIND app qbittorrentofficial/qbittorrent-nox 5.2.4-1 newest 5.3.0-2
|
||||
2026-11-01T03:41:12.1338982Z GAP buil alpine 3.24.2 newest 3.24.3
|
||||
2026-11-01T03:41:12.1339397Z GAP buil alpine 3.24.2 newest 3.24.3
|
||||
2026-11-01T03:41:12.1339768Z GAP doop alpine/k8s 1.37.1
|
||||
2026-11-01T03:41:12.1340186Z GAP doop arcadiatechnology/crafty-4 4.11.0
|
||||
2026-11-01T03:41:12.1340553Z GAP doop bhgedigital/envsubst latest
|
||||
2026-11-01T03:41:12.1340968Z GAP doop busybox 1.38
|
||||
2026-11-01T03:41:12.1341358Z GAP doop codercom/code-server 4.143.1 newest 4.144.0
|
||||
2026-11-01T03:41:12.1341807Z GAP buil debian 13.7-slim
|
||||
2026-11-01T03:41:12.1342167Z GAP buil debian 13.7-slim
|
||||
2026-11-01T03:41:12.1342586Z GAP doop docker.io/bitnamilegacy/postgresql 17.6.0-debian-12-r3
|
||||
2026-11-01T03:41:12.1342965Z GAP doop docker.io/library/nextcloud 34.0.5-apache
|
||||
2026-11-01T03:41:12.1343375Z GAP doop docker.io/valkey/valkey 9.2-alpine
|
||||
2026-11-01T03:41:12.1343734Z GAP doop filebrowser/filebrowser v2.63.23
|
||||
2026-11-01T03:41:12.1344155Z GAP doop ghcr.io/cloudnative-pg/postgresql 17.2 newest 17.11
|
||||
2026-11-01T03:41:12.1344624Z GAP doop ghcr.io/headlamp-k8s/headlamp v0.46.0
|
||||
2026-11-01T03:41:12.1345026Z GAP doop ghcr.io/immich-app/postgres 16-vectorchord0.3.0
|
||||
2026-11-01T03:41:12.1345396Z GAP doop ghcr.io/jimmidyson/configmap-reload v0.15.0
|
||||
2026-11-01T03:41:12.1345796Z GAP doop ghcr.io/onedr0p/exportarr v2.3.0
|
||||
2026-11-01T03:41:12.1346160Z GAP doop ghcr.io/seriousm4x/upsnap 5
|
||||
2026-11-01T03:41:12.1346579Z GAP doop ghcr.io/stakater/reloader v1.4.22 newest v1.4.23
|
||||
2026-11-01T03:41:12.1346972Z GAP doop ghcr.io/tautulli/tautulli v2.18.2
|
||||
2026-11-01T03:41:12.1347379Z GAP doop griefed/serverpackcreator 8.1.2
|
||||
2026-11-01T03:41:12.1347744Z GAP doop gtstef/filebrowser 1.5.8-stable
|
||||
2026-11-01T03:41:12.1348138Z GAP doop guacamole/guacamole 1.6.0
|
||||
2026-11-01T03:41:12.1348497Z GAP doop guacamole/guacd 1.6.0
|
||||
2026-11-01T03:41:12.1348889Z GAP doop index.docker.io/plexinc/pms-docker 1.43.5.11029-6bf8af3f0
|
||||
2026-11-01T03:41:12.1349266Z GAP doop itzg/mc-backup 2026.10.1 newest 2026.10.3
|
||||
2026-11-01T03:41:12.1349770Z GAP doop itzg/minecraft-server 2026.10.0-java21 newest 2026.10.1-java17
|
||||
2026-11-01T03:41:12.1350160Z GAP doop linuxserver/bookstack 26.09.20260929
|
||||
2026-11-01T03:41:12.1350789Z GAP doop linuxserver/prowlarr version-2.6.5.5623
|
||||
2026-11-01T03:41:12.1351164Z GAP doop linuxserver/qbittorrent 5.3.0
|
||||
2026-11-01T03:41:12.1351571Z GAP doop linuxserver/radarr version-6.4.4.10685
|
||||
2026-11-01T03:41:12.1351937Z GAP doop linuxserver/sonarr version-4.0.20.3014
|
||||
2026-11-01T03:41:12.1352380Z GAP doop mariadb 11
|
||||
2026-11-01T03:41:12.1352948Z GAP doop mikefarah/yq 4.54.1
|
||||
2026-11-01T03:41:12.1353428Z GAP doop mongodb/mongodb-community-server 8.0.5-ubuntu2204 newest 8.3.13-ubuntu2204
|
||||
2026-11-01T03:41:12.1353806Z GAP doop msdeluise/plant-it-server 0.10.0
|
||||
2026-11-01T03:41:12.1354231Z GAP doop mysql 8.4
|
||||
2026-11-01T03:41:12.1354581Z GAP doop nicolaka/netshoot latest
|
||||
2026-11-01T03:41:12.1355010Z GAP doop postgis/postgis 16-3.5
|
||||
2026-11-01T03:41:12.1355425Z GAP doop postgres 15-alpine
|
||||
2026-11-01T03:41:12.1355801Z GAP doop postgres 16-alpine
|
||||
2026-11-01T03:41:12.1356155Z GAP doop privatebin/nginx-fpm-alpine 2.0.6 newest 2.1.0
|
||||
2026-11-01T03:41:12.1356531Z GAP doop prom/alertmanager v0.34.1 newest v0.34.2
|
||||
2026-11-01T03:41:12.1357162Z GAP doop prom/node-exporter v1.12.1
|
||||
2026-11-01T03:41:12.1357595Z GAP doop prom/prometheus v3.15.0 newest v3.15.1
|
||||
2026-11-01T03:41:12.1357952Z GAP doop prometheuscommunity/smartctl-exporter v0.15.0
|
||||
2026-11-01T03:41:12.1358325Z GAP doop python 3.15-bookworm
|
||||
2026-11-01T03:41:12.1358752Z GAP doop quay.io/jetstack/version-checker v0.11.0
|
||||
2026-11-01T03:41:12.1359117Z GAP doop quay.io/prometheus/blackbox-exporter v0.29.1
|
||||
2026-11-01T03:41:12.1359561Z GAP doop renovate/renovate 44.181.1 newest 44.198.3
|
||||
2026-11-01T03:41:12.1359974Z GAP doop tailscale/tailscale v1.104.2 newest v1.104.4
|
||||
2026-11-01T03:41:12.1360546Z GAP app emby/embyserver 4.11.0.4 newest 4.11.0.12
|
||||
2026-11-01T03:41:12.1360942Z GAP app ghcr.io/immich-app/postgres 16-vectorchord0.4.3-pg
|
||||
2026-11-01T03:41:12.1361339Z GAP app ghcr.io/karakeep-app/karakeep-chrome 151.0.7922.47-r1
|
||||
2026-11-01T03:41:12.1361757Z GAP app mariadb 12.3
|
||||
2026-11-01T03:41:12.1362419Z GAP app mariadb 11.4 newest 11.8
|
||||
2026-11-01T03:41:12.1362817Z GAP app mariadb 11.8
|
||||
2026-11-01T03:41:12.1363170Z GAP app mariadb 12.3
|
||||
2026-11-01T03:41:12.1363743Z GAP app mariadb 11.8
|
||||
2026-11-01T03:41:12.1364192Z GAP app msdeluise/plant-it 0.10.0
|
||||
2026-11-01T03:41:12.1364957Z GAP app plexinc/pms-docker 1.43.5.11029-6bf8af3f0
|
||||
2026-11-01T03:41:12.1365422Z GAP app postgis/postgis 16-3.5-alpine
|
||||
2026-11-01T03:41:12.1365832Z GAP app postgis/postgis 17-3.5-alpine
|
||||
2026-11-01T03:41:12.1366240Z GAP app postgres 18-alpine
|
||||
2026-11-01T03:41:12.1366658Z GAP app postgres 17-alpine
|
||||
2026-11-01T03:41:12.1366960Z GAP app postgres 18-alpine
|
||||
2026-11-01T03:41:12.1367172Z GAP app postgres 18-alpine
|
||||
2026-11-01T03:41:12.1367377Z GAP app postgres 18-alpine
|
||||
2026-11-01T03:41:12.1367685Z GAP app postgres 18-alpine
|
||||
2026-11-01T03:41:12.1367898Z GAP app postgres 18-alpine
|
||||
2026-11-01T03:41:12.1368110Z GAP app postgres 17-alpine
|
||||
2026-11-01T03:41:12.1368312Z GAP app postgres 16-alpine
|
||||
2026-11-01T03:41:12.1368728Z GAP app registry.gitlab.com/crafty-controller/crafty-4 4.11.0
|
||||
2026-11-01T03:41:12.1368964Z FLOATING doop ghcr.io/seanmorley15/adventurelog-backend latest
|
||||
2026-11-01T03:41:12.1369186Z FLOATING doop ghcr.io/seanmorley15/adventurelog-frontend latest
|
||||
2026-11-01T03:41:12.1369475Z FLOATING doop nginx 1.31-alpine
|
||||
2026-11-01T03:41:12.1369695Z FLOATING doop redis 8-alpine
|
||||
2026-11-01T03:41:12.1369915Z FLOATING doop redis 8.10-alpine
|
||||
2026-11-01T03:41:12.1370124Z FLOATING app ghcr.io/claperco/claper 2.5
|
||||
2026-11-01T03:41:12.1370396Z FLOATING app ghcr.io/thomiceli/opengist 1.15
|
||||
2026-11-01T03:41:12.1370614Z FLOATING app jellyfin/jellyfin 12.4
|
||||
2026-11-01T03:41:12.1371484Z FLOATING app lscr.io/linuxserver/prowlarr version-2.6.5.5623
|
||||
2026-11-01T03:41:12.1371848Z FLOATING app lscr.io/linuxserver/sabnzbd version-5.1.3
|
||||
2026-11-01T03:41:12.1372093Z FLOATING app lscr.io/linuxserver/transmission version-4.1.3-r0
|
||||
2026-11-01T03:41:12.1372329Z FLOATING app nzbgetcom/nzbget v26.3
|
||||
2026-11-01T03:41:12.1372553Z FLOATING app redis 7.4-alpine
|
||||
2026-11-01T03:41:12.1372818Z FLOATING app redis 7-alpine
|
||||
2026-11-01T03:41:12.1373033Z FLOATING app redis 7-alpine
|
||||
2026-11-01T03:41:12.1373243Z FLOATING app redis 7-alpine
|
||||
2026-11-01T03:41:12.1373471Z FLOATING app redis 7-alpine
|
||||
2026-11-01T03:41:12.1373687Z FLOATING app redis 7-alpine
|
||||
2026-11-01T03:41:12.1373908Z FLOATING app redis 7-alpine
|
||||
2026-11-01T03:41:12.1374120Z FLOATING app wger/server 2.7
|
||||
2026-11-01T03:41:12.1374337Z SELF box gitea.dooplex.hu/admin/felhom-samba 1.2.0
|
||||
2026-11-01T03:41:12.1374549Z SELF app gitea.dooplex.hu/admin/recipe-importer v0.9.11
|
||||
2026-11-01T03:41:12.1374764Z CURRENT doop f0rc3/gokapi v2.2.4
|
||||
2026-11-01T03:41:12.1375148Z CURRENT doop ghcr.io/alam00000/bentopdf 2.8.10
|
||||
2026-11-01T03:41:12.1375374Z CURRENT doop ghcr.io/seerr-team/seerr v3.5.1
|
||||
2026-11-01T03:41:12.1375591Z CURRENT doop ghcr.io/thomiceli/opengist 1.15.3
|
||||
2026-11-01T03:41:12.1375812Z CURRENT doop glanceapp/glance v0.8.7
|
||||
2026-11-01T03:41:12.1376027Z CURRENT buil golang 1.27.3-trixie
|
||||
2026-11-01T03:41:12.1376235Z CURRENT buil golang 1.27.3-alpine3.24
|
||||
2026-11-01T03:41:12.1376438Z CURRENT doop onlyoffice/documentserver 9.4.0
|
||||
2026-11-01T03:41:12.1376661Z CURRENT buil restic 0.19.1
|
||||
2026-11-01T03:41:12.1376876Z CURRENT doop vaultwarden/server 1.37.4
|
||||
2026-11-01T03:41:12.1377085Z CURRENT app deluan/navidrome 0.64.2
|
||||
2026-11-01T03:41:12.1377297Z CURRENT app docmost/docmost 0.97.0
|
||||
2026-11-01T03:41:12.1377507Z CURRENT app flomp/wanderer-db v0.21.2
|
||||
2026-11-01T03:41:12.1377733Z CURRENT app flomp/wanderer-web v0.21.2
|
||||
2026-11-01T03:41:12.1377948Z CURRENT app freikin/dawarich 1.19.0
|
||||
2026-11-01T03:41:12.1378178Z CURRENT app ghcr.io/advplyr/audiobookshelf 2.37.2
|
||||
2026-11-01T03:41:12.1378393Z CURRENT app ghcr.io/alam00000/bentopdf v2.8.10
|
||||
2026-11-01T03:41:12.1378601Z CURRENT app ghcr.io/alexta69/metube 2026.10.27
|
||||
2026-11-01T03:41:12.1378809Z CURRENT app ghcr.io/cmintey/wishlist v0.69.0
|
||||
2026-11-01T03:41:12.1379078Z CURRENT app ghcr.io/diced/zipline 4.8.2
|
||||
2026-11-01T03:41:12.1379333Z CURRENT app ghcr.io/gethomepage/homepage v2.7.0
|
||||
2026-11-01T03:41:12.1379722Z CURRENT app ghcr.io/gramps-project/grampsweb v25.6.0
|
||||
2026-11-01T03:41:12.1380038Z CURRENT app ghcr.io/grimmory-tools/grimmory v3.5.0
|
||||
2026-11-01T03:41:12.1380484Z CURRENT app ghcr.io/home-assistant/home-assistant 2026.10.4
|
||||
2026-11-01T03:41:12.1381013Z CURRENT app ghcr.io/papra-hq/papra 26.7.1-rootless
|
||||
2026-11-01T03:41:12.1381504Z CURRENT app ghcr.io/seanmorley15/adventurelog-backend v0.13.1
|
||||
2026-11-01T03:41:12.1381948Z CURRENT app ghcr.io/seanmorley15/adventurelog-frontend v0.13.1
|
||||
2026-11-01T03:41:12.1382617Z CURRENT app ghcr.io/seerr-team/seerr v3.5.1
|
||||
2026-11-01T03:41:12.1382983Z CURRENT app ghcr.io/sysadminsmedia/homebox 0.27.1
|
||||
2026-11-01T03:41:12.1383219Z CURRENT app ghost 6.73.0-alpine
|
||||
2026-11-01T03:41:12.1383448Z CURRENT app lscr.io/linuxserver/grocy 4.7.1
|
||||
2026-11-01T03:41:12.1383667Z CURRENT app lscr.io/linuxserver/radarr 6.4.4
|
||||
2026-11-01T03:41:12.1383880Z CURRENT app lscr.io/linuxserver/sonarr 4.0.20
|
||||
2026-11-01T03:41:12.1384095Z CURRENT app lukevella/rallly 4.16.3
|
||||
2026-11-01T03:41:12.1384301Z CURRENT app onlyoffice/documentserver 9.4.0
|
||||
2026-11-01T03:41:12.1384520Z CURRENT app outlinewiki/outline 1.12.0
|
||||
2026-11-01T03:41:12.1384742Z CURRENT app vaultwarden/server 1.37.4-alpine
|
||||
2026-11-01T03:41:12.1384972Z CURRENT app vikunja/vikunja 2.7.1
|
||||
2026-11-01T03:41:12.1385182Z COUNTS ADVISORY=43 BEHIND=13 CURRENT=38 FLOATING=20 GAP=74 NOT_CHECKED=7 SELF=2
|
||||
2026-11-01T03:41:12.1385395Z RUNTIME read=0 (0 s) from-cache=185 not-checked=0 zstd-decoder=not needed
|
||||
2026-11-01T03:41:12.1385622Z TAGS fetched=1 from-cache=115 retried-429=0 (cache /root/.cache/felhom-watch-tags.json)
|
||||
2026-11-01T03:41:12.1385869Z REQUESTS api.github.com=71 api.osv.dev=1 auth.docker.io=1 blog.cloudflare.com=1 github.com=64 hub.docker.com=4 raw.githubusercontent.com=1 registry-1.docker.io=1
|
||||
2026-11-01T03:41:12.6557991Z MAIL RESEND-ACCEPTED id=01a19532-6dea-737a-8376-6092add4c4ea kind=advisory subject=[Felhom security] filebrowser, mealie, uptime-kuma — 6 new advisories
