admin/felhom.eu
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

R-1303: the GitHub key is in place (CI dry job 2415 read every repo in one night); first real night (job 2413) mailed nothing, as designed; STATUS do-item removed
gates / gates (push) Successful in 2m0s
Details

Browse Source
This commit is contained in:
admin committed 2026-10-27 07:55:04 +01:00
1 parent 8744eab80d
commit c6248dbfc5
4 files changed
+679 -2
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

documentation/audits/security-watch-2026-10-26/ci-dry-with-key.log
+165
View File
@@ -0,0 +1,165 @@
2026-10-27T06:49:06.4932503Z felhom-gates-runner(version:v0.6.1) received task 2438 of job watch, be triggered by event: workflow_dispatch
2026-10-27T06:49:06.4941549Z workflow prepared
2026-10-27T06:49:06.4943430Z evaluating expression 'success()'
2026-10-27T06:49:06.4944876Z expression 'success()' evaluated to 'true'
2026-10-27T06:49:06.4955881Z evaluating expression ''
2026-10-27T06:49:06.4956625Z expression '' evaluated to 'true'
2026-10-27T06:49:06.4956928Z ⭐ Run Main Fetch main (latest, for the memory) and the two sibling repos
2026-10-27T06:49:06.4963063Z Wrote command \n\necho "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"\nbase=http://gitea.gitea-system.svc.cluster.local:3000/admin\ngit init -q . && git remote add origin $base/felhom.eu.git\ngit fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD\necho "felhom.eu main at $(git rev-parse --short=12 HEAD)"\nfor r in felhom-controller app-catalog-felhom.eu; do\n git init -q ../$r && git -C ../$r remote add origin $base/$r.git\n git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD\n echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)"\ndone\n\n\n to 'workflow/0.sh'
2026-10-27T06:49:06.4965168Z ::group::Run echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"
2026-10-27T06:49:06.4965617Z echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"
2026-10-27T06:49:06.4965895Z base=http://gitea.gitea-system.svc.cluster.local:3000/admin
2026-10-27T06:49:06.4966168Z git init -q . && git remote add origin $base/felhom.eu.git
2026-10-27T06:49:06.4966408Z git fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD
2026-10-27T06:49:06.4966639Z echo "felhom.eu main at $(git rev-parse --short=12 HEAD)"
2026-10-27T06:49:06.4966860Z for r in felhom-controller app-catalog-felhom.eu; do
2026-10-27T06:49:06.4967073Z git init -q ../$r && git -C ../$r remote add origin $base/$r.git
2026-10-27T06:49:06.4967300Z git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD
2026-10-27T06:49:06.4967566Z echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)"
2026-10-27T06:49:06.4967784Z done
2026-10-27T06:49:06.4967972Z shell: bash --noprofile --norc -e -o pipefail {0}
2026-10-27T06:49:06.4968215Z ::endgroup::
2026-10-27T06:49:50.5742891Z felhom.eu main at 8744eab80d4c
2026-10-27T06:49:53.0868505Z felhom-controller at 9b5bb0a9a620
2026-10-27T06:49:54.1122283Z app-catalog-felhom.eu at 9ff723ca4db5
2026-10-27T06:49:54.1139323Z ::group::Run set -u
2026-10-27T06:49:54.1139578Z set -u
2026-10-27T06:49:54.1139725Z mkdir -p documentation/security-watch
2026-10-27T06:49:54.1139868Z mode="${MODE:-run}"
2026-10-27T06:49:54.1139998Z [ "${GITHUB_EVENT_NAME:-}" = "schedule" ] && mode=run
2026-10-27T06:49:54.1140154Z echo "mode: $mode"
2026-10-27T06:49:54.1140279Z case "$mode" in
2026-10-27T06:49:54.1140399Z test-mail) python3 scripts/security_watch.py --test-mail; exit $? ;;
2026-10-27T06:49:54.1140551Z dry) extra="--no-mail" ; state=/tmp/state-dry.json
2026-10-27T06:49:54.1140701Z cp documentation/security-watch/state.json "$state" 2>/dev/null || true ;;
2026-10-27T06:49:54.1140845Z seed) extra="--seed" ; state=documentation/security-watch/state.json ;;
2026-10-27T06:49:54.1140999Z run) extra="" ; state=documentation/security-watch/state.json ;;
2026-10-27T06:49:54.1141170Z *) echo "unknown mode $mode"; exit 2 ;;
2026-10-27T06:49:54.1141310Z esac
2026-10-27T06:49:54.1141423Z python3 scripts/security_watch.py --state="$state" --catalog=../app-catalog-felhom.eu \
2026-10-27T06:49:54.1141599Z --controller=../felhom-controller --json=/tmp/watch-results.json $extra
2026-10-27T06:49:54.1141747Z shell: bash --noprofile --norc -e -o pipefail {0}
2026-10-27T06:49:54.1141916Z env:
2026-10-27T06:49:54.1142048Z RESEND_API_KEY: ***
2026-10-27T06:49:54.1142229Z GH_ADVISORY_TOKEN: ***
2026-10-27T06:49:54.1142367Z MODE: dry
2026-10-27T06:49:54.1142486Z ::endgroup::
2026-10-27T06:49:54.1179246Z mode: dry
2026-10-27T06:49:54.2710125Z /root/.cache/act/a2dd0fe0d5e2b283/hostexecutor/scripts/security_watch.py:715: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
2026-10-27T06:49:54.2710890Z today = datetime.date.fromisoformat(opts["today"]) if "today" in opts else datetime.datetime.utcnow().date()
2026-10-27T06:49:54.3264563Z security watch 2026-10-27: 108 pins (11 box/build, 97 app); GitHub key PRESENT — every repo's advisories tonight
2026-10-27T06:50:56.0729558Z ADVISORY box cloudflare/cloudflared 2026.10.3 feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3 (fixed read the notice); vulnnotes:cloudflared@2026.10.4:VULN-176088 (fixed 2026.10.4)
2026-10-27T06:50:56.0730401Z ADVISORY box gtstef/filebrowser 1.5.6-stable GHSA-gfgm-886h-6r47 (fixed 2.0.2-stable, 2.1.4-beta); GHSA-wxj5-g3qp-g732 (fixed 2.0.2-stable, 2.1.3-beta); GHSA-3j46-5w28-f8p2 (fixed 2.1.0-stable, 2.1.3-beta); GHSA-4vrc-935w-xxq2 (fixed 2.1.0-stable, 2.1.3-beta); … 32 more
2026-10-27T06:50:56.0730981Z ADVISORY box traefik v3.7.13 GHSA-hrpp-p4fc-wwf8 (fixed v3.7.16); GHSA-p8wx-ph99-xgcr (fixed v3.7.15); GHSA-fh26-gfpp-7xxx (fixed v3.7.14); GHSA-qvj7-gq9c-hp7q (fixed v3.7.14); … 11 more
2026-10-27T06:50:56.0731256Z ADVISORY app calcom/cal.com v6.2.0 GHSA-p3f6-52gv-cj7m (fixed the range is unreadable — check by hand); GHSA-cpf2-q635-xrwx (fixed the range is unreadable — check by hand)
2026-10-27T06:50:56.0731458Z ADVISORY app codewithcj/sparkyfitness v0.17.3 GHSA-v883-jx9h-qf29 (fixed no fixed version named yet); GHSA-cmmf-53wf-r5gv (fixed no fixed version named yet); GHSA-p8cf-g8rv-gvrq (fixed no fixed version named yet)
2026-10-27T06:50:56.0731897Z ADVISORY app codewithcj/sparkyfitness_server v0.17.3 GHSA-v883-jx9h-qf29 (fixed no fixed version named yet); GHSA-cmmf-53wf-r5gv (fixed no fixed version named yet); GHSA-p8cf-g8rv-gvrq (fixed no fixed version named yet)
2026-10-27T06:50:56.0732150Z ADVISORY app docmost/docmost 0.96.0 release:docmost/docmost@v0.97.0 (fixed v0.97.0)
2026-10-27T06:50:56.0732311Z ADVISORY app f0rc3/gokapi v1.9.6 GHSA-45vh-rpc8-hxpp (fixed 2.2.4); GHSA-qwc6-vc2v-2ggj (fixed 2.2.4); GHSA-j6jp-78w8-34x6 (fixed 2.2.4); GHSA-m2hx-wjxc-9fp4 (fixed 2.2.3); … 6 more
2026-10-27T06:50:56.0732502Z ADVISORY app fallenbagel/jellyseerr 2.7.3 GHSA-8j73-j6rc-q8xh (fixed 3.5.0); GHSA-xc6j-6p6h-p799 (fixed 3.5.0); GHSA-mc6w-69r3-62h8 (fixed 3.4.0); GHSA-gx3h-3jg5-q65f (fixed 3.1.0); … 2 more
2026-10-27T06:50:56.0732674Z ADVISORY app flomp/wanderer-db v0.20.0 GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2); … 7 more
2026-10-27T06:50:56.0732890Z ADVISORY app flomp/wanderer-web v0.20.0 GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2); … 7 more
2026-10-27T06:50:56.0733056Z ADVISORY app freikin/dawarich 1.15.3 release:Freika/dawarich@1.17.0 (fixed 1.17.0)
2026-10-27T06:50:56.0733204Z ADVISORY app ghcr.io/advplyr/audiobookshelf 2.37.1 release:advplyr/audiobookshelf@v2.37.2 (fixed v2.37.2)
2026-10-27T06:50:56.0733362Z ADVISORY app ghcr.io/alam00000/bentopdf v2.8.6 GHSA-wh78-rcw2-hhg9 (fixed v2.8.7); GHSA-5xjf-rr5x-pcfj (fixed no fixed version named yet); GHSA-cx8x-7rrr-r9x8 (fixed no fixed version named yet); release:alam00000/bentopdf@v2.8.10 (fixed v2.8.10); … 1 more
2026-10-27T06:50:56.0733682Z ADVISORY app ghcr.io/cmintey/wishlist v0.67.1 release:cmintey/wishlist@v0.69.0 (fixed v0.69.0); release:cmintey/wishlist@v0.68.0 (fixed v0.68.0)
2026-10-27T06:50:56.0733911Z ADVISORY app ghcr.io/gethomepage/homepage v1.13.2 GHSA-669x-4pg4-w24r (fixed 2.2.0)
2026-10-27T06:50:56.0734072Z ADVISORY app ghcr.io/home-assistant/home-assistant 2026.9.4 GHSA-jff5-5j3g-vhqc (fixed the range is unreadable — check by hand)
2026-10-27T06:50:56.0734227Z ADVISORY app ghcr.io/immich-app/immich-machine-learning v3.2.4 GHSA-8244-8vpr-vp9c (fixed the range is unreadable — check by hand); release:immich-app/immich@v3.3.5 (fixed v3.3.5)
2026-10-27T06:50:56.0734420Z ADVISORY app ghcr.io/immich-app/immich-server v3.2.4 GHSA-8244-8vpr-vp9c (fixed the range is unreadable — check by hand); release:immich-app/immich@v3.3.5 (fixed v3.3.5)
2026-10-27T06:50:56.0734604Z ADVISORY app ghcr.io/karakeep-app/karakeep 0.33.2 GHSA-pp34-2c9r-mchw (fixed no fixed version named yet); release:karakeep-app/karakeep@v0.34.1 (fixed v0.34.1); release:karakeep-app/karakeep@v0.34.0 (fixed v0.34.0)
2026-10-27T06:50:56.0734835Z ADVISORY app ghcr.io/lukegus/termix 2.8.0 GHSA-6gr3-r7jx-wfmh (fixed >= 26.10.0); GHSA-frx8-qqgg-7j7g (fixed >= 26.10.0); GHSA-3q2m-5r5p-w45r (fixed >= 26.10.0); GHSA-rgf3-2q88-q4wp (fixed >= 26.10.0); … 8 more
2026-10-27T06:50:56.0735056Z ADVISORY app ghcr.io/mealie-recipes/mealie v3.28.0 GHSA-99wf-32rc-2767 (fixed 3.29.0)
2026-10-27T06:50:56.0736071Z ADVISORY app ghcr.io/paperless-ngx/paperless-ngx 2.20.15 GHSA-c8f3-pqr2-rr24 (fixed 3.3.2); GHSA-2jhj-xqrq-rmrq (fixed 3.1.2)
2026-10-27T06:50:56.0736383Z ADVISORY app ghcr.io/sysadminsmedia/homebox 0.26.2 GHSA-mw9p-fhpj-jf82 (fixed 0.27.0); GHSA-h7wm-wjr6-cfxh (fixed 0.27.0); GHSA-58m4-m8xj-v3j2 (fixed 0.27.0); GHSA-754m-5j7m-8wfv (fixed 0.27.0); … 11 more
2026-10-27T06:50:56.0736630Z ADVISORY app ghcr.io/tandoorrecipes/recipes 2.6.15 GHSA-5f74-7rgh-pc97 (fixed no fixed version named yet); GHSA-pcq2-64qw-jm4x (fixed no fixed version named yet); GHSA-69q3-5q6x-7hmx (fixed no fixed version named yet); GHSA-xq7g-9q95-vjc6 (fixed no fixed version named yet); … 6 more
2026-10-27T06:50:56.0736855Z ADVISORY app gitea/gitea 1.27.3 GHSA-wx44-9m3m-rjqx (fixed 28.2.0); GHSA-4jmf-h2cm-hg7w (fixed 28.2.0); GHSA-8j56-f865-gqq2 (fixed 28.2.0); GHSA-fxq4-gr55-7x5g (fixed 28.2.0); … 37 more
2026-10-27T06:50:56.0737032Z ADVISORY app glanceapp/glance v0.8.5 GHSA-r225-jhr6-68cc (fixed >= 0.8.7)
2026-10-27T06:50:56.0737221Z ADVISORY app grafana/grafana 13.2.3 GHSA-8xmm-x63g-f6xv (fixed no fixed version named yet); GHSA-4724-7jwc-3fpw (fixed the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 (fixed the range is unreadable — check by hand); GHSA-8wjh-59cw-9xh4 (fixed no fixed version named yet); … 1 more
2026-10-27T06:50:56.0737456Z ADVISORY app jellyfin/jellyfin 10.11.11 GHSA-cf3c-8m59-2vhx (fixed 12.0); GHSA-6828-c7cx-hvqm (fixed 12.0); GHSA-4vx8-xhc9-qg6x (fixed 12.0); GHSA-9x85-gx46-6522 (fixed 12.0); … 2 more
2026-10-27T06:50:56.0737643Z ADVISORY app louislam/uptime-kuma 2.5.5 GHSA-98hr-q8q8-5j23 (fixed 2.5.6); GHSA-qjxc-h5jf-c7rj (fixed the range is unreadable — check by hand); release:louislam/uptime-kuma@2.5.8 (fixed 2.5.8); release:louislam/uptime-kuma@2.5.7 (fixed 2.5.7); … 1 more
2026-10-27T06:50:56.0737844Z ADVISORY app lscr.io/linuxserver/bookstack 26.09.1 release:BookStackApp/BookStack@v26.09.2 (fixed v26.09.2)
2026-10-27T06:50:56.0738041Z ADVISORY app lscr.io/linuxserver/code-server 4.129.0 release:coder/code-server@v4.141.1 (fixed v4.141.1)
2026-10-27T06:50:56.0738211Z ADVISORY app lukevella/rallly 4.15.3 GHSA-gmq4-f8j5-8w8q (fixed 4.15.4); release:lukevella/rallly@v4.16.2 (fixed v4.16.2); release:lukevella/rallly@v4.16.0 (fixed v4.16.0); release:lukevella/rallly@v4.15.5 (fixed v4.15.5); … 1 more
2026-10-27T06:50:56.0738383Z ADVISORY app n8nio/n8n 2.42.1 GHSA-43v8-hjhm-chjp (fixed >= 2.43.5, >= 2.44.1); GHSA-mgpr-56r4-5c67 (fixed >= 2.43.5, >= 2.44.1); GHSA-8vrr-mgc5-jg55 (fixed >= 2.43.5, >= 2.44.1); GHSA-qmvv-q3c9-wpp7 (fixed >= 2.43.5, >= 2.44.1); … 9 more
2026-10-27T06:50:56.0738554Z ADVISORY app outlinewiki/outline 1.10.1 GHSA-x4w3-9p9j-cprh (fixed 1.12.0); GHSA-rq53-m97j-f2pg (fixed 1.12.0); GHSA-h6ff-rw9x-5mq2 (fixed 1.12.0); GHSA-rvj7-2gww-6xfq (fixed 1.12.0); … 9 more
2026-10-27T06:50:56.0738767Z ADVISORY app privatebin/pdo 2.0.6 GHSA-w873-3ghv-hmh6 (fixed 2.1.0); release:PrivateBin/PrivateBin@2.1.0 (fixed 2.1.0)
2026-10-27T06:50:56.0738928Z ADVISORY app rommapp/romm 5.3.1 GHSA-q7fg-rj3q-m3gm (fixed 5.4.0); GHSA-7jw3-ppmp-57wc (fixed 5.4.0); GHSA-9q83-m866-5jrp (fixed 5.4.0); GHSA-722m-w9p2-xv2j (fixed 5.4.0); … 2 more
2026-10-27T06:50:56.0739080Z ADVISORY app vikunja/vikunja 2.6.0 GHSA-5fc2-w2j4-6r8w (fixed 2.7.1); GHSA-xgw3-ccqg-f6ww (fixed 2.7.1); GHSA-frf4-3prf-3vch (fixed 2.7.1); GHSA-rp64-xg8g-9mpr (fixed 2.7.1); … 41 more
2026-10-27T06:50:56.0739256Z NOT CHECKED app lscr.io/linuxserver/sonarr 4.0.20 https://hub.docker.com/v2/repositories/linuxserver/sonarr/tags: The read operation timed out
2026-10-27T06:50:56.0739468Z BEHIND app actualbudget/actual-server 26.9.0 newest 26.10.0
2026-10-27T06:50:56.0739915Z BEHIND app getmeili/meilisearch v1.41.0 newest v1.56.0
2026-10-27T06:50:56.0740140Z BEHIND app getmeili/meilisearch v1.36.0 newest v1.56.0
2026-10-27T06:50:56.0740289Z BEHIND app ghcr.io/alexta69/metube 2026.09.29 newest 2026.10.27
2026-10-27T06:50:56.0740471Z BEHIND app ghcr.io/hargata/lubelogger v1.7.3 newest v1.7.4
2026-10-27T06:50:56.0740611Z BEHIND app ghcr.io/kozea/radicale 3.8.1 newest 3.9.0
2026-10-27T06:50:56.0740775Z BEHIND app ghcr.io/papra-hq/papra 26.6.2-rootless newest 26.7.1-rootless
2026-10-27T06:50:56.0740921Z BEHIND app ghost 6.67.0-alpine newest 6.72.0-alpine
2026-10-27T06:50:56.0741075Z BEHIND app gotson/komga 1.28.0 newest 1.29.1
2026-10-27T06:50:56.0741224Z BEHIND app kimai/kimai2 2.67.0 newest 2.71.0
2026-10-27T06:50:56.0741377Z BEHIND app nextcloud 34.0.4-apache newest 34.0.5-apache
2026-10-27T06:50:56.0741532Z BEHIND app nginx 1.30.5-alpine newest 1.31.8-alpine
2026-10-27T06:50:56.0741710Z BEHIND app qbittorrentofficial/qbittorrent-nox 5.2.4-1 newest 5.3.0-2
2026-10-27T06:50:56.0741849Z GAP buil alpine 3.24.2 newest 3.24.3
2026-10-27T06:50:56.0741988Z GAP buil alpine 3.24.2 newest 3.24.3
2026-10-27T06:50:56.0742121Z GAP buil debian 13.7-slim
2026-10-27T06:50:56.0742242Z GAP buil debian 13.7-slim
2026-10-27T06:50:56.0742368Z GAP app emby/embyserver 4.11.0.4 newest 4.11.0.11
2026-10-27T06:50:56.0742540Z GAP app ghcr.io/immich-app/postgres 16-vectorchord0.4.3-pg
2026-10-27T06:50:56.0742669Z GAP app ghcr.io/karakeep-app/karakeep-chrome 151.0.7922.47-r1
2026-10-27T06:50:56.0742788Z GAP app mariadb 12.3
2026-10-27T06:50:56.0742911Z GAP app mariadb 11.4 newest 11.8
2026-10-27T06:50:56.0743035Z GAP app mariadb 11.8
2026-10-27T06:50:56.0743162Z GAP app mariadb 12.3
2026-10-27T06:50:56.0743370Z GAP app mariadb 11.8
2026-10-27T06:50:56.0743541Z GAP app msdeluise/plant-it 0.10.0
2026-10-27T06:50:56.0743670Z GAP app plexinc/pms-docker 1.43.5.11029-6bf8af3f0
2026-10-27T06:50:56.0743836Z GAP app postgis/postgis 16-3.5-alpine
2026-10-27T06:50:56.0743974Z GAP app postgis/postgis 17-3.5-alpine
2026-10-27T06:50:56.0744093Z GAP app postgres 18-alpine
2026-10-27T06:50:56.0744214Z GAP app postgres 17-alpine
2026-10-27T06:50:56.0744326Z GAP app postgres 18-alpine
2026-10-27T06:50:56.0744460Z GAP app postgres 18-alpine
2026-10-27T06:50:56.0744608Z GAP app postgres 18-alpine
2026-10-27T06:50:56.0744732Z GAP app postgres 18-alpine
2026-10-27T06:50:56.0744851Z GAP app postgres 18-alpine
2026-10-27T06:50:56.0744971Z GAP app postgres 17-alpine
2026-10-27T06:50:56.0745082Z GAP app postgres 16-alpine
2026-10-27T06:50:56.0745191Z GAP app registry.gitlab.com/crafty-controller/crafty-4 4.11.0
2026-10-27T06:50:56.0745364Z FLOATING app ghcr.io/claperco/claper 2.5
2026-10-27T06:50:56.0745506Z FLOATING app ghcr.io/thomiceli/opengist 1.15
2026-10-27T06:50:56.0745629Z FLOATING app lscr.io/linuxserver/prowlarr version-2.6.5.5623
2026-10-27T06:50:56.0745757Z FLOATING app lscr.io/linuxserver/sabnzbd version-5.1.3
2026-10-27T06:50:56.0745877Z FLOATING app lscr.io/linuxserver/transmission version-4.1.3-r0
2026-10-27T06:50:56.0746133Z FLOATING app nzbgetcom/nzbget v26.3
2026-10-27T06:50:56.0746266Z FLOATING app redis 7.4-alpine
2026-10-27T06:50:56.0746415Z FLOATING app redis 7-alpine
2026-10-27T06:50:56.0746531Z FLOATING app redis 7-alpine
2026-10-27T06:50:56.0746654Z FLOATING app redis 7-alpine
2026-10-27T06:50:56.0746792Z FLOATING app redis 7-alpine
2026-10-27T06:50:56.0746935Z FLOATING app redis 7-alpine
2026-10-27T06:50:56.0747074Z FLOATING app redis 7-alpine
2026-10-27T06:50:56.0747235Z FLOATING app wger/server 2.7