|
||||
2026-11-01T03:41:12.6711327Z STATE written: documentation/security-watch/state.json (319 known advisories)
|
||||
2026-11-01T03:41:12.7710692Z ::group::Run set -u
|
||||
2026-11-01T03:41:12.7711240Z set -u
|
||||
2026-11-01T03:41:12.7711462Z f=documentation/security-watch/state.json
|
||||
2026-11-01T03:41:12.7711690Z if [ ! -f "$f" ]; then
|
||||
2026-11-01T03:41:12.7711943Z echo "no memory file was written - nothing to commit"; exit 0
|
||||
2026-11-01T03:41:12.7712183Z fi
|
||||
2026-11-01T03:41:12.7712373Z if git ls-files --error-unmatch "$f" >/dev/null 2>&1 && git diff --quiet -- "$f"; then
|
||||
2026-11-01T03:41:12.7712686Z echo "memory unchanged - nothing to commit"; exit 0
|
||||
2026-11-01T03:41:12.7712904Z fi
|
||||
2026-11-01T03:41:12.7713087Z cp "$f" /tmp/state.json
|
||||
2026-11-01T03:41:12.7713285Z auth=$(python3 -c 'import base64,os;print(base64.b64encode(("x:"+os.environ["PUSH_TOKEN"]).encode()).decode())')
|
||||
2026-11-01T03:41:12.7713599Z for attempt in 1 2 3; do
|
||||
2026-11-01T03:41:12.7713785Z git fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD
|
||||
2026-11-01T03:41:12.7714014Z mkdir -p "$(dirname "$f")" && cp /tmp/state.json "$f"
|
||||
2026-11-01T03:41:12.7714281Z git add "$f"
|
||||
2026-11-01T03:41:12.7714480Z git -c user.name="felhom security watch" -c user.email=monitoring@felhom.eu \
|
||||
2026-11-01T03:41:12.7714716Z commit -q -m "security-watch: memory of $(date -u +%F) (R-1303). Docs only." || { echo "nothing to commit"; exit 0; }
|
||||
2026-11-01T03:41:12.7715080Z if git -c http.extraHeader="Authorization: Basic $auth" push -q origin HEAD:main; then
|
||||
2026-11-01T03:41:12.7715364Z echo "memory pushed: $(git rev-parse --short=12 HEAD)"; exit 0
|
||||
2026-11-01T03:41:12.7715588Z fi
|
||||
2026-11-01T03:41:12.7715773Z echo "push refused (attempt $attempt) - re-fetching main"
|
||||
2026-11-01T03:41:12.7716047Z sleep 5
|
||||
2026-11-01T03:41:12.7716243Z done
|
||||
2026-11-01T03:41:12.7716428Z echo "MEMORY NOT SAVED after 3 attempts"; exit 1
|
||||
2026-11-01T03:41:12.7716635Z shell: bash --noprofile --norc -e -o pipefail {0}
|
||||
2026-11-01T03:41:12.7716941Z env:
|
||||
2026-11-01T03:41:12.7717708Z PUSH_TOKEN: ***
|
||||
2026-11-01T03:41:12.7717924Z ::endgroup::
|
||||
2026-11-01T03:41:14.3641483Z memory pushed: f196e74e60d1
|
||||
2026-11-01T03:41:14.3655287Z Cleaning up container for job watch
|
||||
2026-11-01T03:41:14.9940266Z 🏁 Job succeeded
|
||||
@@ -0,0 +1,289 @@
|
||||
2026-11-02T03:40:21.9801809Z felhom-gates-runner-2(version:v0.6.1) received task 2575 of job watch, be triggered by event: schedule
|
||||
2026-11-02T03:40:21.9869882Z workflow prepared
|
||||
2026-11-02T03:40:21.9871299Z evaluating expression 'always()'
|
||||
2026-11-02T03:40:21.9878841Z expression 'always()' evaluated to 'true'
|
||||
2026-11-02T03:40:21.9902676Z evaluating expression ''
|
||||
2026-11-02T03:40:21.9903371Z expression '' evaluated to 'true'
|
||||
2026-11-02T03:40:21.9903634Z ⭐ Run Main Fetch main (latest, for the memory) and the two sibling repos
|
||||
2026-11-02T03:40:21.9914312Z Wrote command \n\necho "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"\nbase=http://gitea.gitea-system.svc.cluster.local:3000/admin\ngit init -q . && git remote add origin $base/felhom.eu.git\ngit fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD\necho "felhom.eu main at $(git rev-parse --short=12 HEAD)"\nfor r in felhom-controller app-catalog-felhom.eu; do\n git init -q ../$r && git -C ../$r remote add origin $base/$r.git\n git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD\n echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)"\ndone\n\n\n to 'workflow/0.sh'
|
||||
2026-11-02T03:40:21.9916099Z ::group::Run echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"
|
||||
2026-11-02T03:40:21.9916504Z echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"
|
||||
2026-11-02T03:40:21.9916878Z base=http://gitea.gitea-system.svc.cluster.local:3000/admin
|
||||
2026-11-02T03:40:21.9917101Z git init -q . && git remote add origin $base/felhom.eu.git
|
||||
2026-11-02T03:40:21.9917313Z git fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD
|
||||
2026-11-02T03:40:21.9917535Z echo "felhom.eu main at $(git rev-parse --short=12 HEAD)"
|
||||
2026-11-02T03:40:21.9917749Z for r in felhom-controller app-catalog-felhom.eu; do
|
||||
2026-11-02T03:40:21.9917957Z git init -q ../$r && git -C ../$r remote add origin $base/$r.git
|
||||
2026-11-02T03:40:21.9918167Z git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD
|
||||
2026-11-02T03:40:21.9918444Z echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)"
|
||||
2026-11-02T03:40:21.9918660Z done
|
||||
2026-11-02T03:40:21.9918853Z shell: bash --noprofile --norc -e -o pipefail {0}
|
||||
2026-11-02T03:40:21.9919120Z ::endgroup::
|
||||
2026-11-02T03:40:33.3973194Z felhom.eu main at f196e74e60d1
|
||||
2026-11-02T03:40:35.7560058Z felhom-controller at a90b62323f11
|
||||
2026-11-02T03:40:36.1982093Z app-catalog-felhom.eu at 313eaf68d01f
|
||||
2026-11-02T03:40:36.2053718Z ::group::Run set -u
|
||||
2026-11-02T03:40:36.2054137Z set -u
|
||||
2026-11-02T03:40:36.2054432Z mkdir -p documentation/security-watch
|
||||
2026-11-02T03:40:36.2054650Z mode="${MODE:-run}"
|
||||
2026-11-02T03:40:36.2054844Z [ "${GITHUB_EVENT_NAME:-}" = "schedule" ] && mode=run
|
||||
2026-11-02T03:40:36.2055125Z echo "mode: $mode"
|
||||
2026-11-02T03:40:36.2055325Z case "$mode" in
|
||||
2026-11-02T03:40:36.2055515Z test-mail) python3 scripts/security_watch.py --test-mail; exit $? ;;
|
||||
2026-11-02T03:40:36.2055736Z dry) extra="--no-mail" ; state=/tmp/state-dry.json
|
||||
2026-11-02T03:40:36.2056119Z cp documentation/security-watch/state.json "$state" 2>/dev/null || true ;;
|
||||
2026-11-02T03:40:36.2056352Z seed) extra="--seed" ; state=documentation/security-watch/state.json ;;
|
||||
2026-11-02T03:40:36.2056582Z run) extra="" ; state=documentation/security-watch/state.json ;;
|
||||
2026-11-02T03:40:36.2056865Z *) echo "unknown mode $mode"; exit 2 ;;
|
||||
2026-11-02T03:40:36.2057071Z esac
|
||||
2026-11-02T03:40:36.2057249Z python3 scripts/security_watch.py --state="$state" --catalog=../app-catalog-felhom.eu \
|
||||
2026-11-02T03:40:36.2057593Z --controller=../felhom-controller --json=/tmp/watch-results.json $extra
|
||||
2026-11-02T03:40:36.2057873Z shell: bash --noprofile --norc -e -o pipefail {0}
|
||||
2026-11-02T03:40:36.2058144Z env:
|
||||
2026-11-02T03:40:36.2059169Z RESEND_API_KEY: ***
|
||||
2026-11-02T03:40:36.2059474Z GH_ADVISORY_TOKEN: ***
|
||||
2026-11-02T03:40:36.2059701Z MODE:
|
||||
2026-11-02T03:40:36.2060003Z FELHOM_WHEEL_FETCH: 1
|
||||
2026-11-02T03:40:36.2060251Z ::endgroup::
|
||||
2026-11-02T03:40:36.2132655Z mode: run
|
||||
2026-11-02T03:40:36.5018361Z /root/.cache/act/3c4eb45e7511cf55/hostexecutor/scripts/security_watch.py:905: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
|
||||
2026-11-02T03:40:36.5019025Z today = datetime.date.fromisoformat(opts["today"]) if "today" in opts else datetime.datetime.utcnow().date()
|
||||
2026-11-02T03:40:36.5615817Z security watch 2026-11-02: 197 pins (11 box/build, 97 app, 89 DooPlex); GitHub key PRESENT — every repo's advisories tonight
|
||||
2026-11-02T03:42:35.4769235Z RUNTIME-READ lscr.io/linuxserver/grocy:4.7.1 14 s ok
|
||||
2026-11-02T03:42:45.3184025Z RUNTIME-READ lscr.io/linuxserver/radarr:6.4.4 8 s ok
|
||||
2026-11-02T03:43:58.2859647Z RUNTIME-READ linuxserver/qbittorrent:5.3.0 9 s ok
|
||||
2026-11-02T03:44:15.0993208Z ADVISORY doop actualbudget/actual-server 26.10.0 CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-11-02T03:44:15.0994027Z ADVISORY doop advplyr/audiobookshelf 2.37.1 CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-11-02T03:44:15.0994362Z ADVISORY box cloudflare/cloudflared 2026.10.4 feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3 (fixed read the notice); vulnnotes:cloudflared@2026.10.6:VULN-184686 (fixed 2026.10.6); vulnnotes:cloudflared@2026.10.5:VULN-183456 (fixed 2026.10.5)
|
||||
2026-11-02T03:44:15.0994720Z ADVISORY doop codewithcj/sparkyfitness v1.9.0 release:CodeWithCJ/SparkyFitness@v1.10.0 (fixed v1.10.0)
|
||||
2026-11-02T03:44:15.0995081Z ADVISORY doop codewithcj/sparkyfitness_server v1.9.0 release:CodeWithCJ/SparkyFitness@v1.10.0 (fixed v1.10.0); CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-11-02T03:44:15.0995724Z ADVISORY doop crocodilestick/calibre-web-automated dev CVE-2026-111497 (fixed 1.2.1)
|
||||
2026-11-02T03:44:15.0996573Z ADVISORY doop docker.io/calcom/cal.com v6.2.0 CVE-2026-111497 (fixed 22.23.4, 24.22.1, 26.12.1)
|
||||
2026-11-02T03:44:15.0996874Z ADVISORY doop flomp/wanderer-db v0.21.0 GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2); … 1 more
|
||||
2026-11-02T03:44:15.0997202Z ADVISORY doop flomp/wanderer-web v0.21.0 GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2); … 2 more
|
||||
2026-11-02T03:44:15.0997508Z ADVISORY doop ghcr.io/gethomepage/homepage v1.13.2 GHSA-669x-4pg4-w24r (fixed 2.2.0); CVE-2026-111497 (fixed 22.23.4)
|
||||
2026-11-02T03:44:15.0997795Z ADVISORY doop ghcr.io/immich-app/immich-machine-learning v2.7.5 GHSA-q89f-h332-8q2h (fixed v3.2.4); GHSA-h5w4-vjv4-9r5q (fixed a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 (fixed v3.2.0); GHSA-72rm-x7xr-v679 (fixed v3.3.0); … 7 more
|
||||
2026-11-02T03:44:15.0998127Z ADVISORY doop ghcr.io/immich-app/immich-server v2.7.5 GHSA-q89f-h332-8q2h (fixed v3.2.4); GHSA-h5w4-vjv4-9r5q (fixed a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 (fixed v3.2.0); GHSA-72rm-x7xr-v679 (fixed v3.3.0); … 8 more
|
||||
2026-11-02T03:44:15.0998579Z ADVISORY doop ghcr.io/lukegus/termix release-2.9.2 CVE-2026-111497 (fixed 26.12.1)
|
||||
2026-11-02T03:44:15.0998907Z ADVISORY doop ghcr.io/paperless-ngx/paperless-ngx 3.3.4 release:paperless-ngx/paperless-ngx@v3.4.0 (fixed v3.4.0); CVE-2026-111497 (fixed 1.2.1)
|
||||
2026-11-02T03:44:15.0999294Z ADVISORY doop gitea/gitea 1.26.2 GHSA-mf6p-vqpw-3r7x (fixed 28.3.0); GHSA-32h8-5xqg-h466 (fixed 28.3.0); GHSA-9v6p-xpcp-7488 (fixed 28.3.0); GHSA-6h2f-c8jm-84hc (fixed 28.3.0); … 146 more
|
||||
2026-11-02T03:44:15.0999654Z ADVISORY doop grafana/grafana 13.2.4 GHSA-8xmm-x63g-f6xv (fixed no fixed version named yet); GHSA-4724-7jwc-3fpw (fixed the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 (fixed the range is unreadable — check by hand); GHSA-8wjh-59cw-9xh4 (fixed no fixed version named yet); … 2 more
|
||||
2026-11-02T03:44:15.1000068Z ADVISORY box gtstef/filebrowser 1.5.8-stable GHSA-892f-9h5p-mfc8 (fixed 2.1.0-stable, 2.1.4-beta); GHSA-gfgm-886h-6r47 (fixed 2.0.2-stable, 2.1.4-beta); GHSA-wxj5-g3qp-g732 (fixed 2.0.2-stable, 2.1.3-beta); GHSA-3j46-5w28-f8p2 (fixed 2.1.0-stable, 2.1.3-beta); … 32 more
|
||||
2026-11-02T03:44:15.1000442Z ADVISORY doop louislam/uptime-kuma 2.5.6 GHSA-86ch-2247-gr56 (fixed 2.5.9); GHSA-qjxc-h5jf-c7rj (fixed the range is unreadable — check by hand); release:louislam/uptime-kuma@2.5.9 (fixed 2.5.9); release:louislam/uptime-kuma@2.5.8 (fixed 2.5.8); … 2 more