2026-10-27T06:50:56.0747428Z SELF box gitea.dooplex.hu/admin/felhom-samba 1.2.0
2026-10-27T06:50:56.0747569Z SELF app gitea.dooplex.hu/admin/recipe-importer v0.9.11
2026-10-27T06:50:56.0747694Z CURRENT buil golang 1.27.3-trixie
2026-10-27T06:50:56.0747815Z CURRENT buil golang 1.27.3-alpine3.24
2026-10-27T06:50:56.0747938Z CURRENT buil restic 0.19.1
2026-10-27T06:50:56.0748107Z CURRENT app crocodilestick/calibre-web-automated v4.0.8
2026-10-27T06:50:56.0748252Z CURRENT app deluan/navidrome 0.64.2
2026-10-27T06:50:56.0748417Z CURRENT app ghcr.io/diced/zipline 4.8.0
2026-10-27T06:50:56.0748549Z CURRENT app ghcr.io/gramps-project/grampsweb v25.6.0
2026-10-27T06:50:56.0748688Z CURRENT app ghcr.io/grimmory-tools/grimmory v3.5.0
2026-10-27T06:50:56.0748819Z CURRENT app ghcr.io/seanmorley15/adventurelog-backend v0.13.0
2026-10-27T06:50:56.0748961Z CURRENT app ghcr.io/seanmorley15/adventurelog-frontend v0.13.0
2026-10-27T06:50:56.0749080Z CURRENT app lscr.io/linuxserver/grocy 4.7.1
2026-10-27T06:50:56.0749206Z CURRENT app lscr.io/linuxserver/radarr 6.4.4
2026-10-27T06:50:56.0749341Z CURRENT app onlyoffice/documentserver 9.4.0
2026-10-27T06:50:56.0749461Z CURRENT app vaultwarden/server 1.37.4-alpine
2026-10-27T06:50:56.0749578Z COUNTS ADVISORY=38 BEHIND=13 CURRENT=14 FLOATING=14 GAP=26 NOT_CHECKED=1 SELF=2
2026-10-27T06:50:56.0749713Z REQUESTS api.github.com=68 api.osv.dev=1 blog.cloudflare.com=1 ghcr.io=52 github.com=63 hub.docker.com=143 raw.githubusercontent.com=1
2026-10-27T06:50:56.0886369Z MAIL (not sent, --no-mail): [Felhom security] sparkyfitness, sparkyfitness_server, gokapi, jellyseerr … — 56 new advisories
2026-10-27T06:50:56.0886769Z MAIL (not sent, --no-mail): [Felhom security] the watch could not check registry:docker.io
2026-10-27T06:50:56.0932887Z STATE written: /tmp/state-dry.json (302 known advisories)
2026-10-27T06:50:56.1300881Z Cleaning up container for job watch
2026-10-27T06:50:56.7138033Z 🏁 Job succeeded
documentation/audits/security-watch-2026-10-26/ci-night1-2026-10-27.log
+512
View File
@@ -0,0 +1,512 @@
2026-10-27T03:40:05.3805687Z felhom-gates-runner-2(version:v0.6.1) received task 2436 of job watch, be triggered by event: schedule
2026-10-27T03:40:05.3812127Z workflow prepared
2026-10-27T03:40:05.3813054Z evaluating expression 'success()'
2026-10-27T03:40:05.3814118Z expression 'success()' evaluated to 'true'
2026-10-27T03:40:05.3820035Z evaluating expression ''
2026-10-27T03:40:05.3820475Z expression '' evaluated to 'true'
2026-10-27T03:40:05.3820635Z ⭐ Run Main Fetch main (latest, for the memory) and the two sibling repos
2026-10-27T03:40:05.3823993Z Wrote command \n\necho "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"\nbase=http://gitea.gitea-system.svc.cluster.local:3000/admin\ngit init -q . && git remote add origin $base/felhom.eu.git\ngit fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD\necho "felhom.eu main at $(git rev-parse --short=12 HEAD)"\nfor r in felhom-controller app-catalog-felhom.eu; do\n git init -q ../$r && git -C ../$r remote add origin $base/$r.git\n git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD\n echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)"\ndone\n\n\n to 'workflow/0.sh'
2026-10-27T03:40:05.3825210Z ::group::Run echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"
2026-10-27T03:40:05.3825455Z echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"
2026-10-27T03:40:05.3825671Z base=http://gitea.gitea-system.svc.cluster.local:3000/admin
2026-10-27T03:40:05.3825805Z git init -q . && git remote add origin $base/felhom.eu.git
2026-10-27T03:40:05.3825930Z git fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD
2026-10-27T03:40:05.3826074Z echo "felhom.eu main at $(git rev-parse --short=12 HEAD)"
2026-10-27T03:40:05.3826200Z for r in felhom-controller app-catalog-felhom.eu; do
2026-10-27T03:40:05.3826409Z git init -q ../$r && git -C ../$r remote add origin $base/$r.git
2026-10-27T03:40:05.3826543Z git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD
2026-10-27T03:40:05.3826678Z echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)"
2026-10-27T03:40:05.3826838Z done
2026-10-27T03:40:05.3826947Z shell: bash --noprofile --norc -e -o pipefail {0}
2026-10-27T03:40:05.3827086Z ::endgroup::
2026-10-27T03:40:39.8990312Z felhom.eu main at 626275b18700
2026-10-27T03:40:42.4387267Z felhom-controller at 9b5bb0a9a620
2026-10-27T03:40:43.2228344Z app-catalog-felhom.eu at 9ff723ca4db5
2026-10-27T03:40:43.2252091Z ::group::Run set -u
2026-10-27T03:40:43.2252485Z set -u
2026-10-27T03:40:43.2252829Z mkdir -p documentation/security-watch
2026-10-27T03:40:43.2253054Z mode="${MODE:-run}"
2026-10-27T03:40:43.2253256Z [ "${GITHUB_EVENT_NAME:-}" = "schedule" ] && mode=run
2026-10-27T03:40:43.2253483Z echo "mode: $mode"
2026-10-27T03:40:43.2253718Z case "$mode" in
2026-10-27T03:40:43.2253956Z test-mail) python3 scripts/security_watch.py --test-mail; exit $? ;;
2026-10-27T03:40:43.2254377Z dry) extra="--no-mail" ; state=/tmp/state-dry.json
2026-10-27T03:40:43.2254654Z cp documentation/security-watch/state.json "$state" 2>/dev/null || true ;;
2026-10-27T03:40:43.2254914Z seed) extra="--seed" ; state=documentation/security-watch/state.json ;;
2026-10-27T03:40:43.2255146Z run) extra="" ; state=documentation/security-watch/state.json ;;
2026-10-27T03:40:43.2255367Z *) echo "unknown mode $mode"; exit 2 ;;
2026-10-27T03:40:43.2255628Z esac
2026-10-27T03:40:43.2255902Z python3 scripts/security_watch.py --state="$state" --catalog=../app-catalog-felhom.eu \
2026-10-27T03:40:43.2256131Z --controller=../felhom-controller --json=/tmp/watch-results.json $extra
2026-10-27T03:40:43.2256531Z shell: bash --noprofile --norc -e -o pipefail {0}
2026-10-27T03:40:43.2256794Z env:
2026-10-27T03:40:43.2257706Z RESEND_API_KEY: ***
2026-10-27T03:40:43.2257981Z GH_ADVISORY_TOKEN:
2026-10-27T03:40:43.2258191Z MODE:
2026-10-27T03:40:43.2258370Z ::endgroup::
2026-10-27T03:40:43.2305235Z mode: run
2026-10-27T03:40:43.4170605Z /root/.cache/act/22c2c50c70929041/hostexecutor/scripts/security_watch.py:715: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
2026-10-27T03:40:43.4172059Z today = datetime.date.fromisoformat(opts["today"]) if "today" in opts else datetime.datetime.utcnow().date()
2026-10-27T03:40:43.4724546Z security watch 2026-10-27: 108 pins (11 box/build, 97 app); GitHub key ABSENT — apps' advisories in a 2-night rotation
2026-10-27T03:41:29.7165880Z ADVISORY box cloudflare/cloudflared 2026.10.3 feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3 (fixed read the notice); vulnnotes:cloudflared@2026.10.4:VULN-176088 (fixed 2026.10.4)
2026-10-27T03:41:29.7167192Z ADVISORY box gtstef/filebrowser 1.5.6-stable GHSA-gfgm-886h-6r47 (fixed 2.0.2-stable, 2.1.4-beta); GHSA-wxj5-g3qp-g732 (fixed 2.0.2-stable, 2.1.3-beta); GHSA-3j46-5w28-f8p2 (fixed 2.1.0-stable, 2.1.3-beta); GHSA-4vrc-935w-xxq2 (fixed 2.1.0-stable, 2.1.3-beta); … 32 more
2026-10-27T03:41:29.7167676Z ADVISORY box traefik v3.7.13 GHSA-hrpp-p4fc-wwf8 (fixed v3.7.16); GHSA-p8wx-ph99-xgcr (fixed v3.7.15); GHSA-fh26-gfpp-7xxx (fixed v3.7.14); GHSA-qvj7-gq9c-hp7q (fixed v3.7.14); … 11 more
2026-10-27T03:41:29.7168404Z ADVISORY app calcom/cal.com v6.2.0 GHSA-p3f6-52gv-cj7m (fixed the range is unreadable — check by hand); GHSA-cpf2-q635-xrwx (fixed the range is unreadable — check by hand)
2026-10-27T03:41:29.7168912Z ADVISORY app docmost/docmost 0.96.0 release:docmost/docmost@v0.97.0 (fixed v0.97.0)
2026-10-27T03:41:29.7169238Z ADVISORY app flomp/wanderer-db v0.20.0 release:open-wanderer/wanderer@v0.21.2 (fixed v0.21.2); release:open-wanderer/wanderer@v0.21.0 (fixed v0.21.0)
2026-10-27T03:41:29.7171035Z ADVISORY app flomp/wanderer-web v0.20.0 release:open-wanderer/wanderer@v0.21.2 (fixed v0.21.2); release:open-wanderer/wanderer@v0.21.0 (fixed v0.21.0)
2026-10-27T03:41:29.7171474Z ADVISORY app freikin/dawarich 1.15.3 release:Freika/dawarich@1.17.0 (fixed 1.17.0)
2026-10-27T03:41:29.7171735Z ADVISORY app ghcr.io/advplyr/audiobookshelf 2.37.1 release:advplyr/audiobookshelf@v2.37.2 (fixed v2.37.2)
2026-10-27T03:41:29.7172114Z ADVISORY app ghcr.io/alam00000/bentopdf v2.8.6 release:alam00000/bentopdf@v2.8.10 (fixed v2.8.10); release:alam00000/bentopdf@v2.8.7 (fixed v2.8.7)
2026-10-27T03:41:29.7172592Z ADVISORY app ghcr.io/cmintey/wishlist v0.67.1 release:cmintey/wishlist@v0.69.0 (fixed v0.69.0); release:cmintey/wishlist@v0.68.0 (fixed v0.68.0)
2026-10-27T03:41:29.7172865Z ADVISORY app ghcr.io/gethomepage/homepage v1.13.2 GHSA-669x-4pg4-w24r (fixed 2.2.0)
2026-10-27T03:41:29.7173115Z ADVISORY app ghcr.io/immich-app/immich-machine-learning v3.2.4 release:immich-app/immich@v3.3.5 (fixed v3.3.5)
2026-10-27T03:41:29.7173457Z ADVISORY app ghcr.io/immich-app/immich-server v3.2.4 release:immich-app/immich@v3.3.5 (fixed v3.3.5)
2026-10-27T03:41:29.7173795Z ADVISORY app ghcr.io/karakeep-app/karakeep 0.33.2 release:karakeep-app/karakeep@v0.34.1 (fixed v0.34.1); release:karakeep-app/karakeep@v0.34.0 (fixed v0.34.0)
2026-10-27T03:41:29.7174141Z ADVISORY app ghcr.io/lukegus/termix 2.8.0 GHSA-6gr3-r7jx-wfmh (fixed >= 26.10.0); GHSA-frx8-qqgg-7j7g (fixed >= 26.10.0); GHSA-3q2m-5r5p-w45r (fixed >= 26.10.0); GHSA-rgf3-2q88-q4wp (fixed >= 26.10.0); … 8 more
2026-10-27T03:41:29.7174698Z ADVISORY app ghcr.io/mealie-recipes/mealie v3.28.0 GHSA-99wf-32rc-2767 (fixed 3.29.0)
2026-10-27T03:41:29.7175111Z ADVISORY app ghcr.io/paperless-ngx/paperless-ngx 2.20.15 GHSA-c8f3-pqr2-rr24 (fixed 3.3.2); GHSA-2jhj-xqrq-rmrq (fixed 3.1.2)
2026-10-27T03:41:29.7175424Z ADVISORY app ghcr.io/sysadminsmedia/homebox 0.26.2 GHSA-mw9p-fhpj-jf82 (fixed 0.27.0); GHSA-h7wm-wjr6-cfxh (fixed 0.27.0); GHSA-58m4-m8xj-v3j2 (fixed 0.27.0); GHSA-754m-5j7m-8wfv (fixed 0.27.0); … 11 more
2026-10-27T03:41:29.7175741Z ADVISORY app ghcr.io/tandoorrecipes/recipes 2.6.15 GHSA-5f74-7rgh-pc97 (fixed no fixed version named yet); GHSA-pcq2-64qw-jm4x (fixed no fixed version named yet); GHSA-69q3-5q6x-7hmx (fixed no fixed version named yet); GHSA-xq7g-9q95-vjc6 (fixed no fixed version named yet); … 6 more
2026-10-27T03:41:29.7176089Z ADVISORY app gitea/gitea 1.27.3 GHSA-wx44-9m3m-rjqx (fixed 28.2.0); GHSA-4jmf-h2cm-hg7w (fixed 28.2.0); GHSA-8j56-f865-gqq2 (fixed 28.2.0); GHSA-fxq4-gr55-7x5g (fixed 28.2.0); … 37 more
2026-10-27T03:41:29.7176593Z ADVISORY app glanceapp/glance v0.8.5 GHSA-r225-jhr6-68cc (fixed >= 0.8.7)
2026-10-27T03:41:29.7176839Z ADVISORY app grafana/grafana 13.2.3 GHSA-8xmm-x63g-f6xv (fixed no fixed version named yet); GHSA-4724-7jwc-3fpw (fixed the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 (fixed the range is unreadable — check by hand); GHSA-8wjh-59cw-9xh4 (fixed no fixed version named yet); … 1 more
2026-10-27T03:41:29.7177262Z ADVISORY app louislam/uptime-kuma 2.5.5 release:louislam/uptime-kuma@2.5.8 (fixed 2.5.8); release:louislam/uptime-kuma@2.5.7 (fixed 2.5.7); release:louislam/uptime-kuma@2.5.6 (fixed 2.5.6)
2026-10-27T03:41:29.7177682Z ADVISORY app lscr.io/linuxserver/bookstack 26.09.1 release:BookStackApp/BookStack@v26.09.2 (fixed v26.09.2)
2026-10-27T03:41:29.7178019Z ADVISORY app lscr.io/linuxserver/code-server 4.129.0 release:coder/code-server@v4.141.1 (fixed v4.141.1)
2026-10-27T03:41:29.7178515Z ADVISORY app lukevella/rallly 4.15.3 release:lukevella/rallly@v4.16.2 (fixed v4.16.2); release:lukevella/rallly@v4.16.0 (fixed v4.16.0); release:lukevella/rallly@v4.15.5 (fixed v4.15.5); release:lukevella/rallly@v4.15.4 (fixed v4.15.4)
2026-10-27T03:41:29.7178880Z ADVISORY app n8nio/n8n 2.42.1 GHSA-43v8-hjhm-chjp (fixed >= 2.43.5, >= 2.44.1); GHSA-mgpr-56r4-5c67 (fixed >= 2.43.5, >= 2.44.1); GHSA-8vrr-mgc5-jg55 (fixed >= 2.43.5, >= 2.44.1); GHSA-qmvv-q3c9-wpp7 (fixed >= 2.43.5, >= 2.44.1); … 9 more
2026-10-27T03:41:29.7179396Z ADVISORY app outlinewiki/outline 1.10.1 GHSA-x4w3-9p9j-cprh (fixed 1.12.0); GHSA-rq53-m97j-f2pg (fixed 1.12.0); GHSA-h6ff-rw9x-5mq2 (fixed 1.12.0); GHSA-rvj7-2gww-6xfq (fixed 1.12.0); … 9 more
2026-10-27T03:41:29.7180024Z ADVISORY app privatebin/pdo 2.0.6 GHSA-w873-3ghv-hmh6 (fixed 2.1.0); release:PrivateBin/PrivateBin@2.1.0 (fixed 2.1.0)
2026-10-27T03:41:29.7180279Z ADVISORY app rommapp/romm 5.3.1 GHSA-q7fg-rj3q-m3gm (fixed 5.4.0); GHSA-7jw3-ppmp-57wc (fixed 5.4.0); GHSA-9q83-m866-5jrp (fixed 5.4.0); GHSA-722m-w9p2-xv2j (fixed 5.4.0); … 2 more
2026-10-27T03:41:29.7180630Z ADVISORY app vikunja/vikunja 2.6.0 GHSA-5fc2-w2j4-6r8w (fixed 2.7.1); GHSA-xgw3-ccqg-f6ww (fixed 2.7.1); GHSA-frf4-3prf-3vch (fixed 2.7.1); GHSA-rp64-xg8g-9mpr (fixed 2.7.1); … 41 more
2026-10-27T03:41:29.7180983Z BEHIND app actualbudget/actual-server 26.9.0 newest 26.10.0
2026-10-27T03:41:29.7181219Z BEHIND app getmeili/meilisearch v1.41.0 newest v1.56.0
2026-10-27T03:41:29.7181444Z BEHIND app getmeili/meilisearch v1.36.0 newest v1.56.0
2026-10-27T03:41:29.7181777Z BEHIND app ghcr.io/alexta69/metube 2026.09.29 newest 2026.10.27
2026-10-27T03:41:29.7182038Z BEHIND app ghcr.io/hargata/lubelogger v1.7.3 newest v1.7.4
2026-10-27T03:41:29.7182272Z BEHIND app ghcr.io/kozea/radicale 3.8.1 newest 3.9.0
2026-10-27T03:41:29.7182588Z BEHIND app ghcr.io/papra-hq/papra 26.6.2-rootless newest 26.7.1-rootless
2026-10-27T03:41:29.7182820Z BEHIND app ghost 6.67.0-alpine newest 6.72.0-alpine
2026-10-27T03:41:29.7183054Z BEHIND app gotson/komga 1.28.0 newest 1.29.1
2026-10-27T03:41:29.7183416Z BEHIND app kimai/kimai2 2.67.0 newest 2.71.0
2026-10-27T03:41:29.7183715Z BEHIND app nextcloud 34.0.4-apache newest 34.0.5-apache
2026-10-27T03:41:29.7184223Z BEHIND app nginx 1.30.5-alpine newest 1.31.8-alpine
2026-10-27T03:41:29.7184494Z BEHIND app qbittorrentofficial/qbittorrent-nox 5.2.4-1 newest 5.3.0-2
2026-10-27T03:41:29.7184899Z GAP buil alpine 3.24.2 newest 3.24.3
2026-10-27T03:41:29.7185124Z GAP buil alpine 3.24.2 newest 3.24.3
2026-10-27T03:41:29.7185394Z GAP buil debian 13.7-slim
2026-10-27T03:41:29.7185613Z GAP buil debian 13.7-slim
2026-10-27T03:41:29.7186088Z GAP app emby/embyserver 4.11.0.4 newest 4.11.0.11
2026-10-27T03:41:29.7186325Z GAP app ghcr.io/immich-app/postgres 16-vectorchord0.4.3-pg
2026-10-27T03:41:29.7186569Z GAP app ghcr.io/karakeep-app/karakeep-chrome 151.0.7922.47-r1
2026-10-27T03:41:29.7186895Z GAP app mariadb 12.3
2026-10-27T03:41:29.7187161Z GAP app mariadb 11.4 newest 11.8
2026-10-27T03:41:29.7187387Z GAP app mariadb 11.8
2026-10-27T03:41:29.7187603Z GAP app mariadb 12.3
2026-10-27T03:41:29.7187879Z GAP app mariadb 11.8
2026-10-27T03:41:29.7188143Z GAP app msdeluise/plant-it 0.10.0
2026-10-27T03:41:29.7188375Z GAP app plexinc/pms-docker 1.43.5.11029-6bf8af3f0
2026-10-27T03:41:29.7188739Z GAP app postgis/postgis 16-3.5-alpine
2026-10-27T03:41:29.7188999Z GAP app postgis/postgis 17-3.5-alpine
2026-10-27T03:41:29.7189209Z GAP app postgres 18-alpine
2026-10-27T03:41:29.7189420Z GAP app postgres 17-alpine
2026-10-27T03:41:29.7189698Z GAP app postgres 18-alpine
2026-10-27T03:41:29.7189959Z GAP app postgres 18-alpine
2026-10-27T03:41:29.7190166Z GAP app postgres 18-alpine
2026-10-27T03:41:29.7190419Z GAP app postgres 18-alpine
2026-10-27T03:41:29.7190642Z GAP app postgres 18-alpine
2026-10-27T03:41:29.7190875Z GAP app postgres 17-alpine
2026-10-27T03:41:29.7191134Z GAP app postgres 16-alpine
2026-10-27T03:41:29.7191454Z GAP app registry.gitlab.com/crafty-controller/crafty-4 4.11.0
2026-10-27T03:41:29.7191780Z FLOATING app ghcr.io/claperco/claper 2.5
2026-10-27T03:41:29.7192005Z FLOATING app ghcr.io/thomiceli/opengist 1.15
2026-10-27T03:41:29.7192303Z FLOATING app lscr.io/linuxserver/prowlarr version-2.6.5.5623
2026-10-27T03:41:29.7192532Z FLOATING app lscr.io/linuxserver/sabnzbd version-5.1.3
2026-10-27T03:41:29.7192743Z FLOATING app lscr.io/linuxserver/transmission version-4.1.3-r0
2026-10-27T03:41:29.7193012Z FLOATING app nzbgetcom/nzbget v26.3
2026-10-27T03:41:29.7193313Z FLOATING app redis 7.4-alpine
2026-10-27T03:41:29.7193749Z FLOATING app redis 7-alpine
2026-10-27T03:41:29.7194017Z FLOATING app redis 7-alpine
2026-10-27T03:41:29.7194278Z FLOATING app redis 7-alpine
2026-10-27T03:41:29.7194599Z FLOATING app redis 7-alpine
2026-10-27T03:41:29.7194855Z FLOATING app redis 7-alpine
2026-10-27T03:41:29.7195304Z FLOATING app redis 7-alpine
2026-10-27T03:41:29.7195577Z FLOATING app wger/server 2.7
2026-10-27T03:41:29.7195942Z SELF box gitea.dooplex.hu/admin/felhom-samba 1.2.0
2026-10-27T03:41:29.7196164Z SELF app gitea.dooplex.hu/admin/recipe-importer v0.9.11
2026-10-27T03:41:29.7196426Z CURRENT buil golang 1.27.3-trixie
2026-10-27T03:41:29.7196695Z CURRENT buil golang 1.27.3-alpine3.24