|
||||
2026-11-02T03:44:15.1000778Z ADVISORY doop outlinewiki/outline 1.11.0 GHSA-x4w3-9p9j-cprh (fixed 1.12.0); GHSA-rq53-m97j-f2pg (fixed 1.12.0); GHSA-h6ff-rw9x-5mq2 (fixed 1.12.0); GHSA-rvj7-2gww-6xfq (fixed 1.12.0); … 3 more
|
||||
2026-11-02T03:44:15.1001149Z ADVISORY doop redis 8.10.2 GHSA-c8h9-259x-jff4 (fixed the range is unreadable — check by hand); GHSA-8ghh-qpmp-7826 (fixed no fixed version named yet); GHSA-93m2-935m-8rj3 (fixed no fixed version named yet); GHSA-m8fj-85cg-7vhp (fixed the range is unreadable — check by hand); … 8 more
|
||||
2026-11-02T03:44:15.1001565Z ADVISORY doop rommapp/romm 5.4.0 release:rommapp/romm@5.4.1 (fixed 5.4.1); CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-11-02T03:44:15.1001958Z ADVISORY box traefik v3.7.16 release:traefik/traefik@v3.7.17 (fixed v3.7.17)
|
||||
2026-11-02T03:44:15.1002240Z ADVISORY doop vabene1111/recipes 2.6.15 CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-11-02T03:44:15.1002582Z ADVISORY doop vaultwarden/server 1.37.4 release:dani-garcia/vaultwarden@1.37.5 (fixed 1.37.5)
|
||||
2026-11-02T03:44:15.1002929Z ADVISORY app actualbudget/actual-server 26.9.0 CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-11-02T03:44:15.1003206Z ADVISORY app calcom/cal.com v6.2.0 GHSA-p3f6-52gv-cj7m (fixed the range is unreadable — check by hand); GHSA-cpf2-q635-xrwx (fixed the range is unreadable — check by hand); CVE-2026-111497 (fixed 22.23.4, 24.22.1, 26.12.1)
|
||||
2026-11-02T03:44:15.1003610Z ADVISORY app codewithcj/sparkyfitness v0.17.3 GHSA-v883-jx9h-qf29 (fixed a version after 1.7.2 (the notice names none)); GHSA-cmmf-53wf-r5gv (fixed a version after 1.6.5 (the notice names none)); GHSA-p8cf-g8rv-gvrq (fixed a version after 1.6.5 (the notice names none))
|
||||
2026-11-02T03:44:15.1004108Z ADVISORY app codewithcj/sparkyfitness_server v0.17.3 GHSA-v883-jx9h-qf29 (fixed a version after 1.7.2 (the notice names none)); GHSA-cmmf-53wf-r5gv (fixed a version after 1.6.5 (the notice names none)); GHSA-p8cf-g8rv-gvrq (fixed a version after 1.6.5 (the notice names none)); CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-11-02T03:44:15.1004449Z ADVISORY app crocodilestick/calibre-web-automated v4.0.8 CVE-2026-111497 (fixed 1.2.1)
|
||||
2026-11-02T03:44:15.1004702Z ADVISORY app f0rc3/gokapi v1.9.6 GHSA-45vh-rpc8-hxpp (fixed 2.2.4); GHSA-qwc6-vc2v-2ggj (fixed 2.2.4); GHSA-j6jp-78w8-34x6 (fixed 2.2.4); GHSA-m2hx-wjxc-9fp4 (fixed 2.2.3); … 6 more
|
||||
2026-11-02T03:44:15.1005153Z ADVISORY app ghcr.io/immich-app/immich-machine-learning v3.3.5 GHSA-8244-8vpr-vp9c (fixed the range is unreadable — check by hand)
|
||||
2026-11-02T03:44:15.1005563Z ADVISORY app ghcr.io/immich-app/immich-server v3.3.5 GHSA-8244-8vpr-vp9c (fixed the range is unreadable — check by hand)
|
||||
2026-11-02T03:44:15.1005990Z ADVISORY app ghcr.io/karakeep-app/karakeep 0.34.1 GHSA-pp34-2c9r-mchw (fixed no fixed version named yet)
|
||||
2026-11-02T03:44:15.1006314Z ADVISORY app ghcr.io/lukegus/termix 26.10.5 GHSA-r9gw-3w87-mhh7 (fixed no fixed version named yet); release:Termix-SSH/Termix@v26.10.6 (fixed v26.10.6)
|
||||
2026-11-02T03:44:15.1006720Z ADVISORY app ghcr.io/mealie-recipes/mealie v3.29.0 release:mealie-recipes/mealie@v3.30.0 (fixed v3.30.0)
|
||||
2026-11-02T03:44:15.1006965Z ADVISORY app ghcr.io/paperless-ngx/paperless-ngx 2.20.15 GHSA-c8f3-pqr2-rr24 (fixed 3.3.2); GHSA-2jhj-xqrq-rmrq (fixed 3.1.2); CVE-2026-111497 (fixed 1.1.1)
|
||||
2026-11-02T03:44:15.1007206Z ADVISORY app ghcr.io/tandoorrecipes/recipes 2.7.2 GHSA-c7mc-c9jr-38hf (fixed the range is unreadable — check by hand); GHSA-cqj3-64qw-4w52 (fixed the range is unreadable — check by hand)
|
||||
2026-11-02T03:44:15.1007542Z ADVISORY app gitea/gitea 28.2.0 GHSA-mf6p-vqpw-3r7x (fixed 28.3.0); GHSA-32h8-5xqg-h466 (fixed 28.3.0); GHSA-9v6p-xpcp-7488 (fixed 28.3.0); GHSA-6h2f-c8jm-84hc (fixed 28.3.0); … 18 more
|
||||
2026-11-02T03:44:15.1007829Z ADVISORY app glanceapp/glance v0.8.5 GHSA-r225-jhr6-68cc (fixed >= 0.8.7)
|
||||
2026-11-02T03:44:15.1008069Z ADVISORY app grafana/grafana 13.2.4 GHSA-8xmm-x63g-f6xv (fixed no fixed version named yet); GHSA-4724-7jwc-3fpw (fixed the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 (fixed the range is unreadable — check by hand); GHSA-8wjh-59cw-9xh4 (fixed no fixed version named yet); … 2 more
|
||||
2026-11-02T03:44:15.1008513Z ADVISORY app louislam/uptime-kuma 2.5.7 GHSA-86ch-2247-gr56 (fixed 2.5.9); GHSA-qjxc-h5jf-c7rj (fixed the range is unreadable — check by hand); release:louislam/uptime-kuma@2.5.9 (fixed 2.5.9); release:louislam/uptime-kuma@2.5.8 (fixed 2.5.8)
|
||||
2026-11-02T03:44:15.1008811Z ADVISORY app n8nio/n8n 2.44.7 GHSA-2x68-96jw-5r6c (fixed >= 3.0.1); GHSA-9p7v-45m2-wxgj (fixed >= 3.0.1); GHSA-mx4r-96jx-v278 (fixed >= 3.0.1); GHSA-4v22-g448-h4rg (fixed >= 2.45.5, >= 2.46.1, >= 3.0.1); … 9 more
|
||||
2026-11-02T03:44:15.1009100Z ADVISORY app privatebin/pdo 2.1.0 GHSA-c4gc-8mcm-hh65 (fixed 2.1.1); GHSA-hw9p-r7fq-8mvr (fixed 2.1.1)
|
||||
2026-11-02T03:44:15.1009382Z ADVISORY app rommapp/romm 5.4.1 CVE-2026-111497 (fixed 24.22.1)
|
||||
2026-11-02T03:44:15.1009659Z ADVISORY app vaultwarden/server 1.37.4-alpine release:dani-garcia/vaultwarden@1.37.5 (fixed 1.37.5)
|
||||
2026-11-02T03:44:15.1009954Z NOT CHECKED doop gitea.dooplex.hu/admin/felhom-act-runner 0.1.0 registry gitea.dooplex.hu: no anonymous token route
|
||||
2026-11-02T03:44:15.1010207Z NOT CHECKED doop gitea.dooplex.hu/admin/jarr latest registry gitea.dooplex.hu: no anonymous token route
|
||||
2026-11-02T03:44:15.1010502Z NOT CHECKED doop gitea.dooplex.hu/admin/recipe-importer latest registry gitea.dooplex.hu: no anonymous token route
|
||||
2026-11-02T03:44:15.1010758Z NOT CHECKED doop gitea.dooplex.hu/admin/revfulop-calendar 1.6.2 registry gitea.dooplex.hu: no anonymous token route
|
||||
2026-11-02T03:44:15.1011066Z NOT CHECKED doop gitea.dooplex.hu/admin/sparkyfitness-export 0.3.0 registry gitea.dooplex.hu: no anonymous token route
|
||||
2026-11-02T03:44:15.1011313Z NOT CHECKED doop gitea.dooplex.hu/admin/wan-probe 0.1.0 registry gitea.dooplex.hu: no anonymous token route
|
||||
2026-11-02T03:44:15.1012070Z NOT CHECKED doop minio/minio latest Docker registry tags of minio/minio: HTTP 401; manifest minio/minio:latest: HTTP 401
|
||||
2026-11-02T03:44:15.1012412Z NOT CHECKED doop mongodb/mongodb-community-server 8.0.5-ubuntu2204 https://hub.docker.com/v2/repositories/mongodb/mongodb-community-server/tags: The read operation timed out
|
||||
2026-11-02T03:44:15.1012711Z NOT CHECKED app flomp/wanderer-db v0.21.2 https://hub.docker.com/v2/repositories/flomp/wanderer-db/tags: The read operation timed out
|
||||
2026-11-02T03:44:15.1013043Z NOT CHECKED app lscr.io/linuxserver/grocy 4.7.1 https://hub.docker.com/v2/repositories/linuxserver/grocy/tags: The read operation timed out
|
||||
2026-11-02T03:44:15.1013346Z BEHIND doop getmeili/meilisearch v1.11.3 newest v1.56.0
|
||||
2026-11-02T03:44:15.1013564Z BEHIND doop ghcr.io/alam00000/bentopdf 2.8.10 newest 2.8.11
|
||||
2026-11-02T03:44:15.1013771Z BEHIND doop ghcr.io/diced/zipline 4.8.1 newest 4.8.2
|
||||
2026-11-02T03:44:15.1014032Z BEHIND app freikin/dawarich 1.19.0 newest 1.20.1
|
||||
2026-11-02T03:44:15.1014302Z BEHIND app getmeili/meilisearch v1.41.0 newest v1.56.0
|
||||
2026-11-02T03:44:15.1014506Z BEHIND app getmeili/meilisearch v1.36.0 newest v1.56.0
|
||||
2026-11-02T03:44:15.1014789Z BEHIND app ghcr.io/alam00000/bentopdf v2.8.10 newest v2.8.11
|
||||
2026-11-02T03:44:15.1015052Z BEHIND app ghcr.io/alexta69/metube 2026.10.27 newest 2026.11.01
|
||||
2026-11-02T03:44:15.1015305Z BEHIND app ghcr.io/hargata/lubelogger v1.7.3 newest v1.7.4
|
||||
2026-11-02T03:44:15.1015530Z BEHIND app ghcr.io/kozea/radicale 3.8.1 newest 3.9.0
|
||||
2026-11-02T03:44:15.1015838Z BEHIND app gotson/komga 1.28.0 newest 1.29.2
|
||||
2026-11-02T03:44:15.1016107Z BEHIND app kimai/kimai2 2.67.0 newest 2.71.0
|
||||
2026-11-02T03:44:15.1016437Z BEHIND app lscr.io/linuxserver/bookstack 26.09.2 newest 26.09.20260929
|
||||
2026-11-02T03:44:15.1016850Z BEHIND app lscr.io/linuxserver/code-server 4.143.1 newest 4.144.0
|
||||
2026-11-02T03:44:15.1017202Z BEHIND app lukevella/rallly 4.16.3 newest 4.16.4
|
||||
2026-11-02T03:44:15.1017562Z BEHIND app nextcloud 34.0.4-apache newest 34.0.5-apache
|
||||
2026-11-02T03:44:15.1017824Z BEHIND app nginx 1.30.5-alpine newest 1.31.8-alpine
|
||||
2026-11-02T03:44:15.1018232Z BEHIND app qbittorrentofficial/qbittorrent-nox 5.2.4-1 newest 5.3.0-2
|
||||
2026-11-02T03:44:15.1018453Z GAP buil alpine 3.24.2 newest 3.24.3
|
||||
2026-11-02T03:44:15.1018662Z GAP buil alpine 3.24.2 newest 3.24.3
|
||||
2026-11-02T03:44:15.1018977Z GAP doop alpine/k8s 1.37.1 newest 1.37.2
|
||||
2026-11-02T03:44:15.1019218Z GAP doop arcadiatechnology/crafty-4 4.11.0
|
||||
2026-11-02T03:44:15.1019448Z GAP doop bhgedigital/envsubst latest
|
||||
2026-11-02T03:44:15.1019730Z GAP doop busybox 1.38
|
||||
2026-11-02T03:44:15.1020008Z GAP doop codercom/code-server 4.143.1 newest 4.144.0
|
||||
2026-11-02T03:44:15.1020253Z GAP buil debian 13.7-slim
|
||||
2026-11-02T03:44:15.1020514Z GAP buil debian 13.7-slim
|
||||
2026-11-02T03:44:15.1020803Z GAP doop docker.io/bitnamilegacy/postgresql 17.6.0-debian-12-r3
|
||||
2026-11-02T03:44:15.1021053Z GAP doop docker.io/library/nextcloud 34.0.5-apache
|
||||
2026-11-02T03:44:15.1021329Z GAP doop docker.io/valkey/valkey 9.2-alpine
|
||||
2026-11-02T03:44:15.1021530Z GAP doop filebrowser/filebrowser v2.63.23
|
||||
2026-11-02T03:44:15.1021782Z GAP doop ghcr.io/cloudnative-pg/postgresql 17.2 newest 17.11
|
||||
2026-11-02T03:44:15.1022321Z GAP doop ghcr.io/headlamp-k8s/headlamp v0.46.0
|
||||
2026-11-02T03:44:15.1022589Z GAP doop ghcr.io/immich-app/postgres 16-vectorchord0.3.0
|
||||
2026-11-02T03:44:15.1023257Z GAP doop ghcr.io/jimmidyson/configmap-reload v0.15.0
|
||||
2026-11-02T03:44:15.1023482Z GAP doop ghcr.io/onedr0p/exportarr v2.3.0
|
||||
2026-11-02T03:44:15.1023811Z GAP doop ghcr.io/seriousm4x/upsnap 5
|
||||
2026-11-02T03:44:15.1024027Z GAP doop ghcr.io/stakater/reloader v1.4.22 newest v1.4.23
|
||||
2026-11-02T03:44:15.1024266Z GAP doop ghcr.io/tautulli/tautulli v2.18.2
|
||||
2026-11-02T03:44:15.1024481Z GAP doop griefed/serverpackcreator 8.1.2
|
||||
2026-11-02T03:44:15.1024693Z GAP doop gtstef/filebrowser 1.5.8-stable
|
||||
2026-11-02T03:44:15.1024955Z GAP doop guacamole/guacamole 1.6.0
|
||||
2026-11-02T03:44:15.1025209Z GAP doop guacamole/guacd 1.6.0
|
||||
2026-11-02T03:44:15.1025412Z GAP doop index.docker.io/plexinc/pms-docker 1.43.5.11029-6bf8af3f0
|
||||
2026-11-02T03:44:15.1025619Z GAP doop itzg/mc-backup 2026.10.1 newest 2026.10.3
|
||||
2026-11-02T03:44:15.1025864Z GAP doop itzg/minecraft-server 2026.10.0-java21 newest 2026.10.1-java17
|
||||
2026-11-02T03:44:15.1026084Z GAP doop linuxserver/bookstack 26.09.20260929
|
||||
2026-11-02T03:44:15.1026367Z GAP doop linuxserver/prowlarr version-2.6.5.5623
|
||||
2026-11-02T03:44:15.1026715Z GAP doop linuxserver/qbittorrent 5.3.0
|
||||
2026-11-02T03:44:15.1026930Z GAP doop linuxserver/radarr version-6.4.4.10685
|
||||