2026-10-27T03:41:29.7197101Z CURRENT buil restic 0.19.1
2026-10-27T03:41:29.7197320Z CURRENT app codewithcj/sparkyfitness v0.17.3
2026-10-27T03:41:29.7197645Z CURRENT app codewithcj/sparkyfitness_server v0.17.3
2026-10-27T03:41:29.7197958Z CURRENT app crocodilestick/calibre-web-automated v4.0.8
2026-10-27T03:41:29.7198171Z CURRENT app deluan/navidrome 0.64.2
2026-10-27T03:41:29.7198468Z CURRENT app f0rc3/gokapi v1.9.6
2026-10-27T03:41:29.7199046Z CURRENT app fallenbagel/jellyseerr 2.7.3
2026-10-27T03:41:29.7199322Z CURRENT app ghcr.io/diced/zipline 4.8.0
2026-10-27T03:41:29.7199534Z CURRENT app ghcr.io/gramps-project/grampsweb v25.6.0
2026-10-27T03:41:29.7199916Z CURRENT app ghcr.io/grimmory-tools/grimmory v3.5.0
2026-10-27T03:41:29.7200169Z CURRENT app ghcr.io/home-assistant/home-assistant 2026.9.4
2026-10-27T03:41:29.7200387Z CURRENT app ghcr.io/seanmorley15/adventurelog-backend v0.13.0
2026-10-27T03:41:29.7200724Z CURRENT app ghcr.io/seanmorley15/adventurelog-frontend v0.13.0
2026-10-27T03:41:29.7200949Z CURRENT app jellyfin/jellyfin 10.11.11
2026-10-27T03:41:29.7201155Z CURRENT app lscr.io/linuxserver/grocy 4.7.1
2026-10-27T03:41:29.7201367Z CURRENT app lscr.io/linuxserver/radarr 6.4.4
2026-10-27T03:41:29.7201650Z CURRENT app lscr.io/linuxserver/sonarr 4.0.20
2026-10-27T03:41:29.7201855Z CURRENT app onlyoffice/documentserver 9.4.0
2026-10-27T03:41:29.7202233Z CURRENT app vaultwarden/server 1.37.4-alpine
2026-10-27T03:41:29.7202501Z COUNTS ADVISORY=32 BEHIND=13 CURRENT=21 FLOATING=14 GAP=26 SELF=2
2026-10-27T03:41:29.7202721Z REQUESTS api.github.com=37 api.osv.dev=1 blog.cloudflare.com=1 ghcr.io=52 github.com=62 hub.docker.com=141 raw.githubusercontent.com=1
2026-10-27T03:41:29.7216132Z WOULD HAVE MAILED (seed): (silent, first read after the seed) calcom/cal.com GHSA-p3f6-52gv-cj7m
2026-10-27T03:41:29.7216614Z
2026-10-27T03:41:29.7217047Z WOULD HAVE MAILED (seed): (silent, first read after the seed) calcom/cal.com GHSA-cpf2-q635-xrwx
2026-10-27T03:41:29.7217285Z
2026-10-27T03:41:29.7217473Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-wx44-9m3m-rjqx
2026-10-27T03:41:29.7217747Z
2026-10-27T03:41:29.7217927Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-4jmf-h2cm-hg7w
2026-10-27T03:41:29.7218142Z
2026-10-27T03:41:29.7218321Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-8j56-f865-gqq2
2026-10-27T03:41:29.7218980Z
2026-10-27T03:41:29.7219190Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-fxq4-gr55-7x5g
2026-10-27T03:41:29.7219394Z
2026-10-27T03:41:29.7219611Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-96qg-qxxj-r8xq
2026-10-27T03:41:29.7219816Z
2026-10-27T03:41:29.7219994Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-vvqw-mjq8-x248
2026-10-27T03:41:29.7220249Z
2026-10-27T03:41:29.7220487Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-cwq7-782w-pxcc
2026-10-27T03:41:29.7220690Z
2026-10-27T03:41:29.7220861Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-fx95-gwfc-grgc
2026-10-27T03:41:29.7221109Z
2026-10-27T03:41:29.7221283Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-6f9g-7jgm-m5ph
2026-10-27T03:41:29.7221508Z
2026-10-27T03:41:29.7221674Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-8hhh-mqpg-jpxc
2026-10-27T03:41:29.7221944Z
2026-10-27T03:41:29.7222214Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-469m-x4mw-38r3
2026-10-27T03:41:29.7222536Z
2026-10-27T03:41:29.7222752Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-jj5r-9rpc-8h6h
2026-10-27T03:41:29.7223066Z
2026-10-27T03:41:29.7223238Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-c3cr-qq9g-666c
2026-10-27T03:41:29.7223446Z
2026-10-27T03:41:29.7223680Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-mw6q-qj47-9g5q
2026-10-27T03:41:29.7223890Z
2026-10-27T03:41:29.7224058Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-7v5j-mph8-9w6g
2026-10-27T03:41:29.7224307Z
2026-10-27T03:41:29.7224513Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-93pj-3x56-5gc2
2026-10-27T03:41:29.7224718Z
2026-10-27T03:41:29.7224890Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-xmfc-hqq8-33wh
2026-10-27T03:41:29.7225169Z
2026-10-27T03:41:29.7225412Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-4j4g-m7mr-hp5j
2026-10-27T03:41:29.7225612Z
2026-10-27T03:41:29.7225903Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-xh39-mxw9-34pp
2026-10-27T03:41:29.7226112Z
2026-10-27T03:41:29.7226280Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-pvjf-7jrm-6w9g
2026-10-27T03:41:29.7226685Z
2026-10-27T03:41:29.7226922Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-vcp6-2qc6-gvq3
2026-10-27T03:41:29.7227130Z
2026-10-27T03:41:29.7227296Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-7cq7-4v93-8wjm
2026-10-27T03:41:29.7227659Z
2026-10-27T03:41:29.7227829Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-8pwg-hcgm-54cp
2026-10-27T03:41:29.7228257Z
2026-10-27T03:41:29.7228431Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-7769-9pr9-m24h
2026-10-27T03:41:29.7228698Z
2026-10-27T03:41:29.7228879Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-x8c3-3rp8-2j46
2026-10-27T03:41:29.7229082Z
2026-10-27T03:41:29.7229408Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-p3rv-cr5f-9gjh
2026-10-27T03:41:29.7229733Z
2026-10-27T03:41:29.7229899Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-hf55-9cwq-2x64
2026-10-27T03:41:29.7230100Z
2026-10-27T03:41:29.7230337Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-94rx-fqm6-q23v
2026-10-27T03:41:29.7230546Z
2026-10-27T03:41:29.7230716Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-6pv5-8rp7-8c75
2026-10-27T03:41:29.7230959Z
2026-10-27T03:41:29.7231130Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-xfqq-h54g-92f8
2026-10-27T03:41:29.7231335Z
2026-10-27T03:41:29.7232329Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-9h7g-h754-c8x2
2026-10-27T03:41:29.7232599Z
2026-10-27T03:41:29.7232773Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-hcgw-r9gf-8mph
2026-10-27T03:41:29.7232986Z
2026-10-27T03:41:29.7233197Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-g4hw-fg4c-89mq
2026-10-27T03:41:29.7233499Z
2026-10-27T03:41:29.7233672Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-54w9-6cc5-9wj9
2026-10-27T03:41:29.7233874Z
2026-10-27T03:41:29.7234105Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-mf69-7pqq-86vx
2026-10-27T03:41:29.7234421Z
2026-10-27T03:41:29.7234594Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-x4q3-gcj3-m6cf
2026-10-27T03:41:29.7234833Z
2026-10-27T03:41:29.7235009Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-fqjr-23c8-gg9m
2026-10-27T03:41:29.7235223Z
2026-10-27T03:41:29.7235391Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-rqhx-647v-wx32
2026-10-27T03:41:29.7235651Z
2026-10-27T03:41:29.7235816Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-6g2h-xpg3-rm48
2026-10-27T03:41:29.7236023Z
2026-10-27T03:41:29.7236232Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-467c-4w7p-8427
2026-10-27T03:41:29.7236448Z
2026-10-27T03:41:29.7236617Z WOULD HAVE MAILED (seed): (silent, first read after the seed) gitea/gitea GHSA-p3pc-g8m5-hrrr
2026-10-27T03:41:29.7236932Z
2026-10-27T03:41:29.7237156Z WOULD HAVE MAILED (seed): (silent, first read after the seed) glanceapp/glance GHSA-r225-jhr6-68cc
2026-10-27T03:41:29.7237360Z
2026-10-27T03:41:29.7237530Z WOULD HAVE MAILED (seed): (silent, first read after the seed) grafana/grafana GHSA-8xmm-x63g-f6xv
2026-10-27T03:41:29.7237848Z
2026-10-27T03:41:29.7238126Z WOULD HAVE MAILED (seed): (silent, first read after the seed) grafana/grafana GHSA-4724-7jwc-3fpw
2026-10-27T03:41:29.7238333Z
2026-10-27T03:41:29.7238504Z WOULD HAVE MAILED (seed): (silent, first read after the seed) grafana/grafana GHSA-2x6g-h2hg-rq84
2026-10-27T03:41:29.7238783Z
2026-10-27T03:41:29.7238949Z WOULD HAVE MAILED (seed): (silent, first read after the seed) grafana/grafana GHSA-8wjh-59cw-9xh4
2026-10-27T03:41:29.7239261Z
2026-10-27T03:41:29.7239471Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/sysadminsmedia/homebox GHSA-mw9p-fhpj-jf82
2026-10-27T03:41:29.7239687Z
2026-10-27T03:41:29.7239961Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/sysadminsmedia/homebox GHSA-h7wm-wjr6-cfxh
2026-10-27T03:41:29.7240172Z