2026-11-02T03:44:15.1027135Z GAP doop linuxserver/sonarr version-4.0.20.3014
|
||||
2026-11-02T03:44:15.1027419Z GAP doop mariadb 11
|
||||
2026-11-02T03:44:15.1027653Z GAP doop mikefarah/yq 4.54.1
|
||||
2026-11-02T03:44:15.1027851Z GAP doop msdeluise/plant-it-server 0.10.0
|
||||
2026-11-02T03:44:15.1028171Z GAP doop mysql 8.4
|
||||
2026-11-02T03:44:15.1028379Z GAP doop nicolaka/netshoot latest
|
||||
2026-11-02T03:44:15.1028583Z GAP doop postgis/postgis 16-3.5
|
||||
2026-11-02T03:44:15.1029300Z GAP doop postgres 15-alpine
|
||||
2026-11-02T03:44:15.1029632Z GAP doop postgres 16-alpine
|
||||
2026-11-02T03:44:15.1029842Z GAP doop privatebin/nginx-fpm-alpine 2.0.6 newest 2.1.0
|
||||
2026-11-02T03:44:15.1030052Z GAP doop prom/alertmanager v0.34.1 newest v0.34.2
|
||||
2026-11-02T03:44:15.1030502Z GAP doop prom/node-exporter v1.12.1
|
||||
2026-11-02T03:44:15.1030775Z GAP doop prom/prometheus v3.15.0 newest v3.15.1
|
||||
2026-11-02T03:44:15.1030988Z GAP doop prometheuscommunity/smartctl-exporter v0.15.0
|
||||
2026-11-02T03:44:15.1031194Z GAP doop python 3.15-bookworm
|
||||
2026-11-02T03:44:15.1031394Z GAP doop quay.io/jetstack/version-checker v0.11.0
|
||||
2026-11-02T03:44:15.1031636Z GAP doop quay.io/prometheus/blackbox-exporter v0.29.1
|
||||
2026-11-02T03:44:15.1031841Z GAP doop renovate/renovate 44.181.1 newest 44.199.2
|
||||
2026-11-02T03:44:15.1032055Z GAP doop tailscale/tailscale v1.104.2 newest v1.104.4
|
||||
2026-11-02T03:44:15.1032378Z GAP app emby/embyserver 4.11.0.4 newest 4.11.0.13
|
||||
2026-11-02T03:44:15.1032668Z GAP app ghcr.io/immich-app/postgres 16-vectorchord0.4.3-pg
|
||||
2026-11-02T03:44:15.1032876Z GAP app ghcr.io/karakeep-app/karakeep-chrome 151.0.7922.47-r1
|
||||
2026-11-02T03:44:15.1033080Z GAP app mariadb 12.3
|
||||
2026-11-02T03:44:15.1033291Z GAP app mariadb 11.4 newest 11.8
|
||||
2026-11-02T03:44:15.1033504Z GAP app mariadb 11.8
|
||||
2026-11-02T03:44:15.1033701Z GAP app mariadb 12.3
|
||||
2026-11-02T03:44:15.1034018Z GAP app mariadb 11.8
|
||||
2026-11-02T03:44:15.1034214Z GAP app msdeluise/plant-it 0.10.0
|
||||
2026-11-02T03:44:15.1034489Z GAP app plexinc/pms-docker 1.43.5.11029-6bf8af3f0
|
||||
2026-11-02T03:44:15.1034888Z GAP app postgis/postgis 16-3.5-alpine
|
||||
2026-11-02T03:44:15.1035144Z GAP app postgis/postgis 17-3.5-alpine
|
||||
2026-11-02T03:44:15.1035345Z GAP app postgres 18-alpine
|
||||
2026-11-02T03:44:15.1035544Z GAP app postgres 17-alpine
|
||||
2026-11-02T03:44:15.1035793Z GAP app postgres 18-alpine
|
||||
2026-11-02T03:44:15.1035993Z GAP app postgres 18-alpine
|
||||
2026-11-02T03:44:15.1036202Z GAP app postgres 18-alpine
|
||||
2026-11-02T03:44:15.1036388Z GAP app postgres 18-alpine
|
||||
2026-11-02T03:44:15.1036635Z GAP app postgres 18-alpine
|
||||
2026-11-02T03:44:15.1036941Z GAP app postgres 17-alpine
|
||||
2026-11-02T03:44:15.1037229Z GAP app postgres 16-alpine
|
||||
2026-11-02T03:44:15.1037474Z GAP app registry.gitlab.com/crafty-controller/crafty-4 4.11.0
|
||||
2026-11-02T03:44:15.1037735Z FLOATING doop ghcr.io/seanmorley15/adventurelog-backend latest
|
||||
2026-11-02T03:44:15.1037943Z FLOATING doop ghcr.io/seanmorley15/adventurelog-frontend latest
|
||||
2026-11-02T03:44:15.1038158Z FLOATING doop nginx 1.31-alpine
|
||||
2026-11-02T03:44:15.1038440Z FLOATING doop redis 8-alpine
|
||||
2026-11-02T03:44:15.1038662Z FLOATING doop redis 8.10-alpine
|
||||
2026-11-02T03:44:15.1038873Z FLOATING app ghcr.io/claperco/claper 2.5
|
||||
2026-11-02T03:44:15.1039117Z FLOATING app ghcr.io/thomiceli/opengist 1.15
|
||||
2026-11-02T03:44:15.1039465Z FLOATING app jellyfin/jellyfin 12.4
|
||||
2026-11-02T03:44:15.1039676Z FLOATING app lscr.io/linuxserver/prowlarr version-2.6.5.5623
|
||||
2026-11-02T03:44:15.1039892Z FLOATING app lscr.io/linuxserver/sabnzbd version-5.1.3
|
||||
2026-11-02T03:44:15.1040103Z FLOATING app lscr.io/linuxserver/transmission version-4.1.3-r0
|
||||
2026-11-02T03:44:15.1040332Z FLOATING app nzbgetcom/nzbget v26.3
|
||||
2026-11-02T03:44:15.1040568Z FLOATING app redis 7.4-alpine
|
||||
2026-11-02T03:44:15.1040786Z FLOATING app redis 7-alpine
|
||||
2026-11-02T03:44:15.1041026Z FLOATING app redis 7-alpine
|
||||
2026-11-02T03:44:15.1041249Z FLOATING app redis 7-alpine
|
||||
2026-11-02T03:44:15.1041445Z FLOATING app redis 7-alpine
|
||||
2026-11-02T03:44:15.1041750Z FLOATING app redis 7-alpine
|
||||
2026-11-02T03:44:15.1041927Z FLOATING app redis 7-alpine
|
||||
2026-11-02T03:44:15.1042099Z FLOATING app wger/server 2.7
|
||||
2026-11-02T03:44:15.1042298Z SELF box gitea.dooplex.hu/admin/felhom-samba 1.2.0
|
||||
2026-11-02T03:44:15.1042585Z SELF app gitea.dooplex.hu/admin/recipe-importer v0.9.11
|
||||
2026-11-02T03:44:15.1042719Z CURRENT doop f0rc3/gokapi v2.2.4
|
||||
2026-11-02T03:44:15.1042844Z CURRENT doop ghcr.io/seerr-team/seerr v3.5.1
|
||||
2026-11-02T03:44:15.1042993Z CURRENT doop ghcr.io/thomiceli/opengist 1.15.3
|
||||
2026-11-02T03:44:15.1043114Z CURRENT doop glanceapp/glance v0.8.7
|
||||
2026-11-02T03:44:15.1043299Z CURRENT buil golang 1.27.3-trixie
|
||||
2026-11-02T03:44:15.1043426Z CURRENT buil golang 1.27.3-alpine3.24
|
||||
2026-11-02T03:44:15.1043553Z CURRENT doop onlyoffice/documentserver 9.4.0
|
||||
2026-11-02T03:44:15.1043664Z CURRENT buil restic 0.19.1
|
||||
2026-11-02T03:44:15.1043785Z CURRENT app deluan/navidrome 0.64.2
|
||||
2026-11-02T03:44:15.1043961Z CURRENT app docmost/docmost 0.97.0
|
||||
2026-11-02T03:44:15.1044078Z CURRENT app flomp/wanderer-web v0.21.2
|
||||
2026-11-02T03:44:15.1044199Z CURRENT app ghcr.io/advplyr/audiobookshelf 2.37.2
|
||||
2026-11-02T03:44:15.1044442Z CURRENT app ghcr.io/cmintey/wishlist v0.69.0
|
||||
2026-11-02T03:44:15.1044567Z CURRENT app ghcr.io/diced/zipline 4.8.2
|
||||
2026-11-02T03:44:15.1044717Z CURRENT app ghcr.io/gethomepage/homepage v2.7.0
|
||||
2026-11-02T03:44:15.1044842Z CURRENT app ghcr.io/gramps-project/grampsweb v25.6.0
|
||||
2026-11-02T03:44:15.1044967Z CURRENT app ghcr.io/grimmory-tools/grimmory v3.5.0
|
||||
2026-11-02T03:44:15.1045099Z CURRENT app ghcr.io/home-assistant/home-assistant 2026.10.4
|
||||
2026-11-02T03:44:15.1045216Z CURRENT app ghcr.io/papra-hq/papra 26.7.1-rootless
|
||||
2026-11-02T03:44:15.1045346Z CURRENT app ghcr.io/seanmorley15/adventurelog-backend v0.13.1
|
||||
2026-11-02T03:44:15.1045467Z CURRENT app ghcr.io/seanmorley15/adventurelog-frontend v0.13.1
|
||||
2026-11-02T03:44:15.1045588Z CURRENT app ghcr.io/seerr-team/seerr v3.5.1
|
||||
2026-11-02T03:44:15.1045707Z CURRENT app ghcr.io/sysadminsmedia/homebox 0.27.1
|
||||
2026-11-02T03:44:15.1045825Z CURRENT app ghost 6.73.0-alpine
|
||||
2026-11-02T03:44:15.1045959Z CURRENT app lscr.io/linuxserver/radarr 6.4.4
|
||||
2026-11-02T03:44:15.1046076Z CURRENT app lscr.io/linuxserver/sonarr 4.0.20
|
||||
2026-11-02T03:44:15.1046419Z CURRENT app onlyoffice/documentserver 9.4.0
|
||||
2026-11-02T03:44:15.1046547Z CURRENT app outlinewiki/outline 1.12.0
|
||||
2026-11-02T03:44:15.1046661Z CURRENT app vikunja/vikunja 2.7.1
|
||||
2026-11-02T03:44:15.1046772Z COUNTS ADVISORY=45 BEHIND=18 CURRENT=29 FLOATING=20 GAP=73 NOT_CHECKED=10 SELF=2
|
||||
2026-11-02T03:44:15.3041346Z RUNTIME read=3 (32 s) from-cache=182 not-checked=0 zstd-decoder=zstandard 0.25.0 (pinned wheel, sha256 checked)
|
||||
2026-11-02T03:44:15.3042212Z TAGS fetched=116 from-cache=0 retried-429=0 (cache /root/.cache/felhom-watch-tags.json)
|
||||
2026-11-02T03:44:15.3042768Z REQUESTS api.github.com=68 api.osv.dev=1 auth.docker.io=1 blog.cloudflare.com=1 ghcr.io=174 github.com=61 hub.docker.com=207 raw.githubusercontent.com=1 registry-1.docker.io=1
|
||||
2026-11-02T03:44:15.9347866Z MAIL RESEND-ACCEPTED id=01a19a5b-956c-7ca7-a332-bfd997b952ae kind=advisory subject=[Felhom security] filebrowser, gitea, uptime-kuma, server … — 42 new advisories, 41 reminders
|
||||
2026-11-02T03:44:16.4929385Z MAIL RESEND-ACCEPTED id=01a19a5b-9798-717e-999c-ca8a0f258ea0 kind=weekly subject=[Felhom security] weekly: 59 behind, 354 advisories open
|
||||
2026-11-02T03:44:16.5179695Z STATE written: documentation/security-watch/state.json (361 known advisories)
|
||||
2026-11-02T03:44:16.6151554Z ::group::Run set -u
|
||||
2026-11-02T03:44:16.6151985Z set -u
|
||||
2026-11-02T03:44:16.6152208Z f=documentation/security-watch/state.json
|
||||
2026-11-02T03:44:16.6152469Z if [ ! -f "$f" ]; then
|
||||
2026-11-02T03:44:16.6152679Z echo "no memory file was written - nothing to commit"; exit 0
|
||||
2026-11-02T03:44:16.6152915Z fi
|
||||
2026-11-02T03:44:16.6153110Z if git ls-files --error-unmatch "$f" >/dev/null 2>&1 && git diff --quiet -- "$f"; then
|
||||
2026-11-02T03:44:16.6153367Z echo "memory unchanged - nothing to commit"; exit 0
|
||||
2026-11-02T03:44:16.6153585Z fi
|
||||
2026-11-02T03:44:16.6153795Z cp "$f" /tmp/state.json
|
||||
2026-11-02T03:44:16.6154081Z auth=$(python3 -c 'import base64,os;print(base64.b64encode(("x:"+os.environ["PUSH_TOKEN"]).encode()).decode())')
|
||||
2026-11-02T03:44:16.6154333Z for attempt in 1 2 3; do
|
||||
2026-11-02T03:44:16.6154528Z git fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD
|
||||
2026-11-02T03:44:16.6154752Z mkdir -p "$(dirname "$f")" && cp /tmp/state.json "$f"
|
||||
2026-11-02T03:44:16.6154968Z git add "$f"
|
||||
2026-11-02T03:44:16.6155167Z git -c user.name="felhom security watch" -c user.email=monitoring@felhom.eu \
|
||||
2026-11-02T03:44:16.6155543Z commit -q -m "security-watch: memory of $(date -u +%F) (R-1303). Docs only." || { echo "nothing to commit"; exit 0; }
|
||||
2026-11-02T03:44:16.6155860Z if git -c http.extraHeader="Authorization: Basic $auth" push -q origin HEAD:main; then
|
||||
2026-11-02T03:44:16.6156103Z echo "memory pushed: $(git rev-parse --short=12 HEAD)"; exit 0
|
||||
2026-11-02T03:44:16.6156330Z fi
|
||||
2026-11-02T03:44:16.6156522Z echo "push refused (attempt $attempt) - re-fetching main"
|
||||
2026-11-02T03:44:16.6156898Z sleep 5
|
||||
2026-11-02T03:44:16.6157098Z done
|
||||
2026-11-02T03:44:16.6157276Z echo "MEMORY NOT SAVED after 3 attempts"; exit 1
|
||||
2026-11-02T03:44:16.6157550Z shell: bash --noprofile --norc -e -o pipefail {0}
|
||||
2026-11-02T03:44:16.6157904Z env:
|
||||
2026-11-02T03:44:16.6158099Z PUSH_TOKEN: ***
|
||||
2026-11-02T03:44:16.6158491Z ::endgroup::
|
||||
2026-11-02T03:44:19.0295763Z memory pushed: c25b790ce9aa
|
||||
2026-11-02T03:44:19.0303829Z Cleaning up container for job watch
|
||||
2026-11-02T03:44:19.6579652Z 🏁 Job succeeded
|
||||
@@ -0,0 +1,114 @@
|
||||
-- W9: notices that are not about the product; an empty fix with a closed range
|
||||
ok W9 a GitHub Actions advisory (the project's CI) is not about the image -> not listed
|
||||
ok W9 an empty fix with a range ending at 2.6.0 -> ADVISORY, fixed after 2.6.0 (not 'no fixed version')
|
||||
ok W9 negative: the same notice at 2.7.0 -> not listed
|
||||
ok W9 control: an open range with no fix still says 'no fixed version named yet'
|
||||
-- W1-W4: the classes
|
||||
ok W1 traefik v3.7.13 -> ADVISORY, fixed v3.7.14
|
||||
ok W1 negative: traefik v3.7.16 -> CURRENT (the rc is no fix, v2 is another channel)
|
||||
ok W1 Nextcloud 34.0.4 -> no Server advisory (fixed 34.0.1); the Deck app's advisory is not ours
|
||||
ok W1 Nextcloud 34.0.0 -> ADVISORY GHSA-nc01
|
||||
ok W1 an unreadable range is LISTED (unsure), never dropped
|
||||
ok W1 OSV: Go 1.27.2 -> GO-2026-6809 fixed 1.27.3; Go 1.27.3 -> none
|
||||
ok W2 the recorded Cloudflare blog item -> ADVISORY for cloudflared (and only that item)
|
||||
ok W2 the VULN- marker in 2026.10.4 -> ADVISORY fixed 2026.10.4; 2026.10.2's plain bump is not one
|
||||
ok W2 the same blog item 71 days later -> nothing (30-day window)
|
||||
ok W2 positive control at the pin it hit: cloudflared 2026.9.3 on 2026-10-26 -> ADVISORY
|
||||
ok W3 filebrowser 1.5.6-stable -> BEHIND 1.5.7-stable (the beta is no channel, its CVE no fix)
|
||||
ok W3 redis 7-alpine -> FLOATING
|
||||
ok W3 postgres gap -> GAP (BEHIND still computed: no newer 16-…)
|
||||
ok W3 an abandoned template -> GAP, nothing looked up (no route needed)
|
||||
ok W4 a source that fails -> NOT CHECKED, with the reason
|
||||
ok W4 the table prints the NOT CHECKED line
|
||||
-- W5-W7: memory and mails
|
||||
ok W5 a new advisory mails that night
|
||||
ok W5 the mail carries our version, the fixed version, the lane
|
||||
ok W5 the same advisory the next night mails NOTHING
|
||||
ok W5 still open 7 days later -> one reminder
|
||||
ok W5 and not again the next night
|
||||
ok W5 a vendor notice mails once and never repeats
|
||||
ok W5 a pin checked clean forgets its closed advisory
|
||||
ok W5 box programs first in the subject
|
||||
-- W6: a source down
|
||||
ok W6 one night down -> no mail
|
||||
ok W6 two nights -> one mail naming the source
|
||||
ok W6 a third night -> no second mail
|
||||
ok W6 back up -> the streak resets (one more night down -> no mail)
|
||||
-- W7: weekly and seed
|
||||
ok W7 Monday -> the weekly summary
|
||||
ok W7 not twice the same Monday
|
||||
ok W7 a Tuesday whose last weekly is 8 days old -> the weekly (a missed Monday)
|
||||
ok W7 a seed mails nothing, records the advisory, and says what it would have mailed
|
||||
ok W7 a pin the seed could not read is PENDING
|
||||
ok W7 its first real read is recorded SILENTLY; a pin added later still mails
|
||||
-- W13: one image in the catalog AND on DooPlex (R-1333)
|
||||
ok W13 a new notice on both pins is mailed for BOTH (the catalog's 5.4.1 and DooPlex's 5.4.0)
|
||||
ok W13 the memory keeps one entry per group
|
||||
ok W13 the old shared key is copied to the DooPlex key: no mail again
|
||||
ok W13 a shared key whose catalog pin is gone moves to the DooPlex key (no stale twin, no mail)
|
||||
ok W13 DooPlex's pin checked clean forgets only DooPlex's entry
|
||||
-- W14: Docker Hub — retry a 429, cache a tag list for 24 h, one fetch per path, paced (R-1334)
|
||||
ok W14 a 429 is retried after its Retry-After, and the retry's tags are used
|
||||
ok W14 a 429 on every try -> NOT CHECKED only after the last try (4 tries)
|
||||
ok W14 a tag list cached an hour ago -> no request
|
||||
ok W14 a tag list cached 25 h ago -> fetched again, and the cache holds the new list
|
||||
ok W14 two names of one Docker Hub path -> one fetch
|
||||
ok W14 Docker Hub requests are spaced (>= 1.0 s apart)
|
||||
ok W14 main() loads the runner's tag cache, hands it to run() and prints the TAGS line
|
||||
-- W8: the inventory and its gate
|
||||
ok W8 a gap with no reason is a problem
|
||||
ok W8 two sources parse
|
||||
ok W8 an unknown kind is a problem
|
||||
ok W8 a decoy pin whose line is only a comment REFUSES (rc 1, names demo/b)
|
||||
-- W10: the runtime inside an image
|
||||
ok W10 Node 24.18.1 -> ADVISORY from runtime, CVE-2026-111497, fixed 24.22.1
|
||||
ok W10 negative control: Node 24.22.1 -> no advisory
|
||||
ok W10 Python Brotli 1.2.0 -> ADVISORY, fixed 1.2.1
|
||||
ok W10 negative control: Brotli 1.2.1 -> no advisory
|
||||
ok W10 Node 20 (no fixed release on its line) -> ADVISORY naming the end of life
|
||||
ok W10 a layer read error -> NOT CHECKED with source runtime
|
||||
ok W10 a registry with no route -> a note, not a failure
|
||||
RUNTIME-READ ex/node-old:1.0.0 0 s ok
|
||||
ok W10 the result is cached by digest: one full read for two nights
|
||||
RUNTIME-READ ex/broken:1.0.0 0 s NOT CHECKED: layer sha256:1234 unreadable: ReadError
|
||||
ok W10 an UNCHECKED result is not cached (tomorrow tries again)
|
||||
ok W10 main() hands the reader to run() (off only with --no-runtime)
|
||||
ok W10 the reader counts what it read and from the cache (the log's RUNTIME line)
|
||||
-- W11: ghcr.io tags are paged
|
||||
ok W11 both pages are read (1.1.0 is on page 2)
|
||||
-- W12: the DooPlex group
|
||||
ok W12 the list file is read, group dooplex, the catalog's sources reused
|
||||
ok W12 an image the catalog does not ship is a stated gap (runtime + registry only)
|
||||
ok W12 a DooPlex advisory names the homelab session and not the lane
|
||||
XX W12 a DooPlex image in our own private registry -> GAP with the reason, no failed source (R-1334) ('NOT CHECKED', [{'source': 'runtime', 'why': 'registry gitea.dooplex.hu: no anonymous token route'}])
|
||||
ok W12 the weekly mail has its own DooPlex block
|
||||
-- W15: a timeout is tried again; a stated unreadable pin is a GAP, not a failed source (R-1334)
|
||||
XX t_timeouts_and_stated ran SourceError: https://hub.docker.com/v2/repositories/library/redis/tags?page_size=100&ordering=last_updated: The read operation timed out
|
||||
-- W16: notices that do not apply, and fixes that were missed (R-1310)
|
||||
XX W16 another program's package in the repo (Gitea's runner) is not listed True
|
||||
ok W16 the same notice also naming the pinned program IS listed (control)
|
||||
ok W16 the pinned program's package is listed (control)
|
||||
XX W16 Uptime Kuma's rootless-only notice is not listed for our image True
|
||||
XX W16 every GHSA a release names is its own entry, once ['release:ex/app@1.0.1', 'release:ex/app@1.0.2']
|
||||
XX W16 ... with the lowest release that names it as the fix {'release:ex/app@1.0.2': '1.0.2', 'release:ex/app@1.0.1': '1.0.1'}
|
||||
XX W16 a GHSA in both the advisory list and a release is one entry (the advisory's) [{'id': 'GHSA-aaaa-bbbb-cccc', 'source': 'GitHub advisory', 'severity': 'high', 'summary': 'snicheck skips the check', 'fixed': '1.0.1', 'link': 'https://github.com/traefik/traefik/security/advisories/GHSA-fh26-gfpp-7xxx', 'unsure': False, 'published': '2026-10-07'}, {'id': 'release:ex/app@1.0.1', 'source': 'release notes', 'severity': '', 'summary': 'Fixes GHSA-aaaa-bbbb-cccc', 'fixed': '1.0.1', 'link': 'https://github.com/ex/app/releases/tag/1.0.1', 'unsure': False, 'published': ''}]
|
||||
XX W16 a line where „security” is only a word is no ADVISORY (Traefik's announcements line) [{'id': 'release:ex/app@1.0.1', 'source': 'release notes', 'severity': '', 'summary': '[security] Point security announcements to GitHub advisories (#14099)', 'fixed': '1.0.1', 'link': 'https://github.com/ex/app/releases/tag/1.0.1', 'unsure': False, 'published': ''}]
|
||||
XX W16 „no longer receives security fixes” is no ADVISORY (Dawarich) [{'id': 'release:ex/app@1.0.1', 'source': 'release notes', 'severity': '', 'summary': 'Dawarich no longer receives security fixes on this line', 'fixed': '1.0.1', 'link': 'https://github.com/ex/app/releases/tag/1.0.1', 'unsure': False, 'published': ''}]
|
||||
XX W16 the same notes with a real id ARE listed, by that id (control: Traefik v3.7.17) [{'id': 'release:ex/app@1.0.1', 'source': 'release notes', 'severity': '', 'summary': 'CVE fixed: Advisory GHSA-xv5x-242w-7hf7', 'fixed': '1.0.1', 'link': 'https://github.com/ex/app/releases/tag/1.0.1', 'unsure': False, 'published': ''}]
|
||||
ok W16 a plain „Security Fixes” heading with no id is still an ADVISORY (control: Vaultwarden's shape)
|
||||
XX W16 linuxserver's YY.MM.YYYYMMDD tag is not newer than 26.09.2 26.09.20260929
|
||||
XX W16 a real newer tag beside it still counts (control) 26.09.20260929
|
||||
ok W16 a pin that IS on the date shape still compares its own shape (control)
|
||||
|
||||
FAIL: W12 a DooPlex image in our own private registry -> GAP with the reason, no failed source (R-1334) ('NOT CHECKED', [{'source': 'runtime', 'why': 'registry gitea.dooplex.hu: no anonymous token route'}])
|
||||
FAIL: t_timeouts_and_stated ran SourceError: https://hub.docker.com/v2/repositories/library/redis/tags?page_size=100&ordering=last_updated: The read operation timed out
|
||||
FAIL: W16 another program's package in the repo (Gitea's runner) is not listed True
|
||||
FAIL: W16 Uptime Kuma's rootless-only notice is not listed for our image True
|
||||
FAIL: W16 every GHSA a release names is its own entry, once ['release:ex/app@1.0.1', 'release:ex/app@1.0.2']
|
||||
FAIL: W16 ... with the lowest release that names it as the fix {'release:ex/app@1.0.2': '1.0.2', 'release:ex/app@1.0.1': '1.0.1'}
|
||||
FAIL: W16 a GHSA in both the advisory list and a release is one entry (the advisory's) [{'id': 'GHSA-aaaa-bbbb-cccc', 'source': 'GitHub advisory', 'severity': 'high', 'summary': 'snicheck skips the check', 'fixed': '1.0.1', 'link': 'https://github.com/traefik/traefik/security/advisories/GHSA-fh26-gfpp-7xxx', 'unsure': False, 'published': '2026-10-07'}, {'id': 'release:ex/app@1.0.1', 'source': 'release notes', 'severity': '', 'summary': 'Fixes GHSA-aaaa-bbbb-cccc', 'fixed': '1.0.1', 'link': 'https://github.com/ex/app/releases/tag/1.0.1', 'unsure': False, 'published': ''}]
|
||||
FAIL: W16 a line where „security” is only a word is no ADVISORY (Traefik's announcements line) [{'id': 'release:ex/app@1.0.1', 'source': 'release notes', 'severity': '', 'summary': '[security] Point security announcements to GitHub advisories (#14099)', 'fixed': '1.0.1', 'link': 'https://github.com/ex/app/releases/tag/1.0.1', 'unsure': False, 'published': ''}]
|
||||
FAIL: W16 „no longer receives security fixes” is no ADVISORY (Dawarich) [{'id': 'release:ex/app@1.0.1', 'source': 'release notes', 'severity': '', 'summary': 'Dawarich no longer receives security fixes on this line', 'fixed': '1.0.1', 'link': 'https://github.com/ex/app/releases/tag/1.0.1', 'unsure': False, 'published': ''}]
|
||||
FAIL: W16 the same notes with a real id ARE listed, by that id (control: Traefik v3.7.17) [{'id': 'release:ex/app@1.0.1', 'source': 'release notes', 'severity': '', 'summary': 'CVE fixed: Advisory GHSA-xv5x-242w-7hf7', 'fixed': '1.0.1', 'link': 'https://github.com/ex/app/releases/tag/1.0.1', 'unsure': False, 'published': ''}]
|
||||
FAIL: W16 linuxserver's YY.MM.YYYYMMDD tag is not newer than 26.09.2 26.09.20260929
|
||||
FAIL: W16 a real newer tag beside it still counts (control) 26.09.20260929
|
||||
@@ -1,3 +1,14 @@
|
||||
## 2026-11-02 — the watch: stated unreadable pins are GAP, timeouts retried, every failed source printed (R-1334); R-1310's rules
|
||||
|
||||
- **Measured first** (`documentation/audits/security-2026-11-02/part1/DIAGNOSIS.md`): five real nights, both runners, 0 Docker Hub 429. A
|
||||
streak is per source, so seven pins that can never be read held `registry:docker.io` and `runtime` open for a week, and a real
|
||||
outage of either could not have mailed.