2026-10-27T03:41:29.7240406Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/sysadminsmedia/homebox GHSA-58m4-m8xj-v3j2
2026-10-27T03:41:29.7240615Z
2026-10-27T03:41:29.7240788Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/sysadminsmedia/homebox GHSA-754m-5j7m-8wfv
2026-10-27T03:41:29.7241037Z
2026-10-27T03:41:29.7241210Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/sysadminsmedia/homebox GHSA-59cq-p2m6-hh23
2026-10-27T03:41:29.7241415Z
2026-10-27T03:41:29.7241582Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/sysadminsmedia/homebox GHSA-j935-m3f2-frrj
2026-10-27T03:41:29.7241852Z
2026-10-27T03:41:29.7242025Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/sysadminsmedia/homebox GHSA-4gp5-59x3-vhhg
2026-10-27T03:41:29.7242342Z
2026-10-27T03:41:29.7242580Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/sysadminsmedia/homebox GHSA-4p8r-vm9v-c9pm
2026-10-27T03:41:29.7242789Z
2026-10-27T03:41:29.7242962Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/sysadminsmedia/homebox GHSA-wxcf-4p4j-vhvg
2026-10-27T03:41:29.7243168Z
2026-10-27T03:41:29.7243657Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/sysadminsmedia/homebox GHSA-g3p9-jfjj-pqgw
2026-10-27T03:41:29.7243962Z
2026-10-27T03:41:29.7244136Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/sysadminsmedia/homebox GHSA-xqg9-6xxv-3452
2026-10-27T03:41:29.7244383Z
2026-10-27T03:41:29.7244549Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/sysadminsmedia/homebox GHSA-jm28-2xm3-m6m5
2026-10-27T03:41:29.7244756Z
2026-10-27T03:41:29.7244922Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/sysadminsmedia/homebox GHSA-rhfm-x4x2-p3qr
2026-10-27T03:41:29.7245198Z
2026-10-27T03:41:29.7245374Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/gethomepage/homepage GHSA-669x-4pg4-w24r
2026-10-27T03:41:29.7245686Z
2026-10-27T03:41:29.7245890Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/mealie-recipes/mealie GHSA-99wf-32rc-2767
2026-10-27T03:41:29.7246099Z
2026-10-27T03:41:29.7246270Z WOULD HAVE MAILED (seed): (silent, first read after the seed) n8nio/n8n GHSA-43v8-hjhm-chjp
2026-10-27T03:41:29.7246468Z
2026-10-27T03:41:29.7246696Z WOULD HAVE MAILED (seed): (silent, first read after the seed) n8nio/n8n GHSA-mgpr-56r4-5c67
2026-10-27T03:41:29.7246896Z
2026-10-27T03:41:29.7247061Z WOULD HAVE MAILED (seed): (silent, first read after the seed) n8nio/n8n GHSA-8vrr-mgc5-jg55
2026-10-27T03:41:29.7247313Z
2026-10-27T03:41:29.7247476Z WOULD HAVE MAILED (seed): (silent, first read after the seed) n8nio/n8n GHSA-qmvv-q3c9-wpp7
2026-10-27T03:41:29.7247675Z
2026-10-27T03:41:29.7247842Z WOULD HAVE MAILED (seed): (silent, first read after the seed) n8nio/n8n GHSA-pcr3-v5vr-qppf
2026-10-27T03:41:29.7248098Z
2026-10-27T03:41:29.7248262Z WOULD HAVE MAILED (seed): (silent, first read after the seed) n8nio/n8n GHSA-65mv-v8rp-54wc
2026-10-27T03:41:29.7248631Z
2026-10-27T03:41:29.7248846Z WOULD HAVE MAILED (seed): (silent, first read after the seed) n8nio/n8n GHSA-m7gv-mpg5-7c9v
2026-10-27T03:41:29.7249044Z
2026-10-27T03:41:29.7249211Z WOULD HAVE MAILED (seed): (silent, first read after the seed) n8nio/n8n GHSA-crfj-5wv6-8v86
2026-10-27T03:41:29.7249407Z
2026-10-27T03:41:29.7249630Z WOULD HAVE MAILED (seed): (silent, first read after the seed) n8nio/n8n GHSA-mp7q-23hg-35cf
2026-10-27T03:41:29.7249832Z
2026-10-27T03:41:29.7249998Z WOULD HAVE MAILED (seed): (silent, first read after the seed) n8nio/n8n GHSA-wvjj-qg37-pv73
2026-10-27T03:41:29.7250241Z
2026-10-27T03:41:29.7250408Z WOULD HAVE MAILED (seed): (silent, first read after the seed) n8nio/n8n GHSA-8crx-5h96-q72q
2026-10-27T03:41:29.7250612Z
2026-10-27T03:41:29.7251077Z WOULD HAVE MAILED (seed): (silent, first read after the seed) n8nio/n8n GHSA-v9cx-v88r-42vw
2026-10-27T03:41:29.7251352Z
2026-10-27T03:41:29.7251525Z WOULD HAVE MAILED (seed): (silent, first read after the seed) n8nio/n8n GHSA-365g-vjw2-grx8
2026-10-27T03:41:29.7251824Z
2026-10-27T03:41:29.7252036Z WOULD HAVE MAILED (seed): (silent, first read after the seed) outlinewiki/outline GHSA-x4w3-9p9j-cprh
2026-10-27T03:41:29.7252341Z
2026-10-27T03:41:29.7252504Z WOULD HAVE MAILED (seed): (silent, first read after the seed) outlinewiki/outline GHSA-rq53-m97j-f2pg
2026-10-27T03:41:29.7252715Z
2026-10-27T03:41:29.7252939Z WOULD HAVE MAILED (seed): (silent, first read after the seed) outlinewiki/outline GHSA-h6ff-rw9x-5mq2
2026-10-27T03:41:29.7253144Z
2026-10-27T03:41:29.7253312Z WOULD HAVE MAILED (seed): (silent, first read after the seed) outlinewiki/outline GHSA-rvj7-2gww-6xfq
2026-10-27T03:41:29.7253557Z
2026-10-27T03:41:29.7253917Z WOULD HAVE MAILED (seed): (silent, first read after the seed) outlinewiki/outline GHSA-cprf-crfh-w3p4
2026-10-27T03:41:29.7254221Z
2026-10-27T03:41:29.7254390Z WOULD HAVE MAILED (seed): (silent, first read after the seed) outlinewiki/outline GHSA-97vv-f6qq-6842
2026-10-27T03:41:29.7254650Z
2026-10-27T03:41:29.7254818Z WOULD HAVE MAILED (seed): (silent, first read after the seed) outlinewiki/outline GHSA-w8vg-8mjx-xq8x
2026-10-27T03:41:29.7255034Z
2026-10-27T03:41:29.7255240Z WOULD HAVE MAILED (seed): (silent, first read after the seed) outlinewiki/outline GHSA-65xg-84g9-7hrm
2026-10-27T03:41:29.7255447Z
2026-10-27T03:41:29.7255611Z WOULD HAVE MAILED (seed): (silent, first read after the seed) outlinewiki/outline GHSA-f28f-75h4-499q
2026-10-27T03:41:29.7255819Z
2026-10-27T03:41:29.7256043Z WOULD HAVE MAILED (seed): (silent, first read after the seed) outlinewiki/outline GHSA-27h6-gg7j-wj5w
2026-10-27T03:41:29.7256250Z
2026-10-27T03:41:29.7256418Z WOULD HAVE MAILED (seed): (silent, first read after the seed) outlinewiki/outline GHSA-48rq-wx9j-g949
2026-10-27T03:41:29.7256666Z
2026-10-27T03:41:29.7256838Z WOULD HAVE MAILED (seed): (silent, first read after the seed) outlinewiki/outline GHSA-m9vh-j2wc-xj24
2026-10-27T03:41:29.7257040Z
2026-10-27T03:41:29.7257216Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/paperless-ngx/paperless-ngx GHSA-c8f3-pqr2-rr24
2026-10-27T03:41:29.7257590Z
2026-10-27T03:41:29.7257760Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/paperless-ngx/paperless-ngx GHSA-2jhj-xqrq-rmrq
2026-10-27T03:41:29.7257972Z
2026-10-27T03:41:29.7258177Z WOULD HAVE MAILED (seed): (silent, first read after the seed) privatebin/pdo GHSA-w873-3ghv-hmh6
2026-10-27T03:41:29.7258384Z
2026-10-27T03:41:29.7258546Z WOULD HAVE MAILED (seed): (silent, first read after the seed) rommapp/romm GHSA-q7fg-rj3q-m3gm
2026-10-27T03:41:29.7258753Z
2026-10-27T03:41:29.7259069Z WOULD HAVE MAILED (seed): (silent, first read after the seed) rommapp/romm GHSA-7jw3-ppmp-57wc
2026-10-27T03:41:29.7259271Z
2026-10-27T03:41:29.7259439Z WOULD HAVE MAILED (seed): (silent, first read after the seed) rommapp/romm GHSA-9q83-m866-5jrp
2026-10-27T03:41:29.7259681Z
2026-10-27T03:41:29.7259859Z WOULD HAVE MAILED (seed): (silent, first read after the seed) rommapp/romm GHSA-722m-w9p2-xv2j
2026-10-27T03:41:29.7260057Z
2026-10-27T03:41:29.7260226Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/tandoorrecipes/recipes GHSA-5f74-7rgh-pc97
2026-10-27T03:41:29.7260457Z
2026-10-27T03:41:29.7260625Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/tandoorrecipes/recipes GHSA-pcq2-64qw-jm4x
2026-10-27T03:41:29.7260842Z
2026-10-27T03:41:29.7261010Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/tandoorrecipes/recipes GHSA-69q3-5q6x-7hmx
2026-10-27T03:41:29.7261222Z
2026-10-27T03:41:29.7261383Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/tandoorrecipes/recipes GHSA-xq7g-9q95-vjc6
2026-10-27T03:41:29.7261594Z
2026-10-27T03:41:29.7261822Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/tandoorrecipes/recipes GHSA-748x-xc8h-95hj
2026-10-27T03:41:29.7262203Z
2026-10-27T03:41:29.7262374Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/tandoorrecipes/recipes GHSA-c7mc-c9jr-38hf
2026-10-27T03:41:29.7262826Z
2026-10-27T03:41:29.7263000Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/tandoorrecipes/recipes GHSA-vc5c-xh64-79vp
2026-10-27T03:41:29.7263213Z
2026-10-27T03:41:29.7263378Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/tandoorrecipes/recipes GHSA-5p9v-743w-79h3
2026-10-27T03:41:29.7263742Z
2026-10-27T03:41:29.7263910Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/tandoorrecipes/recipes GHSA-cqj3-64qw-4w52