|
||||
- **`security_watch.py`:** `STATED_UNREADABLE` (pin + its one answer) and our private registry's DooPlex images are GAP with the
|
||||
reason in the weekly mail; a read timeout is retried on every source (`Transient`, budget 30 a night), a ghcr.io 429 too, the
|
||||
digest resolve once. Log: `FAILED-SOURCE …`, `FAILED-SOURCES n`, `RUNTIME … not-checked=… stated-unreadable=…`, `retried-timeout=`.
|
||||
- **R-1310:** `PACKAGE_NOT_OURS`; one entry per GHSA a release names; `WORD_ONLY` lines are no ADVISORY; `YY.MM.YYYYMMDD` tags ignored.
|
||||
- Tests: W15, W16, W12 changed — 100 checks; red first (`tests-red-before-fix.txt`), each rule also by a mutant (13 of 13 red).
|
||||
|
||||
## 2026-10-30 — `publish-site-cloudflare.sh`: the website and the installer to Cloudflare Pages (D35 / R-1228)
|
||||
|
||||
- Stages `website/` from `origin/main` and `scripts/` from the installer tag named in `manifests/webpage.yaml`; REFUSES
|
||||
|
||||
+157
-32
@@ -7,7 +7,8 @@ publishes its security notices, and sorts every pin into exactly one class:
|
||||
|
||||
ADVISORY a notice affects the version we pin (with the fixed version when the notice gives one)
|
||||
NOT CHECKED a source this pin needs failed tonight — printed and counted, never a silent pass
|
||||
GAP the pin has no machine-readable source (a stated `gap:` line); BEHIND is still shown
|
||||
GAP the pin has no machine-readable source (a stated `gap:` line), or the watch can never read it (our own
|
||||
private registry; STATED_UNREADABLE) — listed with its reason in every weekly mail; BEHIND is still shown
|
||||
FLOATING the tag names no exact version (`redis:7-alpine`), so no range can be matched; BEHIND still shown
|
||||
BEHIND a newer version exists in the same channel, and no notice
|
||||
CURRENT none of the above
|
||||
@@ -79,6 +80,10 @@ VULNNOTES = {
|
||||
}
|
||||
STRONG = re.compile(r"\bCVE-\d{4}-\d{3,}|\bGHSA(?:-[0-9a-z]{4}){3}\b|vulnerab|security (?:fix|issue|update|release|"
|
||||
r"advisory|patch|vulnerability)|\[security\]", re.I)
|
||||
GHSA = re.compile(r"\bGHSA(?:-[0-9a-z]{4}){3}\b", re.I)
|
||||
# A line where „security" is only a word (R-1310, 2026-11-02): Traefik v3.7.17's „Point security announcements to GitHub
|
||||
# advisories", Dawarich's „no longer receives security fixes". Pinned: test W16. A new shape is listed, the safe direction.
|
||||
WORD_ONLY = re.compile(r"security announcements?|security (?:policy|contact|researchers?)|no longer (?:receives?|gets?) security", re.I)
|
||||
FEED_WORDS = re.compile(r"vulnerab|compromis|\bCVE-\d{4}|security (?:update|fix|advisory|issue|notice)|exploit", re.I)
|
||||
|
||||
|
||||
@@ -86,6 +91,10 @@ class SourceError(Exception):
|
||||
pass
|
||||
|
||||
|
||||
class Transient(SourceError):
|
||||
"""A transport failure (a read timeout, a reset): worth one more try. An HTTP answer is not transient, except a 429."""
|
||||
|
||||
|
||||
# ── network (the tests replace Net) ──────────────────────────────────────────────────────────────────────────────────
|
||||
class Net:
|
||||
def __init__(self, gh_token=""):
|
||||
@@ -106,7 +115,7 @@ class Net:
|
||||
except urllib.error.HTTPError as e:
|
||||
return e.code, dict(e.headers or {}), e.read() if hasattr(e, "read") else b""
|
||||
except Exception as e: # noqa: BLE001 — every transport failure is a NOT CHECKED, named
|
||||
raise SourceError("%s: %s" % (url.split("?")[0], e))
|
||||
raise Transient("%s: %s" % (url.split("?")[0], e))
|
||||
|
||||
def post_json(self, url, body, timeout=30):
|
||||
self._count(url)
|
||||
@@ -188,16 +197,32 @@ def patched_for(text, ours):
|
||||
|
||||
# A repo whose advisory list covers more than the program we run: only these package names count.
|
||||
PACKAGE_ONLY = {"nextcloud/security-advisories": re.compile(r"^server$", re.I)}
|
||||
# A repo whose advisories also name OTHER programs we do not run (R-1310, read from every repo's list 2026-11-02). A notice
|
||||
# naming only these is not ours; a notice naming these AND the pinned program is. A new name is listed until it is added
|
||||
# here — the safe direction. Pinned: test W16.
|
||||
PACKAGE_NOT_OURS = {
|
||||
"go-gitea/gitea": re.compile(r"gitea\.com/gitea/runner", re.I),
|
||||
"home-assistant/core": re.compile(r"Companion|Operating System|Supervisor|home-assistant-js-websocket", re.I),
|
||||
"advplyr/audiobookshelf": re.compile(r"audiobookshelf-app", re.I),
|
||||
"go-vikunja/vikunja": re.compile(r"vikunja-desktop|code\.vikunja\.io/veans", re.I),
|
||||
"actualbudget/actual": re.compile(r"@actual-app/cli", re.I),
|
||||
"Termix-SSH/Termix": re.compile(r"@termix-plugin", re.I),
|
||||
"louislam/uptime-kuma": re.compile(r"Rootless Docker Image only|louislam/dockge", re.I),
|
||||
"PrivateBin/PrivateBin": re.compile(r"privatebin/(?:gcs|nginx-fpm-alpine|s3|unit-\S+)", re.I),
|
||||
}
|
||||
|
||||
|
||||
def ghsa_affects(adv, ours, repo=""):
|
||||
"""-> (affected True/False/None, fixed text). None = the range is unreadable (listed, never dropped)."""
|
||||
verdicts, fixed = [], []
|
||||
only = PACKAGE_ONLY.get(repo)
|
||||
only, not_ours, skipped = PACKAGE_ONLY.get(repo), PACKAGE_NOT_OURS.get(repo), False
|
||||
for vul in adv.get("vulnerabilities") or []:
|
||||
pkg = (vul.get("package") or {}).get("name") or ""
|
||||
if only and not only.search(pkg.strip()):
|
||||
continue
|
||||
if not_ours and not_ours.search(pkg):
|
||||
skipped = True
|
||||
continue
|
||||
# A GitHub Actions advisory is about the project's own CI workflow, never the image we run (R-1310: Home
|
||||
# Assistant's GHSA-jff5, 2023). Pinned: test W9.
|
||||
if ((vul.get("package") or {}).get("ecosystem") or "").lower() == "actions":
|
||||
@@ -221,7 +246,7 @@ def ghsa_affects(adv, ours, repo=""):
|
||||
if any(v is True for v in verdicts):
|
||||
return True, ", ".join(sorted(set(fixed)))
|
||||
if not verdicts or all(v is False for v in verdicts):
|
||||
return False if verdicts else (None if not only else False), "" if verdicts else "the notice names no version range"
|
||||
return False if verdicts or skipped else (None if not only else False), "" if verdicts else "the notice names no version range"
|
||||
return None, "the range is unreadable — check by hand"
|
||||
|
||||
|
||||
@@ -287,12 +312,20 @@ def cached_runtime_reader(cache, resolve=None, read=None):
|
||||
stats[key] += n
|
||||
|
||||
def reader(ref):
|
||||
try:
|
||||
digest = resolve(ref)
|
||||
except image_runtime.Unreadable as e:
|
||||
return {"ref": ref, "unchecked": [str(e)]}
|
||||
except Exception as e: # noqa: BLE001 — a network error is a NOT CHECKED, never a crash of the whole watch
|
||||
return {"ref": ref, "unchecked": ["%s: %s" % (type(e).__name__, str(e)[:120])]}
|
||||
digest = None
|
||||
for attempt in (1, 2): # a read timeout gets one more try (R-1334)
|
||||
try:
|
||||
digest = resolve(ref)
|
||||
break
|
||||
except image_runtime.Unreadable as e:
|
||||
# counted: the log's RUNTIME line said not-checked=0 for six nights while this path failed (R-1334)
|
||||
count("not_checked")
|
||||
return {"ref": ref, "unchecked": [str(e)]}
|
||||
except Exception as e: # noqa: BLE001 — a network error is a NOT CHECKED, never a crash of the whole watch
|
||||
if attempt == 2:
|
||||
count("not_checked")
|
||||
return {"ref": ref, "unchecked": ["%s: %s" % (type(e).__name__, str(e)[:120])]}
|
||||
time.sleep(5)
|
||||
if digest and digest in cache:
|
||||
hit = dict(cache[digest], ref=ref)
|
||||
hit["_used"] = True
|
||||
@@ -324,6 +357,19 @@ HUB_TRIES = 4
|
||||
HUB_GAP_S = 1.0
|
||||
HUB_BACKOFF_S = (10, 30, 60)
|
||||
TAG_CACHE_S = 24 * 3600
|
||||
# A read timeout is tried again (R-1334: 1-3 pins a night failed that way on 2026-10-29..11-02, a different pin each
|
||||
# night, and were read fine the night after). The budget stops a real outage from stretching the job past its limit.
|
||||
TRANSIENT_TRIES = 3
|
||||
TRANSIENT_WAIT_S = (5, 15)
|
||||
TRANSIENT_BUDGET = 30
|
||||
# A pin the watch can never read, stated here with the ONE answer it gives: it is a GAP with this reason, not a failed
|
||||
# source. Any other answer (a timeout, a 500) is still NOT CHECKED, and an unlisted 401 too — a Docker Hub outage must
|
||||
# never read as a gap. Earned 2026-11-02 (R-1334): this one pin and our six private images held the „registry:docker.io"
|
||||
# and „runtime" streaks open for a week, so no later outage of either source could have mailed. Pinned: test W15.
|
||||
STATED_UNREADABLE = {
|
||||
"minio/minio": ("HTTP 401", "Docker Hub answers HTTP 401 for its tags and its manifest: the image is no longer published "
|
||||
"there (seen 2026-10-28, R-1328). No notice can be matched; the homelab session moves the pin"),
|
||||
}
|
||||
|
||||
|
||||
class Sources:
|
||||
@@ -335,10 +381,38 @@ class Sources:
|
||||
self.now = time.time() if now is None else now
|
||||
self.sleep, self.clock = sleep or time.sleep, clock or time.monotonic
|
||||
self._hub_lock, self._hub_last = threading.Lock(), None
|
||||
self.tag_stats = {"from_cache": 0, "fetched": 0, "retried_429": 0}
|
||||
self.tag_stats = {"from_cache": 0, "fetched": 0, "retried_429": 0, "retried_timeout": 0}
|
||||
self._transient_left = TRANSIENT_BUDGET
|
||||
|
||||
def _may_retry_transient(self):
|
||||
with self._hub_lock:
|
||||
if self._transient_left <= 0:
|
||||
return False
|
||||
self._transient_left -= 1
|
||||
self.tag_stats["retried_timeout"] += 1
|
||||
return True
|
||||
|
||||
def get(self, url, headers=None):
|
||||
"""A GET to any source but Docker Hub: a read timeout is tried again, within tonight's budget."""
|
||||
for i in range(TRANSIENT_TRIES):
|
||||
try:
|
||||
st, h, body = self.net.get(url, headers)
|
||||
except Transient:
|
||||
if i == TRANSIENT_TRIES - 1 or not self._may_retry_transient():
|
||||
raise
|
||||
self.sleep(TRANSIENT_WAIT_S[min(i, len(TRANSIENT_WAIT_S) - 1)])
|
||||
continue
|
||||
hh = h or {}
|
||||
# a 429 with quota left is a burst refusal (ghcr.io, 2026-11-02 by hand): wait and try again; GitHub's spent quota
|
||||
# (X-RateLimit-Remaining: 0) is the caller's to read
|
||||
spent = str(hh.get("X-RateLimit-Remaining", hh.get("x-ratelimit-remaining", ""))) == "0"
|
||||
if st != 429 or spent or i == TRANSIENT_TRIES - 1 or not self._may_retry_transient():
|
||||
return st, h, body
|
||||
ra = str(hh.get("Retry-After", hh.get("retry-after", "")))
|
||||
self.sleep(min(int(ra), 120) if ra.isdigit() else TRANSIENT_WAIT_S[min(i, len(TRANSIENT_WAIT_S) - 1)])
|
||||
|
||||
def hub_get(self, url, headers=None):
|
||||
"""A GET to Docker Hub: spaced across the workers, a 429 retried. Returns the last answer."""
|
||||
"""A GET to Docker Hub: spaced across the workers, a 429 or a read timeout retried. Returns the last answer."""
|
||||
for i in range(HUB_TRIES):
|
||||
with self._hub_lock:
|
||||
if self._hub_last is not None:
|
||||
@@ -346,7 +420,13 @@ class Sources:
|
||||
if wait > 0:
|
||||
self.sleep(wait)
|
||||
self._hub_last = self.clock()
|
||||
st, h, body = self.net.get(url, headers)
|
||||
try:
|
||||
st, h, body = self.net.get(url, headers)
|
||||
except Transient:
|
||||
if i == HUB_TRIES - 1 or not self._may_retry_transient():
|
||||
raise
|
||||
self.sleep(HUB_BACKOFF_S[min(i, len(HUB_BACKOFF_S) - 1)])
|
||||
continue
|
||||
if st != 429 or i == HUB_TRIES - 1:
|
||||
return st, h, body
|
||||
self.tag_stats["retried_429"] += 1
|
||||
@@ -365,7 +445,7 @@ class Sources:
|
||||
if self.net.gh_token:
|
||||
headers["Authorization"] = "Bearer %s" % self.net.gh_token
|
||||
for _ in range(5):
|
||||
st, h, body = self.net.get(url, headers)
|
||||
st, h, body = self.get(url, headers)
|
||||
if st in (403, 429) and str(h.get("X-RateLimit-Remaining", h.get("x-ratelimit-remaining", ""))) == "0":
|
||||
self.rate_limited = True
|
||||
raise SourceError("GitHub API rate limit (%s)" % st)
|
||||
@@ -382,7 +462,7 @@ class Sources:
|
||||
def release_feed(self, repo):
|
||||
if repo in self._rel:
|
||||
return self._rel[repo]
|
||||
st, _h, body = self.net.get("https://github.com/%s/releases.atom" % repo)
|
||||
st, _h, body = self.get("https://github.com/%s/releases.atom" % repo)
|
||||
if st != 200:
|
||||
raise SourceError("release feed of %s: HTTP %s" % (repo, st))
|
||||
text = body.decode("utf-8", "replace")
|
||||
@@ -401,7 +481,7 @@ class Sources:
|
||||
def feed(self, name):
|
||||
if name in self._feed:
|
||||
return self._feed[name]
|
||||
st, _h, body = self.net.get(FEEDS[name]["url"])
|
||||
st, _h, body = self.get(FEEDS[name]["url"])
|
||||
if st != 200:
|
||||
raise SourceError("feed %s: HTTP %s" % (name, st))
|
||||
text = body.decode("utf-8", "replace")
|
||||
@@ -419,7 +499,7 @@ class Sources:
|
||||
def vulnnotes(self, name):
|
||||
if name in self._notes:
|
||||
return self._notes[name]
|
||||
st, _h, body = self.net.get(VULNNOTES[name]["url"])
|
||||
st, _h, body = self.get(VULNNOTES[name]["url"])
|
||||
if st != 200:
|
||||
raise SourceError("release notes %s: HTTP %s" % (name, st))
|
||||
secs, cur = {}, None
|
||||
@@ -480,13 +560,13 @@ class Sources:
|
||||
if not url:
|
||||
break
|
||||
elif reg == "ghcr.io":
|
||||
st, _h, body = self.net.get("https://ghcr.io/token?scope=repository:%s:pull" % path)
|
||||
st, _h, body = self.get("https://ghcr.io/token?scope=repository:%s:pull" % path)
|
||||
if st != 200:
|
||||
raise SourceError("ghcr.io token for %s: HTTP %s" % (path, st))
|
||||
tok = json.loads(body).get("token", "")
|
||||
url = "https://ghcr.io/v2/%s/tags/list?n=10000" % path
|
||||
for _ in range(50): # ghcr.io PAGES its list (Link: rel="next") — page 1 alone missed every newer tag (R-1327)
|
||||
st, h, body = self.net.get(url, {"Authorization": "Bearer %s" % tok})
|
||||
st, h, body = self.get(url, {"Authorization": "Bearer %s" % tok})
|
||||
if st != 200:
|
||||
raise SourceError("ghcr.io tags of %s: HTTP %s" % (path, st))
|
||||
names += json.loads(body).get("tags") or []
|
||||
@@ -517,6 +597,10 @@ def registry_of(image):
|
||||
|
||||
|
||||
# ── one pin ──────────────────────────────────────────────────────────────────────────────────────────────────────────
|
||||
def is_date_build(v):
|
||||
return len(v) == 3 and 20000101 <= v[2] <= 20991231
|
||||
|
||||
|
||||
def newest_in_channel(tag, names):
|
||||
ours = version_of(tag)
|
||||
if not ours or not names:
|
||||
@@ -529,6 +613,8 @@ def newest_in_channel(tag, names):
|
||||
v = version_of(n)
|
||||
if not v or len(v) != len(ours):
|
||||
continue
|
||||
if is_date_build(v) and not is_date_build(ours):
|
||||
continue # linuxserver's 26.09.20260929 is a rebuild date, not a version above 26.09.2 (R-1310, test W16)
|
||||
if same_channel(ours, v):
|
||||
if vcmp(v, ours) > 0 and (best is None or vcmp(v, version_of(best)) > 0):
|
||||
best = n
|
||||
@@ -570,15 +656,25 @@ def check_item(it, src, today):
|
||||
"fixed": fixed, "link": a.get("html_url") or "",
|
||||
"unsure": hit is None, "published": (a.get("published_at") or "")[:10]})
|
||||
if kind == "github" and not floating:
|
||||
for e in src.release_feed(arg):
|
||||
named = {a["id"] for a in advs}
|
||||
# oldest first, so a GHSA named by two releases reads as fixed in the lower one
|
||||
for e in sorted(src.release_feed(arg), key=lambda r: (version_of(r["tag"]) or ()) + (0,) * 6):
|
||||
v = version_of(e["tag"])
|
||||
if not v or PRERELEASE.search(e["tag"]) or vcmp(v, ours) <= 0 or not same_channel(ours, v):
|
||||
continue
|
||||
m = STRONG.search(e["content"]) or STRONG.search(e["title"])
|
||||
if m:
|
||||
line = next((ln.strip() for ln in re.split(r"[\n.]", e["content"]) if STRONG.search(ln)), m.group(0))
|
||||
lines = [ln.strip() for ln in re.split(r"[\n.]", e["content"]) + [e["title"]]
|
||||
if STRONG.search(ln) and not WORD_ONLY.search(ln)]
|
||||
ghsas = []
|
||||
for ln in lines: # every GHSA a release names is its own entry (R-1310: Tandoor 2.7.0 named eight)
|
||||
ghsas += [("GHSA" + g[4:].lower(), ln) for g in GHSA.findall(ln)]
|
||||
for gid, ln in ghsas:
|
||||
if gid not in named:
|
||||
named.add(gid)
|
||||
advs.append({"id": gid, "source": "release notes", "severity": "", "summary": ln[:200],
|
||||
"fixed": e["tag"], "link": e["link"], "unsure": False, "published": ""})
|
||||
if lines and not ghsas:
|
||||
advs.append({"id": "release:%s@%s" % (arg, e["tag"]), "source": "release notes",
|
||||
"severity": "", "summary": line[:200], "fixed": e["tag"], "link": e["link"],
|
||||
"severity": "", "summary": lines[0][:200], "fixed": e["tag"], "link": e["link"],
|
||||
"unsure": False, "published": ""})
|
||||
elif kind == "osv" and not floating:
|
||||
ver = ".".join(str(x) for x in ours)
|
||||
@@ -637,15 +733,26 @@ def check_item(it, src, today):
|
||||
else:
|
||||
behind, newer_major = newest_in_channel(it["tag"], names)
|
||||
except SourceError as e:
|
||||
nc.append({"source": "registry:%s" % registry_of(it["image"])[0], "why": str(e)})
|
||||
if stated_unreadable(it, str(e)):
|
||||
it["gap_why"] = stated_unreadable(it, str(e))
|
||||
notes.append("registry: %s" % e)
|
||||
else:
|
||||
nc.append({"source": "registry:%s" % registry_of(it["image"])[0], "why": str(e)})
|
||||
if newer_major:
|
||||
notes.append("a newer major exists: %s" % newer_major)
|
||||
if getattr(src, "runtime", None) and not it.get("no_registry") and it.get("image") and it.get("tag"):
|
||||
res = src.runtime("%s:%s" % (it["image"], it["tag"]))
|
||||
unchecked = res.get("unchecked") or []
|
||||
no_route = [u for u in unchecked if u.startswith("registry ") and "no anonymous token route" in u]
|
||||
if no_route and it["group"] != "dooplex":
|
||||
if no_route:
|
||||
notes.append("runtime: %s" % no_route[0])
|
||||
if it["group"] == "dooplex":
|
||||
# our own private registry: the CI has no read of it, tonight or ever. A stated hole, not a failed source
|
||||
# (R-1334: six such images kept the „runtime" streak open, so a real outage could not mail).
|
||||
it["gap_why"] = "%s — our own build in the private registry: registry and runtime not read" % no_route[0]
|
||||
elif unchecked and all(stated_unreadable(it, u) for u in unchecked):
|
||||
it["gap_why"] = stated_unreadable(it, unchecked[0])
|
||||
notes.append("runtime: %s" % unchecked[0])
|
||||
elif unchecked:
|
||||
nc.append({"source": "runtime", "why": "; ".join(unchecked)[:300]})
|
||||
advs += runtime_advisories(res, it["group"])
|
||||
@@ -656,7 +763,7 @@ def check_item(it, src, today):
|
||||
it["class"] = "ADVISORY"
|
||||
elif nc:
|
||||
it["class"] = "NOT CHECKED"
|
||||
elif "gap" in kinds and not [k for k in kinds if k != "gap"]:
|
||||
elif it.get("gap_why") or ("gap" in kinds and not [k for k in kinds if k != "gap"]):
|
||||
it["class"] = "GAP"
|
||||
elif "self" in kinds and len(kinds) == 1:
|
||||
it["class"] = "SELF"
|
||||
@@ -669,6 +776,18 @@ def check_item(it, src, today):
|
||||
return it
|
||||
|
||||
|
||||
def stated_unreadable(it, why):
|
||||
"""The stated reason when this failure is the one answer this pin is known to give (STATED_UNREADABLE), else None."""
|
||||
known = STATED_UNREADABLE.get(it.get("image"))
|
||||
return known[1] if known and known[0] in why else None
|
||||
|
||||
|
||||
def failed_lines(items):
|
||||
"""Every failed source of every pin. The table shows one class per pin, so an ADVISORY pin hid its failed source."""
|
||||
return ["FAILED-SOURCE %s %s:%s — %s" % (f["source"], it["image"], it["tag"], f["why"][:200])
|
||||
for it in items for f in it.get("not_checked", [])]
|
||||
|
||||
|
||||
def source_name(kind, arg):
|
||||
return {"github": "github", "advisories": "github", "osv": "osv", "feed": "feed:" + arg,
|
||||
"vulnnotes": "vulnnotes:" + arg}.get(kind, kind)
|
||||
@@ -840,8 +959,8 @@ def weekly_mail(items, today):
|
||||
lines += block("Open advisories (mailed already):", sorted({"%s %s — %s" % (it["image"], it["tag"], a["id"])
|
||||
for it in items for a in it.get("advisories", [])}))
|
||||
lines += block("No machine-readable source (GAP) — not watched for notices:",
|
||||
sorted({"%s — %s" % (it["image"], next((v for k, v in it.get("sources", []) if k == "gap"),
|
||||
"; ".join(it.get("notes", []))))
|
||||
sorted({"%s — %s" % (it["image"], it.get("gap_why") or next((v for k, v in it.get("sources", []) if k == "gap"),
|
||||
"; ".join(it.get("notes", []))))
|
||||
for it in items if it.get("class") == "GAP"}))
|
||||
lines += block("Floating tags (no exact version to match a notice against):",
|
||||
sorted({"%s:%s (%s)" % (it["image"], it["tag"], it["owner"]) for it in items if it.get("class") == "FLOATING"}))
|
||||
@@ -951,13 +1070,19 @@ def main(argv):
|
||||
for it in items:
|
||||
counts[it["class"]] = counts.get(it["class"], 0) + 1
|
||||
print("COUNTS " + " ".join("%s=%d" % (k.replace(" ", "_"), v) for k, v in sorted(counts.items())))
|
||||
failed = failed_lines(items)
|
||||
for line in failed:
|
||||
print(line)
|
||||
print("FAILED-SOURCES %d" % len(failed))
|
||||
if rreader:
|
||||
st = rreader.stats
|
||||
print("RUNTIME read=%d (%.0f s) from-cache=%d not-checked=%d zstd-decoder=%s" % (
|
||||
st["read"], st["read_s"], st["cached"], st["not_checked"],
|
||||
nc_rt = sum(1 for it in items for f in it.get("not_checked", []) if f["source"] == "runtime")
|
||||
print("RUNTIME read=%d (%.0f s) from-cache=%d not-checked=%d stated-unreadable=%d zstd-decoder=%s" % (
|
||||
st["read"], st["read_s"], st["cached"], nc_rt, max(st["not_checked"] - nc_rt, 0),
|
||||
image_runtime.zstd_decoder_how() if st["read"] else "not needed"))
|
||||
ts = run.sources.tag_stats
|
||||
print("TAGS fetched=%d from-cache=%d retried-429=%d (cache %s)" % (ts["fetched"], ts["from_cache"], ts["retried_429"], tpath))
|
||||
print("TAGS fetched=%d from-cache=%d retried-429=%d retried-timeout=%d (cache %s)" % (
|
||||
ts["fetched"], ts["from_cache"], ts["retried_429"], ts["retried_timeout"], tpath))
|
||||
print("REQUESTS " + " ".join("%s=%d" % kv for kv in sorted(net.requests.items())))
|
||||
state_path = opts.get("state")
|
||||
state, missing = {}, True
|
||||
|
||||
@@ -25,6 +25,13 @@ What is pinned, each by its consequence (the mail or the class), not by its mech
|
||||
W14 Docker Hub (R-1334): a 429 is retried (Retry-After honoured) and is NOT CHECKED only after the last try; a tag list
|
||||
cached under 24 h is not fetched, an older one is; two names of one path fetch once; requests are spaced
|
||||
W11 ghcr.io tag lists are PAGED (Link: rel="next"): every page is read, so a newer tag on page 2 is seen
|
||||
W15 a one-off read timeout (the 2026-10-29..11-02 nights' cause, R-1334) is tried again on every source; a timeout on
|
||||
every try is NOT CHECKED; a pin the watch can never read (our own private registry, a stated Docker Hub 401) is a
|
||||
GAP with its reason, opens no failure streak, and a real outage of that source mails; an unstated 401 stays NOT
|
||||
CHECKED; every failed source is printed, even for an ADVISORY pin; the RUNTIME line counts a failed resolve
|
||||
W16 R-1310: another program's package in the repo is not listed; every GHSA a release names is its own entry, with the
|
||||
lowest fixing tag, never twice; a line where „security” is only a word is no ADVISORY; a YY.MM.YYYYMMDD tag is not
|
||||
„newer"
|
||||
Red-proofs (2026-10-26): W5 with the `k not in known` test removed (every night mails) -> W5 fails; W6 with the streak
|
||||
threshold at 1 -> W6 fails; W2 with FEED_DAYS check removed -> W2's old-item case fails; W4 with SourceError swallowed
|
||||
-> W4 fails. W9 (2026-10-27, R-1310) was seen failing before its two rules existed (2 of 4 checks red, the two
|
||||
@@ -439,8 +446,9 @@ def t_dooplex():
|
||||
priv[0]["sources"] = [("gap", "DooPlex workload")]
|
||||
w.run(priv, FakeNet({}), TODAY, False, runtime=lambda ref: {"ref": ref, "unchecked": [
|
||||
"registry gitea.dooplex.hu: no anonymous token route"]})
|
||||
check("W12 a DooPlex image in a private registry -> NOT CHECKED with the reason", priv[0]["class"] == "NOT CHECKED" and
|
||||
"gitea.dooplex.hu" in priv[0]["not_checked"][0]["why"], (priv[0]["class"], priv[0]["not_checked"]))
|
||||
check("W12 a DooPlex image in our own private registry -> GAP with the reason, no failed source (R-1334)",
|
||||
priv[0]["class"] == "GAP" and not priv[0]["not_checked"] and "gitea.dooplex.hu" in priv[0].get("gap_why", ""),
|
||||
(priv[0]["class"], priv[0]["not_checked"]))
|
||||
wk = w.weekly_mail([dict(it, behind="5.4.1", **{"class": "BEHIND"})], TODAY)
|
||||
check("W12 the weekly mail has its own DooPlex block", "DooPlex (homelab)" in wk["text"], wk["text"][:300])
|
||||
|
||||
@@ -536,6 +544,176 @@ def t_dockerhub():
|
||||
"tag_cache=tcache)" in src_text and "felhom-watch-tags.json" in src_text and "TAGS fetched=" in src_text)
|
||||
|
||||
|
||||
def t_timeouts_and_stated():
|
||||
print("-- W15: a timeout is tried again; a stated unreadable pin is a GAP, not a failed source (R-1334)")
|
||||
hub = "https://hub.docker.com/v2/repositories/library/redis/tags"
|
||||
ok = (200, {}, {"results": [{"name": "7.4.1"}], "next": None})
|
||||
|
||||
class FlakyNet(SeqNet):
|
||||
"""The first `n` GETs of a URL prefix raise the transport error the nights logged."""