2026-10-27T03:41:29.7264126Z
2026-10-27T03:41:29.7264443Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/lukegus/termix GHSA-6gr3-r7jx-wfmh
2026-10-27T03:41:29.7264660Z
2026-10-27T03:41:29.7264826Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/lukegus/termix GHSA-frx8-qqgg-7j7g
2026-10-27T03:41:29.7265031Z
2026-10-27T03:41:29.7265263Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/lukegus/termix GHSA-3q2m-5r5p-w45r
2026-10-27T03:41:29.7265470Z
2026-10-27T03:41:29.7265745Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/lukegus/termix GHSA-rgf3-2q88-q4wp
2026-10-27T03:41:29.7265993Z
2026-10-27T03:41:29.7266219Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/lukegus/termix GHSA-7j7m-85p4-2cpm
2026-10-27T03:41:29.7266421Z
2026-10-27T03:41:29.7266586Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/lukegus/termix GHSA-wv2p-5jqw-9qf3
2026-10-27T03:41:29.7266855Z
2026-10-27T03:41:29.7267022Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/lukegus/termix GHSA-r7x4-j6x8-jxrx
2026-10-27T03:41:29.7267228Z
2026-10-27T03:41:29.7267442Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/lukegus/termix GHSA-v3vp-ffww-q7pw
2026-10-27T03:41:29.7267647Z
2026-10-27T03:41:29.7267814Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/lukegus/termix GHSA-j7j4-82wh-3vj5
2026-10-27T03:41:29.7268014Z
2026-10-27T03:41:29.7268337Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/lukegus/termix GHSA-fj9w-vcj9-66qh
2026-10-27T03:41:29.7268626Z
2026-10-27T03:41:29.7268940Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/lukegus/termix GHSA-hmv7-25x4-vp6w
2026-10-27T03:41:29.7269198Z
2026-10-27T03:41:29.7269364Z WOULD HAVE MAILED (seed): (silent, first read after the seed) ghcr.io/lukegus/termix GHSA-r9gw-3w87-mhh7
2026-10-27T03:41:29.7269569Z
2026-10-27T03:41:29.7269732Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-5fc2-w2j4-6r8w
2026-10-27T03:41:29.7270004Z
2026-10-27T03:41:29.7270176Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-xgw3-ccqg-f6ww
2026-10-27T03:41:29.7270383Z
2026-10-27T03:41:29.7270590Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-frf4-3prf-3vch
2026-10-27T03:41:29.7270895Z
2026-10-27T03:41:29.7271061Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-rp64-xg8g-9mpr
2026-10-27T03:41:29.7271469Z
2026-10-27T03:41:29.7271702Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-9hxw-pxcq-4q8q
2026-10-27T03:41:29.7271899Z
2026-10-27T03:41:29.7272062Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-ff52-3296-2fvr
2026-10-27T03:41:29.7272440Z
2026-10-27T03:41:29.7272607Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-9xh7-5jg8-mf43
2026-10-27T03:41:29.7272810Z
2026-10-27T03:41:29.7273137Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-586f-48mj-3rwr
2026-10-27T03:41:29.7273408Z
2026-10-27T03:41:29.7273576Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-9rfw-7hv4-3vv3
2026-10-27T03:41:29.7273775Z
2026-10-27T03:41:29.7274090Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-5f6v-j6xm-wwj9
2026-10-27T03:41:29.7274293Z
2026-10-27T03:41:29.7274461Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-hm4w-h7v8-ch43
2026-10-27T03:41:29.7274659Z
2026-10-27T03:41:29.7274887Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-h8wj-3gwg-jjjg
2026-10-27T03:41:29.7275167Z
2026-10-27T03:41:29.7275332Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-p697-wq4x-grpj
2026-10-27T03:41:29.7275579Z
2026-10-27T03:41:29.7275748Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-hrw2-p27j-8mj8
2026-10-27T03:41:29.7275951Z
2026-10-27T03:41:29.7276120Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-c934-xjq2-mrg3
2026-10-27T03:41:29.7276380Z
2026-10-27T03:41:29.7276552Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-qf5p-grf5-wcq4
2026-10-27T03:41:29.7276857Z
2026-10-27T03:41:29.7277028Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-rj93-wmch-2crq
2026-10-27T03:41:29.7277230Z
2026-10-27T03:41:29.7277398Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-7gmh-4fw6-8xc5
2026-10-27T03:41:29.7277707Z
2026-10-27T03:41:29.7277933Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-2f75-93c9-xf32
2026-10-27T03:41:29.7278148Z
2026-10-27T03:41:29.7278315Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-mqq8-869v-48q8
2026-10-27T03:41:29.7278615Z
2026-10-27T03:41:29.7278781Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-v3r6-33v3-79c2
2026-10-27T03:41:29.7278984Z
2026-10-27T03:41:29.7279154Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-w64q-7p4m-j8g8
2026-10-27T03:41:29.7279503Z
2026-10-27T03:41:29.7279670Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-g2xc-jv9q-46wq
2026-10-27T03:41:29.7279868Z
2026-10-27T03:41:29.7280076Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-7f23-p76f-cx74
2026-10-27T03:41:29.7280282Z
2026-10-27T03:41:29.7280450Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-hq66-9qg8-jwqg
2026-10-27T03:41:29.7280657Z
2026-10-27T03:41:29.7280883Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-49pj-52x6-8gpj
2026-10-27T03:41:29.7281083Z
2026-10-27T03:41:29.7281251Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-5q33-h98p-rgh9
2026-10-27T03:41:29.7281548Z
2026-10-27T03:41:29.7281719Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-3x3m-2j93-w46j
2026-10-27T03:41:29.7281920Z
2026-10-27T03:41:29.7282282Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-66cq-j6rw-pjch
2026-10-27T03:41:29.7282545Z
2026-10-27T03:41:29.7282710Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-wqjr-22r7-5437
2026-10-27T03:41:29.7282912Z
2026-10-27T03:41:29.7283119Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-fjrf-gjmg-9v6g
2026-10-27T03:41:29.7283328Z
2026-10-27T03:41:29.7283495Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-j5v7-qcwp-5g32
2026-10-27T03:41:29.7283798Z
2026-10-27T03:41:29.7284027Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-4qvp-948j-4cgv
2026-10-27T03:41:29.7284346Z
2026-10-27T03:41:29.7284530Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-p23m-cq25-pc4j
2026-10-27T03:41:29.7284776Z
2026-10-27T03:41:29.7284989Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-h4q3-mc9r-q7vv
2026-10-27T03:41:29.7285300Z
2026-10-27T03:41:29.7285472Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-rp33-8f2m-hm6j
2026-10-27T03:41:29.7285735Z
2026-10-27T03:41:29.7285900Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-v579-5fwc-gr28
2026-10-27T03:41:29.7286102Z
2026-10-27T03:41:29.7286311Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-4hv6-xc92-j86g
2026-10-27T03:41:29.7286515Z
2026-10-27T03:41:29.7286846Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-fprf-r6rv-xg99
2026-10-27T03:41:29.7287057Z
2026-10-27T03:41:29.7287286Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-hjx8-qv73-f7cm
2026-10-27T03:41:29.7287490Z
2026-10-27T03:41:29.7287660Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-pjr3-86v4-5p7w
2026-10-27T03:41:29.7288005Z
2026-10-27T03:41:29.7288176Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-fmmf-xq98-g327
2026-10-27T03:41:29.7288373Z
2026-10-27T03:41:29.7288537Z WOULD HAVE MAILED (seed): (silent, first read after the seed) vikunja/vikunja GHSA-m687-p538-r5hp
2026-10-27T03:41:29.7288802Z
2026-10-27T03:41:29.7432797Z STATE written: documentation/security-watch/state.json (246 known advisories)
2026-10-27T03:41:29.7844973Z ::group::Run set -u
2026-10-27T03:41:29.7845440Z set -u
2026-10-27T03:41:29.7845960Z f=documentation/security-watch/state.json
2026-10-27T03:41:29.7846192Z if [ ! -f "$f" ]; then
2026-10-27T03:41:29.7846389Z echo "no memory file was written - nothing to commit"; exit 0
2026-10-27T03:41:29.7846678Z fi
2026-10-27T03:41:29.7846978Z if git ls-files --error-unmatch "$f" >/dev/null 2>&1 && git diff --quiet -- "$f"; then
2026-10-27T03:41:29.7847218Z echo "memory unchanged - nothing to commit"; exit 0
2026-10-27T03:41:29.7847500Z fi
2026-10-27T03:41:29.7847721Z cp "$f" /tmp/state.json
2026-10-27T03:41:29.7847920Z auth=$(python3 -c 'import base64,os;print(base64.b64encode(("x:"+os.environ["PUSH_TOKEN"]).encode()).decode())')
2026-10-27T03:41:29.7848176Z for attempt in 1 2 3; do
2026-10-27T03:41:29.7851642Z git fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD
2026-10-27T03:41:29.7853044Z mkdir -p "$(dirname "$f")" && cp /tmp/state.json "$f"
2026-10-27T03:41:29.7854056Z git add "$f"
2026-10-27T03:41:29.7854637Z git -c user.name="felhom security watch" -c user.email=monitoring@felhom.eu \
2026-10-27T03:41:29.7855726Z commit -q -m "security-watch: memory of $(date -u +%F) (R-1303). Docs only." || { echo "nothing to commit"; exit 0; }
2026-10-27T03:41:29.7857207Z if git -c http.extraHeader="Authorization: Basic $auth" push -q origin HEAD:main; then
2026-10-27T03:41:29.7858145Z echo "memory pushed: $(git rev-parse --short=12 HEAD)"; exit 0
2026-10-27T03:41:29.7858821Z fi
2026-10-27T03:41:29.7859183Z echo "push refused (attempt $attempt) - re-fetching main"
2026-10-27T03:41:29.7859658Z sleep 5
2026-10-27T03:41:29.7860203Z done
2026-10-27T03:41:29.7861145Z echo "MEMORY NOT SAVED after 3 attempts"; exit 1
2026-10-27T03:41:29.7861646Z shell: bash --noprofile --norc -e -o pipefail {0}
2026-10-27T03:41:29.7862135Z env:
2026-10-27T03:41:29.7863249Z PUSH_TOKEN: ***
2026-10-27T03:41:29.7863741Z ::endgroup::
2026-10-27T03:41:33.0186294Z remote: . Processing 1 references
2026-10-27T03:41:33.0187155Z remote: Processed 1 references in total
2026-10-27T03:41:33.0237338Z memory pushed: 3c8c1ded1ffc
2026-10-27T03:41:33.0248158Z Cleaning up container for job watch
2026-10-27T03:41:33.6014878Z 🏁 Job succeeded
documentation/backlog/OPEN-ITEMS.md
+1 -1
View File
@@ -238,7 +238,7 @@ stopping line that lies.
| ID | Category | Sev | What | State | Blocked on | Next action | Owner |
|---|---|---|---|---|---|---|---|
| **R-1241** | Security & access | P1 | **2026-10-24: the Felhom half is DONE** — hub 0.168.0 deployed (the tokens sealed; every copy leaving the volume is clean, the live file's old bytes accepted by the operator, R-975 closed), the hub volume out of the Longhorn backup (D40, R-1243 VERIFY), the two old plain copies deleted by the operator. **What stays here is the homelab half:** the open NFS export and Longhorn's login (the homelab session). **A hacked app pod on DooPlex can read the hub's nightly database copies — with every customer's unsealed Cloudflare, tunnel and git token (R-975) — through the Longhorn NFS export, and by a published file-handle escape the operator signing keys on the same disk: whoever breaks one homelab app can take over the boxes' tunnels and sign agent updates.** MEASURED 2026-10-23 (Plex2Shell impact audit, `audits/plex2shell-felhom-impact-2026-10-23/`): export `/mnt/5_hdd/backup/longhorn-pvc` rw, `no_root_squash`, `no_subtree_check`, a sub-directory of sda1, which also holds `/mnt/5_hdd/felhom.eu/felhom-op-*` (no passphrase, R-924); `secure` is void in pods (containerd sets `ip_unprivileged_port_start=0`; a uid-1000 probe with no capabilities bound port 700); the four `felhom-system` volumes have `encrypted=false`; Longhorn's API on :9500 answers any pod with no login (backups, targets, volumes). In the Plex2Shell window neither door was used — verdict NOT REACHED (nfsd accepted 0 new connections 10-10 → 10-23, positive control; no off-schedule Longhorn backup or volume). 2026-10-23 ~15:18Z, operator yes: the export was narrowed from `*` to `10.42.0.0/16` — the home network and the tailnet are closed, pods are not (Longhorn connects from its pod address). Not exercised: the escape itself (Tier-2 machine). | OPEN | the homelab session (DooPlex host + cluster); the operator (R-924) | Homelab: a NetworkPolicy so only `longhorn-system` reaches :2049/:111 and :9500, or the backup store on its own filesystem. Felhom: R-975 sealed in hub 0.168.0 (deploy pending); the hub's plain Longhorn copies → R-1243; a passphrase on the signing keys (R-924) | operator |
| **R-1303** | Security & access | P2 | **Nobody watched the security notices of what we ship** — now a nightly CI watch (`scripts/security_watch.py`, 03:40 UTC; 108 pins: 11 box/build, 97 app): ADVISORY mails that night, BEHIND weekly, a source down two nights mails. BUILT and live-proven 2026-10-26: the test mail reached the mailbox (CI job 2407); the seed run (job 2408) recorded 142 open notices on 30 pins without mailing and committed its memory itself. Spike: `audits/security-watch-2026-10-26/SPIKE.md`; gaps: R-1307, R-1308, R-1309 | OPEN — built; closes after a week of nightly runs with the key (watch the Monday summary and one real ADVISORY mail) | the GitHub key: operator said yes 2026-10-26; secret `GH_ADVISORY_TOKEN` (store and CI) — without it the apps' advisory lists are read every second night | read the first nights' logs; switch to the key when it exists | CC |
| **R-1303** | Security & access | P2 | **Nobody watched the security notices of what we ship** — now a nightly CI watch (`scripts/security_watch.py`, 03:40 UTC; 108 pins: 11 box/build, 97 app): ADVISORY mails that night, BEHIND weekly, a source down two nights mails. BUILT and live-proven 2026-10-26: the test mail reached the mailbox (CI job 2407); the seed run (job 2408) recorded 142 open notices on 30 pins without mailing and committed its memory itself. Spike: `audits/security-watch-2026-10-26/SPIKE.md`; gaps: R-1307, R-1308, R-1309 | OPEN — built; closes after a week of nightly runs with the key (watch the Monday summary and one real ADVISORY mail) | none — the GitHub key is in place since 2026-10-27 (`GH_ADVISORY_TOKEN`, store and CI; its own token, not Renovate's): a dry CI run with it (job 2415) read every repo's advisories in one night (68 GitHub requests, 38 ADVISORY, 1 NOT CHECKED = one Docker Hub timeout). The first real night (job 2413, no key yet) mailed nothing: 159 silent first reads of notices the seed could not read, memory committed by the job. Logs: `audits/security-watch-2026-10-26/ci-night1-2026-10-27.log`, `ci-dry-with-key.log` | read the nightly logs to 2026-11-03; close on the Monday summary and one real ADVISORY mail | CC |
| **R-1139** | Security & access | P2 | **Tester 2's break-glass root password was not rotated with the others (R-954, operator decision D1 = A, 2026-10-17): the box has been offline since 2026-10-04.** demo-hp, Tester 1 and demo-felhom were rotated and proven on 2026-10-17 (`audits/agent-allowlist-rotation-2026-10-17/P3/`). | OPEN — filed 2026-10-17 **2026-10-22: closes when Tester 2 is reinstalled (operator ruling 2026-10-22 14:11 — a fresh install sets and vaults a new console password).** | Tester 2 reporting again | When it reports: the installer's step 4b alone (`P3/rotate-step4b.sh` shape), then the vaulted value logs in (PVE API 200) and the old one is refused | CC |
| **R-1305** | Security & access | P2 | **The file manager on every box (FileBrowser Quantum 1.5.6-stable) is inside 36 published notices; 2 are fixed in our own channel (1.5.7-stable)** — GHSA-qx86-4v5r-26g5 (high: with the victim's password, an anonymous request re-enrolls TOTP and skips the second factor; our households have no second factor there, so low for us) and GHSA-3846-gh75-gp3m (medium: a public upload share replaces files). Most others name fixes only on the 2.x line. `files.<domain>` is public through the tunnel (behind the controller's forwardAuth, password sign-in on). Found by the first security-watch run (R-1303). `audits/security-watch-2026-10-26/ADVISORIES-2026-10-26.md` | OPEN — filed 2026-10-26 | a controller release | raise `FileBrowserImage` to 1.5.7-stable in the next controller release; triage the 34 others against 1.5.x (which apply to the stable line) | CC |
| **R-1304** | Security & access | P3 | **traefik v3.7.13 (our pin) is inside 12 advisories of October 2026, fixed in v3.7.14–v3.7.16** (GHSA-fh26-gfpp-7xxx snicheck, GHSA-hrpp-p4fc-wwf8 ForwardAuth pool, GHSA-53qr-784g-cj35 FastProxy, and nine on the Kubernetes ingress-nginx provider or NTLM/Negotiate backends). Triage from our config: docker + file providers only, no FastProxy, no per-router TLS options, no NTLM backend; ForwardAuth goes to the controller — none seem to apply. Found by the security-watch spike (R-1303). `audits/security-watch-2026-10-26/raw/repoadv-traefik_traefik.txt` | OPEN — filed 2026-10-26 | a controller release | raise `TraefikImage` to ≥ v3.7.16 in the next controller release from `main`, with the release notes read for breaking changes | CC |