|
||||
def __init__(self, routes, flaky, n=1):
|
||||
SeqNet.__init__(self, routes)
|
||||
self.flaky, self.left = flaky, n
|
||||
|
||||
def get(self, url, headers=None, timeout=30):
|
||||
if url.startswith(self.flaky) and self.left > 0:
|
||||
self.left -= 1
|
||||
self.seen.append(url)
|
||||
raise w.Transient("%s: The read operation timed out" % url)
|
||||
return SeqNet.get(self, url, headers, timeout)
|
||||
|
||||
def mk(net):
|
||||
return w.Sources(net, TODAY, False, sleep=lambda s: None, clock=lambda: 0.0)
|
||||
net = FlakyNet({hub: [ok]}, hub)
|
||||
check("W15 a Docker Hub read timeout is tried again and the retry's tags are used",
|
||||
mk(net).tags("redis") == ["7.4.1"] and len(net.seen) == 2, net.seen)
|
||||
net = FlakyNet({hub: [ok]}, hub, n=99)
|
||||
try:
|
||||
mk(net).tags("redis")
|
||||
res = "no error"
|
||||
except w.SourceError as e:
|
||||
res = str(e)
|
||||
check("W15 a timeout on every try -> NOT CHECKED after the last try", "timed out" in res and
|
||||
len(net.seen) == w.HUB_TRIES, (res, len(net.seen)))
|
||||
feed = "https://github.com/ex/app/releases.atom"
|
||||
net = FlakyNet({feed: EMPTY_FEED}, feed)
|
||||
check("W15 a release-feed read timeout is tried again (nginx, 2026-10-29)", mk(net).release_feed("ex/app") == [] and
|
||||
len(net.seen) == 2, net.seen)
|
||||
ghcr = "https://ghcr.io/"
|
||||
net = SeqNet({ghcr + "token": (200, {}, {"token": "t"}),
|
||||
ghcr + "v2/ex/app/tags/list": [(429, {"Retry-After": "1"}, b""), (200, {}, {"tags": ["1.0.0"]})]})
|
||||
check("W15 a ghcr.io tag list answering 429 is tried again (2026-11-02: immich-server)",
|
||||
mk(net).tags("ghcr.io/ex/app") == ["1.0.0"] and len(net.seen) == 3, net.seen)
|
||||
net = SeqNet({"https://api.github.com/": [(403, {"X-RateLimit-Remaining": "0"}, b""), (200, {}, [])]})
|
||||
try:
|
||||
mk(net).gh_advisories("ex/app")
|
||||
res = "no error"
|
||||
except w.SourceError as e:
|
||||
res = str(e)
|
||||
check("W15 GitHub's spent quota is not waited on (control)", "rate limit" in res and len(net.seen) == 1, (res, net.seen))
|
||||
api = "https://api.github.com/repos/ex/app/security-advisories"
|
||||
net = FlakyNet({api: (200, {}, [])}, api)
|
||||
check("W15 a GitHub advisories read timeout is tried again", mk(net).gh_advisories("ex/app") == [] and
|
||||
len(net.seen) == 2, net.seen)
|
||||
|
||||
# minio's shape: the tag list and the manifest both answer 401, every night
|
||||
def minio():
|
||||
i = item("minio/minio", "latest", "gap:DooPlex workload", group="dooplex")
|
||||
i["sources"] = [("gap", "DooPlex workload")]
|
||||
return i
|
||||
auth = "https://auth.docker.io/token"
|
||||
r401 = {"https://hub.docker.com/v2/repositories/minio/minio/tags": (404, {}, b""), auth: (200, {}, {"token": "t"}),
|
||||
"https://registry-1.docker.io/v2/minio/minio/tags/list": (401, {}, b"")}
|
||||
read401 = lambda ref: {"ref": ref, "unchecked": ["manifest minio/minio:latest: HTTP 401"]} # noqa: E731
|
||||
pins = [minio()]
|
||||
w.run(pins, FakeNet(r401), TODAY, False, runtime=read401)
|
||||
check("W15 a stated unreadable pin (minio: 401 on tags and manifest) -> GAP with its reason, no failed source",
|
||||
pins[0]["class"] == "GAP" and not pins[0]["not_checked"] and "401" in pins[0].get("gap_why", ""),
|
||||
(pins[0]["class"], pins[0]["not_checked"]))
|
||||
wk = w.weekly_mail(pins, TODAY)
|
||||
check("W15 the weekly lists it with its reason (a stated hole, not a silent one)",
|
||||
"minio/minio" in wk["text"] and "401" in wk["text"], wk["text"])
|
||||
other = [dict(minio(), image="ex/other")]
|
||||
other[0]["sources"] = [("gap", "DooPlex workload")]
|
||||
rother = {"https://hub.docker.com/v2/repositories/ex/other/tags": (401, {}, b"")}
|
||||
w.run(other, FakeNet(rother), TODAY, False, runtime=lambda ref: {"ref": ref, "unchecked": ["manifest ex/other:latest: HTTP 401"]})
|
||||
check("W15 an UNSTATED 401 stays NOT CHECKED (a Hub outage is never a GAP)",
|
||||
other[0]["class"] == "NOT CHECKED" and len(other[0]["not_checked"]) == 2, (other[0]["class"], other[0]["not_checked"]))
|
||||
timeout = [minio()]
|
||||
w.run(timeout, FakeNet({"https://hub.docker.com/v2/repositories/minio/minio/tags": RuntimeError("The read operation timed out")}),
|
||||
TODAY, False, runtime=read401)
|
||||
check("W15 the stated pin failing ANOTHER way (a timeout) is still NOT CHECKED",
|
||||
timeout[0]["class"] == "NOT CHECKED", (timeout[0]["class"], timeout[0]["not_checked"]))
|
||||
# the consequence: the 2026-10-28..11-02 streak was held open by these pins alone, so a real outage mailed nothing
|
||||
state = {"weekly_last": TODAY.isoformat(), "failures": {"runtime": {"streak": 6, "mailed": True},
|
||||
"registry:docker.io": {"streak": 7, "mailed": True}}}
|
||||
pins = [minio()]
|
||||
w.run(pins, FakeNet(r401), TODAY, False, runtime=read401)
|
||||
_, st, _ = w.plan(pins, state, TODAY)
|
||||
check("W15 with only the stated pins left, the memory's `failures` empties (the streak resets)",
|
||||
st["failures"] == {}, st["failures"])
|
||||
down = [clean("ex/a")]
|
||||
down[0]["not_checked"] = [{"source": "registry:docker.io", "why": "HTTP 500"}]
|
||||
m1, st, _ = w.plan(down, st, TODAY)
|
||||
m2, st, _ = w.plan(down, st, TODAY + datetime.timedelta(days=1))
|
||||
check("W15 after that reset a real outage of the source mails on its second night", kinds(m1, "not_checked") == [] and
|
||||
len(kinds(m2, "not_checked")) == 1, (kinds(m1), kinds(m2)))
|
||||
# the log tells the truth
|
||||
adv = [adv_item("ex/a", "CVE-1")]
|
||||
adv[0]["not_checked"] = [{"source": "runtime", "why": "manifest ex/a:1: HTTP 500"}]
|
||||
check("W15 a pin with an advisory AND a failed source is printed (the table shows only its class)",
|
||||
any("runtime" in ln and "ex/a" in ln and "HTTP 500" in ln for ln in w.failed_lines(adv)), w.failed_lines(adv))
|
||||
r = w.cached_runtime_reader({}, resolve=lambda ref: (_ for _ in ()).throw(w.image_runtime.Unreadable("manifest x:1: HTTP 500")),
|
||||
read=lambda ref: {})
|
||||
r("x:1")
|
||||
check("W15 a failed resolve counts in the RUNTIME line's not-checked (it said 0 for six nights)",
|
||||
r.stats["not_checked"] == 1, r.stats)
|
||||
calls = []
|
||||
|
||||
def flaky_resolve(ref):
|
||||
calls.append(ref)
|
||||
if len(calls) == 1:
|
||||
raise TimeoutError("timed out")
|
||||
return "sha256:abc"
|
||||
r = w.cached_runtime_reader({"sha256:abc": {"ok": 1}}, resolve=flaky_resolve, read=lambda ref: {})
|
||||
res = r("x:1")
|
||||
check("W15 a resolve timeout is tried once more before NOT CHECKED", not res.get("unchecked") and len(calls) == 2, (res, calls))
|
||||
|
||||
|
||||
def t_r1310():
|
||||
print("-- W16: notices that do not apply, and fixes that were missed (R-1310)")
|
||||
gh = lambda name, rng="<= 2.0.0", fx="2.0.1": {"package": {"name": name}, "vulnerable_version_range": rng, "patched_versions": fx} # noqa: E731
|
||||
hit, _ = w.ghsa_affects({"vulnerabilities": [gh("gitea.com/gitea/runner")]}, (1, 0, 0), "go-gitea/gitea")
|
||||
check("W16 another program's package in the repo (Gitea's runner) is not listed", hit is False, hit)
|
||||
hit, _ = w.ghsa_affects({"vulnerabilities": [gh("gitea.com/gitea/runner"), gh("gitea.dev")]}, (1, 0, 0), "go-gitea/gitea")
|
||||
check("W16 the same notice also naming the pinned program IS listed (control)", hit is True, hit)
|
||||
hit, _ = w.ghsa_affects({"vulnerabilities": [gh("gitea.dev")]}, (1, 0, 0), "go-gitea/gitea")
|
||||
check("W16 the pinned program's package is listed (control)", hit is True, hit)
|
||||
hit, _ = w.ghsa_affects({"vulnerabilities": [gh("Rootless Docker Image only")]}, (1, 0, 0), "louislam/uptime-kuma")
|
||||
check("W16 Uptime Kuma's rootless-only notice is not listed for our image", hit is False, hit)
|
||||
|
||||
def feed(*entries):
|
||||
out = "<feed>"
|
||||
for tag, body in entries:
|
||||
out += '<entry><link href="https://github.com/ex/app/releases/tag/%s"/><title>%s</title><content>%s</content></entry>' % (tag, tag, body)
|
||||
return (200, {}, (out + "</feed>").encode())
|
||||
routes = lambda f: {"https://api.github.com/repos/ex/app/": (200, {}, []), "https://github.com/ex/app/releases.atom": f, # noqa: E731
|
||||
"https://hub.docker.com/v2/repositories/ex/app/tags": TAGS("1.0.0")}
|
||||
# Tandoor 2.7.0's shape: eight ids, one line each
|
||||
pins = run_items([item("ex/app", "1.0.0", "github:ex/app")], routes(feed(
|
||||
("1.0.2", "Fixes GHSA-aaaa-bbbb-cccc and GHSA-dddd-eeee-ffff."),
|
||||
("1.0.1", "Security: GHSA-aaaa-bbbb-cccc"))))
|
||||
ids = sorted(a["id"] for a in pins[0]["advisories"])
|
||||
check("W16 every GHSA a release names is its own entry, once", ids == ["GHSA-aaaa-bbbb-cccc", "GHSA-dddd-eeee-ffff"], ids)
|
||||
fx = {a["id"]: a["fixed"] for a in pins[0]["advisories"]}
|
||||
check("W16 ... with the lowest release that names it as the fix", fx.get("GHSA-aaaa-bbbb-cccc") == "1.0.1" and
|
||||
fx.get("GHSA-dddd-eeee-ffff") == "1.0.2", fx)
|
||||
pub = dict(ADV_TRAEFIK[0], ghsa_id="GHSA-aaaa-bbbb-cccc", vulnerabilities=[gh("ex/app", "<= 1.0.0", "1.0.1")])
|
||||
pins = run_items([item("ex/app", "1.0.0", "github:ex/app")], dict(routes(feed(("1.0.1", "Fixes GHSA-aaaa-bbbb-cccc"))),
|
||||
**{"https://api.github.com/repos/ex/app/": (200, {}, [pub])}))
|
||||
check("W16 a GHSA in both the advisory list and a release is one entry (the advisory's)",
|
||||
[a["source"] for a in pins[0]["advisories"]] == ["GitHub advisory"], pins[0]["advisories"])
|
||||
# Traefik v3.7.17's notes: a real id AND a word-only line
|
||||
trf = "[security] Point security announcements to GitHub advisories (#14099)"
|
||||
pins = run_items([item("ex/app", "1.0.0", "github:ex/app")], routes(feed(("1.0.1", trf))))
|
||||
check("W16 a line where „security” is only a word is no ADVISORY (Traefik's announcements line)",
|
||||
pins[0]["class"] != "ADVISORY", pins[0]["advisories"])
|
||||
pins = run_items([item("ex/app", "1.0.0", "github:ex/app")], routes(feed(("1.0.1", "Dawarich no longer receives security fixes on this line"))))
|
||||
check("W16 „no longer receives security fixes” is no ADVISORY (Dawarich)", pins[0]["class"] != "ADVISORY", pins[0]["advisories"])
|
||||
pins = run_items([item("ex/app", "1.0.0", "github:ex/app")], routes(feed(("1.0.1", "CVE fixed: Advisory GHSA-xv5x-242w-7hf7\n" + trf))))
|
||||
check("W16 the same notes with a real id ARE listed, by that id (control: Traefik v3.7.17)",
|
||||
[a["id"] for a in pins[0]["advisories"]] == ["GHSA-xv5x-242w-7hf7"], pins[0]["advisories"])
|
||||
pins = run_items([item("ex/app", "1.0.0", "github:ex/app")], routes(feed(("1.0.1", "Security Fixes"))))
|
||||
check("W16 a plain „Security Fixes” heading with no id is still an ADVISORY (control: Vaultwarden's shape)",
|
||||
pins[0]["class"] == "ADVISORY" or any(True for a in pins[0]["advisories"]), pins[0]["advisories"])
|
||||
best, _ = w.newest_in_channel("26.09.2", ["26.09.20260929", "26.09.1"])
|
||||
check("W16 linuxserver's YY.MM.YYYYMMDD tag is not newer than 26.09.2", best is None, best)
|
||||
best, _ = w.newest_in_channel("26.09.2", ["26.09.20260929", "26.09.3"])
|
||||
check("W16 a real newer tag beside it still counts (control)", best == "26.09.3", best)
|
||||
best, _ = w.newest_in_channel("26.09.20260901", ["26.09.20260929"])
|
||||
check("W16 a pin that IS on the date shape still compares its own shape (control)", best == "26.09.20260929", best)
|
||||
|
||||
|
||||
def main():
|
||||
t_ranges()
|
||||
t_classes()
|
||||
@@ -543,7 +721,7 @@ def main():
|
||||
t_two_groups()
|
||||
t_dockerhub()
|
||||
t_inventory()
|
||||
for t in (t_runtime, t_ghcr_pages, t_dooplex):
|
||||
for t in (t_runtime, t_ghcr_pages, t_dooplex, t_timeouts_and_stated, t_r1310):
|
||||
try:
|
||||
t()
|
||||
except Exception as e: # noqa: BLE001 — a missing feature is a red check, not a crash
|
||||
|
||||
Reference in new issue
Block a user